Data Processing Agreement

1. What This Is

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, our Terms and Conditions. It governs our processing of personal data on your behalf and satisfies Article 28(3) of the UK GDPR. Accepting the Terms accepts this DPA; no separate signature is needed.

Terms used here — controller, processor, personal data, processing, data subject, personal data breach — carry the meanings given in the UK GDPR and the Data Protection Act 2018.

2. Roles

You are the controller. We are the processor. You decide what personal data is collected through your website and services, and why. We process it only to deliver the services you have engaged us for.

Where we process personal data for our own purposes — running our own business, invoicing you, marketing our own services — we are a controller in our own right, and our Privacy Policy governs that, not this DPA.

Online shops: where we build or manage an online shop for you, you are the merchant. Payments are taken through a payment provider account held in your name, so that provider is your own processor under your direct agreement with them — not our sub-processor. We do not receive, hold or handle your customers' money, and we do not have access to their full payment card details.

3. Subject Matter, Duration, Nature and Purpose

4. Our Obligations

We will:

• 4.1 Process only on your instructions. Process personal data only on your documented instructions, including on international transfers, unless required to do otherwise by law — in which case we will tell you before processing, unless the law forbids it. The Terms, this DPA and your day-to-day requests are your documented instructions. We will tell you if we believe an instruction breaches data protection law.
• 4.2 Keep it confidential. Ensure everyone authorised to process the data is under a binding duty of confidentiality.
• 4.3 Secure it. Implement appropriate technical and organisational measures under Article 32 — see section 6.
• 4.4 Control sub-processors. Engage sub-processors only as set out in section 5.
• 4.5 Help with data subject rights. Taking account of the nature of the processing, assist you by appropriate technical and organisational measures in responding to requests to exercise data subject rights — access, rectification, erasure, restriction, portability and objection. If a request reaches us directly we will not answer it ourselves; we will pass it to you without undue delay.
• 4.6 Help with your wider obligations. Assist you in complying with Articles 32 to 36 — security, breach notification, and data protection impact assessments — taking account of the nature of processing and the information available to us.
• 4.7 Return or delete. At the end of the engagement, and at your choice, delete or return the personal data and delete existing copies, unless we are required by law to keep it. Section 10.6 of the Terms sets out how this works in practice, including your free data export.
• 4.8 Demonstrate compliance. Make available the information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits — see section 8.

5. Sub-Processors

5.1 General authorisation. You give us general written authorisation to engage the sub-processors listed below. We impose data protection obligations on each of them no less protective than those in this DPA, and we remain fully liable to you for their performance.

5.2 Changes. We will give you at least 30 days' written notice before adding or replacing a sub-processor. If you have a reasonable data-protection objection, tell us within those 30 days and we will work with you to find an alternative. Where none is workable, you may cancel under section 9 of the Terms without penalty.

5.3 Current sub-processors. This list reflects the services we actually use. Not every client engages every service — a client with no social media package is not processed through Meta, and so on.

5.4 What is not sub-processed. Your client records, our notes, and the AI assistant that works with them run on our own hardware in the United Kingdom, on a local language model. That content is not sent to any third-party AI provider.

6. Security

Taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to individuals, we maintain appropriate technical and organisational measures, including:

• encryption in transit (HTTPS/TLS) across all websites and services we provide
• access controls, with credentials held in an encrypted secret store
• primary storage of client records on our own hardware in the United Kingdom rather than on third-party cloud storage
• regular automated backups, and the ability to restore service from them
• keeping platform and dependency software patched, with security monitoring on hosted sites
• separation of each client's data, so one client's records are not accessible from another's site or account
• payment card data handled entirely by a PCI DSS compliant payment provider, never passing through or being stored on our systems

7. Personal Data Breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process for you. Our notification will describe, so far as we know it, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

We will not notify the ICO or any data subject on your behalf unless you instruct us to in writing — as controller, that decision and the 72-hour deadline under Article 33 are yours. We will give you what you need to make it.

8. Audits and Information

On reasonable written notice, and no more than once in any 12-month period unless a breach or a regulator requires otherwise, we will make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to an audit by you or an auditor you appoint. Audits must be conducted during normal business hours, must not unreasonably disrupt our business, and are subject to confidentiality. You bear your own costs; we bear ours.

9. International Transfers

Some sub-processors listed in section 5.3 process data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure an appropriate safeguard under Chapter V of the UK GDPR is in place — an adequacy decision, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You authorise us to enter into those transfer mechanisms with sub-processors on your behalf where doing so is necessary to provide the services.

10. Your Obligations

As controller, you are responsible for:

• having a lawful basis for the personal data you collect, and for the transparency information given to your customers — your own privacy policy and cookie notice
• the accuracy and lawfulness of any personal data you provide to us or instruct us to process
• responding to data subject rights requests, and deciding on regulator notification after a breach
• registering with the Information Commissioner's Office and paying the data protection fee, where your organisation is required to
• not sending us special category or criminal offence data without agreeing it in writing first

11. Liability and Term

Liability under this DPA is subject to the limitations and exclusions in section 20 of the Terms.

This DPA takes effect when you accept the Terms and continues for as long as we process personal data on your behalf. Sections 4.7, 7, 8 and 11 survive its end.

Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

12. Contact

Data protection queries, breach notifications and audit requests:
Dalton Digital Limited
Email: contact@daltondigital.co.uk
Company No: 15930308