Data Processing Agreement
Version 1.0, last updated
It sets out the terms required by Article 28(3) of the UK GDPR.
1. Definitions
1.1 Words defined in the Terms have the same meaning here. In addition:
- Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended from time to time, including by the Data (Use and Access) Act 2025.
- UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
- Personal Data, Controller, Processor, Data Subject, Personal Data Breach and processing have the meanings given in the UK GDPR.
- Client Personal Data means the Personal Data described in Annex 1 that we process on your behalf in providing the Services.
- ICO means the Information Commission, the UK’s data protection regulator, which replaced the Information Commissioner on 30 September 2026, and any successor.
- Sub-processor means a third party we engage to process Client Personal Data.
- Restricted Transfer means a transfer of Client Personal Data to a country outside the UK that is a transfer to which Chapter 5 of the UK GDPR applies.
2. Roles and scope
2.1 For Client Personal Data, you are the Controller and we are the Processor.
2.2 This DPA does not apply to Personal Data we process as a Controller for our own purposes, such as the contact details of your staff that we use to manage our relationship with you, notes and recordings of our calls with you, our marketing records or our accounts. Our privacy notice at https://padon.ai/privacy covers that data.
2.3 The Ad Platforms and the other services you use under your own accounts, such as Google (including Google Ads, Google Analytics, Search Console and your Google Business Profile), Meta, Wix or your web host, process Personal Data under your own agreements with them. They are your providers, not our Sub-processors. When we work in those accounts, or upload data to them or download data from them, we act on your instructions as your Processor.
2.4 Payment data you give to a payment provider, such as GoCardless or Stripe, is processed by that provider as an independent controller under its own terms. Payment providers are not our Sub-processors.
2.5 Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects.
3. Your obligations
3.1 You are responsible for:
(a) having a lawful basis for the processing you ask us to carry out, and for your instructions;
(b) giving Data Subjects the information required by Articles 13 and 14 of the UK GDPR, including a privacy notice on your website that explains how enquiries, leads and tracking data are used and, where you ask us to use customer lists for advertising, that use;
(c) obtaining any consent the law requires, including consent under regulation 6 of PECR before tracking we set up on your website runs (clause 6.7 of the Terms);
(d) the accuracy and lawfulness of the Client Personal Data you give us, including customer lists and personal data in Client Content such as staff names, photos and customer reviews;
(e) where your forms or lead forms may receive special category data, for example health information sent to a health or care business, having a condition for that processing under Article 9 of the UK GDPR (and, where needed, Schedule 1 to the Data Protection Act 2018); and
(f) not asking people to send criminal offence data or payment card details through your forms or lead forms unless we have agreed in writing that the form is suitable for it.
3.2 People may include health or other sensitive details in free-text fields even when not asked. For health and care businesses, we add a short note to the forms we build asking people not to include medical details, unless you tell us not to. We recommend you keep it.
4. Our obligations
4.1 We will:
(a) process Client Personal Data only on your documented instructions, including with regard to Restricted Transfers, unless we are required to do otherwise by UK law. In that case we will tell you of that legal requirement before processing, unless the law prohibits us from telling you on important grounds of public interest. The Agreement and your use of the Services are your documented instructions, and further instructions must be consistent with the Agreement;
(b) tell you immediately if, in our opinion, an instruction infringes Data Protection Law;
(c) make sure that anyone we authorise to process Client Personal Data is bound by a duty of confidentiality. Our backup contact under clause 7.1 has access only to what is needed to notify you of a Personal Data Breach, and has given us a written confidentiality undertaking;
(d) take the security measures required by Article 32 of the UK GDPR, including those in Annex 3;
(e) comply with clause 5 when engaging Sub-processors;
(f) taking into account the nature of the processing, assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from Data Subjects exercising their rights under Chapter 3 of the UK GDPR;
(g) assist you, taking into account the nature of the processing and the information available to us, in meeting your obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation with the ICO);
(h) at the end of the Services, return or delete Client Personal Data under clause 9; and
(i) make available to you all information necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, under clause 8.
4.2 We will not sell Client Personal Data, use it for our own purposes, or use it to contact your customers. We will not use it to train AI models. We use AI providers only under business terms that do not let them train their models on what we send them, and we never send form enquiries, leads or customer lists to AI providers. All Sub-processors process Client Personal Data only on our instructions, under their data processing terms.
4.3 If we receive a request directly from a Data Subject about Client Personal Data, we will pass it to you within 5 Business Days and will not respond to it ourselves, except to tell the Data Subject that we have passed it on, unless you ask us to.
5. Sub-processors
5.1 You give us general written authorisation to engage Sub-processors. The Sub-processors we use at the date of this DPA are listed in Annex 2.
5.2 We will tell you by email at least 30 days before we add or replace a Sub-processor, and update Annex 2 at https://padon.ai/dpa. You may object on reasonable data protection grounds within that 30-day period. If you object, we will discuss your concerns in good faith. If we cannot resolve them, you may end the Agreement by notice with immediate effect before the change takes effect.
5.3 We will impose on each Sub-processor, by written contract, data protection obligations that give the same protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Where a Sub-processor offers only its standard terms, we will check that they meet Article 28 of the UK GDPR before we use it.
5.4 We remain fully liable to you for the performance of each Sub-processor’s data protection obligations.
6. International transfers
6.1 We will only make, or allow a Sub-processor to make, a Restricted Transfer if it is covered by one of the following:
(a) UK adequacy regulations, including the Data Protection (Adequacy) (United States of America) Regulations 2023 (the UK-US data bridge) where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework;
(b) appropriate safeguards under Article 46 of the UK GDPR, such as the International Data Transfer Agreement issued under section 119A of the Data Protection Act 2018 or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any transfer risk assessment required by Data Protection Law; or
(c) another mechanism permitted by Chapter 5 of the UK GDPR.
6.2 The transfer mechanism for each Sub-processor at the date of this DPA is set out in Annex 2. If a mechanism stops being available, we will rely on another permitted mechanism or stop the transfer.
7. Personal Data Breaches
7.1 We will tell you without undue delay, and in any case within 24 hours, after becoming aware of a Personal Data Breach affecting Client Personal Data. If our director is unavailable, our backup contact, whom we name in your Order Form, will do this.
7.2 Our notice will, so far as we know at the time, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to deal with it. If we do not have all of that information at first, we will give it to you in stages as soon as we have it.
7.3 We will take reasonable steps to contain and investigate the breach and to reduce its effects, and will give you the help you reasonably need to notify the ICO and Data Subjects where required. Unless the law requires us to, we will not notify the ICO or Data Subjects about a breach affecting Client Personal Data without first consulting you.
8. Information and audits
8.1 We will answer your reasonable written questions about our processing of Client Personal Data, and give you copies of the relevant parts of our Sub-processors’ security documentation where we are allowed to share them.
8.2 If our written answers do not reasonably satisfy you, or the ICO requires it, you (or an independent auditor bound by confidentiality whom we do not reasonably object to) may audit our compliance with this DPA. You must give us at least 30 days’ written notice, carry out the audit during business hours without unreasonable disruption, and pay your own costs. Except where the audit follows a Personal Data Breach or is required by the ICO, you may audit no more than once in any 12-month period. Audits of Sub-processors are limited to the audit rights we have under our contracts with them.
9. Retention, return and deletion
9.1 While the Services continue, we keep Client Personal Data only as long as we need it to provide them:
(a) records of enquiries sent through forms on a Site we host: 12 months, so that we can report enquiry numbers to you and deal with delivery problems;
(b) leads from your ads that pass through our systems: 30 days after we pass them to you;
(c) customer lists you ask us to upload: deleted within 7 days after we upload them to your own ad account; and
(d) Personal Data in your ad accounts, analytics and Search Console: we work with it there and do not copy it out, except in reports that show only totals.
Copies of enquiries and leads sent to you are in your own systems and are your responsibility.
9.2 When the Services end, we return Client Personal Data to you, as part of the exit pack under clause 10.1(d) of the Terms, unless you ask us to delete it instead, and then delete the remaining copies within 30 days, unless UK law requires us to keep them.
9.3 Copies in backups are deleted in the normal backup cycle, which is no more than 30 days. Until then, we keep them secure and do not use them for any other purpose.
10. Liability and general
10.1 Each party’s liability under or in connection with this DPA is subject to the limits and exclusions in clause 14 of the Terms. Nothing in this DPA limits either party’s liability to Data Subjects or the ICO under Data Protection Law.
10.2 If there is a conflict between this DPA and the Terms about the processing of Client Personal Data, this DPA wins.
10.3 This DPA lasts for as long as we process Client Personal Data for you, even if that continues after the Agreement ends.
10.4 We may update this DPA under clause 19 of the Terms, and to reflect changes in Data Protection Law or ICO guidance.
10.5 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the Services under the Terms: building, hosting and changing Sites and their forms; writing content; managing your ads, tracking and audiences; handling leads; and reporting to you. |
| Duration | The term of the Agreement, and afterwards until the data is returned or deleted under clause 9. |
| Nature of processing | Receiving, storing, hosting, transmitting, displaying, counting, uploading, downloading and deleting data; viewing data in your ad accounts, analytics and Search Console; setting up tracking tags and conversion connections; drafting and editing content with AI tools (Client Content only, never form enquiries, leads or customer lists). |
| Purpose | Delivering enquiries and leads to you; publishing and changing your Site; running, measuring and improving your ads, including matching customer lists you give us with your own audiences on the Ad Platforms; and reporting results to you. |
| Data Subjects | (a) People who send enquiries through forms on a Site we host. (b) People who respond to your ads, including through lead forms. (c) Your customers in lists you ask us to upload. (d) Visitors to your website whose data your tracking tags and analytics collect. (e) People whose personal data appears in Client Content, such as your staff, owners and customers who left reviews. |
| Types of Personal Data | (a) What a person enters in a form or lead form, typically name, email address, phone number, postcode and message, with the time and the page or ad it came from, and technical data such as the IP address used to deliver forms and block spam. (b) Customer list fields such as name, email address, phone number and postcode, which the Ad Platforms match in hashed form. (c) Online identifiers, IP addresses, device and browser data, pages visited and conversion events, as collected by tracking tags and analytics. (d) Names, job titles, photos, quotes and reviews in Client Content. |
| Special category data | Not asked for by default. Health information may be volunteered in free-text fields, particularly for health and care clients (see clauses 3.1(e) and 3.2). |
Annex 2: Sub-processors
Status at 28 October 2026.
| Sub-processor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting Sites; receiving and storing form submissions and leads; running our software | Global network; company based in the USA. Storage region: EU (copies may be cached elsewhere on Cloudflare’s network) | UK-US data bridge (Cloudflare relies on the UK Extension to the EU-US Data Privacy Framework), with the UK Addendum to the EU Standard Contractual Clauses in Cloudflare’s DPA as a fallback |
| Resend (Plus Five Five, Inc.) | Sending enquiries, leads and reports to you by email | USA | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework); Standard Contractual Clauses with the UK Addendum in Resend’s DPA |
| Anthropic, PBC | AI processing (Claude) of Client Content and our instructions, under Anthropic’s Commercial Terms. Never form enquiries, leads or customer lists | USA | UK Addendum to the EU Standard Contractual Clauses in Anthropic’s DPA, which is incorporated into its Commercial Terms. Anthropic is not relied on as certified under the Data Privacy Framework. We have carried out a transfer risk assessment for this transfer |
| Google LLC (Google Workspace) | Our email, file storage (including customer lists before upload) and video calls | USA and other countries where Google operates | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework); Google’s Cloud Data Processing Addendum |
| GitHub, Inc. | Storing the code and content of Sites we build | USA | UK-US data bridge (UK Extension to the EU-US Data Privacy Framework), with the UK Addendum to the EU Standard Contractual Clauses in GitHub’s Data Protection Agreement as a fallback |
The Ad Platforms and other services you use under your own accounts (clause 2.3), and payment providers (clause 2.4), are not Sub-processors.
Annex 3: Security measures
We maintain at least the following measures, proportionate to a small business processing this data:
- Access control. Only our director, Max Okunev, has access to our systems and to Client Personal Data. Our backup contact has access only to what is needed to notify clients of a Personal Data Breach (the client contact list and the breach log), not to enquiries, leads, customer lists or Site content, and has signed a written confidentiality undertaking. Anyone else we engage will be given only the access they need and will be bound by confidentiality.
- Your accounts. We access your ad accounts, analytics, Search Console and website through each platform’s own user, manager and partner access, never with your passwords, and remove our access when the Services end.
- Authentication. Unique accounts, strong passwords held in a password manager, and multi-factor authentication on every service that holds Client Personal Data or gives access to your accounts (hosting, email, AI provider, code repository, ad manager accounts and payment providers).
- Encryption. All Sites and form submissions are served over HTTPS (TLS). Data stored with our providers is encrypted at rest by those providers. Our devices use full-disk encryption and a screen lock.
- Devices and software. Operating systems, browsers and tools are kept up to date with security patches. We do not process Client Personal Data on shared or public computers.
- Data minimisation. Forms collect only the fields you ask for. Customer lists are kept only in our Google Workspace storage until upload and deleted within 7 days after it. Form enquiries, leads and customer lists are never sent to AI providers. Retention follows clause 9.
- Separation. Each client’s Site, form records and files are kept logically separate from other clients’.
- Spam and abuse protection. Forms use measures to block automated abuse.
- Supplier review. We review each Sub-processor’s security and data protection terms before use and when they change.
- Backups and recovery. Site files are kept in version control so that a working version can be restored.
- Incident response. We have a written procedure for detecting, recording, containing and reporting Personal Data Breaches, and keep a breach log. Our backup contact can act on a breach if our director is unavailable.
- Deletion. Data is deleted at the end of its retention period and at the end of the Services under clause 9.