Processor: Technophobia Ltd (Company No. 14898332, VAT GB 495 7043 58), 13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom. hello@technophobia.uk · +44 1229 774591

Controller: The Customer named in the main agreement or SoW.

Terms used here have the meanings in UK GDPR and the Data Protection Act 2018.

• Subject matter: automation, integration, monitoring, support, and related services described in the SoW.
• Duration: the term of the services plus any exit period.

Processing may include collecting, receiving, storing, organising, adapting, transmitting, restricting, deleting, or otherwise handling data to run agreed workflows, integrations, notifications, reports, and tests.

• Personal data: names, emails, phone numbers, role, account IDs, order/booking details, message content, workflow logs and metadata.
• Special categories: not intended. Do not include unless we both agree controls in writing.
• Data subjects: your staff, prospects, customers, suppliers, and partners.

• We process personal data only on your documented instructions: the agreement, SoW, tickets, and your written requests.
• If an instruction appears unlawful, we will tell you.

• We keep personal data confidential.
• Staff and contractors are bound by confidentiality and receive appropriate training.
• Access is on a least-privilege basis.

We will implement the technical and organisational measures in Schedule B and any extra measures in the SoW, taking account of risk, state of the art, and costs.

• We may use sub-processors listed at /sub-processors and any project-specific ones named in the SoW.
• We put written terms in place with sub-processors that protect personal data to a similar level.
• You authorise our use of sub-processors for the services. You may object on reasonable grounds; we will discuss options.

If personal data leaves the UK, we will use a valid transfer tool (e.g., UK IDTA, UK Addendum to EU SCCs, or adequacy). We will apply supplementary measures where needed.

• We help you respond to data subject requests that relate to our processing.
• We assist with security, breach notices, impact assessments, and consultations to the extent relevant to our services.

• If we become aware of a personal data breach in systems we control, we will notify you without undue delay.
• We will share known details, mitigation steps, and a contact point. Notifications are not admissions of fault.

• We keep records of processing we carry out for you.
• On reasonable notice, we will provide information needed to show compliance. Where a formal audit is required, we agree scope, timing, and confidentiality first.

• On end of services, at your choice we delete or return personal data held in systems we control, unless law requires retention.
• We may keep minimal logs and billing records as required by law.

• You have a lawful basis for personal data you ask us to process.
• You do not send special category data unless agreed in writing with controls.
• You keep your own systems and consents in order.

• Liability follows the caps and exclusions in the main agreement.
• If there is a conflict, this DPA controls for data topics, then the main agreement.

English law governs this DPA. The courts of England and Wales have exclusive jurisdiction.

• Access control: MFA on admin accounts; least-privilege roles; access reviews; separate client workspaces.
• Secrets: stored outside code; restricted access; rotation on change.
• Network and host security: hardened hosts; firewalls; patched OS; restricted inbound access; TLS for data in transit.
• Application security: code review for risky changes; environment separation; rollback steps; change logs.
• Monitoring and logging: health checks; alerting on failures; log retention 30–90 days unless agreed otherwise.
• Backups and DR: backups for hosted components; periodic restore tests; documented RTO/RPO where relevant.
• Supplier due diligence: contract terms with sub-processors; review of locations and controls; short data retention where practical.
• Personnel: confidentiality commitments; training; joiner/mover/leaver checks.
• Data minimisation: restrict fields; mask test data; avoid special category data unless agreed.
• Incident response: internal playbooks; rapid containment; client notice without undue delay.

Current providers are listed at /sub-processors. Project-specific providers appear in the SoW.

• UK IDTA or UK Addendum to EU SCCs as applicable.
• Adequacy decisions where available.
• Supplementary measures based on risk (e.g., encryption in transit, limited retention, regional processing).

Privacy contact: hello@technophobia.uk · +44 1229 774591
Technophobia Ltd, 13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom.