Data Processing Agreement

DevEdge Ltd

Effective date: 16 October 2026

This Data Processing Agreement (“DPA”) forms part of the contractual agreement between DevEdge Ltd (“DevEdge”, “we”, “us” or “our”) and the client (“you” or “your”) where DevEdge processes personal data on the client’s behalf.

This agreement supplements our Terms and Conditions and applies to relevant services provided by DevEdge.

1. Scope and Application

This DPA applies where DevEdge acts as a data processor on behalf of a client acting as a data controller, or where DevEdge acts as a subprocessor on behalf of a client acting as a processor, under applicable data protection law, including the UK GDPR, the Data Protection Act 2018, and the EU GDPR (Regulation (EU) 2016/679) where applicable (together, “Data Protection Legislation”).

Relevant services may include:

• Website and managed WordPress hosting.
• Website Support and technical maintenance.
• Website backups, recovery and restoration.
• DevEdge Connect website health and security monitoring.
• DevEdge Hub reporting, diagnostics and incident management.
• Emergency Response services.
• Website and email migrations.
• Development, integration and technical administration services.
• Other agreed services involving the processing of personal data.

This DPA applies only to personal data processed on behalf of the client.

Where DevEdge acts as an independent data controller, including for its own billing, business administration and client account management, that processing is governed by our Privacy Policy and applicable data protection law.

2. Roles and Responsibilities

The client acts as the data controller, or as a processor acting on behalf of another controller, in respect of personal data supplied to or processed through the relevant services.

DevEdge acts as a data processor or subprocessor, as applicable.

The client is responsible for:

• Establishing a lawful basis for processing personal data.
• Providing appropriate privacy notices to individuals.
• Determining the purposes of processing and applicable retention requirements.
• Managing data subject requests and other controller obligations.
• Ensuring that instructions given to DevEdge are lawful.
• Obtaining any necessary authorisation from an upstream controller where the client acts as a processor.

DevEdge is responsible for processing personal data in accordance with this DPA, documented lawful instructions and its applicable obligations under data protection legislation.

3. Processing Instructions

DevEdge will process personal data only on the client’s documented instructions, including instructions relating to international transfers, unless otherwise required by applicable UK, EU or member state law to which DevEdge is subject.

The service agreement, agreed service configuration, this DPA and subsequent documented instructions together constitute the client’s instructions.

DevEdge may process personal data as reasonably necessary to deliver, maintain, secure, monitor, troubleshoot and administer the agreed services within those instructions.

If DevEdge is legally required to process data outside those instructions, it will inform the client beforehand unless prohibited by law.

Where DevEdge reasonably believes an instruction infringes applicable data protection law, it will inform the client without undue delay.

4. Confidentiality

DevEdge will ensure that personnel authorised to process client personal data are subject to appropriate confidentiality obligations.

Access to client personal data will be limited to personnel and approved service providers who reasonably require access to perform their responsibilities.

Confidentiality obligations will continue after an individual’s involvement in providing the services ends.

5. Security Measures

DevEdge will implement appropriate technical and organisational measures, taking into account the nature, scope, context and risks of the processing.

Depending on the service, these may include:

• Access controls and restricted administrative permissions.
• Encryption in transit and, where appropriate, at rest.
• Hosting and application-level security measures.
• Malware detection, vulnerability monitoring and security updates.
• Logging, monitoring and security incident investigation.
• Backup and recovery arrangements.
• Security segregation between client environments.
• Measures to maintain the confidentiality, integrity and availability of systems.
• Processes for reviewing and assessing security controls.

The precise measures depend on the purchased service and applicable technical environment.

DevEdge may update security technologies and implementation methods provided an appropriate level of protection is maintained.

6. DevEdge Connect and Security Monitoring

Where DevEdge Connect is enabled, technical and security-related personal data may be processed to provide website monitoring, diagnostics, vulnerability assessment and incident management.

This may include:

• Pseudonymous administrator account identifiers.
• Administrator account creation, removal and permission changes.
• Login timestamps and relevant authentication activity.
• IP addresses and approximate location information where necessary for security monitoring.
• Two-factor authentication status where supported.
• Website security configuration and relevant software changes.
• Technical fault information and security incident records.

DevEdge aims to minimise the personal information collected and transmitted.

Routine monitoring is not intended to collect passwords, password hashes, authentication tokens or session credentials.

Monitoring is subject to the agreed service scope and the DevEdge Connect & Security Monitoring provisions within our Terms and Conditions.

7. Subprocessors

The client grants DevEdge general written authorisation to engage subprocessors reasonably necessary to provide the agreed services, subject to the conditions in this section.

These may include providers of:

• Hosting and server infrastructure.
• Cloud storage and off-site backups.
• Content delivery, DNS and security services.
• Monitoring and technical infrastructure.
• Support, communication and incident-management systems.

DevEdge will maintain a current register of subprocessors identifying their functions and relevant processing locations.

