Data Processing Agreement

1. Definitions

• "Controller" — you, the customer who signs up for ModuForge services.
• "Processor" — Pandemonium Software Ltd (company number 16948391), trading as ModuForge ("we", "us").
• "Personal Data" — any information relating to an identified or identifiable natural person, as defined by UK GDPR Article 4(1).
• "Sub-processor" — a third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Subject" — the individual whose Personal Data is processed (typically your customers, website visitors, or newsletter subscribers).
• "UK GDPR" — the General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, read with the Data Protection Act 2018.

2. Scope and purpose of processing

The Processor processes Personal Data solely to deliver the services described in the Terms of Service:

• Building, hosting and maintaining the Controller's website. Previews are built in the Processor's Cloudflare account; the live site runs as a Cloudflare Worker in the Controller's own Cloudflare account.
• Running the tools on the Controller's site that call the Processor's systems: the enquiry form, online booking, the newsletter, the loyalty card, the customer list (CRM), the Google reviews strip and offers.
• Receiving email the Controller forwards, or has forwarded automatically, to its private forwarding address, and adding it to the customer list (CRM): the sender's name and email address where the email shows them, the subject, the words of the email as plain text (up to 2,000 characters), when it arrived, and which lead site it came from. Attachments, images and the original message are not kept. The Processor never replies to, forwards on or sends anything to the people in those emails.
• Sending email on the Controller's behalf: enquiry notifications, booking confirmations and reminders, newsletters.
• Running operational automation: review monitoring, Google Business Profile audits, the monthly report.
• Manage+, where the Controller adds it: drafting replies, posts and campaigns, which are delivered to the Controller to use.
• The WhatsApp assistant, where the Controller links a WhatsApp number: telling the Controller about their enquiries and bookings over WhatsApp, and taking their instructions.
• Providing ongoing support, updates, and change requests.

The Processor does not process Personal Data for any purpose other than delivering the contracted services, and never sells, rents, or shares Personal Data for marketing purposes.

3. Categories of Personal Data processed

Special category data: the Processor does not knowingly process any special category data (Article 9) or criminal offence data (Article 10). If the Controller's website collects such data, the Controller must inform the Processor in writing before processing begins.

4. Processor obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller (which are the Terms of Service and any written change requests), unless required by law to do otherwise — in which case the Processor will inform the Controller before processing, unless legally prohibited from doing so.
• Immediately inform the Controller if, in its opinion, an instruction infringes UK GDPR or other data protection law.
• Ensure that any persons authorised to process the Personal Data are bound by confidentiality obligations. This applies to the Processor's director and to anyone the Processor engages in future.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including: encryption of data in transit (HTTPS/TLS), access controls on all systems, automated data deletion processes, and regular security reviews.
• Not engage another processor (sub-processor) without the Controller's prior written consent — see Section 6.
• Assist the Controller in responding to Data Subject requests (access, rectification, erasure, portability, restriction, objection) within the timeframes required by UK GDPR.
• Assist the Controller in ensuring compliance with Articles 32 to 36 (security, breach notification, impact assessments, prior consultation) taking into account the nature of processing and the information available to the Processor.
• At the Controller's choice, delete or return all Personal Data after the end of the service — and delete existing copies unless UK law requires storage. See Section 8.
• Make available to the Controller all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller.

5. Controller obligations

The Controller shall:

• Ensure there is a lawful basis for providing Personal Data to the Processor (typically contract performance or legitimate interest).
• Provide clear and complete instructions regarding the processing of Personal Data.
• Be responsible for the accuracy of Personal Data provided.
• Fulfil its own obligations to Data Subjects (privacy notices, consent collection where required, responding to rights requests), including having a lawful basis to contact each person it adds, imports or emails through the Processor's tools (section 10.2 of the Terms of Service).
• The Controller decides which emails it forwards, and forwards only emails it is entitled to process. It should not forward special category data (for example health details) unless it needs it to deal with the enquiry.

6. Sub-processors

The Controller provides general written authorisation for the Processor to engage the following sub-processors. The Processor will notify the Controller by email before adding or replacing a sub-processor, giving the Controller the opportunity to object within 14 days.

Other recipients: if the Controller's site has a vehicle lookup, a registration a visitor types is sent to the DVLA and the DVSA (UK government agencies) to look the vehicle up. Registrations aren't logged.

International transfers

Several sub-processors are outside the UK, mostly in the United States. When personal data goes outside the UK, it is protected by one of the safeguards UK law allows: the UK–US data bridge (the EU–US Data Privacy Framework with its UK Extension) for a US company certified under it; or the UK's International Data Transfer Agreement, or the EU standard contractual clauses with the UK Addendum, in the provider's data processing terms. Ireland and the rest of the EEA are covered by the UK's adequacy regulations. The safeguard for each, from its own terms:

The Processor will ensure that any sub-processor provides at least the same level of data protection as this DPA requires.

