UK GDPR · Controller / Processor terms
Data Processing Addendum
This DPA sets out the data protection terms that apply where Don Plates processes personal data on behalf of a Plate Designer business customer.
1. Parties and Scope
This Data Processing Addendum ("DPA") forms part of the agreement between ShawByte Labs Limited, trading as Don Plates ("Don Plates", "Processor", "we", "us") and the business customer using the Don Plates Plate Designer ("Customer" or "Controller") where Don Plates processes Personal Data on the Customer's behalf.
This DPA applies only to processing in which the Customer acts as controller and Don Plates acts as processor. It does not apply to personal information that Don Plates processes as an independent controller for its own account administration, billing, security, legal or business purposes; that processing is addressed in our Privacy Policy.
By entering into the Plate Designer subscription agreement and using functionality that causes Don Plates to process Personal Data on the Customer's behalf, the parties agree to this DPA.
2. Data Protection Roles
The Customer determines the purposes and essential means of processing Customer Personal Data and acts as Controller. Don Plates processes Customer Personal Data on behalf of the Customer and acts as Processor, except where applicable law requires otherwise or where Don Plates independently determines purposes and means for a separate processing activity.
Each party remains responsible for complying with the data protection obligations that apply directly to it under UK data protection law.
3. Details of the Processing
The subject matter, duration, nature and purpose of processing, types of Personal Data, categories of Data Subjects, and the Controller's rights and obligations are described in Schedule 1.
The Customer is responsible for ensuring that its instructions and use of the Software comply with applicable data protection law, and that it has an appropriate lawful basis and has provided required privacy information to Data Subjects.
4. Documented Instructions
Don Plates will process Customer Personal Data only on the Customer's documented instructions, including instructions contained in the main agreement, this DPA and the Customer's authorised use and configuration of the Software, unless processing is required by UK law.
If UK law requires processing other than on the Customer's instructions, Don Plates will inform the Customer of that legal requirement before processing unless the law prohibits such notice on important grounds of public interest.
If Don Plates believes an instruction infringes applicable data protection law, we will inform the Customer without undue delay and may suspend the affected processing while the parties address the issue.
5. Confidentiality
Don Plates will ensure that persons authorised to process Customer Personal Data are subject to an appropriate obligation of confidentiality or are under an applicable statutory duty of confidentiality.
Access to Customer Personal Data will be limited to persons who require access for the provision, security, maintenance or support of the service.
6. Security of Processing
Taking into account the state of the art, costs of implementation, nature, scope, context and purposes of processing, and the risks to individuals, Don Plates will implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risk.
Measures may include, as appropriate, access controls, authentication, secure transport, server and application security controls, backups, logging, vulnerability and patch management, confidentiality controls and procedures for restoring availability following an incident.
Current categories of measures are described further in Schedule 2. Security measures may evolve where the overall level of protection is not materially reduced.
7. Sub-processors
The Customer gives Don Plates general written authorisation to engage sub-processors where reasonably necessary to provide, host, secure, support, communicate through or otherwise operate the service.
Don Plates will impose data protection obligations on each sub-processor that provide an equivalent level of protection for Customer Personal Data in relation to the processing performed by that sub-processor, as required by applicable law. Don Plates remains responsible to the Customer for the performance of its sub-processors' applicable data protection obligations.
Where required by UK GDPR, Don Plates will provide reasonable notice of an intended addition or replacement of a sub-processor and give the Customer an opportunity to object on reasonable data-protection grounds.
If a reasonable objection cannot be resolved, the parties will work in good faith to identify an appropriate solution. Where no reasonable solution is available, either party may terminate the affected service in accordance with the main agreement.
8. Data Subject Rights
Taking into account the nature of the processing, Don Plates will provide reasonable assistance through appropriate technical and organisational measures, insofar as possible, to help the Customer respond to requests from Data Subjects exercising their rights under applicable data protection law.
If Don Plates receives a request directly relating to Customer Personal Data, we will ordinarily direct the Data Subject to the Customer or notify the Customer, unless prohibited by law. Don Plates will not independently respond to the substance of the request except on the Customer's documented instructions or where required by law.
9. Assistance to the Controller
Taking into account the nature of processing and information available to Don Plates, we will provide reasonable assistance to the Customer with its obligations concerning:
- security of processing;
- personal data breach assessment and notification;
- data protection impact assessments where required; and
- prior consultation with the ICO where required by applicable law.
Assistance beyond functionality and information normally available through the service may be subject to reasonable charges where permitted and agreed, particularly where a request is unusually extensive or arises from the Customer's own systems or instructions.
