Data processing agreement

Which of us is which

For the data on your website, you are the controller and we are the processor: we act only on your documented instructions and never use your data for our own purposes.

What we may come into contact with

We do not go looking for your customer data, but maintaining a website means being able to reach it. In practice that can include:

• contact form submissions and enquiries stored in your site
• customer accounts, orders and addresses on an ecommerce site
• names and email addresses in your CMS user list
• anything visible in a database backup

Sub-processors

We use a small number, and we tell you before adding one:

• Our VPS provider, for the monitoring infrastructure — EU region.
• Our backup storage provider — encrypted at rest, EU region, separate from your hosting.
• Your own hosting provider remains yours; we do not sit between you and them.

How it is protected

Least-privilege accounts rather than shared logins. All credentials in an encrypted password manager with two-factor authentication — never in email, chat or a spreadsheet. Backups encrypted at rest and stored in the EU. Access over encrypted connections only. Anything beyond passive checking — active security testing — happens only with your written authorisation.

When it ends

On termination we delete our copies and remove our accounts, and confirm both in writing within 5 working days. Backups age out on their normal retention schedule and are not kept beyond it.

If something goes wrong

If we become aware of a personal data breach affecting your data, we tell you without undue delay and with what we know at the time — not after we have finished investigating. You are the one with the reporting obligation, so you need the facts early rather than tidily.