Data processing terms

These terms apply whenever we handle personal data on your behalf while providing services under our terms of business, and they form part of that agreement. Examples are hosting your website, looking after your online shop, receiving enquiries sent through your website, working in your analytics or advertising accounts, and running our live chat on your website.

Words such as "personal data", "controller", "processor", "data subject" and "personal data breach" have the meanings given to them by the UK GDPR and the Data Protection Act 2018.

If these terms and our terms of business ever conflict about personal data, these terms apply.

You are the controller of the personal data your website, shop and accounts collect: you decide why and how it is used. We are your processor: we handle it only to provide our services to you.

Each of us will keep to data protection law. You are responsible for having a lawful basis for collecting the data, for your own privacy notice, and for any consent your website needs, for example for cookies.

Subject matter and duration: the personal data we handle while providing our services, for as long as the agreement lasts and until we have deleted or returned the data under section 7.

Nature and purpose: hosting, building, maintaining and supporting websites and online shops; search engine optimisation; managing advertising and social media accounts; and running live chat, as set out in your quote.

Types of personal data: contact details and messages sent through your website; customer, order and account records in your shop; information in your analytics, advertising and social media accounts; and anything about people in the content you give us, such as staff names and photos.

Data subjects: your website's visitors, enquirers and customers, and your staff and contacts named in your content.

We do not expect to handle special category data, such as health information, or data about criminal convictions. If your website needs to collect it, tell us first, so that we can agree in writing how it will be protected.

We handle the personal data only on your documented instructions, which are the agreement, these terms and any further instructions you give us in writing, including about transfers outside the UK. If the law requires us to do something else, we tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we tell you straight away.

Everyone we allow to handle the data is bound to keep it confidential.

We take the security measures Article 32 of the UK GDPR requires, including:

• encrypted connections for every website and system we run;
• access limited to the people who need it for your work, behind sign-in with one-time codes or links;
• keeping the software we install on sites we host up to date; and
• keeping copies of the code and content of the websites we build, so they can be put back.

We help you answer requests from people using their data protection rights, such as a request for a copy of their data or to delete it, by providing the information and changes you need within a reasonable time.

We help you meet your duties on security, breach notification, data protection impact assessments and consulting the Information Commissioner, taking into account the information available to us.

We tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We give you the details the law requires as soon as we have them, and help you deal with it.

We make available the information you need to show that these terms are being kept to, and allow and contribute to reasonable audits by you or an auditor you appoint, with at least 14 days' notice and at your cost.

You give us general permission to use the companies listed below to help provide our services. We only use a company that gives the same data protection promises we give you in these terms, and we stay responsible to you for their work.

Services you buy in your own name, such as a Shopify plan, a payment provider, Google Analytics or a Google Business Profile, are your own processors under their own terms, not ours.

We tell you at least 30 days before we add or replace a company on this list. If you have a reasonable objection on data protection grounds, tell us within that time and we will try to find another way. If we cannot, either of us may end the affected service without penalty.

We only transfer your personal data outside the UK with a safeguard UK law recognises: to a country the UK treats as adequate, to a company certified under the UK-US data bridge, or under the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

When the services end, we give you back your personal data or delete it, whichever you choose, within 30 days, and delete any copies we still hold, unless the law requires us to keep them.

Moving a website to your own hosting counts as giving the data back. Once the move is complete and you have confirmed it works, we delete our copies.

The limits on liability in our terms of business apply to these terms as well, except where the law does not allow them to.

Questions about these terms, and any instructions about personal data, go to hello@popit.media.