Data processing terms

Effective date: 25 September 2026Last updated: 19 October 2026

1. When these terms apply

UK GDPR Article 28 requires a written contract when a processor handles personal data for a controller. These terms are that contract for OpsForm client work.

They apply when a proposal incorporates the client terms and we process personal data on your documented instructions. Typical cases are building, testing, supporting or hosting a system that contains personal data about your staff, customers or suppliers, and sending messages through a tool on your behalf.

They do not apply to personal data we decide the purposes for ourselves, such as your enquiry, our invoices, and our own business records. For that data we are controller, and the privacy notice applies.

If a project makes us a joint controller or a separate controller for a particular activity, the proposal must say so. These terms do not create joint controllership by themselves.

2. Roles

While these terms apply, you are the controller and we are the processor. For website enquiries and OpsForm’s own administration, OpsForm is the controller and these terms do not apply. “Personal data”, “processing”, “controller” and “processor” have the meanings in UK GDPR. “UK data protection law” means UK GDPR, the Data Protection Act 2018, and related UK privacy law, including PECR where it applies to the processing.

The processor is Girgis Ramzi, trading as OpsForm, a sole trader based in Brighton, England. Contact: hello@opsform.co.uk.

3. Processing details

Article 28 asks the contract to state the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the controller’s obligations and rights. The controller’s obligations and rights are these terms and the client terms. The rest is project-specific.

A proposal that does not describe the types of personal data and the categories of people is incomplete. We should not start that processing until those details, or an equivalent schedule, are agreed.

4. Instructions

We will process personal data only on your documented instructions, including as set out in the proposal and these terms, unless UK law requires something else. If UK law requires us to process data without your instruction, we will tell you unless the law prohibits that notice.

The instructions we accept by entering the contract are: process the data as reasonably required to perform the services, and do not use it for another purpose. A later instruction must be in writing. If we believe an instruction breaks UK data protection law, we will tell you promptly and may pause the affected processing until you confirm or change it. We will not be in breach for that pause.

An instruction to transfer personal data abroad is covered by section 8. We will not make that transfer unless this contract or a later written instruction allows it.

5. Confidentiality of personal data

We will make sure that people we authorise to process the personal data are under a duty of confidence or are under an appropriate statutory duty. Access is limited to people who need it for the services.

6. Security

We will put in place technical and organisational measures appropriate to the risk, as required by UK GDPR Article 32. What is appropriate depends on the data and the system. Unless the proposal specifies a different set, the baseline is:

• access only for people who need it, removed when they no longer do;
• secrets and credentials stored as secrets, not in email to the public address and not in a public repository;
• encryption in transit for the production service where we control that configuration;
• separation between production data and demo or sample data where the proposal says production data is in use;
• a way to restore availability after an incident, to the level the proposal’s backup arrangements actually provide.

This is not a claim of absolute security or of a particular certification. If you need a named standard, a penetration test, or a hosting region, put it in the proposal.

7. Sub-processors

You give us a general written authorisation to use sub-processors, on the conditions in this section. We will not use a sub-processor for client personal data without a written contract that imposes data protection terms no less protective than these, as Article 28 requires.

We remain liable to you for a sub-processor’s performance of those data protection obligations.

The proposal will name the sub-processors known at the start, or say that none are used because processing stays on systems you control. There is no universal list, because projects do not share the same suppliers.

We will tell you before we add or replace a sub-processor that will process the personal data, giving you at least 14 days to object on reasonable data-protection grounds. If you object, we will not use that sub-processor for your data and we will look for a reasonable alternative. If there is no reasonable alternative, either party may end the affected part of the services without penalty, other than payment for work done and costs already committed.

Infrastructure we use only to host the public marketing site is not, by that fact, a sub-processor of your project data. It is described in the privacy notice because it relates to website visitors.

An AI, email, messaging, payment, maps or identity provider is a sub-processor only if we, rather than you, engage them to process the personal data. If the account is yours, you are usually responsible for that provider contract. The proposal should say which it is.

8. International transfers

We will not transfer personal data outside the UK unless one of the following applies:

• the transfer is covered by UK adequacy regulations;
• we and the recipient have put in place a lawful safeguard, such as the UK international data transfer agreement or the UK addendum to the EU standard contractual clauses, and the data protection test is met (the protection is not materially lower than under UK GDPR and the Data Protection Act 2018); or
• a UK GDPR exception applies in a particular case and you have agreed that route in writing.

Where we rely on a safeguard, we will do a transfer risk assessment that is reasonable and proportionate to the transfer. The proposal should state if production data is intended to leave the UK, and name the country and the safeguard. If that line is blank, the instruction is to keep the processing in the UK so far as the agreed hosting allows. If the agreed host cannot offer a UK region, we will tell you before that data is placed there.

9. People’s rights and complaints

We will, taking into account the nature of the processing, assist you with appropriate technical and organisational measures so you can respond to requests from people to exercise their rights (access, correction, erasure, restriction, portability and objection).

If we receive a request directly, we will pass it to you promptly and will not answer it ourselves unless you instruct us to or the law requires it.

We will also help you meet your duties to handle a data protection complaint, including the duty to acknowledge a complaint within 30 days and to tell the person the outcome without undue delay, where that duty applies to you and you need information only we hold. You remain responsible for the response to your data subjects.

10. Personal data breaches

We will tell you without undue delay after we become aware of a personal data breach affecting the data we process for you. We will include, so far as we know it, what happened, the categories and approximate number of people and records, the likely consequences, and the measures taken or proposed. We will update you as we learn more.

You decide whether to notify the ICO or the affected people. We will not notify them ourselves except where the law requires us to, or you ask us in writing to send a notice you have approved.

11. Impact assessments

If you are carrying out a data protection impact assessment or a consultation with the ICO about the processing we do for you, we will provide reasonable information about our processing and security so you can complete it. We do not complete the assessment for you.

12. End of the processing

When the services end, we will, at your choice, delete or return the personal data we processed for you, and delete existing copies, unless UK law requires us to keep it. You must tell us your choice within 30 days of the end date. If you do not, we will delete the data within a further 30 days, except for copies in routine backups, which we will isolate and delete on the backup cycle rather than use.

We may keep information we hold as controller, such as invoices and correspondence needed for tax or legal claims. That is not “project personal data” under this section.

13. Information and audits

We will make available the information reasonably needed to show that we meet Article 28, and we will allow for and contribute to audits and inspections that you, or an auditor you mandate, conduct.

An audit must be on reasonable written notice (at least 20 working days, unless a breach investigation cannot wait), during working hours, not more than once in a contract year unless a breach justifies another, and subject to confidentiality. You will avoid unreasonable disruption and you will not get access to other clients’ data. We may charge a reasonable fee for a wide audit that goes beyond confirming these terms, as agreed before it starts. A questionnaire is the usual first step.

14. Your responsibilities as controller

You will:

• make sure the processing has a lawful basis, and an additional condition if special category or criminal-offence data is involved;
• provide privacy information to the people whose data is processed;
• send us instructions that comply with the law;
• not ask us to collect more data than the project needs;
• be responsible for the security of accounts and environments you control.

15. Liability

Liability between us for this processing is governed by the liability section of the client terms. Nothing in these data processing terms limits a person’s rights against a controller or a processor under UK data protection law. Each party is responsible to the ICO and to individuals for the obligations that fall on its own role.

16. Contact

Data protection contact for processor matters: hello@opsform.co.uk.