Data processing agreement

1. The parties

The Processor is Ashburn Stone Ltd, a company registered in England and Wales (company number 17450849), of The Old Fire Station, Salt Lane, Salisbury, SP1 1DU, United Kingdom. Registered with the Information Commissioner’s Office under registration number ZC235282. Contact for data protection matters: hello@ashburnstone.co.uk or 01722 568 062.

The Controller is the client identified in the Principal Agreement (the accepted quote, contract, or ongoing engagement to which this DPA is attached).

2. Definitions

Terms used in this DPA have the meanings given in the UK GDPR. In particular, “Personal Data”, “Data Subject”, “Processing”, “Controller”, “Processor”, “Sub-processor”, “Personal Data Breach”, and “Supervisory Authority” have the meanings set out in Article 4 of the UK GDPR. “Services” means the services provided by the Processor to the Controller under the Principal Agreement. “Applicable Data Protection Law” means the UK GDPR, the DPA 2018, the Privacy and Electronic Communications Regulations 2003 (as amended), and any other data protection law applicable in the United Kingdom.

3. Subject matter and duration

The subject matter of the processing is the provision of the Services under the Principal Agreement. This DPA takes effect on the earlier of (a) the date the Principal Agreement takes effect, or (b) the date on which the Processor first begins processing Personal Data on behalf of the Controller. It continues for as long as the Processor processes Personal Data on the Controller’s behalf, and any obligations that by their nature survive termination (including return or deletion of data, confidentiality, and liability) will continue to apply after termination.

4. Nature and purpose of processing

The Processor processes Personal Data for the purpose of delivering the Services agreed between the parties, which may include: designing, building, maintaining, and hosting websites; providing IT support and system administration; managing email, backup, and productivity systems; providing accounting or invoicing tools; answering telephone calls and website chats on the Controller’s behalf using an automated assistant; backing up the Controller’s devices and managing anti-virus on them; and providing any other service described in the Principal Agreement.

The nature of the processing includes collection, storage, retrieval, organisation, consultation, use, transmission, backup, and deletion of Personal Data, in each case only to the extent needed to deliver the Services.

5. Types of personal data and categories of data subjects

The Personal Data processed under this DPA may include: names, email addresses, telephone numbers, postal addresses, job titles, login credentials, IP addresses, device identifiers, usage and log data, uploaded files and their contents, call audio, call transcripts and summaries, website chat transcripts, and any other Personal Data contained in systems, websites, mailboxes, or files that the Controller asks the Processor to work on.

The categories of Data Subject may include: the Controller’s employees, contractors, customers, prospective customers, suppliers, website visitors, mailing list subscribers, and any other individuals whose Personal Data is contained in the systems or content the Processor is engaged to work on.

The Controller acknowledges that the exact scope of Personal Data processed will depend on the specific Services and on the content and systems the Controller shares with the Processor. The Controller is responsible for ensuring it is entitled to share that data with the Processor and that a lawful basis under UK GDPR exists for the processing.

6. Processor’s obligations

The Processor will process Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data to a country outside the United Kingdom, unless required to do so by applicable law. If the Processor is required by law to process Personal Data other than on the Controller’s instructions, it will notify the Controller of that legal requirement before processing (unless the law prohibits such notification on important grounds of public interest).

The Principal Agreement (including any accepted quote, statement of work, or written instruction from the Controller) constitutes the Controller’s documented instructions. Additional or changed instructions must be given in writing (email is sufficient). If the Processor considers that an instruction infringes Applicable Data Protection Law, it will inform the Controller and may suspend the affected processing until the matter is resolved.

The Processor will ensure that persons authorised to process the Personal Data have committed themselves to confidentiality (contractually or by statutory duty) and are trained on their data protection responsibilities. The Processor will not disclose Personal Data to any third party except as permitted under this DPA or as required by law.

The Processor will assist the Controller, taking into account the nature of the processing and the information available, in ensuring compliance with the Controller’s obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments, and prior consultation with the Supervisory Authority).

7. Security

The Processor will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

Those measures include, as a minimum: encryption of data in transit using industry-standard TLS; access controls limiting Personal Data to personnel who need it for the Services; use of unique credentials and multi-factor authentication where offered by systems handling client data; regular backups of systems the Processor manages; separation of client environments where technically appropriate; secure disposal of media containing Personal Data; and periodic review of the Processor’s security posture.

The Controller acknowledges that no system is entirely secure and that security is a shared responsibility. The Controller is responsible for the security of its own end-user devices, credentials, and internal processes, and for promptly notifying the Processor of any suspected compromise on its side.

8. Sub-processors

The Controller grants the Processor general authorisation to engage sub-processors to assist in providing the Services, subject to the conditions in this clause. A current list of authorised sub-processors, with what each processes and the transfer mechanism, is published at ashburnstone.co.uk/sub-processors and forms Schedule 1.

