Data-processing agreement

Parties and scope

Arctic Parade LTD. Contact address: 9 Haigh Road, Huddersfield, England, HD3 2AE. Email: arran@arcticparade.com. Company registration: 17033806; England and Wales. Registered office: 9 Haigh Road, Huddersfield, England, HD3 2AE. This agreement supplements the early-access terms between us and the organisation creating or administering the workspace (the Customer). It applies to personal data processed for the Customer, including where an MSP instructs us as a sub-processor. The Customer confirms authority from any upstream controller. It does not replace our controller privacy notice for business/account administration.

Processing schedule

Subject: customer inventory and lifecycle operations. Purpose: import or authorised discovery, catalogue comparison, action tracking, evidence history, customer reports and enabled review emails. Operations: collection, organisation, storage, retrieval, authorised disclosure, export and deletion. Duration: while the workspace/service exists plus the protected 14-day backup expiry period. Categories: customer/contact labels, resource identifiers, technology/version/environment context, owner/reviewer names, notes, action dates and evidence supplied by authorised members. Data subjects: the Customer’s or its clients’ staff, contractors and contacts whose information appears in those records. Special-category data and criminal-offence data are not intended inputs.

Customer instructions and obligations

Uploads, authorised connector configuration, workspace settings and written support instructions form the documented instructions. We process only on those instructions unless law requires otherwise, notifying the Customer where permitted. The Customer chooses lawful inputs, informs relevant individuals and authorises its members. We flag instructions we believe unlawful. We do not sell workspace data, use it to train AI models or send customer marketing on the Customer’s behalf under this agreement.

Confidentiality and security

Authorised personnel must be bound by confidentiality. We maintain proportionate technical and organisational measures including organisation-scoped database queries, administrator/operator/viewer roles, password hashing, optional MFA, encrypted connector secrets, TLS, secure cookies, CSRF protection, restricted operator configuration, audit history, monitoring and tested local recovery. We review access and vulnerabilities and restore from protected backups during recovery tests. Current measures and limitations are listed on the security page. Off-host recovery, independent penetration-test certification and an availability SLA are not currently included.

Sub-processors

The Customer generally authorises the vendors listed in the supplier register for the stated purposes when the relevant feature is enabled. We impose equivalent processing obligations and remain responsible for our sub-processors. We provide advance notice of planned additions/replacements and an opportunity to object on data-protection grounds. Our proposed normal notice period is 30 days through the account contact route. We agree an alternative or allow the affected service to end if a reasonable objection cannot be resolved. No new host or AI provider is silently added through this agreement.

Transfers

International transfers require the Customer’s documented instructions and an applicable UK adequacy route or safeguard, together with any required data-protection test. We provide information on the recorded mechanism on request. The Postmark account-date agreement and its published UK transfer routes are recorded in our supplier evidence. The Customer’s own agreement with a connected cloud provider governs the Customer’s cloud account; Arctic Parade remains responsible for transfers made by its sub-processors.

Rights, assistance and breach notification

We assist with individual rights, security obligations, breach assessment/notification and impact assessments, taking account of the service. We notify the Customer of a personal data breach without undue delay after awareness, provide available facts and updates, and cooperate in containment. We do not make the Customer’s regulatory reporting decision for it.

Return, deletion and backup handling

At the Customer’s choice on ending the service, return workspace data in the supported JSON export format or delete it. Active deletion removes inventory, evidence, history, member access, tokens, pending jobs and encrypted credentials. Backup copies remain protected, beyond ordinary use, and expire within 14 days; any recovery must reapply recorded deletion instructions before resumed use. Where law requires a limited record to be retained, we identify the obligation and limit further use. Revoking access in the connected cloud provider and controlling files exported by members require separate Customer action. Written data-removal instructions are not conditional on paying a new fee.

Information and audits

We provide information reasonably necessary to demonstrate compliance and allow or contribute to audits and inspections, including legally required urgent checks. The Customer normally gives reasonable notice, uses existing reports first, limits the review to relevant systems and protects other customers’ data. The Customer bears its own audit costs unless the audit identifies our material breach. Contact arran@arcticparade.com to arrange scope and access.

Order and precedence

This processing agreement forms part of the business terms when accepted at signup or by an authorised administrator. It is governed by the governing-law clause in those terms. It prevails over conflicting commercial terms about personal-data processing; applicable transfer clauses prevail where required. No variation of this processing agreement is effective unless recorded in writing by authorised representatives.

Current product and data scopes

See current review coverage and collection limits and access, evidence and hosting boundaries. These pages describe the product scope. The early-access draft and legal-review status above still apply.

Related documents and guidance

• Technical measures
• Sub-processors and other suppliers
• Privacy notice
• ICO: processor contracts