Data processing agreement

1. About this agreement

1.1 This Data Processing Agreement ("DPA") is between Spectacle Ltd (company number 17469934) ("we", "us") and the customer who has agreed to our Terms and Conditions ("you"). It forms part of our Terms and Conditions, and words defined there have the same meaning here.

1.2 It applies whenever we process personal data on your behalf while providing our services, for example when we host, maintain or build a website that collects data from your customers or visitors. For that data, you are the controller and we are your processor.

1.3 It is designed to meet the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018 ("Data Protection Law"). Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in Data Protection Law.

1.4 It does not cover personal data we hold about you as our customer, such as your account and billing details. We are the controller of that data, and our Privacy Policy explains how we handle it.

1.5 If this DPA conflicts with our Terms and Conditions on data protection, this DPA takes priority. You accept it when you accept our Terms and Conditions, and it lasts for as long as we process personal data for you.

2. Details of the processing

2.1 We will not use this personal data for our own purposes.

3. Our obligations

3.1 When we process personal data for you, we will:

1. process it only on your documented instructions, which are this DPA, our Terms and Conditions and requests you make through the Dashboard, unless the law requires otherwise. If the law requires us to process it differently, we will tell you first, unless the law forbids that;
2. tell you straight away if we believe an instruction breaks Data Protection Law;
3. make sure everyone who can access it, including our team and freelancers, is bound by confidentiality;
4. keep it secure using the measures in section 6;
5. use sub-processors only as set out in section 5;
6. help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights. If a request comes to us directly, we will pass it to you and not answer it ourselves;
7. help you meet your obligations on security, breach notification, data protection impact assessments and consulting the ICO, taking into account the information available to us;
8. at the end of our services, delete or return the data as set out in section 9;
9. give you the information you reasonably need to show that we are meeting these obligations.

3.2 Help under points 6 and 7 that goes beyond a reasonable amount of time may be chargeable at our standard rate. We will tell you before charging.

4. Your obligations

4.1 As controller, you are responsible for:

• having a lawful basis for collecting and using personal data through your website;
• giving people clear information about how their data is used, including a privacy notice on your website;
• getting any consent your website needs, including for cookies;
• making sure your instructions to us follow Data Protection Law;
• deciding how long your website keeps personal data, and telling us if you need anything deleted;
• telling us before your website starts to collect special category data or data about children.

5. Sub-processors

5.1 Spectacle Ltd hosts and manages your website. To do this, we use a small number of carefully chosen sub-processors. You give us general authorisation to use the sub-processors listed in the Dashboard, which currently are:

Not every sub-processor is used for every website. Which ones apply depends on where your website is hosted and the services it uses. The Dashboard shows the ones that apply to you.

5.2 Freelancers working on your project may also access personal data in your website, but only when needed for that project and under written confidentiality and data protection terms.

5.3 We will give you at least 30 days' notice through the Dashboard before we add or replace a sub-processor. You can object on reasonable data protection grounds within that time. If we cannot resolve your objection, you can cancel the affected services without penalty, and we will refund any fees paid in advance for the period after cancellation.

5.4 We will have a written contract with each sub-processor that gives at least the same protection as this DPA. We remain responsible to you for their work.

6. Security measures

6.1 We protect personal data in your website with technical and organisational measures appropriate to the risk, including:

• Encryption: HTTPS on every website, and encrypted connections for all admin and server access.
• Access control: access only for team members and freelancers who need it, individual logins, two-factor authentication on our admin accounts, and prompt removal of access when it is no longer needed.
• Updates: regular updates to server software, website core, plugins and themes under your Website Care Plan.
• Monitoring and protection: uptime and security monitoring, a web application firewall, and malware scanning on request.
• Backups: regular backups kept for 30 days and stored separately from the live website, so that it can be restored after an incident.
• People: confidentiality commitments from everyone with access, and clear internal procedures for handling data and incidents.

6.2 We review these measures regularly and may improve them. We will not reduce the overall level of protection.

7. Personal data breaches

7.1 If we become aware of a personal data breach affecting personal data we process for you, we will tell you through the Dashboard and by email within 48 hours. This gives you time to meet your own 72-hour deadline for reporting to the ICO.

7.2 As far as we know at the time, we will tell you:

• what happened, and when;
• the types and approximate amount of data and the number of people affected;
• the likely consequences;
• what we have done, or will do, to deal with it and limit the harm;
• who on our team you can contact for more information.

7.3 If we do not have all the information straight away, we will send it in stages as we find out more.

7.4 We will take reasonable steps to contain the breach and help you investigate it. We will not tell the ICO or the people affected about a breach of your data without your agreement, unless the law requires us to.

7.5 Telling you about a breach is not an admission of fault.

8. International transfers

8.1 Your website and its backups are stored with the providers listed in section 5.1, in the UK, the EU or the US. The Dashboard shows where your website is held.

8.2 Some sub-processors may access or route data outside the UK, for example through Cloudflare's global network. We transfer personal data outside the UK only where it is protected by:

• a UK adequacy decision;
• the UK Extension to the EU-US Data Privacy Framework;
• the UK International Data Transfer Agreement; or
• the EU Standard Contractual Clauses with the UK Addendum.

9. Audits, ending the agreement, and liability

Audits

9.1 We will answer reasonable written questions about our data protection practices, through the Dashboard, once a year or after a personal data breach.

9.2 If the ICO requires an audit, or our answers are not enough to show that we are meeting this DPA, you or an independent auditor you appoint may audit us. You must give 30 days' notice and sign a confidentiality agreement. The audit must take place during Working Days and cause as little disruption as possible. You pay your own costs, and our reasonable time at our standard rate, unless the audit shows that we have seriously broken this DPA.

When our services end

9.3 When our services end, you can download a full backup of your website and its data from the Dashboard for 30 days. After that, we delete the personal data from our live systems. Backups are deleted within their 30-day rotation cycle.

9.4 We may keep personal data only where the law requires it. If we do, we will keep protecting it under this DPA.

Liability

9.5 Each of us is liable for the harm caused by our own breach of this DPA or of Data Protection Law. The limits and exclusions in our Terms and Conditions apply to this DPA, as far as the law allows.