Data Processing Addendum (Summary)
Effective date: October 9, 2026
When we handle personal data for a client, for example running a platform, operating campaigns or building AI systems on the client's data, the client is the controller and we are the processor. Our standard Data Processing Addendum (the "DPA") is part of every SOW that involves this kind of work. It is written to meet Article 28 of the EU and UK GDPR and works under other data protection laws too. Here is what it commits us to.
What each project records
Each SOW records what the processing is about and how long it lasts, what we do with the data and why, the types of personal data involved and the people it relates to.
Your instructions
We process personal data only on your documented instructions and for the purposes in the SOW, never for our own purposes. If we believe an instruction breaks data protection law, we will tell you.
Confidentiality
Everyone on our team who handles your personal data is bound by confidentiality.
Security
We use technical and organisational measures that match how sensitive the data is. These include encryption in transit, and at rest wherever the platform supports it, access limited to the people who need it, separate environments for development and live systems, activity logging, and secure coding and review practices.
Sub-processors
We use carefully chosen sub-processors, such as cloud hosting and communication providers, under written terms that protect the data at least as well as our DPA. We keep a current list for clients, tell you before we add or replace one, and you may object on reasonable grounds. We stay responsible for the work our sub-processors do.
Helping you meet your duties
We help you respond when people exercise their rights, and with security, breach notifications, data protection impact assessments and any consultation with a regulator, as far as the nature of our work allows.
Breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, give you the information you need for your own notifications, and work with you to contain it.
International transfers
If your personal data needs to move between countries, we use a recognised safeguard, such as the Standard Contractual Clauses with the UK Addendum where it applies, and record it in the SOW.
When the work ends
We return or delete your personal data, as you choose, unless the law requires us to keep it, and we confirm deletion in writing if you ask.
Audits
We give you the information you need to show compliance, such as documentation and security summaries, and allow audits on reasonable notice and confidentiality terms where the contract provides for them.
Getting the full DPA
To sign the full DPA for your project, ask through the contact form. It comes with every SOW that involves processing personal data.