DATA PROCESSING AGREEMENT
How we handle your data.
This agreement sets out how Whipcream Ltd processes personal data on behalf of its business customers, as required by Article 28 of the UK GDPR. It forms part of the Terms & Conditions and prevails over them on matters of data protection.
Whipcream Ltd · Company no. 16958944
The customer named in the Agreement
UK GDPR Art. 28 · EU GDPR Art. 28 · SCCs and UK Addendum where applicable
1 Introduction and scope
This Data Processing Agreement (" DPA ") is entered into between Whipcream Ltd, company number 16958944, registered office Covent Garden, London, WC2H 9JQ, United Kingdom (" Whipcream ", " Processor "), and the customer identified in the Agreement (" Customer ", " Controller ").
This DPA forms part of, and is incorporated into, the Whipcream Terms & Conditions or any Enterprise Agreement between the parties (together, the " Agreement "). Capitalised terms not defined here have the meaning given in the Agreement.
This DPA applies to the Processing of Personal Data by Whipcream on the Customer's behalf in connection with the Services. It does not apply to Personal Data for which Whipcream is itself a controller, which is described in section 15 and in the Privacy Policy.
This DPA is designed to satisfy Article 28(3) of the UK GDPR and, where applicable, Article 28(3) of the EU GDPR. In the event of a conflict between this DPA and the Agreement in respect of the Processing of Personal Data, this DPA prevails, consistent with clause 3.2 of the Terms & Conditions.
No signature is required for this DPA to take effect: it applies automatically from the date the Customer accepts the Agreement. The Customer may request a countersigned copy at info@whipcream.io.
2 Definitions
The following definitions apply.
Applicable Data Protection Law
The UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003; and, where they apply to the Processing, EU Regulation 2016/679 (the "EU GDPR") and the data protection laws of any other jurisdiction applicable to a party.
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, Supervisory Authority
Have the meanings given in Applicable Data Protection Law.
Customer Personal Data
Personal Data contained within Customer Data, which Whipcream Processes on the Customer's behalf under the Agreement.
Restricted Transfer
A transfer of Customer Personal Data to a country or international organisation outside the United Kingdom or, where the EU GDPR applies, outside the European Economic Area, in circumstances where the transfer is subject to Chapter V of the UK GDPR or the EU GDPR.
Standard Contractual Clauses or SCCs
The standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
The International Data Transfer Addendum to the SCCs issued by the Information Commissioner under section 119A of the Data Protection Act 2018, or the International Data Transfer Agreement, as applicable.
Subprocessor
Any third party engaged by Whipcream to Process Customer Personal Data.
3 Roles of the parties
In respect of Customer Personal Data, the Customer is the Controller and Whipcream is the Processor. Where the Customer is itself a processor acting for a third-party controller, Whipcream is a subprocessor, and the Customer warrants that it has the authority of that controller to enter into this DPA and to give the instructions it gives.
The Customer is responsible for: determining the purposes and means of the Processing; establishing and maintaining a lawful basis for the collection, connection and disclosure of Customer Personal Data to Whipcream; providing all notices and, where required, obtaining all consents from Data Subjects; ensuring the accuracy and lawfulness of the data it connects; and complying with Applicable Data Protection Law in its own right.
The Customer warrants that it is entitled to connect each Third-Party Service and to transfer Customer Personal Data to Whipcream for Processing, and that doing so does not breach any obligation owed to a Data Subject or to that provider.
Each party will comply with Applicable Data Protection Law as it applies to that party. Neither party is responsible for the other's compliance failures.
4 Processing instructions
Whipcream will Process Customer Personal Data only on the Customer's documented instructions, including in relation to Restricted Transfers, unless required to do otherwise by law to which Whipcream is subject. Where such a legal requirement applies, Whipcream will inform the Customer before Processing, unless the law prohibits it on important grounds of public interest.
The Agreement, this DPA (including Annex 1), and the Customer's use and configuration of the Services — including which data sources it connects, which features it enables, and which agentic actions it authorises — constitute the Customer's complete documented instructions. Additional instructions require written agreement and may be subject to a reasonable charge.
Whipcream will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Whipcream may suspend performance of that instruction until it is withdrawn, amended or confirmed, without liability for the resulting delay.
Whipcream will not sell Customer Personal Data, and will not Process it for its own purposes, for the benefit of any other customer, or for advertising.
