Skip to content

Processing personal data
on your behalf.

When we work on your site, we may see personal data that belongs to you and your customers. This is how we handle it.

Last updated

Need our data processing agreement?hello@acclaim.agency

This page is for clients and partner agencies. During a project we often get access to a website, a CRM or a store, and the personal data inside them. For that data you are the controller and we are your processor under Article 28 of the GDPR. How we handle data about you as our own contact is in our privacy policy.

The agreement comes first

Before we work with personal data in your systems, we put a data processing agreement in place. If your company has its own template, send it and we will review it.

  1. We agree what data is involved

    Which systems, which kinds of data and for what work.

  2. We sign the agreement

    Usually together with the project agreement and the NDA.

  3. You give us access

    Only to what the work needs, and in your own accounts.

What we do with it

We use your data only to deliver the work you asked for, and only on your written instructions. We do not copy it into our own systems unless the work needs it, and we never use it for anything of our own.

Plain English

Your customers stay your customers. We do not contact them, analyse them or keep them.

Who else may see it

The people on your project, who are bound by confidentiality. We tell you who works on your project. Some members of our team work outside the EEA, and you can ask us how your data is protected.

We use sub-processors: our project tools and, where a project needs it, individual specialists under contract. Our project tools hold messages and files about the work, so we keep personal data out of them wherever we can. You can ask us for the current list. We tell you before we add a new one, and you can object.

How we keep it safe

  • Access through your own accounts, with a named login for each person.
  • Two-factor authentication on every tool that offers it.
  • Access removed as soon as a person leaves the project.
  • Test and staging copies without real customer data, unless you agree otherwise.

If something goes wrong

If we learn of a breach that affects your data, we tell you without undue delay and give you what you need to meet your own 72-hour duty to the supervisory authority.

When the work ends

We return or delete your personal data, as you choose, and remove our access to your systems. We keep only what the law makes us keep, such as invoices.