Revised for review: 12 October 2026.
REVIEW DRAFT — NOT READY FOR CUSTOMER ACCEPTANCE. This is general drafting assistance, not legal advice. It reconciles the supplied DPA with the accompanying Terms review draft and the user's confirmed scope. Provider/transfer details, actual security measures and the return/deletion procedure remain to be finalised. No unsupported security certification, tested backup process or active post-termination read-only feature is claimed.
This proposed Data Processing Agreement (“DPA”) accompanies the written Order and identified Terms of Service between Robert Christopher Link, trading as Prospexe (“Prospexe”, “we” or “us”), and the business Customer identified in that Order (“Customer” or “you”). It applies to Customer Personal Data processed on the Customer's behalf through the Service.
The agreed DPA must be supplied with the Order and identified by title and version or revision date. It does not depend on an existing public /dpa webpage. Undefined capitalised terms have the meaning given in the agreed Terms.
1. Definitions
1.1 “Data Protection Legislation” means the UK GDPR, the Data Protection Act 2018, applicable Privacy and Electronic Communications Regulations and other applicable data-protection legislation, as amended.
1.2 Controller, Processor, Personal Data, Processing, Data Subject and Personal Data Breach have their applicable statutory meanings.
1.3 “Customer Personal Data” means personal data within Customer Data processed on the Customer's behalf, distinct from our independent controller processing.
1.4 “Sub-processor” means a provider appointed by Prospexe to process Customer Personal Data on its behalf in providing the Service. A customer-selected integration is not automatically classified as a Prospexe-appointed Sub-processor; the actual relationship and data flow must be identified.
2. Roles and customer authority
2.1 Where the Customer is the Controller, Prospexe acts as its Processor for Customer Personal Data. Where the Customer acts as an authorised Processor for an end-client Controller, Prospexe acts as a further Processor in that chain. The Customer must have authority to appoint Prospexe and give the documented instructions.
2.2 The Customer is responsible for lawful sourcing, the relevant lawful basis and any required special-category condition or permissions, and the lawfulness of its instructions. These responsibilities do not remove Prospexe's own statutory obligations.
2.3 Our independent controller processing, including relevant account administration and billing information, is explained in our Privacy Policy. Processing roles must be assessed for the actual purpose; staff data is not automatically outside this DPA merely because those staff have accounts.
3. Documented instructions and processing scope
3.1 We will process Customer Personal Data only on documented, lawful instructions, including the agreed contract and authorised use of its agreed functions, or as required by applicable law. Where legally permitted, we will inform the Customer of a legal processing requirement before carrying it out.
3.2 If we consider an instruction infringes applicable data-protection law, we will promptly inform the Customer and may suspend that instruction while it is addressed.
3.3 Annex 1 identifies the proposed processing scope. Sensitive data may be processed only within the agreed scope and safeguards. Health-related HR records are included for customer-directed employment/absence purposes; that is not permission for unrestricted health, biometric or other sensitive uploads.
4. Confidentiality
4.1 People authorised to process Customer Personal Data must be subject to an appropriate binding duty of confidentiality and receive access only as needed for authorised purposes.
5. Security and resilience
5.1 We will implement appropriate technical and organisational measures for the risks of the agreed processing, including appropriate confidentiality, integrity, availability, resilience and restoration arrangements, and regular assessment of their effectiveness.
5.2 The final Annex 2 must describe the measures actually in place for the deployment. References to encryption, backups, administrative MFA, training or incident procedures are not evidence that each has already been implemented or tested.
5.3 Material changes must not unlawfully reduce the required protection. Customer security responsibilities do not replace our obligations. Security cannot be guaranteed against every possible threat.
6. Sub-processors
6.1 The completed Annex 3 will identify authorised Prospexe-appointed Sub-processors, their functions and relevant locations. The review notes in the present Annex 3 are not an approved production list or a blanket authorisation for unidentified providers.
6.2 We will impose the required written data-protection obligations on appointed Sub-processors and remain responsible to the Customer for their performance to the extent required by law.
6.3 We will give reasonable advance written notice of a proposed addition or replacement, sufficient for an opportunity to object on reasonable data-protection grounds. No fixed number of days is agreed.
6.4 We will seek to resolve a reasonable objection. If no lawful, reasonable alternative can be agreed, the parties will address termination of the affected service. This does not remove mandatory legal remedies or impose an unlawful exclusive-remedy restriction. The agreed Terms govern any contractual refund entitlement, subject to law.
7. International transfers
7.1 Transfers of Customer Personal Data outside the UK must comply with applicable transfer requirements, including a valid adequacy arrangement, appropriate safeguards such as the applicable UK transfer documents, or another lawful mechanism where available.
