Data processing agreement

This agreement is part of our Terms of service. It applies when we process personal data for you through our services: data in your websites, databases, files and mailboxes, such as your customers' details or form entries. It's what UK GDPR (Article 28) needs between a controller and a processor.

For that data, you're the controller: you decide what's collected and why. We're your processor: we handle it only to provide your services.

• Subject matter and purpose: hosting, storing, backing up and serving your websites and email, and sending email for you, for as long as you have the services;
• Types of data: whatever you or your visitors put in your sites and email, usually names, contact details, messages and orders;
• People it's about: your visitors, customers, staff and the people you email.

• we only process the data on your documented instructions, which are our terms, your orders and what you set in your services, unless the law requires otherwise; we tell you if we think an instruction breaks the law;
• everyone who can access the data is bound to keep it confidential;
• we keep appropriate security measures, such as encrypted connections, firewalls, malware scanning, access controls and backups, and keep them up to date;
• we help you respond to people using their rights, and pass on to you any request we receive about your data;
• we help you with security, breach notifications and data protection impact assessments, as far as our role allows;
• we give you the information you need to show this agreement is kept to.

You agree that we use other companies as sub-processors, each under a contract with the same protections as this agreement:

• hosting partners: the hosting platforms, email, backups and domain registrations behind your services;
• email sending services: only if you use our newsletter sending.

Our current list of sub-processors is available on request from dpo@neurodiver.city. We'll tell you by email at least 30 days before adding or replacing a sub-processor. If you object for a good reason and we can't resolve it, you can end the affected services, with a refund for any time paid for and not used. We stay responsible to you for our sub-processors.

In the data centre location you choose when you order, in the UK, Europe or the USA, from those your service offers. Choosing Europe or the USA instructs us to store the data there. Europe (the EEA) is recognised by UK law as protecting personal data properly; transfers to the USA are made under the UK–US data bridge or other safeguards UK law approves.

Some of our sub-processors may also handle data in these places, for example to send email or keep backups, under the same safeguards.

If we become aware of a breach affecting your data, we tell you without undue delay, by email to your account's address, with what we know: what happened, the data and people likely to be affected, and what we're doing about it. Failed attempts that don't put data at risk, such as blocked logins or port scans, aren't breaches.

We'll answer reasonable questions about how we protect your data. If you need an audit, give us at least 30 days' written notice; audits are at most once a year, at your cost, and must protect other customers' data and our security.

When a service ends, its data is deleted. Download anything you want to keep first. Copies in backups are kept apart and overwritten as the backups age, unless the law requires us to keep something.

You're responsible for having a lawful basis for the data you collect, for your own privacy notice, and for the settings and software you choose on your services. Your sites should have their own privacy and cookie policies.

Each side's responsibility under this agreement is subject to the limits in our Terms of service, except where the law doesn't allow it to be limited.