Data processing agreement

Parties and acceptance

Customer (Controller): the business or individual using Sole Trader Admin under an account, identified in the account profile and invitation records.

Supplier (Processor): James Crowe, trading as Sole Trader Admin, 99 The Holbeins, Swindon, Wiltshire, SN5 6DT, United Kingdom.

Version: dpa-beta-2026-11-05. The Customer accepts this agreement by accepting the terms of service version beta-2026-11-05 (electronic acceptance at registration or on re-acceptance).

1. Scope

1.1 This agreement applies to Schedule 1 personal data processed by the Supplier on the Customer’s documented instructions.

1.2 Out of scope (Supplier as controller — see privacy notice): account registration and authentication, platform marketing contact form, Supplier security logging for the Supplier’s own purposes, optional product news preference, and any future subscription billing from the Customer to the Supplier.

1.3 The Customer is controller for end-customer and website-visitor data in the workspace. The Customer must provide its own privacy notice to those individuals.

2. Instructions

2.1 The Supplier processes Schedule 1 data only on documented instructions: this agreement, the accepted terms of service, and the Customer’s use of product features (create, edit, publish, send, export, erasure where available).

2.2 If the Supplier believes an instruction infringes UK GDPR, it will inform the Customer without undue delay.

2.3 Product-imposed means (backup design, immutability of issued invoices and sent quotes, export format, rate limits, enquiry notification design) are part of the service architecture and are disclosed in the privacy notice.

3. Confidentiality

The Supplier ensures that persons authorised to process Schedule 1 data are bound by confidentiality obligations.

4. Security

The Supplier implements appropriate technical and organisational measures, including access control, encryption in transit, tenant isolation, and separate database roles.

Annex A summarises measures. The Supplier does not represent that the VPS disk is fully encrypted at rest unless separately verified and published.

5. Sub-processors

5.1 The Customer authorises the sub-processors in Annex B, subject to change notification.

5.2 The Supplier will notify the Customer of intended additions or replacements with at least 14 days’ notice by email to the account holder, describing the processing and location where known. The Customer may object on reasonable grounds relating to data protection. If the parties cannot resolve an objection, the Customer may stop using the service for new processing; existing backups may retain data until expiry.

6. Data subject requests and DPIAs

The Supplier assists the Customer with data subject requests and DPIAs where feasible, using product tools (export, customer erasure, manual steps) as implemented. Full automation is not available for all request types.

The Customer is responsible for requests from its own customers and website visitors.

7. Personal data breaches

The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Schedule 1 data, with information the Supplier reasonably can provide. The Supplier will cooperate with the Customer’s obligations under UK GDPR.

8. Return and deletion

On termination of access, the Customer may export data while the workspace remains available. Automatic deletion of all Schedule 1 data on closure is not fully automated.

The Supplier deletes or returns Schedule 1 data when instructed and technically feasible, subject to legal retention (including immutable invoices and sent quotes the Customer may need to keep for tax law) and encrypted backups, which are not rewritten on erasure.

9. Audits and information

The Supplier will provide information reasonably required to demonstrate compliance with this agreement, subject to confidentiality and security. On-site audits only by mutual agreement.

10. Liability and governing law

Liability between the parties follows the accepted terms of service where applicable. Nothing in this agreement limits liability that cannot be limited under applicable law.

This agreement is governed by the law of England and Wales.

Schedule 1 — Categories, subjects and purposes

Special categories of data are not intended; free text fields may contain such data — the Customer is responsible.

Annex A — Technical and organisational measures (summary)

• Logical tenant isolation with row-level security and server-side authorisation
• Separate database roles (application, migrator, monitor) with least privilege
• HTTPS/TLS for data in transit
• Encrypted backup files produced by operator scripts
• Rate limits and abuse controls on public forms
• Immutable issued invoices and sent quotes by design
• Owner-only business export with time-limited download