PEAC Data Processing Agreement

Version [1.0] · Effective [Effective date]

1. Parties and scope

1.1 This Data Processing Agreement (DPA) forms part of the PEAC Terms of Service (the Terms) between PEAC Studio Ltd, a company registered in Scotland with company number SC905679, registered office 5 South Charlotte Street, Edinburgh, EH2 4AN (Processor, we), and the Customer (Controller, you).

1.2 It applies to personal data within Customer Data that we process on your behalf in providing the Service (Customer Personal Data). It is intended to meet Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, where applicable, the EU GDPR.

1.3 Terms such as controller, processor, personal data, personal data breach, data subject and processing have the meanings given in the UK GDPR. Capitalised terms not defined here have the meanings in the Terms.

1.4 If there is a conflict between this DPA and the Terms regarding Customer Personal Data, this DPA prevails.

2. Roles

2.1 You are the controller of Customer Personal Data and we are your processor.

2.2 We are a controller (not a processor) of personal data we process for our own purposes — such as account administration, billing, support correspondence and marketing — as described in our Privacy Policy.

3. Our obligations

We will:

(a) process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and your use and configuration of the Service, unless required to do otherwise by UK law (in which case we will tell you first unless the law prohibits it). We will tell you if we believe an instruction infringes data protection law;

(b) ensure that anyone we authorise to process Customer Personal Data is bound by confidentiality;

(c) implement the technical and organisational measures in Annex 2;

(d) engage sub-processors only in accordance with section 4;

(e) taking into account the nature of the processing, assist you by appropriate measures in responding to requests from data subjects exercising their rights. The Service enables your Super-admins to view, correct, export and delete records directly. If we receive a request directly, we will refer the data subject to you without responding substantively;

(f) assist you, taking into account the information available to us, with your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO;

(g) at the end of the Service, delete Customer Personal Data in accordance with section 7; and

(h) make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits in accordance with section 8.

4. Sub-processors

4.1 You give general authorisation for us to engage sub-processors. Our current sub-processors are listed in Annex 3.

4.2 We will give at least 30 days' notice of any new or replacement sub-processor by email to your Super-admins and by updating the list at peac.studio/dpa. You may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, you may terminate the affected Service and receive a refund of prepaid fees for the period after termination.

4.3 We will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remain liable to you for their performance.

5. International transfers

5.1 Customer Personal Data is hosted in [Hosting region].

5.2 Where Customer Personal Data is transferred outside the UK (including to sub-processors or their support personnel), we will ensure the transfer is made under a valid mechanism under UK data protection law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required. [Transfer safeguard — confirm per sub-processor.]

6. Personal data breaches

6.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

6.2 The notice will, so far as then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available.

6.3 We will take reasonable steps to contain, investigate and mitigate the breach. Our notification is not an acknowledgement of fault or liability.

7. Return and deletion

7.1 Your Super-admins may export Customer Data at any time while the Workspace is active or read-only.

7.2 Following the end of the Service, the Workspace remains available read-only for export for 30 days, after which we will delete Customer Personal Data from the live Service. Backup copies are overwritten in the normal cycle within [Backup retention] days and are not used for any other purpose in the meantime.

7.3 We may retain Customer Personal Data where UK law requires it, in which case we will keep it confidential and process it only for that purpose.

8. Audits

8.1 We will respond to reasonable written security and data protection questionnaires no more than once a year (or after a personal data breach).

8.2 If, after reviewing our responses, you reasonably need further evidence, you may request an audit by an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours, at your cost, and no more than once a year. Audits of our sub-processors are satisfied by the certifications and reports they make available.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.

10. Term

This DPA lasts for as long as we process Customer Personal Data on your behalf.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

Access control and isolation

• Each Customer's data is logically separated by Workspace; every application request is checked against the signed-in User's Workspace.
• Users authenticate with individual credentials; passwords are stored using bcrypt hashing and are never visible to us.
• Role-based permissions within the Workspace (Super-admin and User), with destructive actions limited to Super-admins.
• PEAC Studio has no User account in any customer Workspace. Administrative access to the underlying infrastructure is restricted to the director of PEAC Studio, protected by strong unique credentials and multi-factor authentication where offered by the provider, and used only to operate and maintain the Service, investigate faults reported by the Customer, respond to security incidents, or comply with law.

Encryption

• All traffic to and from the Service is encrypted in transit using TLS (HTTPS).
• Data at rest is stored on infrastructure provided by our hosting sub-processor [confirm encryption at rest with our hosting provider].
• Uploaded files are stored in private cloud storage and accessed only through short-lived signed links.

Availability and resilience

• Managed hosting with automated backups of the database [backup frequency and retention — confirm with our hosting provider].
• Restoration procedures available in the event of data loss.

Secure development and operation

• Changes are built and tested before deployment, with the ability to roll back to a previous version.
• Upload validation, including file type and size limits and blocking of executable/script file types.
• Server-side validation of all requests; no payment card data is processed or stored by the Service (card payments are handled entirely by Stripe).

Organisational

• Confidentiality obligations on anyone given access.
• Personal data breach response procedure (section 6).
• Data minimisation: the Service collects only what is needed for its features and contains no advertising or AI processing of Customer Data.

Annex 3 — Sub-processors

Our marketing website (Squarespace) and advertising tools (Meta) do not receive Customer Data and are therefore not sub-processors; their use is covered by our Privacy Policy and Cookie Policy.