Whipcream will not use Customer Personal Data to train foundation or general-purpose AI models, and will contractually prohibit its AI model providers from doing so, unless the Customer has expressly opted in. Whipcream may Process Customer Personal Data to operate, secure, tune, evaluate and improve the Services for the Customer, and to produce aggregated and anonymised information as permitted by section 4.6.
Whipcream may create aggregated and anonymised information derived from Customer Personal Data, and Process it after the end of the Agreement, provided the information cannot reasonably be used to identify the Customer, any Data Subject or the Customer's own customers, whether alone or in combination with other information reasonably available, and provided Whipcream applies minimum aggregation thresholds. Once anonymised, that information is no longer Personal Data and is governed by clause 18 of the Terms & Conditions.
PROHIBITED CATEGORIES OF DATA
The Customer must not connect or upload special category personal data (Article 9 UK GDPR), criminal offence data (Article 10), full payment card numbers, health data or children's data unless the parties have agreed additional safeguards in writing. The Services are not designed for those categories, and Annex 1 records that they are out of scope.
5 Duration of the Processing
Whipcream will Process Customer Personal Data for the duration of the Agreement and for the retention period set out in section 13, unless a longer period is required by law.
6 Confidentiality and personnel
Whipcream will ensure that persons authorised to Process Customer Personal Data are bound by an appropriate contractual or statutory duty of confidentiality that survives the end of their engagement.
Whipcream will limit access to Customer Personal Data to those personnel who need it to provide, secure or support the Services, will apply role-based and least-privilege access controls, and will provide those personnel with appropriate data protection and security training.
Whipcream will apply appropriate screening to personnel with access to production systems, to the extent permitted by law.
Whipcream will implement and maintain the technical and organisational measures set out in Annex 2, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing and the risks to Data Subjects.
Whipcream may update those measures provided the overall level of protection is not materially reduced. The current measures are published and available on request.
The Customer is responsible for security within its own control, including the configuration of the Services and of connected Third-Party Services, user provisioning and de-provisioning, role and permission management, and the security of its own systems, devices, credentials and API keys. Clause 23 of the Terms & Conditions allocates responsibility for security incidents by cause.
The Customer has reviewed Annex 2 and confirms that, in the context of its own use of the Services, the measures are appropriate to the risk.
8 Subprocessors
The Customer gives Whipcream general written authorisation to engage Subprocessors to Process Customer Personal Data.
Whipcream maintains a current list of Subprocessors, including the Processing each performs and the country in which it takes place, at whipcream.io/subprocessors. The Subprocessors engaged at the date of this DPA are listed in Annex 3.
Whipcream will give the Customer at least 30 days' notice of the addition or replacement of a Subprocessor, by email to the account contact or by a subscribable notification on the subprocessor page. The Customer may object on reasonable data protection grounds within that period.
If the Customer objects, the parties will discuss the objection in good faith. If Whipcream cannot provide a commercially reasonable alternative within 30 days, the Customer may terminate the affected subscription on written notice, and Whipcream will refund the Fees prepaid for the period after termination. This is the Customer's sole remedy for an objection.
Whipcream will impose on each Subprocessor, by written contract, data protection obligations that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each Subprocessor's obligations.
Whipcream may engage a new Subprocessor without prior notice where necessary to respond to an emergency, a security threat or the discontinuation of an existing provider, and will notify the Customer as soon as reasonably practicable afterwards.
9 Data subject rights
Taking into account the nature of the Processing, Whipcream will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law.
The Services include self-service functionality allowing the Customer to access, correct, export and delete Customer Personal Data. The Customer will use that functionality in the first instance.
If Whipcream receives a request directly from a Data Subject relating to Customer Personal Data, it will not respond to it substantively, and will forward the request to the Customer without undue delay, unless it is legally required to respond.
Where the Customer requires assistance beyond the self-service functionality, Whipcream will provide reasonable assistance. Whipcream may charge a reasonable fee for assistance that is disproportionate or repetitive, having first told the Customer what the charge will be.
10 Assistance with the Customer's obligations
Taking into account the nature of the Processing and the information available to Whipcream, Whipcream will provide reasonable assistance to the Customer with its obligations under Articles 32 to 36 of the UK GDPR, namely security of processing, notification of Personal Data Breaches, communication of breaches to Data Subjects, data protection impact assessments, and prior consultation with a Supervisory Authority.
