Data Processing Addendum (summary)
Effective date: 12 October 2026
When we handle personal data for a client, for example by running a platform, operating campaigns or building AI systems on the client's data, the client is the controller and we are the processor. Our standard Data Processing Addendum (the "DPA") is part of every statement of work (an "SOW") that involves this kind of work. It is written to meet Article 28 of UK GDPR. If a project involves personal data from the European Union, it covers the EU GDPR too. Here is what it commits us to.
What each project records
Each SOW records what the processing is about and how long it lasts, what we do with the data and why, the types of personal data involved, and the people it relates to.
Your instructions
We process personal data only on your documented instructions, including on any transfer outside the UK, and for the purposes in the SOW, never for our own. If we believe an instruction breaks data protection law, we will tell you.
Confidentiality
Everyone on our team who handles your personal data is bound by confidentiality.
Security
We use technical and organisational measures that match how sensitive the data is, as Article 32 of UK GDPR requires. These include encryption in transit (and at rest wherever the platform supports it), access limited to the people who need it, separate environments for development and live systems, activity logging, and secure coding and review practices.
AI systems
Where a project uses AI models, we record which providers are used, where they process the data and whether their contract terms allow them to use it for training. We choose providers whose terms rule out training on your data unless you instruct otherwise, and we help you with any data protection impact assessment the system needs.
Sub-processors
We use carefully chosen sub-processors, such as cloud hosting, AI model and communications providers, under written terms that protect the data at least as well as our DPA. We keep a current list for each client, showing where each one processes data and the transfer safeguard used. We tell you before we add or replace one, and you may object on reasonable grounds. We stay responsible for the work our sub-processors do.
Helping you meet your duties
We help you respond when people exercise their rights, and with security, breach notifications, data protection impact assessments and any consultation with the Information Commission's Office (ICO), as far as the nature of our work allows.
Breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, give you the information you need for your own notifications and work with you to contain it.
Transfers outside the UK
If your personal data needs to leave the UK, we use a safeguard UK law recognises: UK adequacy regulations, including the UK-US data bridge where it applies, or the ICO's International Data Transfer Agreement or the UK Addendum, after a transfer risk check. We record the safeguard in the SOW.
When the work ends
We return or delete your personal data, as you choose, unless the law requires us to keep it, and we confirm deletion in writing if you ask.
Audits
We give you the information you need to show compliance, such as documentation and security summaries, and allow audits on reasonable notice and confidentiality terms.
Getting the full DPA
To sign the full DPA for your project, ask us through the contact form or by phone. It comes with every SOW that involves processing personal data.