This Data Processing Agreement ("DPA") forms part of my Terms of Service and applies whenever I process personal data on your behalf while providing my services. It's written to meet Article 28 of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

1.Who's who

• You are the controller of the personal data your website collects or stores, such as messages from your contact form, bookings, customer accounts or chat conversations. You decide why and how it's used.
• I, Charlie Jacklin trading as Charlie's Websites, am your processor for that data. I only handle it to provide my services to you.

This DPA doesn't cover the personal information I collect about you as my client, such as your name, email and billing details. For that I'm the controller, and my Privacy Policy explains how I use it.

2.What I process and why

• Subject matter: hosting, maintaining, supporting and backing up your website and any add-ons you choose.
• Duration: for as long as I provide services to you, plus the period afterwards described in "When our agreement ends" below.
• Nature and purpose: storing, hosting, transmitting, backing up, and, when you ask me to or when it's needed to fix a problem, viewing or changing the data, so your website and its features work.
• Types of personal data: whatever your website collects, which typically includes names, email addresses, phone numbers, postal addresses, booking details, messages, account details for your website's users, and technical data such as IP addresses.
• People the data is about: your website's visitors, customers, enquirers, users and your own staff.
• Special category data: you shouldn't use your website to collect special category data (such as health information) or criminal offence data unless we've agreed it in writing first, so we can put the right protections in place.

3.My obligations

I will:

• Follow your instructions. I only process the personal data on your documented instructions, which are these terms, the features you choose, and anything you ask me to do in writing, including through your portal. If the law requires me to process it in another way, I'll tell you first unless the law forbids that. If I think an instruction breaks data protection law, I'll tell you.
• Keep it confidential. I don't share the personal data with anyone except the sub-processors listed below, or where the law requires it. Anyone I allow to access it is bound by confidentiality.
• Keep it secure. I take appropriate technical and organisational measures, as required by Article 32 of the UK GDPR, described in "Security" below.
• Help you with people's rights. If someone asks to see, correct, delete or move their data, or objects to how it's used, I'll help you respond, within a reasonable time. If someone contacts me directly about data you control, I'll pass their request to you and won't respond myself unless you ask me to.
• Help you meet your own obligations, including on security, breach notification, data protection impact assessments and consultations with the Information Commissioner's Office, taking into account the information available to me.
• Tell you about breaches. If I become aware of a personal data breach affecting your data, I'll tell you without undue delay, and in any case within 48 hours, with the information I have about what happened, the data affected, the likely consequences and what I'm doing about it. I'll keep you updated as I learn more.
• Show you I'm meeting this DPA. I'll give you the information you reasonably need to show that I'm meeting these obligations. If that isn't enough, I'll allow and contribute to an audit or inspection by you, or an auditor you choose who is bound by confidentiality, at a reasonable time and with at least 30 days' notice. You'll cover the reasonable costs of an audit unless it shows I've seriously broken this DPA.

4.Sub-processors

You give me general permission to use other providers ("sub-processors") to help provide my services. The current ones are:

• Lovable (Lovable Labs Inc.): the platform my client portal and websites are built and hosted on, including its cloud database and file storage (provided through Supabase) and its email sending.
• Cloudflare, Inc.: network and hosting infrastructure used by the platform, to deliver websites quickly and protect them from attacks.
• Resend, Inc.: receiving email replies to support tickets.
• Stripe Payments Europe, Ltd. and Stripe, Inc.: processing payments, where your website takes payments through Stripe. Stripe also acts as a controller for some payment data under its own terms.

Your website may use other providers you choose, such as a booking or chat service. If so, I'll tell you who they are when we set them up.

Before I add or replace a sub-processor, I'll give you at least 30 days' notice by email. If you have a reasonable data protection objection, tell me within that time. If we can't resolve it, you can end the affected service without paying anything more for it.

I'll put a written contract in place with each sub-processor that gives your data the same level of protection as this DPA, and I'm responsible to you for their performance.

5.International transfers

Some of my sub-processors are based in, or process data in, the United States or other countries outside the UK. Where personal data is transferred outside the UK, I make sure it's protected by a UK adequacy regulation (such as the UK Extension to the EU-US Data Privacy Framework, where the provider has signed up to it) or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6.Security

The measures I take include:

• encryption of data in transit (HTTPS) and at rest, provided by my hosting and database providers;
• two-step sign-in for every account on my client portal, including mine;
• access to data limited to what each person needs, enforced in the database;
• keeping software and dependencies up to date and applying security fixes promptly;
• daily backups, kept for about 14 days, so data can be restored if something goes wrong;
• choosing providers with recognised security standards, such as SOC 2 or ISO 27001.

I review these measures regularly and update them as risks and technology change.

7.Your obligations

You're responsible for:

• having a lawful basis for collecting and using personal data through your website;
• telling your website's visitors how you use their data, for example in your own privacy notice, which I can help you put on your website;
• making sure your instructions to me follow data protection law.

8.When our agreement ends

When our agreement ends, I keep your website and its data for 30 days, so you can ask for a copy or change your mind. During that time, you can ask me to return the personal data to you in a common format, or to delete it straight away.

After 30 days, I delete the personal data, including from my systems and those of my sub-processors, unless the law requires me to keep it. Backups are overwritten in their normal cycle, within about a further 14 days.

9.Liability

Each of us is responsible for our own compliance with data protection law. The limits on liability in my Terms of Service apply to this DPA, except where the law doesn't allow them to.

10.Changes and conflicts

I may update this DPA to reflect changes in the law, my services or my sub-processors. I'll tell you at least 30 days before changes take effect, and ask you to accept the new version.

If this DPA and my Terms of Service conflict on anything to do with personal data, this DPA wins.

11.Contact

For anything about this DPA or your data, contact me at support@charlieswebsites.co.uk.