Whipcream will make available the information reasonably necessary to demonstrate compliance with Article 28, including this DPA, Annex 2, its Subprocessor list, and any third-party audit reports or security certifications it holds from time to time.
11 Personal Data Breach
Whipcream will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data within systems under Whipcream's control.
The notification will describe, to the extent then known: the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point for further information. Where the information cannot all be provided at once, it will be provided in phases without further undue delay.
Whipcream will take reasonable steps to investigate, contain and remediate the breach, and will cooperate with the Customer and provide the reasonable assistance the Customer needs to meet its own notification obligations to a Supervisory Authority or to Data Subjects.
Whipcream's notification is not an acknowledgement of fault or liability. Clause 23.3 of the Terms & Conditions allocates responsibility for incidents caused by the Customer, its personnel, its credentials, its configuration or a Third-Party Service.
The Customer will notify Whipcream without undue delay, and in any event within 24 hours, of any actual or suspected compromise of its account, credentials, API keys or connected Third-Party Service accounts.
Neither party will make a public statement attributing a Personal Data Breach to the other without that party's prior written consent, unless required by law or by a Supervisory Authority.
12 International transfers
Whipcream Processes Customer Personal Data primarily in the United Kingdom and the European Economic Area. Some Subprocessors are located elsewhere, including in the United States, as recorded in Annex 3.
The Customer authorises Whipcream to make Restricted Transfers where necessary to provide the Services, subject to an appropriate safeguard under Chapter V of the UK GDPR or the EU GDPR.
Where a Restricted Transfer occurs and no adequacy decision or adequacy regulations apply, the following apply automatically and are incorporated into this DPA:
for transfers subject to the EU GDPR, the Standard Contractual Clauses, Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the options and annexes completed as set out in Annex 4;
for transfers subject to the UK GDPR, the UK Addendum to those SCCs, completed as set out in Annex 4;
in each case with any supplementary technical, organisational and contractual measures identified as necessary by a transfer risk assessment.
Whipcream will carry out and document a transfer risk assessment for each Restricted Transfer and will make it available to the Customer on reasonable request.
If a safeguard relied on is invalidated or ceases to provide an adequate level of protection, the parties will work together in good faith to implement an alternative. If none is available within a reasonable period, either party may terminate the affected Processing and the affected subscription.
13 Return and deletion of Customer Personal Data
The Customer may export Customer Personal Data at any time during the term using the functionality in the Services, or by written request to Whipcream.
On expiry or termination of the Agreement, Whipcream will retain Customer Personal Data in a form permitting reactivation and export for 30 days, and will then delete it or irreversibly anonymise it within a further 30 days, unless the Customer instructs its return or earlier deletion.
Whipcream may retain Customer Personal Data beyond that period only where and for as long as required by law, or in the following limited circumstances: copies held in routine backups, which are overwritten on Whipcream's standard backup cycle and in any event within 90 days of deletion from production and are restored only for disaster recovery; security, access and audit logs, for up to 12 months; billing, tax and accounting records; data subject to a legal hold or needed for the establishment, exercise or defence of legal claims; and aggregated and anonymised information created under section 4.6.
Data retained under section 13.3 remains subject to this DPA and to the confidentiality and security obligations in the Agreement, and is not Processed for any other purpose.
Whipcream will certify deletion in writing on the Customer's request. This section is consistent with clause 33 of the Terms & Conditions; where an Order Form or Enterprise Agreement specifies a different retention period, that period applies.
14 Audit and information rights
Whipcream will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.
The parties agree that this obligation is satisfied in the first instance by Whipcream providing: this DPA and its annexes; its current Subprocessor list; its security documentation; responses to a reasonable security questionnaire; and any third-party audit report or certification it holds.
Where that information is not sufficient to demonstrate compliance, or following a Personal Data Breach, the Customer may conduct an audit on the following terms: no more than once in any 12-month period, unless required by a Supervisory Authority or following a Personal Data Breach; on at least 30 days' written notice; during business hours; without unreasonably disrupting Whipcream's operations; subject to confidentiality obligations; and excluding access to any other customer's data, to Whipcream's source code, or to information whose disclosure would breach a duty owed to a third party.
The auditor must not be a competitor of Whipcream. The Customer bears its own and Whipcream's reasonable costs of an audit, unless the audit reveals a material breach of this DPA by Whipcream, in which case Whipcream bears its own costs.
