Data Processing Agreement

Last updated: [DATE]. This is a starting template for the processor relationship. Have it reviewed by a UK solicitor before relying on it.

This agreement applies where, in delivering our services, we process personal data on your behalf inside your own platforms (for example configuring conversions, enhanced conversions or Conversions APIs that involve hashed customer identifiers). It forms part of our Terms of Service.

1. Roles

You are the data controller. [YOUR LEGAL NAME] trading as Datahound is the data processor. We process personal data only on your documented instructions, being the delivery of the services you have purchased.

2. Nature and purpose of processing

Configuring, auditing and maintaining analytics and marketing tracking, which may involve setting up the collection and transmission of event data and, where you enable it, hashed user-provided data (such as email or phone) for enhanced conversions and Conversions APIs.

3. Categories of data and data subjects

• Data subjects: your website visitors and customers.
• Data: online identifiers, event and behavioural data, and where you enable it, hashed contact identifiers. We do not require access to raw special-category data.

4. Our obligations

• Process personal data only on your instructions and for the purpose above.
• Ensure our personnel are bound by confidentiality.
• Apply appropriate technical and organisational security measures (see clause 6).
• Use the least-privilege access you grant, and never take ownership of your properties.
• Assist you, so far as reasonable, with data-subject requests, breach notification and any data protection impact assessments.
• On request at the end of the engagement, delete or return personal data and remove our access, unless we must retain it by law.

5. Sub-processors

You authorise us to use the sub-processors needed to deliver the service, including the platforms you have asked us to configure (for example Google, Meta, TikTok, LinkedIn, Shopify) and our operational tools (Vercel, Resend, Stripe). We remain responsible for their compliance and will tell you of material changes.

6. Security

We access your accounts through their own invite systems, never by shared passwords. We do not store your account credentials. Access is scoped to what the work needs and is revocable by you at any time. We keep any project data we hold secure and confidential.

7. International transfers

Where processing involves transfers outside the UK/EEA, appropriate safeguards are in place. Many of the platforms you use operate globally; their transfer mechanisms apply in addition to ours.

8. Breach

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you reasonably need to meet your own obligations.

9. Term

This agreement runs for as long as we process personal data on your behalf. On termination, clause 4 (deletion/return) applies.

← Back to home