Version 2026-10-13 · Effective 13 October 2026
This Data Processing Agreement ("DPA") is between the customer that has agreed to the Squidgy Terms of Service("Customer") and 4142 Ltd, a company registered in England and Wales (company number 16433875), registered office 20 Wenlock Road, London, England, N1 7GU, trading as Squidgy ("Squidgy"). It forms part of the Terms and is accepted when the Customer accepts the Terms; no separate signature is needed. A countersigned copy is available on request from privacy@squidgy.ai.
This DPA applies where Squidgy processes personal data contained in Customer Content on the Customer's behalf in providing the Services ("Customer Personal Data"). It does not cover personal data Squidgy processes as a controller, such as account, billing and website data, which is covered by the Privacy Notice. Capitalised terms not defined here have the meanings in the Terms or in UK GDPR.
For Customer Personal Data, the Customer is the controller and Squidgy is its processor. Where the Customer itself acts as a processor for a Client (for example a builder or agency running Agents for its clients), Squidgy acts as the Customer's sub-processor, and the Customer confirms it has its Client's authorisation to appoint Squidgy on these terms.
Squidgy will:
The Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it submits, including having a lawful basis, giving individuals any required privacy information (including that they may be interacting with an AI), and handling their requests. The Customer will not submit special category data, criminal offence data or children's data unless Squidgy has agreed in writing.
The Customer gives general authorisation for Squidgy to use the sub-processors listed at squidgy.ai/legal/subprocessors. Squidgy will impose data protection terms on each that are no less protective than this DPA, and remains responsible to the Customer for their performance.
Squidgy will notify the Customer by email, to the address on its account, at least 14 days before adding or replacing a sub-processor that will process Customer Personal Data, and will update the published list. Where an urgent replacement is needed to keep the Services running or secure, Squidgy may give shorter notice, but will always notify the Customer before the replacement begins processing Customer Personal Data, and the Customer's right to object below still applies. The Customer may object on reasonable data protection grounds within 10 days of notice. The parties will discuss the objection in good faith; if it is not resolved, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.
Squidgy and some sub-processors process data outside the UK and EEA, including in the United States. Where a transfer of Customer Personal Data needs a transfer mechanism, Squidgy relies on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified recipients) or, where none applies, on the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (the "UK Addendum") and the EU Standard Contractual Clauses (Commission Decision 2021/914) (the "SCCs").
To the extent the SCCs or UK Addendum apply between the Customer and Squidgy, they are incorporated into this DPA by reference as follows: Module 2 (controller to processor) applies where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor; clause 7 (docking) applies; under clause 9 option 2 (general authorisation) applies with the notice period in section 5; the option in clause 11 does not apply; clauses 17 and 18 select the law and courts of Ireland; Annexes I and II are completed by Annexes 1 and 2 of this DPA; for the UK Addendum, Table 1 is completed by section 1, Tables 2 and 3 by this section and the Annexes, and in Table 4 either party may end the UK Addendum as permitted by its section 19. If the SCCs or UK Addendum conflict with this DPA, they prevail.
Where the Customer elects EU-only processing (in its order form or in writing), Squidgy will route the Customer's AI requests only through its AI gateway's EU region, so that prompts and outputs are processed entirely on EU infrastructure and are not routed outside the EU. Only models available in that region are used for the Customer; models marked on the sub-processor list as not available for EU-only processing are not used. Other processing (for example hosting, databases and messaging) remains as described on the sub-processor list unless agreed otherwise.
During the Services the Customer can export and delete its Customer Content using the product. When the Services end, the Customer may choose, by notice to privacy@squidgy.ai within 30 days, to have Squidgy return Customer Personal Data in a common machine-readable format, delete it, or both; it may also export it itself during that period. Squidgy will act on the Customer's choice, and if the Customer makes none, will delete the data. Deletion from live systems will be completed within 60 days of the Customer's deletion request or, if it makes none, within 60 days after the 30-day period ends, and from backups as they expire in the normal backup cycle and in any event within a further 90 days, unless UK or EU law requires Squidgy to keep it, in which case Squidgy will keep it confidential and process it only for that purpose.
Squidgy will answer the Customer's reasonable written security and data protection questions and provide relevant documentation. If that is not enough to demonstrate compliance, or a regulator requires it, the Customer may audit Squidgy's processing of Customer Personal Data on at least 30 days' notice, no more than once a year (unless following a personal data breach), during business hours, at its own cost, subject to confidentiality and without accessing other customers' data. For sub-processors, Squidgy may rely on their published audit reports and certifications where these are sufficient to demonstrate compliance; where they are not available or not sufficient, Squidgy will obtain the further information reasonably needed, or exercise its own audit rights against the sub-processor, on the Customer's behalf.
Each party's liability under this DPA is subject to the limitations in the Terms, except to the extent the SCCs or UK Addendum do not permit this. This DPA prevails over the Terms and the Privacy Notice on data protection matters.
Squidgy may update these measures provided the overall level of protection is not reduced.
The current list, with each provider's purpose and location, is at squidgy.ai/legal/subprocessors.
Version 2026-10-13, effective 13 October 2026.