Privacy & Cookies Policy

Privacy Policy

PenAndPaw is a trading name of Jasimsaf Berkshire Limited, and we are committed to protecting and respecting your privacy.

This privacy policy sets out how we use and protect any information that you give us. We are committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified, then you can be assured that it will only be used in accordance with this privacy statement. We may change this policy from time to time by updating this page. If you have any concerns then please contact us directly using our details found further down this page.

Who is responsible for your data

When you book with a boarding business (a cattery or kennels) through PenAndPaw, that business is the data controllerfor your bookings, payments, and its own records of your pet's stays — it decides how that information is used to care for your pet, and PenAndPaw processes it on the business's behalf. PenAndPaw is the data controller for your sign-in account itself (your email address, password, and security records), which works across every business you book with; for the shared profile described in the next section; and for information about the businesses that subscribe to our platform.

Using one account with more than one business

Your PenAndPaw account works across every boarding business you book with, and some of your information is deliberately held once rather than separately by each business. We call that your shared profile, and PenAndPaw is the data controller for it.

Your shared profile is: your name, contact details and address; each pet's core profile — name, breed, date of birth, description and microchip number; standing care details such as dietary requirements and special needs; your vet practice; and your pet's health record, meaning vaccinations, medical conditions, medications and treatments.

It is held once so that you do not have to re-enter a vaccination certificate or a new phone number at every business, and so that an allergy known to one is not unknown to the next. The practical consequence is worth being clear about: if you or one business update your shared profile, the other businesses you already use will see the updated version.

Two things that do not happen. We never tell one business which other businesses you use, or that you use any. And your bookings, payments, notes and everything else specific to your relationship with a business are never shared with another one — those belong to that business alone.

Our lawful basis for maintaining the shared profile is our legitimate interest, and yours, in one accurate record of you and your pets across the businesses you choose to use — rather than several copies that disagree, which is a real risk to an animal when the disagreement concerns a medication or an allergy. You can ask us about it, correct it, or object, using the contact details below.

Where this policy says PenAndPaw is a controller, the controller is Jasimsaf Berkshire Limited, a company registered in England and Wales with company number 08313597, whose registered office is at 20-22 Venture West, Greenham Business Park, Newbury, England RG19 6HX. Please write to the correspondence address below rather than the registered office.

What data we may collect

To enable your chosen boarding business to provide its service, the platform processes the following categories of information:

• Account & contact details: name, email address, telephone number, postal address, and an emergency contact.
• Marketing preferences: whether you have opted in to email or SMS communications.
• Pet information: name, breed, date of birth, and notes about your cat or dog.
• Veterinary & medical records:vaccination history and expiry dates, medical conditions, current medications, and any notes you or your vet provide that are relevant to your pet's care while in our charge.
• Booking history: check-in and check-out dates, pen assignments, special requirements, and notes recorded during stays.
• Notes your boarding business keeps about you: free-text notes its staff record about you as a client — preferences, handling arrangements, relationship history. These belong to that business alone and are never visible to any other business you use.
• Financial records: invoices, deposits, payments, refunds, and any credits issued.
• Account activity: sign-in timestamps and a basic audit trail of changes made to your bookings.
• Access records: when a member of staff at your boarding business opens one of your bookings, we record that it happened — who looked and when. When staff view a list of customers, we record the view and how many records it showed, not who was in it. These records hold reference numbers only, never your name, contact details or anything from the record itself.

Information about other people:the emergency contact details, and any vet contact details, that you give us are personal data about someone other than you. Please make sure they are happy for you to share their details with us; we use them only in connection with your pet's care.

Payments may be taken by bank transfer (BACS), on the boarding business's in-office card terminal, or — where that business has enabled it — online through Stripe. PenAndPaw does not collect or store payment card numbers; online card details are entered directly with Stripe and never reach PenAndPaw's servers. BACS details are processed on the boarding business's instructions only as needed to reconcile the payment.