Where DevEdge intends to add or replace a subprocessor, it will provide reasonable advance notice and an opportunity for the client to object on legitimate data protection grounds.

The client may raise an objection within 14 calendar days of notification. DevEdge will consider reasonable objections and discuss available alternatives. Where an objection cannot reasonably be resolved, the parties may agree an alternative service arrangement or termination of the affected service in accordance with the applicable contract and legal obligations.

DevEdge will ensure subprocessors are bound by written contractual obligations providing an equivalent level of protection to the applicable requirements of this DPA.

DevEdge remains responsible to the client for the performance of its subprocessors’ data protection obligations in accordance with applicable law.

8. International Data Transfers

Hosting and backup regions: Personal data processed under this agreement is hosted, managed and backed up across infrastructure located within the United Kingdom and the European Economic Area (EEA), specifically:

• United Kingdom: London (Region eu-west-2)
• European Union: Germany / Berlin (Region eu-central-3)

Cross-border transfers: Transfers of personal data between the UK and the EEA/EU rely on mutual UK and EU adequacy regulations. Where personal data is transferred internationally outside the UK or EEA, or where adequacy regulations are varied or no longer apply, DevEdge ensures appropriate statutory transfer safeguards are maintained, including:

• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses;
• The European Commission’s Standard Contractual Clauses (EU SCCs – Commission Implementing Decision (EU) 2021/914, Module 2 Controller-to-Processor or Module 3 Processor-to-Processor as applicable), which are hereby incorporated by reference;
• Another legally permitted transfer mechanism under applicable Data Protection Legislation.

DevEdge will undertake or assist with relevant transfer risk assessments where required.

9. Personal Data Breaches

DevEdge will notify the client without undue delay, and where feasible within 48 hours, after becoming aware of a confirmed personal data breach affecting personal data processed on the client’s behalf.

Where reasonably available, notification will include relevant information about:

• The nature of the incident.
• The categories of personal data potentially affected.
• The known or reasonably estimated impact.
• Measures taken or proposed to contain and address the incident.

Information may be provided in stages as an investigation progresses.

DevEdge will take reasonable steps to investigate, contain and remediate incidents within its responsibilities and assist the client with relevant breach notification obligations.

The client remains responsible for determining whether notification to the ICO, relevant EU supervisory authority or affected individuals is required, except where applicable law places a direct obligation on DevEdge.

10. Data Subject Rights

Taking into account the nature of the processing, DevEdge will provide appropriate technical and organisational assistance to enable the client to respond to data subject rights requests.

These may include requests for access, rectification, erasure, restriction, portability or objection.

Where DevEdge receives a request directly concerning personal data processed on the client’s behalf, it will refer the request to the client where appropriate, unless legally required to respond otherwise.

DevEdge will not independently determine the outcome of requests concerning data for which the client is responsible as controller.

11. Compliance Assistance

Taking into account the nature of processing and information available to DevEdge, we will provide reasonable assistance with the client’s obligations relating to:

• Security of personal data.
• Personal data breach assessment and notification.
• Data protection impact assessments.
• Prior consultation with the ICO where legally required.
• Relevant information concerning processing performed through DevEdge services.

Where assistance requires substantial work outside the contracted service scope, reasonable additional charges may apply where agreed in advance, without limiting assistance DevEdge is legally required to provide.

12. Data Retention, Return and Deletion

Personal data will be retained for the duration reasonably necessary to provide the agreed services and satisfy applicable legal obligations.

Service-specific retention periods, including hosting backups and security monitoring records, may be described in the relevant service documentation.

On termination of the relevant processing services, the client may instruct DevEdge to return or delete personal data processed on its behalf.

DevEdge will provide a reasonable opportunity for the client to request or retrieve relevant data, subject to the service agreement and applicable technical arrangements.

At the client’s choice, DevEdge will delete or return the relevant personal data and delete existing copies, unless applicable law requires retention.

Where data is held in backup systems, deletion may occur through the documented backup expiry and deletion process, subject to appropriate access restrictions and any applicable legal requirements.

Any data retained under a legal obligation will remain protected and will not be used for unrelated purposes.

13. Audit and Compliance Information

DevEdge will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the UK GDPR.

DevEdge will allow for and contribute to reasonable audits or inspections by the client or an appropriately appointed auditor, subject to appropriate confidentiality, security and operational safeguards.

Where practicable, requests may initially be satisfied through relevant policies, records, independent assessments or other supporting documentation.

Audits will be coordinated to minimise unnecessary disruption and avoid compromising other clients’ confidential information or the security of shared infrastructure.

The client will provide reasonable advance notice except where urgent circumstances reasonably justify a shorter period.

Any additional fees for exceptional audit assistance must be reasonable, agreed where applicable and must not prevent the exercise of mandatory statutory audit rights.

