Looking after other people’s information.
Your customers’ details are yours, and we are handling them for you. This is the agreement that says exactly what that means, who decides what, how it is protected, who else is involved, and what happens if something goes wrong.
Everything here describes what Piggles actually does: no clause is in it because other companies have one.
1. Who is who
For the information you put into Piggles about your own customers, you are the CONTROLLER and WizeWorks LLC is the PROCESSOR. In plain terms: you decide what is collected and why, and we only handle it to run the software for you.
We act on your instructions. Your instructions are this addendum, the terms, and the choices you make in the software: switching on an app, connecting an outside service, sending a mailout, deleting a record.
For your OWN account details (your name, your email, what you pay us) we are the controller, because that relationship is between you and us. Those are covered by the privacy page rather than by this addendum.
2. What we process, and for how long
The subject matter is running your business in Piggles: storing your customers and orders, taking bookings, sending the messages you send, publishing the site you build, and showing all of it back to you.
It lasts as long as your subscription, plus the short wind-down window described in §8.
Whose data: your customers, your leads, the people who book with you, the people who fill in your forms, and anyone who contacts you through something you have connected.
What data: names, contact details, addresses, order and booking history, messages and notes you record, and whatever else you choose to put in a field. Piggles does not require you to collect anything in particular, which means you control how much of this there is.
3. What we will not do with it
We do not sell it. We do not share it with data brokers or advertisers. There is no arrangement under which it leaves us for money.
We do not train AI on it, not a model of ours, not a shared assistant, not anonymized, not aggregated. Any AI feature runs on a key you connect yourself, so it goes where you agreed and nowhere else.
We do not use it to build anything, and we do not look at it except where you ask us to help with a support request, or where we have to in order to keep the service running or to comply with the law.
4. The people who can see it
Access is limited to the people at WizeWorks who need it to run the service, and it is logged. Everyone with access is under a duty of confidentiality that continues after they stop working with us.
Your own team’s access is yours to control, in My Team. Somebody who only handles bookings does not have to be able to see your takings, and setting that is a few clicks rather than a support request.
5. How it is kept safe
Every business’ information is isolated at the database level, not merely filtered by the application: the separation is enforced underneath the software, so a bug in a screen cannot reach across it.
It is encrypted in transit and at rest. Passwords are stored so that they cannot be read back, including by us. Card numbers never reach us at all. They go straight to the payment provider and come back as a token.
Signing in is per person, with a second factor available. Backups run continuously.
These measures can change as the technology does. They will not get weaker: anything that materially reduces protection is a change we would tell you about under §7.
6. If something goes wrong
If personal data you are responsible for is exposed, lost or accessed by somebody who should not have it, we will tell you WITHOUT UNDUE DELAY once we know, and in any case within 72 hours of becoming aware.
We will tell you what happened, what information was involved, what we have done about it, and what we suggest you do. We will keep telling you as we learn more rather than waiting until we have the whole picture.
The law usually puts the duty to notify a regulator or your own customers on YOU, as the controller. We will give you what you need to do that, promptly, and we will not make you chase it.
7. The other companies involved
Running Piggles means some information reaches other companies: the people who host the servers, send the email, take the payments, and whatever you choose to connect yourself. Every one of them is named on the privacy page, in two groups: the ones always involved, and the ones that exist only because you switched them on.
You authorize the ones in the first group by agreeing to this addendum. The second group you authorize by connecting them, and you can disconnect any of them at any time.
If we add or change a company in the first group, we will tell you before it starts and you have the right to object. Each one is bound by terms at least as protective as this addendum, and we stay responsible to you for what they do with your information.
8. Getting it back, and getting rid of it
You can export your customers, products, stock, orders, invoices, bookings and articles whenever you want, as spreadsheets other software can actually read. You do not have to ask, and you do not have to be leaving.
When your subscription ends we keep your information for a short window so an accidental cancellation or a late change of mind is recoverable, and then we delete it. If you want it gone sooner, say so and we will do it.
Backups age out on their own cycle rather than being edited, so a deleted record can persist in a backup for a short time after it disappears from the software. It is not restored to the live service, and it goes when that backup does.
9. Helping you meet your own obligations
When one of your customers asks to see their information, to correct it, or to be deleted, the software has the tools and you can do it yourself immediately. Where you genuinely cannot, we will help.
If you need to complete a data protection impact assessment or answer a regulator, we will give you the information we hold about how Piggles processes data. We will not charge you for a reasonable request of this kind.
10. Checking that we do what we say
You can ask us for the information you need to satisfy yourself that this addendum is being kept, and we will provide it.
If that is genuinely not enough for your regulator, we will agree an audit: at a reasonable frequency, with reasonable notice, without disrupting other customers, and covering only what relates to your own information.
11. Where in the world it is
WizeWorks LLC is based in the United States, and Piggles runs on infrastructure that may be located outside the UK and the European Economic Area.
Where information is transferred out of the UK or the EEA, that transfer relies on the appropriate safeguards recognized by law: currently the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses, which are incorporated into this addendum by reference and take precedence over anything here that conflicts with them.
12. How this fits with everything else
This addendum forms part of the terms. Where it and the terms disagree about personal data, this addendum wins.
It applies automatically from the moment you use Piggles to handle anybody else’s personal data. There is nothing to sign and nothing to request: if you need a countersigned copy for your own records, ask and we will provide one.
If any part of it is found to be unenforceable, the rest still stands.