What we do with the information we gather

The boarding business uses your booking, pet and payment information to provide its boarding service and meet its responsibilities. PenAndPaw processes that information on the business's instructions. In particular, the business uses it to:

• Manage your account and your bookings, including check-in and check-out arrangements and pen assignments.
• Care for your pet during their stay — for example, by referring to vaccination, medical, and medication records you have provided.
• Contact you about your booking — confirmations, reminders, changes, and any questions that arise during your pet's stay.
• Take and reconcile payment by bank transfer (BACS) or by card on our in-office card terminal, and keep the resulting accounting records.
• Meet the boarding business's legal obligations — including HMRC tax and VAT record-keeping, and any record requirements that apply under animal-welfare legislation.
• Keep the service secure and prevent misuse — for example, basic sign-in records and an audit trail of changes made to bookings. PenAndPaw controls the narrow platform sign-in and security records for this purpose.
• Record your marketing preferences. The platform does not currently send marketing campaigns; any future sender must identify the responsible organisation, honour your choice and provide an unsubscribe route before sending begins.

The boarding business is responsible for identifying and explaining the lawful bases for its records; these will commonly include its contract with you, legal obligations for tax or regulatory records, and legitimate interests in running its service. PenAndPaw relies on its own lawful bases only for the narrow platform-account, security and subscription purposes for which it is the controller.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical and electronic procedures to safeguard and secure the information we collect — including encryption in transit and at rest, strict scoping so that each boarding business can reach only the records of its own clients, limits on repeated sign-in attempts, and a record of staff opening bookings (see Access records above).

Who processes your data

We use a small number of carefully chosen service providers (sub-processors) to run PenAndPaw. Each processes data only in connection with providing its service to us. Where a provider processes data outside the UK, UK GDPR requires appropriate safeguards (such as the UK Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement). We are completing a documented review of each provider's processing locations, agreements, and transfer safeguards; the current record is available on request, and we will update this table as the review concludes.

• Stripe
  Online card payments and subscription billing.
  Payment and transaction data. Card numbers are entered directly with Stripe and never reach our servers.
  Transfers: May process outside the UK; safeguard review in progress.
• Neon
  Database hosting for the service.
  Account, pet, booking, and payment-record data, encrypted in transit and at rest.
  Transfers: May process outside the UK; safeguard review in progress.
• Vercel
  Application hosting, scheduled jobs, and file storage (business logos and terms documents).
  Data handled by the application while serving your requests; uploaded files.
  Transfers: May process outside the UK; safeguard review in progress.
• Cloudflare
  Encrypted off-site database backups, and storage for the pet photos you upload.
  Backups as encrypted files Cloudflare cannot read; pet photo files with embedded location, device and time details removed.
  Transfers: Stored within the European Union under Cloudflare’s EU jurisdiction setting; UK Addendum to the EU Standard Contractual Clauses.
• Email delivery provider
  Sending transactional emails such as booking confirmations, reminders, and account emails.
  Your name, email address, and the content of the emails we send you.
  Transfers: May process outside the UK; safeguard review in progress.

How long we keep your data

PenAndPaw and each boarding business apply the retention periods relevant to the data for which each is responsible:

• Platform accounts:sign-in credentials, verification state and authentication information are kept while your platform account remains open. A boarding business's booking and care records are separate and follow that business's instructions and retention decisions.
• Pet profile photos:a photo you choose for one of your pets is kept until you replace or remove it, or your account is closed. Only you can set it — a boarding business cannot upload a photo to your pet's profile — and it is shown to the same businesses that can already see that pet's record. Location, device and capture-time details embedded in the image are removed before it is stored, and the file is held in storage located within the European Union (see Who processes your data).
• Photos from a stay:a boarding business may send you photos and a message about your pet during or just after a stay. They are shown in your account (the email you receive carries a link, never the photos themselves) and are kept for 30 days after the end of that booking, then deleted automatically — save any you want to keep before then. Location, device and capture-time details are removed before storage, and the files are held in the same European Union storage.
• After you ask us to close your account: nothing happens until you confirm through the link we email you. Once you do, we tell every business that holds records about you, and each completes its own erasure — your contact details, pet records, medical and vaccination history, and care notes are deleted. We then close and irreversibly anonymise your account, normally within 30 days of your confirmation. Each business keeps a minimal financial record of your stays — your name, which pets were boarded, the dates and the amounts — for the retention period below, because UK GDPR Article 17(3)(b) requires records kept for a legal obligation to be retained. Nothing else about you remains with them.
• Your reference document: before your details are removed we email you a reference document. Keep it safe: once your account is closed, those references are the only way to look up the records we are legally required to keep.
• Financial records:invoices, payment records and related accounting information are retained for 6 years from the end of the financial year in which the transaction took place — not from the date of your stay, as a payment can fall in a later accounting year — in line with HMRC record-keeping requirements, then deleted. If a boarding business stops using PenAndPaw, it takes a copy of its records with it (or has us delete them without a copy); PenAndPaw does not keep a copy of a former business's records. This is separate from PenAndPaw's own subscription invoices and security records.
• Backups:data may persist beyond ordinary use in routine encrypted backups until the provider's rotation period expires. We are confirming the exact maximum period and will publish it here.
• Security and authentication logs: records of login attempts (including failed and suspicious activity) are retained for up to 90 days for fraud and abuse detection. Logs that can be linked to your account are deleted at the same time as your account.
• Access records: records of staff opening a booking are kept for 12 months. They are how we can tell you who has looked at your bookings if you ask, so they are kept a little longer than sign-in logs and are not deleted when your account closes — by then they contain nothing that identifies you.

