1. About this agreement
1.1 This Data Processing Agreement (DPA) forms part of every studio agreement between Underdown Labs Limited (company number 17251214, trading as UF Labs) and its client (the Client) for websites, hosting, forms, email, client portals, booking, shop and related services (the Agreement).
1.2 It sets out how UF Labs handles personal data on the Client's behalf, as required by Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.3 If this DPA and the Agreement conflict on data protection, this DPA wins. Otherwise the Agreement applies as normal.
1.4 UF Labs may update this DPA to reflect changes in law or in how the services are delivered. We will give the Client at least 30 days' notice by email or through the client portal. An update cannot reduce the protection given to Client Personal Data unless the Client agrees in writing.
2. Roles
2.1 The Client is the controller of personal data collected through its website and services (Client Personal Data). UF Labs is the Client's processor.
2.2 The Client is responsible for having a lawful basis for collecting Client Personal Data, for its privacy notice and cookie choices, and for its own ICO registration where required.
2.3 Where UF Labs uses the Client's own details to run the relationship, for example billing, contracts and support, UF Labs does so as a separate controller under its own privacy notice.
3. Details of the processing
- Subject matter: providing the services in the Agreement, including hosting the Client's website, receiving and delivering form submissions, sending service emails, running client portals, and booking or shop features where included.
- Duration: for the term of the Agreement, plus the return and deletion period in clause 9.
- Nature and purpose: hosting, storage, transmission, email delivery, backup, support and security monitoring, only so the services work as agreed.
- Types of personal data: names and contact details; the content of enquiries and any information people choose to include, such as details about their pets; newsletter sign-ups and preferences; booking, order and account details where those features are used; website analytics data where a visitor has consented; and technical data such as IP addresses and server logs.
- People the data is about: visitors to the Client's website, people who contact the Client, the Client's customers and newsletter subscribers.
- Special category data: the services are not designed to collect it. The Client will not ask for it through UF Labs forms or features unless the parties agree extra safeguards in writing first.
4. How UF Labs handles Client Personal Data
4.1 Instructions. UF Labs processes Client Personal Data only on the Client's documented instructions. The Agreement, this DPA and the way the Client configures its services are those instructions; the Client may give further instructions by email or through the client portal. UF Labs will tell the Client if it believes an instruction breaks data protection law, and will process data otherwise only where the law requires it, telling the Client first unless the law forbids that.
4.2 Confidentiality. Only people who need access to provide the services can access Client Personal Data, and they are bound by confidentiality.
4.3 Security. UF Labs keeps appropriate technical and organisational measures in place to protect Client Personal Data, taking into account the risk. These include encrypted connections (HTTPS) for websites, forms and portals; access to systems limited to those who need it; database access controls; keeping passwords and keys out of website code; keeping software up to date; and using providers with recognised security standards.
5. Providers (sub-processors)
5.1 The Client gives UF Labs general authorisation to use other companies to help provide the services (providers). The current list, with what each one does and where it stores data, is published at uflabs.co.uk/legal/providers.
5.2 UF Labs will tell the Client at least 30 days before adding or replacing a provider that will handle Client Personal Data, by email or through the client portal. The Client may object on reasonable data protection grounds within that period. The parties will then work in good faith to find a solution. If they cannot, the Client may end the affected services without any early termination charge.
5.3 UF Labs only uses providers that give sufficient guarantees to meet UK GDPR, under a written contract with data protection terms that are no less protective than this DPA. UF Labs remains responsible to the Client for its providers.
6. Transfers outside the UK
6.1 UF Labs will only transfer Client Personal Data outside the UK where it is protected as UK law requires: to a country the UK recognises as adequate (including the EU and EEA), under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or to a US organisation certified under the UK-US Data Bridge.
7. Helping the Client
7.1 People's rights. If UF Labs receives a request from someone exercising their data protection rights about Client Personal Data, it will pass it to the Client promptly and will not answer it directly unless the Client asks. UF Labs will help the Client respond, for example by finding, exporting, correcting or deleting records held in the services.
7.2 Other obligations. UF Labs will give the Client reasonable help with security, breach notification, data protection impact assessments and any consultation with the ICO, taking into account the nature of the processing and the information available to UF Labs.
8. Personal data breaches
8.1 UF Labs will tell the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. It will give the information it has about what happened, the data and people likely to be affected, and the steps taken, and will update the Client as it learns more, so the Client can meet its own reporting duties.
9. Retention, return and deletion
9.1 During the Agreement, UF Labs will delete Client Personal Data held in the services in line with the Client's documented retention instructions.
9.2 When the Agreement ends, the Client can ask for an export of its Client Personal Data within 30 days. UF Labs will then delete it from the live services, unless the law requires it to be kept. Copies in backups are deleted as those backups expire on their normal cycle and are not restored in the meantime except to recover from an incident.
10. Information and audits
10.1 UF Labs will make available the information the Client reasonably needs to show that this DPA is being followed, including answering reasonable security and data protection questionnaires.
10.2 Where that information is not enough, the Client or an auditor it appoints (who is bound by confidentiality) may carry out an audit on at least 30 days' notice, during business hours, no more than once a year unless there has been a breach or a regulator requires it. Each party pays its own costs.
11. Liability and law
11.1 Liability under this DPA is subject to the limits in the Agreement, except where the law does not allow liability to be limited.
11.2 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.