7.2 UK-targeted hosting does not establish that every authentication or provider data flow stays in the UK. The Customer approved overseas login processing in principle; that approval is not evidence that a particular transfer mechanism has been verified.
7.3 Actual provider roles, processing locations and applicable transfer safeguards must be recorded before the contract package is finalised. Nothing here represents unverified safeguards as already executed.
8. Data subject requests
8.1 Taking account of the processing and information available to us, we will assist the Customer through appropriate measures with its obligation to respond to requests concerning Customer Personal Data.
8.2 If a request arrives directly with us, we will promptly inform the Customer and normally redirect the individual to the responsible Controller, unless required or authorised to respond otherwise by applicable law or lawful instruction.
9. Assistance with compliance
9.1 We will provide the assistance required by applicable law with processing security, breach response, impact assessments and relevant regulatory consultations, taking account of the nature of processing and information available to us.
9.2 The procedure and any charges for optional assistance beyond statutory/contractual duties must be agreed in writing. No additional fee arrangement may prevent a mandatory duty being fulfilled.
10. Personal Data Breach notification
10.1 We will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, consistently with UK GDPR Article 33(2). No fixed contractual outer deadline is agreed. We will not delay the initial notification while awaiting a complete investigation, risk assessment or all the details.
10.2 We will provide the information then available about the breach's nature, affected categories and approximate numbers, a contact point, likely consequences and response measures, and provide further information without undue further delay as it becomes available. We will cooperate appropriately with the Customer's response.
10.3 The responsible Controller must assess and fulfil its own notification obligations. Under UK GDPR Article 33(1), it must notify a reportable breach to the ICO without undue delay and, where feasible, not later than 72 hours after awareness, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. A notification made after 72 hours must give reasons for the delay. That reporting period is not an allowance for us to wait before notifying the Customer. Where the Customer acts as a Processor, it must notify its own Controller without undue delay.
10.4 Nothing in this clause removes another applicable mandatory notification obligation, including our obligations where we independently act as a Controller, or the assistance required under this DPA. The operational incident-escalation and response procedure must still be verified; the absence of a fixed contractual outer deadline does not relax the requirement to act without undue delay.
11. Termination, return, deletion and retained copies
11.1 At the end of service, the Customer may instruct return or deletion of Customer Personal Data as applicable under law. The lawful procedure, return format, secure delivery, timing, retained backups and provider copies must be completed before customer acceptance of this DPA.
11.2 The Customer's intended commercial arrangement is 30 days of restricted read-only/export access after termination. That mode is not activated by these drafts. It applies only once the mode and associated return/deletion process are implemented and verified and expressly documented as active in the agreed customer contract, consistently with Terms clauses 11.5 and 11.6.
11.3 The agreed drafting intention is completion of Customer Personal Data deletion from the active Service at the end of the full 30-day export window, subject to lawful instructions and identified legal-retention exceptions. It is not a further 30-day period in which deletion merely begins. Before this becomes an active contractual commitment, a verified process must preserve the full export window and complete active-service deletion at that boundary, including safe handling of exports in progress. Lawful instructions for earlier return or deletion remain effective where applicable. This draft does not verify or activate that process.
11.4 Backup and provider-copy retention requires separate confirmed arrangements. Active-service deletion at day 30 is not a blanket promise that every backup or provider copy disappears then. Retained Customer Personal Data remains protected by this DPA, is not reused for unrelated purposes, and must be restricted appropriately. The completed procedure must address legally required retention, backup isolation and a defined expiry/deletion schedule, and treatment of data if a backup is restored, without using these matters to avoid a mandatory return/deletion obligation.
11.5 This review draft is not a substitute for the final return/deletion provision required for customer processing. No automatic cleanup, bulk deletion or post-termination account mode is authorised or implemented by this drafting work.
11.6 Terms clause 11.6 contains the broader commercial commitment covering all customer workspace content across subscribed functions, including both personal and non-personal records, attachments and configuration. This DPA governs Customer Personal Data and does not narrow that broader Customer Data commitment to personal data alone. The broader scope is subject to the same verification and contractual-activation conditions, identified lawful exceptions and separate backup/provider-copy arrangements.
12. Information and audits
12.1 We will make available the information required to demonstrate compliance and allow and contribute to audits, including inspections, as required by applicable data-protection law.
12.2 Audits should use reasonable advance notice, appropriate confidentiality, reasonable scope and safeguards for other customers' data. Routine audits may ordinarily be scheduled no more than annually, but this cannot prevent audits required by law, a regulator, a relevant breach or reasonable evidence of non-compliance.
12.3 Relevant independent reports may help avoid duplicative work where actually available, but do not automatically replace mandatory audit rights. No ISO 27001, SOC 2 or equivalent certification is claimed. Routine audits require reasonable advance notice, with no fixed number of days agreed, subject to the exceptions in clause 12.2.
