Your data,handled with care.

01 —

Scope

This Data Processing Addendum (“DPA”) forms part of the agreement between Performative Web and each client (“you”) for our services, including website and app development, CRM development and migration, AI automation, SEO and digital marketing.

It applies whenever we process personal data on your behalf to deliver those services. You are the controller and we are the processor. It doesn’t cover data we collect for our own purposes, such as enquiries through our website; our Privacy policy covers that.

02 —

Details of processing

The statement of work for each project records the specifics. In general:

• Subject matter — the personal data we need to build, migrate, host, support or market your products
• Duration — the term of the agreement, plus any period needed to return or delete data
• Nature and purpose — development, testing, data migration, hosting, support and campaign delivery
• Types of data — usually contact, account, order and usage data held in your systems
• Data subjects — your customers, users, leads, employees and contractors

You confirm that you have a lawful basis for the data you give us, and that you won’t ask us to process special category data unless we have agreed it in writing.

03 —

Our obligations

When we process personal data for you, we will:

• Process it only on your documented instructions, and tell you if we think an instruction breaks data protection law
• Make sure everyone with access is bound by confidentiality
• Help you respond to data subject requests and carry out impact assessments where needed
• Notify you of any personal data breach without undue delay, and within 48 hours of becoming aware of it
• Not sell your data, use it to train AI models, or use it for any purpose of our own

04 —

Security

We use appropriate technical and organisational measures, including encryption in transit, multi-factor authentication on the tools that hold your data, least-privilege access, separate development and production environments wherever the project allows, and prompt removal of access when a project or engagement ends.

We use test or anonymised data during development wherever we can, and only work with live personal data when the task requires it.

05 —

Sub-processors

You authorise us to use sub-processors such as cloud hosting, email and collaboration providers. The sub-processors for your project are listed in the statement of work or are available on request.

We bind every sub-processor to data protection terms at least as protective as this DPA and remain responsible for their work. We will give you at least 14 days’ notice before adding or replacing one, and you may object on reasonable data protection grounds.

06 —

International transfers

We are a remote-first team, so personal data may be accessed or processed outside your country. Where personal data from the UK, EU or EEA goes to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another valid transfer mechanism.

07 —

Audits

We will give you the information you reasonably need to show compliance with this DPA. You may audit our compliance, or appoint an independent auditor bound by confidentiality, once a year with at least 30 days’ written notice, or sooner after a personal data breach.

08 —

Return and deletion

When the services end, we will return your personal data or delete it, as you choose, within 30 days, including copies held by our sub-processors. We only keep data longer where the law requires it, and then only for as long as it requires.

09 —

US privacy laws

Where the CCPA or a similar US state law applies, we act as your service provider. We won’t sell or share the personal information you give us, retain or use it outside our direct business relationship with you, or combine it with personal information from other sources, except as those laws allow.

10 —

Liability and precedence

Each party’s liability under this DPA is subject to the limits in the main agreement. If this DPA conflicts with the main agreement on data protection, this DPA wins.

11 —

Contact

To request a signed copy of this DPA, the sub-processor list for your project, or our standard contractual clauses, email privacy@performativeweb.com.