Legal

Data Processing Agreement

Last updated: November 2026

⚠

Template outline. Have a UK solicitor draft and review this before launch.

1. Controller and processor roles

You (the customer) are the data controller. Sitefolio Ltd is the data processor. We process personal data only on your documented instructions.

2. Processing details

Subject matter: website analytics. Duration: the term of the subscription agreement. Nature and purpose: collecting, storing and analysing website visitor data on your behalf. Type of personal data: [to be specified per customer]. Categories of data subjects: visitors to your website(s).

3. Article 28 obligations

We will: process personal data only on your instructions; ensure persons authorised to process the data are bound by confidentiality; implement appropriate technical and organisational security measures; assist you in responding to data subject rights requests; assist you with security, breach notification, DPIAs and prior consultation obligations; delete or return all personal data on termination; make available all information necessary to demonstrate compliance.

4. Sub-processors

We use the sub-processors listed in our Privacy Policy. We will notify you of any intended changes to sub-processors, giving you the opportunity to object. A current list is available on request.

5. Security measures

We implement appropriate technical and organisational measures including: encryption in transit (TLS 1.2+) and at rest; access controls and least-privilege principles; regular security testing; incident response procedures.

6. Breach notification

We will notify you of a personal data breach within 48 hours of becoming aware of it, to allow you to meet your own 72-hour notification obligation to the ICO.

7. International transfers

We store all data in the UK or EU. Where any transfer outside the UK/EEA is necessary, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses as the transfer mechanism.

8. Deletion at end of contract

On termination of the subscription agreement, we will delete all personal data within 30 days, unless retention is required by law. We will provide written confirmation of deletion on request.