Last updated: 11 October 2026
This Data Processing Addendum ("DPA") forms part of our terms of service (the "Agreement"). It applies when 9horsemen Limited ("we", the "processor") processes personal data on behalf of a business using Gallop ("you", the "controller") under applicable privacy laws, including the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and New Zealand's Privacy Act 2020.
1. Order of precedence
If this DPA and the Agreement conflict about the processing of personal data, this DPA applies. The indemnities and limits of liability in the Agreement apply, in total, to all claims under this DPA.
2. Roles and scope
You're the controller: you decide why your customers' personal data is collected. We act only as your processor (and, under the Privacy Act 2020, your agent). We process personal data only on your documented instructions, which you give by using and configuring Gallop.
- Sensitive data: you must not submit, or let your customers submit, special category data under the GDPR or sensitive personal information under the CCPA, such as health information, biometric data or government ID numbers.
- Confidentiality: everyone we authorise to process personal data is bound by confidentiality obligations.
- Deletion: you can export your data at any time. When your account closes, we delete the personal data we hold for you. Deleted data may stay in our encrypted backups for up to 7 days, as described in our privacy policy, and we keep sales and billing records where the law requires it.
3. CCPA service provider terms
Under California law, we act as your "service provider". We understand and will comply with these restrictions:
- We won't sell or share personal information.
- We won't keep, use or disclose personal information for any purpose, including any commercial purpose, other than providing the services described in the Agreement.
- We won't keep, use or disclose personal information outside our direct business relationship with you, or combine it with personal information we get from others, except as the CCPA allows.
4. Security, requests and audits
We use technical and organisational measures to protect personal data against unauthorised access or loss, including encryption in transit and separating each business's data in our database.
- Breach notification: if we confirm a personal data breach affecting your records, we'll tell you without undue delay, and within 72 hours of confirming it, so you can meet your own duties.
- Requests from your customers: if one of your customers asks us to access, correct or delete their data, we won't answer them directly. We'll pass the request to you and give you reasonable help to respond.
- Audits: once a year, on written request, we'll give you the information reasonably needed to show we comply with this DPA. We'll do this by answering a security questionnaire in writing and sharing summaries of our subprocessors' security certifications (such as SOC 2), under a confidentiality agreement. This doesn't include physical access to our systems or our providers' data centres.
5. Subprocessors and international transfers
You give us general written authorisation to use third-party infrastructure, analytics and AI providers ("subprocessors") to provide the services.
- Our responsibility: we have written agreements with our subprocessors that protect personal data at least as well as this DPA. We remain responsible for their acts and omissions, subject to the limits of liability in the Agreement.
- Changes: our current subprocessors are listed on our subprocessors page. We'll tell account holders at least 15 days before a new subprocessor starts processing your data. If you have a reasonable objection, your remedy is to close your account before the change takes effect.
- International transfers: New Zealand has an adequacy decision from the European Commission and the UK. Where personal data from the EU, UK or New Zealand is transferred to a country without an equivalent decision, such as Australia or the United States, the European Commission's standard contractual clauses (Module 2, controller to processor, and Module 3, processor to processor, for onward transfers to subprocessors) and, for UK data, the UK International Data Transfer Addendum, are incorporated into this DPA by reference.
Schedule 1: Processing details
- Subject matter and duration: providing the Gallop builder, site hosting and business app, for as long as your account is open.
- Nature of processing: storage, computing, transmission (including emails sent in your business's name) and AI-assisted generation through external AI model providers.
- Types of personal data: names, contact details (email addresses and phone numbers), booking and appointment records, purchase history, information customers enter in forms on your site, and technical request logs including IP addresses.
- Categories of data subjects: your customers, visitors to your site, and the team members you invite.
Contact
Questions about this DPA? Email hello@9horsemen.com.