Data Processing Agreement

Last updated: February 27, 2026Version: 1.0

1. Bubba's Role in Data Processing

Bubba acts in different data protection roles depending on the type of processing activity:

1.1 Bubba as Data Controller

Bubba is the data controller (GDPR Art. 4(7)) for the following processing activities, where we determine the purposes and means of processing:

1.2 Bubba as Processor

When a pet owner books a service through the platform, Bubba acts as a data processor (GDPR Art. 4(8)) for certain data that is transmitted to the service provider (business partner) for the purpose of service delivery. In this context, the service provider is the controller for the data necessary to deliver the booked service.

1.3 Service Providers as Separate Controllers

Service providers (business partners) on Bubba are independent data controllers for:

Bubba and service providers are not joint controllers for service delivery. Each party processes data under its own controllership, with appropriate data sharing governed by contractual terms (see our Business Terms & Conditions).

2. Sub-Processors

Bubba engages the following sub-processors to deliver its services. Each sub-processor processes personal data only for the specific purposes described and under contractual data protection obligations compliant with GDPR Article 28.

2.1 Changes to Sub-Processors

We will notify users via email and/or platform notification at least 30 days before engaging a new sub-processor or making material changes to existing sub-processor arrangements. Users have the right to object to such changes; if we cannot accommodate the objection, the user may terminate their account and request data erasure (see GDPR Rights).

3. International Data Transfers

Where personal data is transferred to sub-processors located outside the European Economic Area (EEA), we ensure an adequate level of protection through:

3.1 Transfer Mechanisms

3.2 Standard Contractual Clause Modules

3.3 Transfer Impact Assessments

We conduct Transfer Impact Assessments (TIAs) for all international data transfers to countries without an EU adequacy decision. TIAs evaluate:

4. Pet Health Data Processing

4.1 Classification

Pet health data (vaccination records, medications, medical events, veterinary records) relates to animals, not humans, and is therefore not classified as special category data under GDPR Article 9. However, because pet health records can be linked to identifiable pet owners, we treat this data with heightened care.

4.2 Processing Basis

Pet health data is processed under Art. 6(1)(a) GDPR — your explicit consent. You may withdraw consent for pet health data processing at any time without affecting access to other platform features.

4.3 Access Controls

4.4 Encryption and Storage

4.5 Retention

Pet health data is retained for the duration of your account plus any legally mandated retention period. Upon account deletion, pet health data is anonymized as part of the standard data erasure process (see Section 5).

5. Processor Obligations (Provider Data)

When a pet owner books a service through the Bubba platform, the service provider is the data controller for the personal data necessary to deliver the booked service. Bubba acts as a data processor for this data, processing it only to facilitate the booking, communication, and payment between the pet owner and the Provider.

This section governs Bubba's processing obligations in that capacity, in compliance with GDPR Article 28.

5.1 Lawful Processing

Bubba shall:

5.2 Confidentiality

Bubba shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.3 Data Subject Requests

Bubba shall assist the Provider in fulfilling its obligation to respond to data subject requests (access, rectification, erasure, portability, restriction, objection) by:

5.4 Data Return and Deletion

Upon termination of the Provider's account:

5.5 Sub-Processor Obligations

Bubba shall:

6. Data Retention Schedule

The following table summarizes our data retention periods by category. For detailed information, see our Privacy Policy, Section 2.

7. Data Erasure Approach

7.1 Anonymization Over Hard-Deletion

When you request data erasure (Right to Erasure, GDPR Art. 17), your data is processed through anonymization rather than hard-deletion. This approach:

7.2 Why Anonymization

Anonymized records are retained to maintain:

8. Technical and Organizational Measures (GDPR Art. 32)

We implement the following measures to ensure a level of security appropriate to the risk:

For more details, see our Security Policy.

9. Data Breach Notification

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects:

10. Data Protection Impact Assessments (DPIAs)

We conduct Data Protection Impact Assessments where required by GDPR Art. 35, particularly for:

Currently, no processing activities conducted by Bubba have required a DPIA under the criteria of GDPR Art. 35(3), as:

11. Audit Rights

Bubba shall make available to service providers all information necessary to demonstrate compliance with the obligations under GDPR Article 28 and shall allow for and contribute to audits, including inspections, conducted by the Provider or an auditor mandated by the Provider.

Bubba may satisfy this obligation by:

12. Contact

For questions about our data processing practices or to request a copy of our Data Processing Agreement:

13. Related Documents

This document is provided for transparency purposes. Formal Data Processing Agreements with individual sub-processors are maintained as separate, non-public contractual documents. If you are a business partner requiring a formal DPA with Bubba, please contact legal@bubba.pet.