10. Personal Data Breaches
Don Plates will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data processed by Don Plates.
Taking into account the information available, the notification will provide information reasonably necessary to assist the Customer in meeting its applicable breach-notification obligations. Information may be supplied in phases where all details are not available at the same time.
Notification of an incident does not constitute an admission of fault or liability by Don Plates.
11. International Transfers
Don Plates will not transfer Customer Personal Data to a country outside the United Kingdom except on the Customer's documented instructions or where the transfer is otherwise permitted by this DPA and an appropriate transfer mechanism is in place where required by law.
Such mechanisms may include applicable UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.
12. Return and Deletion of Personal Data
At the end of the relevant services, and at the Customer's choice where applicable, Don Plates will delete or return Customer Personal Data and delete remaining copies, unless UK law requires continued storage.
Data contained in backups may remain until overwritten or deleted through the normal backup cycle, provided it is protected, put beyond ordinary use following termination where practicable, and not restored except where necessary for disaster recovery or legal compliance.
The Customer should export any information it requires before account closure or expiry where export functionality is available.
13. Information, Audits and Inspections
Don Plates will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable under Article 28 UK GDPR and this DPA.
Subject to reasonable notice, confidentiality obligations, security requirements and appropriate scope, Don Plates will allow for and contribute to reasonable audits or inspections by the Customer or an independent auditor appointed by the Customer.
Where reasonable, the parties should first seek to satisfy an audit request through existing documentation, questionnaires or other evidence. Audits must not unreasonably disrupt the service, compromise another customer's information, or require disclosure of information that would create a security risk.
14. Compliance and Records
Don Plates will comply with processor obligations that apply directly to it under UK data protection law, including maintaining records of processing where required and cooperating with the ICO where legally required.
Don Plates will promptly inform the Customer if, in our opinion, a documented instruction infringes applicable UK data protection law.
15. Liability
The liability provisions and limitations contained in the main Plate Designer Terms and Conditions apply to this DPA to the extent permitted by law.
Nothing in this DPA excludes or limits liability that cannot lawfully be excluded or limited, nor does this DPA relieve either party of responsibilities or liabilities imposed directly upon it by applicable data protection law.
16. Order of Precedence and Changes
If there is a conflict between this DPA and the main agreement concerning processing of Customer Personal Data, this DPA takes precedence to the extent of that conflict.
Don Plates may update this DPA where reasonably necessary to reflect changes in law, regulatory guidance, security practices, sub-processing arrangements or the service, provided that an update does not materially reduce the protection afforded to Customer Personal Data during an existing paid subscription without a lawful basis or appropriate agreement.
17. Governing Law
This DPA is governed by the same governing law and jurisdiction provisions as the main Plate Designer Terms and Conditions, unless applicable data protection law requires otherwise.
Schedule 1 – Processing Details
| Subject matter | Provision, hosting, operation, security, maintenance and support of the Don Plates Plate Designer and associated account functionality. |
|---|---|
| Duration | For the duration of the Customer's subscription and for any limited retention period necessary for backup, account recovery, legal compliance or deletion processes. |
| Nature of processing | Hosting, storage, retrieval, transmission, display, organisation, backup, deletion, troubleshooting and other processing necessary to provide the service on the Customer's instructions. |
| Purpose | To provide the Plate Designer, saved-design and profile functionality, production outputs, customer support, security and related contracted services. |
| Types of Personal Data | Personal Data intentionally entered into or contained within Customer designs, uploaded logos/artwork, saved-design names or other Customer-controlled content. The service is not intended for special category data, criminal-offence data or customer identity documents unless expressly agreed. |
| Categories of Data Subjects | Individuals whose Personal Data the Customer chooses to include in Customer-controlled content, which may include the Customer's staff, representatives, customers or other contacts. |
| Controller rights and obligations | The Customer determines lawful purposes and instructions, ensures a lawful basis and transparency, controls Customer content, handles Data Subject requests as Controller, and may exercise the contractual rights set out in this DPA. |
Schedule 2 – Technical and Organisational Measures
Don Plates will maintain measures appropriate to the risks of the processing. Depending on the service architecture, these may include:
- account authentication and access controls;
- HTTPS/TLS for supported web traffic;
- restricted administrative access;
- server, application and database access controls;
- security logging and fault monitoring;
- software updates and security patching;
- backup and recovery arrangements appropriate to the service;
- controls intended to reduce unauthorised file upload or application abuse;
- confidentiality obligations for authorised personnel; and
- incident investigation and response procedures.