Account closures and erasure requests are applied automatically by a daily process. Financial records are deleted once the retention period above has passed, following a check by a member of staff rather than automatically.

Your right to object

Controlling your personal information

You may choose to restrict the collection or use of your personal information in the following ways:

• You have the option to contact us and let us know.
• If you have previously agreed to us using your personal information, you may change your mind at any time by contacting us directly.

We will never sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. You may request details of personal information which we hold about you under the Data Protection Act 2018 and the UK GDPR, and you may also request that information we hold about you is erased from our systems as per Article 17 of the UK GDPR.

If you have an account, the quickest route is the Privacy & Data section of your account settings. Download my data gives you a copy of the personal data we hold about you — bookings, pets, payments and account details — together with a summary of your data-protection rights; we ask for your password first to confirm it is you. Close my account starts a closure request. You can also contact us by post, telephone or email using the details below and we will deal with your request for you.

We respond within one calendar month of receiving your request. If a request is particularly complex, or you have made several, we may extend that by up to two further months — we will tell you within the first month if we need to, and why. We will ask you to prove your identity only where we genuinely need it to be confident who we are dealing with, and we will tell you promptly what we need. We may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded or excessive; we will always explain why. If you are unhappy with how we have handled your request you can complain to the Information Commissioner's Office.

If you believe that any information we are holding on you is incorrect or incomplete, please contact us as soon as possible using our details found further down this page.

Complaining about how we handle your data

You can complain to us directly at support@penandpaw.co.uk. We will acknowledge your complaint within 5 working days, tell you who is dealing with it, and aim to give you a full response within 20 working days. If it is going to take longer than that we will tell you before the 20 days are up, and explain why.

Some complaints are for the boarding business to answer rather than us. Where your complaint is about how a business you have used has handled its own records of you — its bookings, its notes, its staff — that business is the data controller and makes the decision. In that case we will log your complaint, pass it to them without undue delay, and tell you that we have done so and who now holds it. Where your complaint is about your PenAndPaw account, your sign-in, or the profile and animal details shared across the businesses you use, we deal with it ourselves. Either way you will be told who is handling it, and we will not leave your complaint unanswered on the basis that it belongs to someone else.

You do not have to complain to us first. You can go straight to the Information Commissioner's Office at any time, and you can still go to them if you are unhappy with our response.

Cookies

For details of the cookies we use, see our Cookies Policy below.

Links from our site

Where our site contains links to other sites and resources provided by third parties, these links are provided for your information only. We have no control over the contents of those sites or resources, and accept no responsibility for them or for any loss or damage that may arise from your use of them.

Your concerns

If you have any concerns about material which appears on our site, please contact us using our details below.

How to contact us

To contact us about anything to do with your personal data and data protection, please contact us using the following:

• a) by post: PenAndPaw, 12-20 Oxford Street, Newbury, Berkshire, RG14 1JB
• b) by telephone: 01635 789 225
• c) by email: support@penandpaw.co.uk

Changes to this Privacy Notice

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

When we change it we update this page and the date at the top.