Data Processing Agreement
Last reviewed 22 July 2026
This summarises the processor terms that apply when we handle personal data on your behalf. A full signed DPA is available for any engagement that needs one, and forms part of your contract.
This is our current, working policy, written to match how we actually operate and the UK law that applies. Our ICO registration number and Companies House number will be added here and in the footer once confirmed. For a specific contractual form, ask us and we will provide a signed version.
When this applies
This applies wherever we act as your processor under Article 28 of the UK GDPR: hosting, managed systems, migrations, transcription, diallers, virtual administration and any other service where we handle personal data you control. You remain the controller and decide the purposes; we act only on your documented instructions.
Our obligations
As your processor we commit to:
- Process personal data only on your instructions, and tell you if an instruction appears to breach data protection law
- Ensure everyone who handles the data is bound by confidentiality
- Apply appropriate technical and organisational security measures
- Assist you with data subject requests, breach notifications and impact assessments
- Delete or return the data at the end of the engagement, and delete our copies unless the law requires us to keep them
- Make available the information you need to demonstrate compliance, and allow reasonable audit
Sub-processors
We use a small, named set of sub-processors, such as our hosting and infrastructure providers. We tell you who they are, place equivalent obligations on them by contract, and give you advance notice of any intended change so you can object.
International transfers
We do not transfer personal data outside the UK or EEA without an appropriate safeguard, such as UK adequacy or the International Data Transfer Agreement. Where you require data residency in the UK, we design the service to keep it here, including running transcription and document processing on our own infrastructure.
Questions about this policy? Email [email protected] or see the rest of our legal and policy pages.