Data Processing Agreement

What we process, and why

• Subject matter: hosting, backing up, securing, and maintaining your platform.
• Duration: for as long as we host or manage the platform, plus the short wind-down period described under “When we stop” below.
• Nature and purpose: storage, backup, security scanning and patching, and keeping the platform running — nothing else, unless you instruct it.
• Types of personal data: whatever your own platform collects (for a typical business site, usually contact and enquiry details, account records, and order or customer data). You decide what your platform collects, not us.
• Categories of data subject: your customers, users, staff, and contacts — whoever interacts with your platform.

Our obligations to you

1. Only process on your instructions — your hosting or care-plan agreement is your standing instruction. If a law forces us to do something else, we’ll tell you first unless that law forbids it.
2. Keep it confidential — anyone with access is bound by confidentiality.
3. Keep it secure — appropriate technical and organisational measures, set out in Annex B below.
4. Use only approved sub-processors — the current list is in Annex A. We’ll give you advance notice before adding or replacing one, so you can object.
5. Help you meet data-subject requests — if one of your users asks to access, correct, or delete their data, we’ll help you respond within the legal timeframe.
6. Help you stay compliant — with security, breach handling, and data-protection impact assessments, taking into account what we know as your processor.
7. Tell you about a breach without undue delay — if we become aware of a personal-data breach affecting your platform, we’ll notify you promptly with the detail you need to meet your own duty to report to the ICO within 72 hours. You report to the ICO; we support you.
8. Return or delete your data when we stop — see “When we stop”.
9. Let you verify this — we’ll make available the information you reasonably need to show we’re meeting these obligations, and allow for an audit on reasonable notice.

Your obligations to us

You confirm that you have a lawful basis for the personal data your platform processes, that your instructions to us are lawful, and that you’ll tell us in advance if your platform will process special-category data (health, biometric, and similar) so we can agree any extra safeguards.

Where your data is held

Your platform is hosted in the UK (Fasthosts). Some sub-processors listed in Annex A may process limited data outside the UK; where that happens it’s covered by a UK-recognised safeguard — the UK International Data Transfer Agreement (IDTA) or Addendum, or the UK Extension to the EU-US Data Privacy Framework.

When we stop

When our hosting or management of your platform ends, you can request to leave from your client portal (or in writing), and we provide a full handover so you can run the platform elsewhere with nothing held back: your codebase, a database export, your files, and the relevant credentials and configuration your platform needs to run (such as connection strings and API keys), in usable, unencrypted form. This is described on our Support page. After you’ve confirmed receipt, we securely delete our copies — except anything we’re legally required to retain — and confirm deletion in writing on request.

Priority and liability

Where this agreement and our general Terms differ on data-protection matters, this agreement wins. Our overall liability remains subject to the limits in our Terms & Conditions.