Compliance posture
- UK GDPR registered with the ICO
- EU GDPR compliant via standard contractual clauses
- Designated data protection contact handled through the contact form
- Annual data audit; subprocessor list reviewed each quarter
DPA process
For projects where we process personal data on your behalf:
- We sign your DPA on receipt, usually within two business days
- Or you sign our standard DPA (SCC-aligned, EU and UK addenda)
- The DPA is signed before any personal data crosses our systems
What kind of processing we do
Most of our work is not data processing — we deliver assets, not run services. Where we are processors (e.g. a contact-form endpoint, a logged-in beta), the DPA scopes:
- The data categories
- The purpose and duration
- The technical and organisational measures
- The subprocessor chain
Data subject requests
Forwarded to your nominated contact within 24 hours. We do not respond to subject requests on your behalf without explicit, written instruction.