DATA PROCESSING AGREEMENT (DPA)

1. PURPOSE

This Data Processing Agreement ("DPA") forms part of and supplements the StartDotCom Terms of Service.

This DPA applies where:

• A customer acts as a Data Controller.
• StartDotCom acts as a Data Processor.
• Personal Data is processed through the Services.

This DPA is intended to support compliance with:

• UK GDPR
• EU GDPR
• UK Data Protection Act 2018
• Applicable international privacy laws

Where conflicts exist between this DPA and the Terms of Service regarding Personal Data processing, this DPA shall prevail.

2. DEFINITIONS

For purposes of this DPA:

3. SCOPE OF PROCESSING

StartDotCom may process Personal Data solely for the purpose of providing the Services.

Processing activities may include:

• CRM management
• Marketing automation
• Ecommerce operations
• Customer communications
• Website hosting
• AI processing
• Social media publishing
• Analytics
• Workflow automation

Processing shall occur only to the extent necessary to provide contracted Services.

4. PROCESSOR OBLIGATIONS

StartDotCom shall:

• Process Personal Data only on documented instructions.
• Maintain confidentiality obligations.
• Implement appropriate technical and organisational measures.
• Assist with data subject requests where reasonably required.
• Notify customers of Personal Data Breaches where legally required.
• Assist with compliance obligations where reasonably necessary.
• Delete or return Personal Data upon termination where appropriate.

5. CUSTOMER OBLIGATIONS

Customers remain responsible for:

• Determining lawful processing grounds.
• Providing privacy notices.
• Obtaining consent where required.
• Ensuring lawful collection of Personal Data.
• Maintaining lawful instructions.

Customers warrant that Personal Data submitted to the Services has been lawfully obtained.

6. CONFIDENTIALITY

StartDotCom shall ensure that personnel authorised to process Personal Data are subject to confidentiality obligations.

Such obligations shall survive termination where applicable.

7. SECURITY MEASURES

StartDotCom maintains security measures designed to protect Personal Data against unauthorised access, accidental loss, destruction, alteration, disclosure, or misuse.

Security measures may include:

• Encryption
• Access controls
• Multi-factor authentication
• Monitoring
• Logging
• Backup procedures
• Incident response processes

StartDotCom may modify security controls as technologies and risks evolve.

8. SUBPROCESSORS

Customers authorise StartDotCom to engage subprocessors necessary to provide the Services.

Subprocessors may include providers supporting:

• Cloud infrastructure
• Authentication
• Payments
• Communications
• Analytics
• Artificial intelligence
• Security monitoring

StartDotCom shall require subprocessors to maintain appropriate privacy and security obligations.

A current list of significant subprocessors may be made available upon request or through public documentation.

9. INTERNATIONAL TRANSFERS

Where Personal Data is transferred outside the UK or EEA, StartDotCom shall implement appropriate safeguards, including where applicable:

• Standard Contractual Clauses (SCCs)
• UK International Data Transfer Addendum
• Adequacy mechanisms
• Alternative lawful transfer mechanisms

10. DATA SUBJECT RIGHTS

Taking into account the nature of processing, StartDotCom shall provide reasonable assistance to customers responding to requests involving access, rectification, erasure, restriction, objection, or portability.

Customers remain primarily responsible for responding to such requests.

11. PERSONAL DATA BREACHES

Where required by law, StartDotCom shall notify affected customers without undue delay after becoming aware of a confirmed Personal Data Breach affecting customer data.

Notifications may include:

• Nature of the incident
• Categories of affected information
• Likely consequences
• Remediation measures

Not all security incidents constitute reportable Personal Data Breaches.

12. AUDITS

Where required by applicable law and subject to reasonable notice, confidentiality obligations, security requirements, and proportionality considerations, StartDotCom may provide information reasonably necessary to demonstrate compliance.

Audit rights shall not:

• Unreasonably interfere with operations.
• Compromise security.
• Reveal confidential information of other customers.

Alternative audit evidence may be provided at StartDotCom's discretion.

13. DATA RETENTION AND DELETION

Upon termination of Services and subject to legal obligations, StartDotCom shall:

• Delete Personal Data; or
• Return Personal Data where technically feasible.

Retention may continue where required by:

• Law
• Security obligations
• Fraud prevention
• Regulatory requirements
• Legal claims

14. LIABILITY

Liability arising under this DPA shall be governed by the liability provisions contained within the StartDotCom Terms of Service unless otherwise agreed in writing.

15. GOVERNING LAW

This DPA shall be governed by the laws of England and Wales unless otherwise required by mandatory applicable law.

16. CONTACT DETAILS