Data processing addendum
For clients who need a written agreement covering the personal data their website collects. Forms part of the terms of service. Last checked against the product on 2026-10-21.
1. Which of us is responsible for what
For the personal data your website collects from your customers — enquiries, bookings, orders, event photographs — you are the controller and we are the processor. You decide why it is collected and what happens to it. We hold it and act on your instructions.
For your own account with us — your business name, your billing, your support tickets — we are the controller, and that is covered by the privacy page instead.
2. What we will and will not do with it
- Only what is needed to provide the service, and anything you tell us to do.
- Never for our own purposes. We do not mine it, sell it, or train anything on it.
- Only people who need access get it, and they are under confidentiality obligations.
- If we think an instruction of yours breaks data protection law, we will say so rather than quietly carrying it out.
3. Annex 1 — what is processed
People who contact a client through their site
- Whatever the form asks for — typically name, email, phone, message
- A label saying what the enquiry looks to be about and how urgent it seems, worked out from the words on our own servers. It is not sent to anyone, and nothing is deleted or refused because of it
Purpose: To pass the enquiry to the business it was meant for, and to put the urgent ones at the top of their list
Retention: Until the client deletes it, or the account closes
People who buy from a client's shop
- Name
- Delivery address
- What they ordered
- Payment record from Stripe
Purpose: To fulfil the order and keep the business's records
Retention: While the account is open, then as long as the client's own tax obligations require
Visitors to a client's website
- Without consent: the page viewed and when — nothing that identifies anyone
- With consent: a visitor id, a one-way hash of the IP, browser, device and referrer
Purpose: To tell the business how many people visited and which pages they read
Retention: Rolled into daily totals; the session rows are pruned
Guests at an event using a Sparkler camera
- The photographs they take
- A first name, only if they type one
- The IP address and kind of phone used, to stop one device flooding a roll
- A random token their browser keeps — held by us only as a hash
Purpose: To gather the photographs into one roll for whoever set the camera up
Retention: Until the host deletes the roll or the guest deletes their own photographs, which they can do at any time from the camera
4. Annex 2 — subprocessors
You give general authorisation for the 9 companies listed on subprocessors. Each is bound by terms no weaker than these. We will give you notice before adding another, and you may object.
5. Security
Encryption in transit and at rest. Row-level security forced on every table, with access through a service role inside audited server code rather than from a browser. Secrets in a managed secret store, never in the codebase. Access limited to the people who need it.
We are not certified to SOC 2 or ISO 27001 and we do not claim to be. If your procurement requires a certified processor, we are not one, and it is better that you know that here than after signing.
6. If there is a breach
We will tell you without undue delay and within 72 hours of becoming aware, with what we know: what happened, whose data, roughly how much, what we have done, and what we recommend. If the picture is incomplete we will send what we have rather than waiting until it is tidy. Notifying your regulator and the people affected is yours to do; we will give you whatever you need to do it.
7. Helping you with your obligations
If one of your customers asks for a copy of their data, a correction or a deletion, tell us and we will do it. We will not charge you for a reasonable number of these. We will also help with impact assessments and regulator questions where our part of the system is the subject.
8. Audit
We will answer a reasonable security questionnaire once a year and provide what documentation we have. We are a small team, so we will not agree to an unlimited on-site audit right — that is an honest limit rather than a negotiating position.
9. Transfers
Processing happens in the United States. For UK and EU personal data that is a transfer, covered by the standard contractual clauses, which we will execute on request.
10. When it ends
On request within 30 days of the account closing, we will export your data to you and then delete it, except where law requires us to keep something — invoices being the usual case. Backups age out on their own schedule and are not restored for any other purpose.
Signing it
Email hello@webplug.co and we will send a countersigned copy. If your organisation has its own DPA it would rather use, send it and we will read it.