Data Processing

We are the controller for the personal data we collect about you through this website, which is covered by our privacy policy. We are a processor when we handle personal data on your behalf, on your instructions, in a system we build or host for you. The distinction matters because it decides who is accountable to the regulator and who owes duties to the individuals concerned. Where we are a processor, you remain the controller, you decide the purposes, and we do not use the data for anything of our own.

This applies to the services where your customers’ or staff’s data passes through something we run.

• Website hosting, including any enquiry form, account area, booking system or ecommerce checkout we build.
• Business email hosting, including migrations between providers.
• Cloud infrastructure we deploy or manage for you.
• Any bespoke application or internal tool we build and operate on your behalf.
• Support and maintenance work where we need access to a live system containing personal data.

Where we act as your processor, the written agreement between us must contain the terms UK GDPR Article 28 requires. In plain terms, these are the commitments you are entitled to hold us to.

• We process your data only on your documented instructions, and never for our own purposes.
• Everyone with access is bound by a duty of confidentiality, and access is limited to those who need it for the work.
• We apply appropriate technical and organisational security measures, and we will describe them to you.
• We do not engage a sub-processor without telling you, and we remain responsible for its performance.
• We assist you in responding to requests from individuals exercising their rights.
• We notify you without undue delay if we become aware of a personal data breach affecting your data, so that you can meet your own reporting duties.
• We help you meet your obligations on security, breach notification and data protection impact assessments.
• At the end of the engagement we return or delete your data, at your choice, and we do not hold it back.
• We allow you to audit our compliance, and we make the information you need available.

If you are a client or in procurement with us and you need the data processing agreement, a description of our security measures, or answers to a supplier due diligence questionnaire, email [email protected] and tell us what your process requires. We would rather deal with this at the start of an engagement than retrofit it later.

We rely on a small number of providers to deliver hosting, email and infrastructure. These are listed on our suppliers and sub-processors page, which is the same list we will name in any processing agreement. If you object to a particular sub-processor, tell us before the engagement begins so we can discuss whether the work is possible without it.

We aim to keep client data within the United Kingdom or the European Economic Area, and we will confirm the location for your specific systems before an engagement starts. Where a provider processes data outside those areas, the transfer is covered by one of the safeguards UK law permits, such as the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses.

Every system we host carries security assurance as part of the engagement rather than as an extra: patching, monitoring, tested backups and least-privilege access. We describe this in our services rather than certifying to a standard, and we will not claim a certification we do not hold. If your procurement process requires a specific certification, tell us early and we will be straight with you about whether we hold it.