DATA PROCESSING AGREEMENT (DPA)
This Data Processing Agreement (“Agreement”) forms part of the contract between Value Web Designs (“Processor”, “we”, “us”, “our”) and the Client (“Controller”, “you”, “your”) in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
1. Definitions
For the purposes of this Agreement:
– “Personal Data”, “Processing”, “Controller”, and “Processor” shall have the meanings given under UK GDPR.
– “Data Subject” means an identified or identifiable natural person.
– “Sub-processor” means any third party engaged by the Processor to process Personal Data.
2. Scope and Purpose of Processing
2.1 The Processor shall process Personal Data solely for the purpose of providing website design, hosting, and related services to the Controller.
2.2 The nature of processing may include collection, storage, organisation, retrieval, consultation, use, and deletion of Personal Data.
2.3 The categories of Data Subjects may include the Controller’s customers, website users, employees, or suppliers.
2.4 The types of Personal Data processed may include names, contact details, IP addresses, and any data submitted through the Controller’s website.
3. Obligations of the Controller
The Controller shall:
– Ensure that it has a lawful basis for processing Personal Data
– Provide all necessary privacy notices to Data Subjects
– Ensure that Personal Data provided to the Processor is accurate and lawful
– Comply with all applicable data protection laws
4. Obligations of the Processor
The Processor shall:
4.1 Process Personal Data only on documented instructions from the Controller.
4.2 Ensure that persons authorised to process Personal Data are subject to confidentiality obligations.
4.3 Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
4.4 Not use Personal Data for its own purposes.
4.5 Notify the Controller without undue delay if it believes an instruction infringes applicable data protection law.
5. Sub-Processors
5.1 The Controller authorises the Processor to appoint Sub-processors where necessary to deliver services (e.g. hosting providers, infrastructure services).
5.2 The Processor shall ensure that any Sub-processor is bound by data protection obligations no less protective than those set out in this Agreement.
5.3 The Processor remains fully liable for the acts and omissions of any Sub-processors.
6. Data Security
The Processor shall implement appropriate security measures, including but not limited to:
– Secure hosting environments
– Access controls and authentication measures
– Data encryption where appropriate
– Regular system monitoring
7. Personal Data Breach
7.1 The Processor shall notify the Controller without undue delay upon becoming aware of a Personal Data breach.
7.2 The notification shall include sufficient information to allow the Controller to meet its obligations under UK GDPR.
7.3 The Processor shall provide reasonable assistance in investigating and mitigating the breach.
8. Data Subject Rights
The Processor shall, to the extent reasonably possible, assist the Controller in responding to requests from Data Subjects exercising their rights under UK GDPR, including:
– Access requests
– Rectification or erasure
– Restriction or objection to processing
9. Data Retention and Deletion
9.1 Upon termination of services, the Processor shall, at the Controller’s choice, delete or return all Personal Data unless required to retain it by law.
9.2 A £50 website release fee applies where the Controller requests transfer of website files or migration services, subject to 14 days’ written notice.
10. International Transfers
The Processor shall not transfer Personal Data outside the United Kingdom unless:
– Appropriate safeguards are in place; and
– Such transfers comply with UK GDPR requirements
11. Audit and Compliance
11.1 The Processor shall make available information reasonably necessary to demonstrate compliance with this Agreement.
11.2 Audits may be conducted by the Controller upon reasonable notice and at the Controller’s expense.
12. Liability
Each party shall be liable for its own compliance with UK GDPR and applicable data protection laws.
The Processor’s liability shall be limited to the extent permitted by law and as set out in the main service agreement.
13. Term and Termination
This Agreement shall remain in effect for the duration of the services provided by the Processor to the Controller.
14. Governing Law
This Agreement shall be governed by and construed in accordance with the laws of England and Wales.
15. Contact Details
Value Web Designs