This page is for clients and partner agencies. During a project we often get access to a website, a CRM or a store, and the personal data inside them. For that data you are the controller and we are your processor under Article 28 of the GDPR. How we handle data about you as our own contact is in our privacy policy.
The agreement comes first
We sign a data processing agreement with every client before we get access to any personal data. If your company has its own template, we sign yours.
We agree what data is involved
Which systems, which kinds of data and for what work.
We sign the agreement
Usually together with the project agreement and the NDA.
You give us access
Only to what the work needs, and in your own accounts.
What we do with it
We use your data only to deliver the work you asked for, and only on your written instructions. We do not copy it into our own systems unless the work needs it, and we never use it for anything of our own.
Plain English
Who else may see it
The people on your project, who are bound by confidentiality. Our project tools (Slack, ClickUp, Loom and Toggl) hold messages and files about the work, so we keep personal data out of them wherever we can. We do not pass the work to subcontractors without your written consent.
How we keep it safe
- Access through your own accounts, with a named login for each person.
- Two-factor authentication on every tool that offers it.
- Access removed as soon as a person leaves the project.
- Test and staging copies without real customer data, unless you agree otherwise.
If something goes wrong
If we learn of a breach that affects your data, we tell you without undue delay and give you what you need to meet your own 72-hour duty to the supervisory authority.
When the work ends
We return or delete your personal data, as you choose, and remove our access to your systems. We keep only what the law makes us keep, such as invoices.