14. Processing Records and Cooperation

DevEdge will maintain appropriate records of processing activities where required by applicable data protection law.

The parties will reasonably cooperate to investigate and address compliance concerns affecting personal data processed under this DPA.

Each party will promptly inform the other where it becomes aware of circumstances materially affecting the lawful performance of its obligations.

15. Liability and Relationship with Other Terms

This DPA forms part of the relevant service agreement between the parties.

Commercial liability arrangements in the main agreement apply to this DPA only to the extent permitted by applicable law.

Nothing in this DPA excludes, restricts or overrides statutory responsibilities, regulatory powers or liabilities that cannot lawfully be excluded or limited.

Where another contractual provision conflicts with this DPA concerning mandatory controller–processor obligations, this DPA takes precedence to the extent necessary to comply with applicable data protection law.

16. Duration and Termination

This DPA applies for as long as DevEdge processes personal data on behalf of the client under an applicable service agreement.

Obligations concerning confidentiality, protection of retained data, return or deletion, and compliance cooperation will continue where necessary after termination.

17. Governing Law

This DPA is governed by the laws of England and Wales, subject to applicable mandatory data protection legislation.

Details of Processing

Subject matter

Provision of website hosting, technical support, website monitoring, security services, backup management, migrations, development and associated technical operations.

Duration

For the duration of the relevant service agreement and any applicable lawful retention or deletion period.

Nature and purpose

Hosting, storing, accessing, transmitting, backing up, restoring, monitoring, diagnosing, securing, maintaining, migrating and otherwise technically processing personal data as necessary for agreed services.

Categories of data subjects

Depending on the client’s website and services:

• Website visitors.
• Customers and prospective customers.
• Registered website users and members.
• WordPress administrators and editors.
• Client employees, contractors and representatives.
• Individuals whose information is stored in client-managed applications, databases or mailboxes.

Categories of personal data

Depending on the service and information supplied by the client:

• Names and contact details.
• Account and user profile information.
• IP addresses, technical identifiers and activity records.
• Website form submissions.
• Order, transaction and membership records.
• Website content containing personal information.
• Email messages, attachments and mailbox information.
• Administrator security and authentication telemetry.
• Database records and backup data.

Special category data: Unless explicitly agreed otherwise in a signed Proposal, Statement of Work or service specification specifying agreed elevated technical controls, the client warrants that it shall not instruct DevEdge to process, nor upload to DevEdge-managed environments, any Special Category Data (as defined in Article 9 UK/EU GDPR) or criminal convictions data. Where the client processes sensitive data without prior written agreement, the client remains solely responsible for establishing an appropriate lawful basis and maintaining suitable elevated security safeguards.

Controller obligations

The client retains responsibility for determining lawful purposes, relevant legal bases, required notices, retention requirements and lawful processing instructions.

Processing operations

Collection, receipt, storage, organisation, retrieval, consultation, transmission, backup, restoration, modification, restriction, deletion and other operations necessary to provide the agreed services.

Subprocessor Register

DevEdge may use third-party service providers (subprocessors) to assist in delivering contracted services, including hosting infrastructure, cloud storage, backups, website security, monitoring and related technical operations.

Core hosting, cloud storage and offsite backup infrastructure operates in facilities located in the United Kingdom: London (Region eu-west-2) and the European Union: Germany / Berlin (Region eu-central-3). DevEdge maintains an internal record of relevant subprocessors, including their specific services, types of data processed and processing locations.

Information about subprocessors relevant to a client’s services will be made available upon request.

Where DevEdge intends to add or replace a subprocessor, affected clients will be notified in accordance with Section 7 of this Agreement and given a reasonable opportunity to object on legitimate data protection grounds before the change takes effect.

DevEdge will ensure that subprocessors are subject to appropriate contractual data protection and confidentiality obligations providing an equivalent level of protection in accordance with applicable UK and EU data protection law.

Technical and Organisational Measures

The security measures applicable to a service may include, as relevant:

• Role-based access controls and restricted privileged access.
• Appropriate authentication and multifactor authentication controls.
• Encryption in transit and appropriate storage protection.
• Network, server and application security controls.
• Malware detection and vulnerability management.
• Secure backup storage and restoration procedures.
• Monitoring of service availability and security incidents.
• Logging and incident response processes.
• Software maintenance and security updates.
• Confidentiality obligations for personnel.
• Controlled access to production systems.
• Segregation of client resources and data where appropriate.
• Periodic review of security arrangements.
• Secure disposal or deletion of personal data.

The measures actually implemented depend on the relevant service and infrastructure, and may be supplemented by service-specific documentation. DevEdge will maintain measures appropriate to the risk and its legal obligations.

DevEdge Ltd

Website: https://devedge.co.uk

ICO Registration: ZB823609

This DPA forms part of the applicable contractual agreement between DevEdge and the client where incorporated through the agreed Terms and Conditions or another valid contractual arrangement.