Before engaging a new sub-processor, or replacing an existing one, the Processor will give the Controller at least fourteen (14) days’ prior written notice (which may be given by email, by updating the published list in Schedule 1, or through the Client Portal). The Controller may object to the change on reasonable data-protection grounds within that notice period; if the parties cannot resolve the objection, either party may terminate the affected portion of the Services on written notice, and the Processor will refund any fees paid in advance for Services not yet delivered.

The Processor will enter into a written contract with each sub-processor that imposes data protection obligations no less protective than those in this DPA. The Processor remains fully liable to the Controller for the performance of each sub-processor’s data protection obligations.

9. Data subject rights

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller’s obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR (access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making).

If the Processor receives a request directly from a Data Subject relating to Personal Data processed on behalf of the Controller, the Processor will not respond to that request itself but will promptly forward it to the Controller for the Controller to handle. The Processor may acknowledge receipt of the request and inform the Data Subject that the Controller will respond.

10. Personal data breach notification

The Processor will notify the Controller without undue delay, and in any event within forty-eight (48) hours of becoming aware of a Personal Data Breach affecting the Controller’s Personal Data. The notification will include, so far as the information is available to the Processor: a description of the nature of the breach; the categories and approximate number of Data Subjects and records concerned; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects.

The Processor will cooperate with the Controller and provide reasonable assistance to enable the Controller to meet its own obligations under Articles 33 and 34 of the UK GDPR (notification of a breach to the ICO and to affected Data Subjects). Where information is not yet fully available, the Processor may provide information in phases as it becomes available.

Notification of a Personal Data Breach is not, in itself, an admission of fault or liability by the Processor.

11. Data protection impact assessments and prior consultation

The Processor will, taking into account the nature of the processing and the information available, provide the Controller with reasonable assistance in carrying out any Data Protection Impact Assessment (“DPIA”) required under Article 35 of the UK GDPR, and any related prior consultation with the ICO under Article 36, in each case only in respect of processing carried out by the Processor on the Controller’s behalf. Extensive DPIA support may be chargeable at the Processor’s standard rates and will be scoped separately.

12. International transfers

Some of the Processor’s authorised sub-processors are established outside the United Kingdom. Where Personal Data is transferred outside the UK, the Processor will ensure that an appropriate transfer mechanism is in place under the UK GDPR — for example, a UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — before the transfer takes place. Schedule 1 identifies the location of each sub-processor and the transfer mechanism relied upon where the sub-processor is outside the UK.

The Controller instructs the Processor to make such transfers under the mechanisms identified in Schedule 1 for the purposes of delivering the Services.

13. Return or deletion of data on termination

Upon termination of the Services (or earlier at the Controller’s written request), the Processor will, at the Controller’s choice, either return all Personal Data to the Controller in a commonly used electronic format, or delete the Personal Data from the Processor’s active systems, in each case within thirty (30) days of the request. The Processor may retain Personal Data (a) to the extent required by law, (b) in routine encrypted backups until those backups expire in the ordinary course, and (c) in archived records reasonably needed to defend legal claims — in each case subject to the ongoing confidentiality and security obligations in this DPA.

The Processor will confirm deletion in writing on request.

14. Audits and records

The Processor will maintain records of processing activities carried out on behalf of the Controller as required by Article 30(2) of the UK GDPR. On written request, and no more than once in any twelve-month period (except where required following a Personal Data Breach or by the ICO), the Processor will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA.

If the Controller reasonably requires an audit beyond the information the Processor makes available, the parties will agree the scope, timing, and duration of the audit in advance. Audits will be conducted during normal business hours, on reasonable notice, in a manner that does not disrupt the Services or breach the confidentiality of other clients, and at the Controller’s cost (except where the audit reveals material non-compliance by the Processor).

15. Liability

The Processor’s total aggregate liability to the Controller arising out of or in connection with this DPA, whether in contract, tort (including negligence), or otherwise, is subject to the liability provisions in the Principal Agreement. Nothing in this DPA excludes or limits liability that cannot lawfully be excluded or limited, including liability for administrative fines imposed directly on a party by the ICO where such fines cannot be shifted contractually.

Each party is responsible for the administrative fines imposed on it by a Supervisory Authority to the extent those fines relate to that party’s own acts, omissions, or non-compliance.

16. Governing law and jurisdiction

This DP

Schedule 1 — Sub-processors

The Processor’s current sub-processors, what each processes, where, and the transfer mechanism used, are published at ashburnstone.co.uk/sub-processors. That list forms this Schedule, and the Processor updates it in accordance with clause 8. A copy as at any date is available to the Controller on request.

he United States.

Support tickets and client records are held on infrastructure operated by the Processor itself and are not passed to a third-party helpdesk provider.

Signature

This DPA is agreed by the Controller by (a) countersignature below, (b) acceptance of a quote or Principal Agreement that references or incorporates this DPA, or (c) continued receipt of the Services after the Controller has been notified that this DPA applies.

---

Questions about this agreement? Call us on 01722 568 062 or email hello@ashburnstone.co.uk.