(Pursuant to Art. 28 GDPR / UK GDPR) Contractual Document – Personal Data Processing Agreement
1. Parties
This Data Processing Agreement (“DPA”) is entered into between:
- Data Controller: The Client, a legal entity or business owner who mandates Digital Accelerator LTD.
- Data Processor: Digital Accelerator LTD, a company incorporated under English law, based in the United Kingdom, operating as a B2B digital marketing and consultancy agency.
Digital Accelerator LTD shall act, where applicable, as the Data Processor exclusively in cases where it processes personal data on behalf of the Client in the performance of the services.
2. Subject Matter
This DPA governs the processing of personal data carried out by Digital Accelerator LTD on behalf of the Client within the scope of providing professional services in marketing, advertising, digital consultancy, e-commerce, and related activities.
Digital Accelerator LTD processes personal data exclusively on documented instructions from the Client, in compliance with Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR. This DPA applies solely to processing activities carried out on behalf of the Client pursuant to Art. 28 GDPR.
3. Duration of Processing
The processing of personal data shall continue for the duration of the contractual relationship between the parties, unless otherwise required by law. Upon termination of the relationship, data shall be deleted or returned to the Client in accordance with the provisions of this agreement.
4. Nature and Purpose of Processing
The nature of the processing includes, but is not limited to:
- Collection
- Recording
- Consultation
- Usage
- Organization
- Erasure
The purposes of the processing are strictly related to the execution of the services entrusted by the Client to Digital Accelerator LTD.
5. Data Types and Categories of Data Subjects
Types of Data Processed:
- Contact details (name, email, phone number)
- Professional and business data
- Marketing and advertising data
- Platform access credentials (if provided by the Client)
Categories of Data Subjects:
- Clients and prospects of the Client
- End users involved in marketing and advertising activities
6. Obligations of the Data Processor
Digital Accelerator LTD undertakes to:
- a) Process personal data only on documented instructions from the Client;
- b) Ensure that persons authorized to process the data are bound by confidentiality obligations;
- c) Implement appropriate technical and organizational measures to ensure data security;
- d) Not use the data for its own purposes or for purposes other than those specified in the contract;
- e) Assist the Client in complying with GDPR obligations, within the limits of the mandate received.
7. Security Measures
Digital Accelerator LTD adopts security measures proportionate to the risk, including:
- Access to data limited to authorized personnel only;
- Use of passwords and authentication where available;
- Use of GDPR-compliant cloud tools and software;
- Protection of accounts and credentials;
- Internal procedures for data management and deletion.
8. Sub-processors
The Client authorizes Digital Accelerator LTD to appoint sub-processors, including technology providers and digital platforms used for service delivery, such as (by way of example):
- Google (Workspace, Analytics, Ads)
- Meta Platforms
- CRM and marketing automation tools
- Email marketing and analytics platforms
- Hosting and cloud providers
Digital Accelerator LTD guarantees that such sub-processors offer adequate guarantees of compliance with the GDPR.
9. Assistance to the Controller
Digital Accelerator LTD assists the Client, within the scope of its activities, in responding to:
- Requests for access, rectification, or erasure of data;
- Requests for restriction of or objection to processing;
- Any requests from competent authorities.
10. Personal Data Breaches (Data Breach)
In the event of a personal data breach of which it becomes aware, Digital Accelerator LTD shall inform the Client without undue delay, providing available information useful for managing the event.
11. Return or Deletion of Data
Upon termination of the contractual relationship, Digital Accelerator LTD shall, at the Client’s choice:
- Return the personal data;
- Or proceed with its deletion;
Except where retention is required by law.
12. Audits and Inspections
The Client has the right to verify compliance with this DPA, subject to:
- Reasonable notice;
- Non-invasive methods;
- Protection of confidentiality and operational continuity.
13. Liability
Digital Accelerator LTD is liable for data processing within the limits of the instructions received from the Client and this DPA. The Client’s responsibilities as Data Controller remain unaffected.
14. Applicable Law
This DPA is governed by the law applicable to the main contract concluded between the parties.
15. Acceptance
This Data Processing Agreement is considered accepted and binding:
- By signing the contract;
- Or by electronic acceptance, including the selection of a specific checkbox on the Digital Accelerator LTD website.