Data processing agreement

1. Words we use

Words such as controller, processor, personal data, processing, data subject and personal data breach have the meaning they have in the UK GDPR.

"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any law that amends or replaces them.

The Information Commission is the UK data protection regulator. It took over from the Information Commissioner on 30 September 2026 and is still known as the ICO.

"You" means the client who makes the Contract with us. "Client Personal Data" means the personal data we process on your behalf under the Contract.

If the EU GDPR applies to your processing, these terms apply to it too, read with Article 28 of the EU GDPR.

2. Who does what, and your obligations and rights

2.1 You are the controller of Client Personal Data. We are your processor.

2.2 When we use personal data for our own purposes, for example to run our website, to manage our relationship with you, to send invoices or to answer an enquiry, we are a controller. Our privacy notice explains that use. These terms do not cover it.

2.3 You make sure you have a lawful basis under Article 6 of the UK GDPR for the Client Personal Data you give us or ask us to process.

2.4 You give the people concerned the information Articles 13 and 14 of the UK GDPR require, including about the recipients of their data.

2.5 You make sure your instructions to us comply with Data Protection Laws, and you give us only the Client Personal Data we need to deliver the services.

2.6 Your rights under these terms are to give us instructions (clause 6), to be told about and object to new sub-processors (clause 9), to be told about personal data breaches (clause 11), to choose whether we delete or return Client Personal Data (clause 12), and to receive information and carry out audits (clause 13).

3. Subject matter and duration

We process Client Personal Data only to provide the services in the Contract. We do so for as long as the Contract lasts and, after it ends, only for the time needed to delete or return it under clause 12.

4. Nature and purpose

The processing is the collection, organisation, storage, retrieval, consultation, use, disclosure by transmission, restriction, erasure and destruction of personal data. We carry it out to deliver the work your order describes and to report to you on it. We process Client Personal Data for no other purpose, except where the law requires it (clause 6.1).

5. Types of personal data and people

The people whose data we may process are your customers, prospects, suppliers, employees, contractors and website visitors.

The types of personal data are identification data, contact data, employment data, technical data such as IP addresses and device details, transaction data, marketing preferences, and personal data published on your website that our reviews read. The Contract may list further types; they form part of this clause.

We do not process special category data (Article 9 of the UK GDPR) or criminal offence data (Article 10 of the UK GDPR) for you unless we have agreed it with you in writing first.

6. Your instructions

6.1 We process Client Personal Data only on your documented instructions, including about transfers of personal data to a third country or an international organisation, unless domestic law requires us to process it. In that case we tell you about that legal requirement before we process, unless that law forbids it on important grounds of public interest.

6.2 The Contract and these terms are your instructions. You can give further instructions in writing, including by email.

6.3 We tell you immediately if, in our opinion, an instruction infringes the UK GDPR or other domestic law relating to data protection.

7. Confidentiality

Everyone we authorise to process Client Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality. They process it only on your instructions, unless domestic law requires otherwise. We give access only to people who need it to deliver the services.

8. Security

We take all the measures Article 32 of the UK GDPR requires. Schedule 2 lists the measures in place today. We may change them, but not in a way that lowers the overall level of security.

9. Other processors (sub-processors)

9.1 We do not engage another processor without your prior specific or general written authorisation. You give us general written authorisation to engage the other processors listed in Part 1 of our sub-processor list at tamazia.co.uk/legal/sub-processors.

9.2 We tell you of any intended addition or replacement of another processor before it takes effect, so that you have the opportunity to object. We give you at least 30 days' notice. We send the notice to the email address you give us for notices.

9.3 If you object on reasonable data protection grounds, we will discuss it with you in good faith.

9.4 We impose on each other processor, by contract, the same data protection obligations as in these terms, in particular sufficient assurances that it will implement appropriate technical and organisational measures. If another processor fails to fulfil its data protection obligations, we remain fully liable to you for its performance of them.

10. Requests from individuals

Taking into account the nature of the processing, we help you by appropriate technical and organisational measures, insofar as this is possible, to respond to requests from people exercising their rights under Chapter III of the UK GDPR.

If someone contacts us directly about Client Personal Data, we pass the request to you without undue delay. We do not answer it ourselves unless you ask us to.

11. Security, breaches and impact assessments

11.1 Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of the UK GDPR. These cover security, telling the Information Commission and the people affected about a personal data breach, data protection impact assessments, and prior consultation with the Information Commission.

11.2 We notify you without undue delay after becoming aware of a personal data breach affecting Client Personal Data. In any event we notify you within 48 hours of becoming aware of it. We give you the information you need for your own notification, in stages if it is not all available at once.