7. Data breach notification

If the Processor becomes aware of a Personal Data breach, it will:

• Notify the Controller without undue delay and in any event within 24 hours of becoming aware of the breach.
• Provide sufficient detail for the Controller to fulfil its own breach notification obligations under Articles 33 and 34 UK GDPR, including: the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.
• Cooperate with the Controller and take reasonable commercial steps to assist in the investigation, mitigation and remediation of the breach.

8. Data retention and deletion

The Processor applies the following retention periods, which are those in section 11 of the Terms of Service, and are carried out by an automated daily process:

• Personal data (site content, brand assets, contacts, sign-in details, the Controller's customers' records, subscriber lists, analytics): deleted automatically 30 days after the Controller's subscription ends, with the Processor's backup copies of the Controller's files. The 30-day window allows for change-of-mind reactivation and final-invoice handling.
• An account paused instead (dormant): if, with the Controller's agreement, its account is paused rather than closed, the Processor keeps its personal data so it can come back without starting again, and it is deleted automatically 24 months after the Controller's account was paused, in the same way.
• A site the Controller keeps: if the Controller keeps its site (section 5.3 of the Terms of Service), the Processor does not delete the photos, logo and other files the site loads from the Processor's storage, so it keeps working; its other copies of the Controller's files are deleted.
• Financial records (business name, type and town, amounts charged and when, payment references): retained for 7 years from the end of the Processor's financial year (to 31 January) in which they arose, to meet the Processor's accounting and tax duties, and in case either party needs to bring or defend a legal claim. These records contain the minimum data necessary.
• Checkout confirmations: that the Controller was buying for its business, what it authorised the Processor to charge to its card, and that it accepted the Terms of Service: the time and the exact wording, with no names, emails or free text. Kept with the financial records, for the same period and reasons.
• A former-customer record: the least needed to recognise the Controller if it comes back, so it gets the Processor's prices for returning customers: its email address, the domain of that email address, its website's domain and its Companies House number, each only as a one-way hash made with a secret key, so none can be read back or matched without the Processor's key; the date it left; and whether it was a Founding member, its Founding price and how many Founding payments it had made. No names and no readable contact details. Used for nothing else, never for marketing. It is deleted when the Controller comes back or asks, and otherwise erased 24 months after the Controller left. If the Controller asks for it to be deleted, the Processor keeps only a one-way hash of its account and email address, so that it is never recorded again.
• The record of deletion: after deletion completes, the emptied customer record, holding only the financial record above and the dates, shows that the deletion was performed.

The Controller may request early erasure of Personal Data (before the 30-day window expires) by emailing hello@modu-forge.co.uk. The Processor will action this within 30 days as required by Article 17 UK GDPR, apart from the records above that must be kept.

9. Data Subject rights

If a Data Subject contacts the Processor directly with a rights request (access, rectification, erasure, restriction, portability, objection, or a data protection complaint under the Data (Use and Access) Act 2025), the Processor will:

• Promptly notify the Controller of the request.
• Assist the Controller in responding within the UK GDPR timeframe (one calendar month, extendable by two months for complex requests).
• Not respond to the Data Subject directly without the Controller's instruction, unless required by law.

10. Audits

The Controller may request an audit of the Processor's compliance with this DPA by giving 14 days' written notice. The Processor will cooperate and provide reasonable access to relevant records and systems. Audits will be conducted during normal business hours and will not unreasonably interfere with the Processor's operations.

11. Liability

Each party's liability under this DPA is subject to the limitations set out in Section 12 of the Terms of Service.

12. Term and termination

This DPA comes into effect when the Controller accepts the Terms of Service and remains in effect for as long as the Processor processes Personal Data on behalf of the Controller. It terminates automatically when all Personal Data has been deleted or returned in accordance with Section 8.

13. Governing law

This DPA is governed by the laws of England and Wales. Any dispute arising under this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Cookies and storage on the Controller's site

The Processor's code stores nothing for tracking or advertising on the Controller's site, and a live site sets no cookies from it. This is everything it stores on a visitor's device, or asks the visitor's browser to fetch from another company, so the Controller's own privacy notice can say so:

A Controller's site shows content from another company that may store or read things on a visitor's device (a Google map, a YouTube video, or an analytics or marketing script) only if the Controller asks for it. The site then asks the visitor first, with a cookie banner in which rejecting is as easy as accepting, and loads that content only once they agree; until then it shows a placeholder and nothing is sent to that company. Once loaded, that company may set its own cookies, which the Controller's privacy notice names.

15. Contact

For any questions about this DPA, contact the Processor at hello@modu-forge.co.uk.