Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of any agreement for services between Wolfstone Digital Ltd (company number 17114983, registered office Greenwood House, Greenwood Court, Bury St. Edmunds IP32 7GY) ("we", "us") and a client ("you") that incorporates it by reference. It applies where we process personal data on your behalf as processor under UK GDPR Article 28 in the course of delivering the services. Terms defined in UK GDPR have the same meaning here.

1. Roles and scope

For personal data we process on your behalf under the services, you are the controller and we are the processor. This DPA does not apply to personal data we process as controller (such as your team's contact details, covered by our privacy notice), or to data processed by your own website after handover, for which you are the controller.

2. Details of processing

• Subject matter: personal data processed in delivering the agreed services (for example website builds, hosting and analytics configuration, migrations, marketing services).
• Duration: the term of the agreement, plus any agreed handover period.
• Nature and purpose: development, configuration, testing, migration, support and marketing services as described in the agreement.
• Categories of data: typically names, contact details, form submissions, account data and analytics identifiers. We do not expect to process special category data; tell us before the engagement starts if the services will involve it.
• Data subjects: your customers, prospects, website visitors and staff.

3. Our obligations as processor

We will:

• process personal data only on your documented instructions (which include the agreement), unless required by law, in which case we will inform you unless legally prohibited;
• ensure persons authorised to process the data are bound by confidentiality obligations;
• implement appropriate technical and organisational security measures, including access controls, encryption in transit and credential management via a secure vault;
• assist you, taking into account the nature of the processing, with data subject requests and with your obligations under UK GDPR Articles 32 to 36;
• notify you without undue delay after becoming aware of a personal data breach affecting your data;
• at your choice, delete or return the personal data at the end of the services, and delete existing copies unless the law requires storage;
• make available the information reasonably necessary to demonstrate compliance with this DPA, and allow and contribute to audits conducted with reasonable notice, no more than once per year, during business hours and at your cost.

4. Sub-processors

You give general written authorisation for our use of sub-processors. Our current sub-processors are:

We will update this table before adding or replacing a sub-processor and will notify active clients of material changes by email. You may object on reasonable grounds within 14 days of notice. We impose data protection obligations on sub-processors equivalent to those in this DPA and remain responsible for their performance.

5. International transfers

We will not transfer your personal data outside the UK unless a lawful transfer mechanism applies (adequacy regulations, the ICO's International Data Transfer Agreement or Addendum, or another valid safeguard).

6. Liability and updates

Liability under this DPA is subject to the limitations and exclusions in the agreement that incorporates it, to the extent permitted by data protection law. We may update this DPA from time to time; updates will not materially reduce the protections it gives you, and the version in force is the one published here at the date in question. Previous versions are available on request.

We are registered with the Information Commissioner's Office under registration ZC187374. Questions: hello@wolfstone.digital.