11.3 You have your own duty to notify the Information Commission without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to people's rights and freedoms.

12. When the services end

At the end of the services, at your choice, we delete or return all Client Personal Data to you and delete existing copies, unless domestic law requires us to keep it. We do this within 30 days of the end of the services. If you have not told us your choice by then, we delete it.

13. Information and audits

We make available to you all information necessary to show that we meet our obligations under Article 28 of the UK GDPR, and we allow for and contribute to audits, including inspections, carried out by you or by an auditor you appoint. Please give us reasonable written notice of an audit. Any auditor must keep what it learns confidential.

14. International transfers

14.1 You instruct us to use the other processors in Part 1 of our sub-processor list. That list shows where each one processes personal data and what covers each transfer out of the UK. We make no other transfer of Client Personal Data out of the UK without your instructions.

14.2 A transfer to a country in the European Economic Area is covered by UK adequacy regulations. A transfer to a US organisation that takes part in the UK Extension to the EU-US Data Privacy Framework is covered by UK adequacy regulations for that transfer. We make any other restricted transfer of Client Personal Data only under standard data protection clauses issued under section 119A of the Data Protection Act 2018: the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU standard contractual clauses (the Addendum).

14.3 Before we rely on the IDTA or the Addendum, we check that the transfer meets the data protection test in Article 46 of the UK GDPR: that the protection after the transfer is not materially lower than in the UK.

14.4 Where the EU GDPR applies to a transfer, we make it only to a country or organisation covered by an adequacy decision of the European Commission, including a US organisation certified under the EU-US Data Privacy Framework, or under the EU standard contractual clauses, using the module for transfers from one processor to another.

14.5 If the EU GDPR applies to your transfer of Client Personal Data to us in the UK, that transfer is covered by the European Commission's adequacy decision for the United Kingdom.

15. Liability

The liability of each of us arising out of or in connection with these terms is governed by the Contract. Nothing in these terms excludes or limits any liability that cannot be excluded or limited by law.

16. If these terms and the Contract differ

If these terms conflict with the Contract on the protection of personal data, these terms prevail.

17. Form and start

These terms are in writing, including in electronic form, as Article 28(9) of the UK GDPR requires. They apply from the start of the Contract if the Contract includes them, or otherwise from the date both of us sign them.

18. Governing law and jurisdiction

These terms, and any dispute or claim arising out of or in connection with them or their subject matter, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.

Schedule 1: details of the processing

Clause 2 and clauses 3 to 5 set out the subject matter and duration of the processing, its nature and purpose, the types of personal data, the categories of data subjects, and your obligations and rights as controller, as Article 28(3) of the UK GDPR requires. The Contract may add to them for a particular engagement.

Schedule 2: security measures in place today

Article 32 asks for measures appropriate to the risk, including, as appropriate, encryption, the ongoing confidentiality, integrity, availability and resilience of systems, timely restoration after an incident, and regular testing. These are the measures we have in place today.

Part A: our website, its forms and our admin area

• Our website and its forms work only over encrypted HTTPS connections. Browsers are told to use HTTPS for two years, on every subdomain (HTTP Strict Transport Security).
• A Content Security Policy limits where scripts on our pages may load from, and browsers report breaches of that policy to us. Browsers also report a sample of failed network connections to us (Network Error Logging), so that we can spot faults.
• Our enquiry, briefing and audit request forms drop submissions that fill in hidden fields meant only for bots, or that arrive within two seconds of the form opening.
• Our forms ask Cloudflare Turnstile to check for bots and refuse a submission whose check has failed. Today a submission that carries no check result at all is still accepted, and it is marked as unverified.
• Our admin area and its data interfaces refuse any request that does not carry a valid Cloudflare Access sign-in or our admin key.
• We shorten IP addresses before we store them with an enquiry or briefing request: the last block of an IPv4 address is removed and an IPv6 address is cut to its first three blocks. Our database holds no more than a salted one-way hash of the address.
• Form records kept in Cloudflare Workers KV delete themselves two years after they are made.
• Links that let a person see, export or erase their data are signed and stop working after seven days.
• We keep a record of each erasure request we act on for seven years. The record holds a one-way hash of the email address, not the address itself.
• Messages that our payment and booking providers send to our systems are accepted only after their signature is checked.
• Only people who need Client Personal Data to deliver the services can reach it, and each of them is bound to confidentiality.
• Anyone can report a security weakness to us through our security policy.
• Our storage providers encrypt the data they hold for us at rest: Cloudflare states that everything stored in Workers KV and R2 is encrypted at rest, and Neon states that data on its storage is encrypted with AES-256.