15 Whipcream as controller
Whipcream is an independent Controller of the Personal Data described in the Privacy Policy, including account registration data, billing data, support correspondence, and platform usage, security and telemetry data, which it Processes to operate, secure, bill for, support and improve the Services and to comply with its legal obligations.
This DPA does not apply to that Processing, and the Customer is not the Controller of it. Each party acts as an independent Controller in respect of any Personal Data it exchanges with the other for the purposes of contract administration and relationship management.
Where either party discloses business contact details of its personnel to the other for those purposes, the recipient acts as an independent Controller and is responsible for providing the required transparency information to those individuals.
16 Liability, precedence and general
The limitations and exclusions of liability in clause 29 of the Terms & Conditions apply to claims under this DPA, including the enhanced cap in clause 29.6, except where Applicable Data Protection Law prohibits a limitation. Nothing in this DPA limits a Data Subject's rights against either party under Article 82 of the UK GDPR.
Where the Standard Contractual Clauses or the UK Addendum apply and conflict with this DPA, the Clauses or Addendum prevail to the extent of the conflict. Otherwise this DPA prevails over the Agreement in respect of the Processing of Personal Data.
This DPA takes effect on the date the Customer accepts the Agreement and terminates automatically when the Agreement terminates and Whipcream has completed deletion under section 13.
Whipcream may update this DPA where necessary to reflect a change in Applicable Data Protection Law, a decision of a Supervisory Authority or a court, or a change to the Services, provided the update does not materially reduce the protection afforded to Customer Personal Data. Whipcream will give at least 30 days' notice of a material update.
Sections 4.6, 6, 13, 14, 16 and 17 survive termination of this DPA.
17 Governing law and jurisdiction
This DPA is governed by the laws of England and Wales, and clause 37 of the Terms & Conditions applies to any dispute arising out of it.
Where the Standard Contractual Clauses apply to a transfer subject to the EU GDPR, those Clauses are governed by the law and subject to the jurisdiction specified in Annex 4, as required by the Clauses themselves.
18 Annex 1 — Details of the Processing
Subject matter. The provision of the Whipcream agentic revenue intelligence platform under the Agreement.
Nature and purpose. Collection, retrieval from connected sources, storage, organisation, structuring, analysis, aggregation, generation of insights, recommendations and a Revenue Health Score, display, export, security monitoring, backup, support and deletion, in each case to provide, secure and support the Services.
Duration. The term of the Agreement, plus the retention period in section 13.
Frequency. Continuous and automated, through scheduled and event-driven synchronisation with connected data sources, and on demand.
Categories of Data Subject and Personal Data.
Sources of the Personal Data.
Controller contact point. As specified by the Customer in its account or Order Form. Processor contact point. info@whipcream.io.
19 Annex 2 — Technical and organisational measures
Whipcream implements the following measures. They are described at a level appropriate for a contractual annex; further detail is available under NDA.
Whipcream does not currently hold ISO 27001 certification or a SOC 2 report. Whipcream makes no representation that it holds any certification other than those it expressly publishes.
20 Annex 3 — Subprocessors
The following Subprocessors are engaged at the date of this DPA. The current list, including any changes notified under section 8, is kept in this Annex at whipcream.io/data.
The legal entity, registered address and transfer mechanism relied on for each Subprocessor are available on request at info@whipcream.io. Transfers out of the UK and the EEA are made under section 12. Where a Subprocessor's Processing can be configured to exclude Personal Data — for example by disabling payload capture in observability tooling — Whipcream will apply that configuration where it does not materially degrade the Services.
HubSpot, Google Analytics and Mixpanel are not Subprocessors of Whipcream. They are the Customer's own providers, under the Customer's own agreements, from which the Customer instructs Whipcream to retrieve data. Clause 19 of the Terms & Conditions applies to them.
21 Annex 4 — Transfer mechanisms
Where the Standard Contractual Clauses apply, the parties agree the following, and the Clauses are deemed completed accordingly.
Where the UK Addendum applies, the parties agree the following.
Where the Customer is the data exporter under the UK GDPR, the parties may instead use the International Data Transfer Agreement, completed with the equivalent information.
A person answers.
Legal, procurement or security review — write to info@whipcream.io , or use the contact page.
Contact us →
Related documents
See what moves your revenue.
Agentic Revenue Intelligence
WHIPCREAM LTD 71-75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom
Company No. 16958944
info@whipcream.io
