Data Processing Addendum

You are the Controller and determine the purposes of processing; we are the Processor and act only on your documented instructions. We process personal data solely to provide the engaged services (web engineering, AI automation, and security/compliance work).

Depending on the engagement we may process contact details, account data, usage and log data, and any content within systems we are retained to build or audit. Special-category data is processed only where expressly agreed.

We engage the following sub-processors, each under contract:

We maintain technical and organisational measures including encryption in transit (TLS 1.3), least-privilege access with MFA, hardened application controls, rate limiting, audit logging, and a tested incident-response process. Details are on our Trust Center.

We will notify you without undue delay — and within 72 hours where feasible — after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.

We will assist you in responding to access, correction, deletion, and portability requests, and implement such requests on your instruction where the data sits in systems we operate.

Where personal data is transferred outside its origin region, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) and the sub-processor commitments above.

On termination, we will return or delete personal data at your choice, save where retention is required by law.

We will make available the information necessary to demonstrate compliance and allow for reasonable audits, subject to confidentiality.

To execute this DPA, contact us via our contact page and we'll send a countersigned version.