# Data Processing Agreement Version 2026-10-15. Effective for new agreements accepted from 15 October 2026. ## Scope and instructions This DPA forms part of the Bookings service agreement between Hampshire Marketing Ltd and the business identified in its account/order. For booking data the business is controller and Hampshire is processor. Where the business is itself a processor, it must have authority to appoint us. Our own account, billing and security processing is described separately in the Privacy Notice. UK GDPR and the Data Protection Act 2018, as amended, apply. We process only on documented instructions in the agreement, supported settings and authorised written requests, including instructions about international transfers. If UK law requires other processing, we notify you beforehand unless prohibited. We promptly flag instructions we believe breach data-protection law. You determine lawful purposes and bases, give notices, obtain required permissions, minimise data and control authorised users. Full card details, passwords, criminal-offence data and special-category data must not be submitted. Special-category processing requires a separate written agreement and safeguards. ## Confidentiality and security People authorised to process the data are subject to confidentiality duties. We maintain measures appropriate to risk under Article 32, covering confidentiality, integrity, availability, resilience, restoration and assessment. We will not materially reduce the agreed protection. Current measures include HTTPS, secure HTTP-only session cookies, CSRF protection, role and business isolation, password controls and login throttling, protected downloads, restricted attachments and encryption of selected sensitive fields and support attachments. Production debugging is disabled. AWS and IONOS owner accounts have owner-confirmed MFA; this is not a claim that all application accounts have MFA. Daily recovery backups use private encrypted S3 storage in London with restricted access and encrypted transfer. Health is checked hourly; isolated database restore checks are scheduled monthly. Recovery requires review and reapplication of deletion/restriction instructions before ordinary use resumes. We operate request, incident and access-review procedures. We do not promise a fixed recovery time, immutable backups, encryption of every disk or independent certification. ## Subprocessors and transfers You generally authorise the provider register accompanying this DPA. We impose equivalent data-protection obligations by written contract and remain responsible for subprocessors' performance of those obligations. For additions/replacements we deliberately appoint, we give at least 30 days' notice. For inherited supplier changes, we notify you promptly on receiving notice, explain the processing and upstream deadline, and provide an opportunity to object on reasonable data-protection grounds before the change. We raise relevant objections with the provider and work to resolve them. If no reasonable alternative resolves an objection, either party may terminate affected services before the new processing starts; return/deletion and applicable contractual remedies continue. We must not treat short upstream notice as automatic customer approval. This achievable notice approach replaces the conflicting blanket 30-day promise. Restricted transfers, including overseas support access, require documented instructions and a lawful UK transfer mechanism, with relevant assessments and safeguards. Where EU GDPR also applies, relevant EU arrangements must also be documented. UK hosting does not mean all provider access is UK-only. ## Requests, incidents and audits We forward individual requests without undue delay and assist you, insofar as possible through appropriate measures, with individual rights. We do not respond substantively without instructions unless legally required. Taking account of the processing and information available, we assist with Articles 32–36 security, breach duties, impact assessments and regulatory consultation. You remain responsible for controller decisions and deadlines; fees for exceptional assistance cannot defeat required assistance. We notify your nominated contact without undue delay after becoming aware of a personal-data breach, without waiting for a complete investigation. We provide available details of its nature, affected people/records, likely consequences, contact point and mitigation, supplementing these as information becomes available. We investigate, contain, preserve relevant evidence and cooperate with your response. We make information available to demonstrate compliance with Article 28 and allow and contribute to your audits/inspections, including through an appointed auditor. Reasonable scope, notice, confidentiality and protection of other customers may be agreed, but cannot prevent legally required or justified audits. Each party bears ordinary costs unless agreed otherwise; charges must not defeat statutory rights. We address identified non-compliance. ## Return and deletion At the end of processing, at your choice we return or securely delete the data and delete existing copies unless UK law requires retention. Request this through support@hampshiremarketing.co.uk. We verify authority and scope and target completion within 30 days of verified instructions; verification must not delay statutory or urgent duties. Exports are operator-assisted readable JSON/CSV and supported files in a protected archive with authenticated, expiring delivery. Coverage and exceptions are reviewed before completion. Larger/exceptional requests receive a reviewed handover rather than a silently incomplete export. Data on your own website or directly contracted services requires your separate action. Deletion is reviewed, with any legally required retention recorded by purpose, scope and review/expiry. Backups awaiting expiry remain protected and outside ordinary use; deletion instructions are reapplied after restoration. The DPA continues while we hold/process your data, including retained copies. A lifetime product licence does not justify indefinite personal-data retention. ## Processing schedule Purpose: operate the enabled booking, appointment, room-hire, membership, resource, messaging and support features on your instructions. Operations include collection, storage, organisation, retrieval, modification, transmission, export and deletion. People: customers, bookers, attendees, contacts and authorised staff; children/guardians where your services involve them, with appropriate minimisation and safeguards. Data: names, contact details, bookings, dates, staff assignments, attendance, memberships, payment references/status, relevant messages, permitted files and technical identifiers. Processing is ongoing during service use and the return/deletion period. Your account/order identifies the business, contact and enabled features. ## Provider register - IONOS Cloud Ltd: UK production VPS hosting, PostgreSQL and database-held resources. Relevant downstream VPS support/operation includes Arsys Internet S.L.U., Spain. Use the account-linked DPA and applicable downstream schedule. UK storage must not be described as UK-only access. - Amazon Web Services: London SES email, inbound-support S3/SQS, monitoring and recovery backups. AWS provides these services under its applicable data-processing terms. Provider support access may take place outside the UK and is subject to the international-transfer requirements above. - Historical migration and rollback copies may remain in Stockholm (Sweden) pending reviewed retirement. They remain protected under this DPA; London is the default for current services, not a guarantee that every historical copy is there. - Optional connections to Google, Stripe and YouTube operate only where enabled. Their roles depend on the activity and your provider agreement: directly contracted providers and independent controllers are distinct from subprocessors we appoint. Google may process identity, calendar, meeting and authorised email data; Stripe processes payment data; embedded YouTube content may send viewer information to YouTube. Your connection settings and the relevant provider notices describe these optional services. ## Retention schedule Active business records remain for the service and reviewed return/deletion process. Routine London recovery backups expire after 30 days, with noncurrent versions expiring one further day after becoming noncurrent; storage lifecycle deletion is asynchronous. Local rollback copies are checked daily for expiry after 30 days unchanged, with recovery/hold exceptions reviewed. Raw inbound support email expires after seven days (noncurrent versions seven days after becoming noncurrent). Ingested tickets/attachments are separate records. Support queues/dead letters retain up to 14 days; reporting queues seven days. Server journals have a 14-day, size-bounded target; Nginx logs retain 14 daily rotations. Resolved email-delivery attempts and accepted notification content are cleaned after 90 days. Pending/uncertain delivery evidence is retained for reviewed reconciliation. Legal holds, financial records and our own controller records require a justified separate retention basis; none of these settings permits indefinite retention or guarantees every copy disappears precisely on day 30.