13. Liability and contract precedence
13.1 The applicable limitations and exclusions are those in Terms clauses 13 and 14, to the extent legally permissible. Prospexe's proposed cap is the Customer's fees paid in the preceding 12 months, with no agreed monetary floor. The specified Customer indemnity is capped on the same basis; this is not automatically a general cap on all Customer liability.
13.2 Nothing removes liabilities or rights that cannot lawfully be limited, including applicable rights of Data Subjects or powers of regulators. The DPA prevails over the Terms for conflicting Customer Personal Data processing requirements.
14. Duration and contacts
14.1 The completed DPA takes effect with the authorised representative's written acceptance of the identified contract package and continues while we process or retain Customer Personal Data for the Customer, including the agreed post-termination period.
14.2 Data-protection notices to Prospexe should be sent to info@prospexe.co.uk. The Customer's authorised instruction and notice contacts must be recorded in the Order or processing schedule.
Annex 1 — Details of processing
Subject matter: providing the subscribed agency CRM/workspace and agreed associated communications, reporting, staff/HR and support functions on the Customer's instructions.
Duration: the agreed service relationship and the finalised return/deletion and lawful retention periods. The intended 30-day read-only/export period is subject to the activation conditions in clause 11.
Nature and purpose: hosting, storage, retrieval, organisation, display, authorised sharing, export and customer-instructed transmission of Customer Personal Data; communications/call handling and transcripts where enabled; HR/absence administration where enabled; and necessary technical support, security and agreed backup operations.
Data subjects: contacts and prospects of the Customer or its authorised end-clients; people participating in customer-directed communications; Customer personnel and contractors; and relevant people identified in support or HR records.
Personal data categories: contact and business identifiers, account/workspace identifiers as applicable, communications and interaction histories, call metadata and transcripts, support content and attachments, and staff/HR employment and absence information within the agreed functions.
Special-category scope: health-related HR information required for the Customer's employment/absence administration, only on lawful documented instructions, with the required lawful basis, special-category condition, access restrictions and agreed safeguards. Other special-category or criminal-offence data requires a separately assessed and documented scope before processing.
Required finalisation: specify the Customer's Controller/Processor role, ultimate-controller authority where relevant, enabled functions, authorised HR access, sensitive-data safeguards and responsible contacts. This annex is not a licence for unrestricted sensitive uploads.
Annex 2 — Security schedule requiring verification
The following areas must be described accurately for the actual deployment before this schedule is approved:
- Transport protection and the actual scope of application, database, stored-file and provider encryption; access to encryption keys and relevant limitations.
- Agency segregation and role-based permissions, privileged access, unique accounts and the actual administrative MFA configuration.
- Logging, monitoring, incident escalation and breach handling, without exposing credentials or unnecessary personal data in logs.
- Actual backup provider, locations, frequency, retention, restoration process and evidence of restoration testing.
- Appropriate confidentiality duties, access-review procedures, staff awareness/training arrangements and vendor review.
- The intended dependency checks and scheduled security scans, with evidence of operation rather than an unsupported claim of certification or comprehensive independent audits.
- Return/deletion controls, restricted post-termination access and treatment of backup and provider copies once approved and implemented.
This is a finalisation checklist, not a representation that every listed measure has already been delivered or tested.
Annex 3 — Provider schedule requiring confirmation
Current production hosting/storage: verify the actual provider, products, roles and locations. IONOS is the planned hosting/storage provider; that plan is not confirmation that the production Service or backups have moved there.
Replit-managed Clerk: used for authentication. Identify the exact processing purposes, controller/processor role for each relevant flow, locations, contractual protections and transfer safeguards. Independent controller account processing must not be indiscriminately listed as Customer Personal Data sub-processing.
Customer-selected email, voice and messaging services: record the providers actually selected and instructed, and identify their contractual role and the relevant data flow. Do not describe all such providers as automatically appointed by Prospexe.
No subscription payment provider has been selected and no website analytics provider is currently used. Do not add fictional providers merely to fill categories in the original template.
Any Prospexe-appointed support, communications, infrastructure or other provider that processes Customer Personal Data must be added to the completed authorised list with its role, locations and required protections.
This annex is not yet an approved production Sub-processor list. Complete and agree it before customer processing under the final contract package.
Review checklist — remove only after resolution
- Based on the user's already supplied DPA, not a request for a replacement upload. The original remains unchanged.
- Reconcile and approve both contract versions together. Do not publish or offer this package for acceptance while the security, provider and return/deletion schedules remain incomplete.
- Notice choices are agreed: reasonable advance notice, with no fixed number of days, for sub-processor changes and routine audits; breach notification without undue delay, following the applicable legal requirement rather than an extra fixed contractual outer deadline. The Controller's separate 72-hour reporting rule is distinguished in clause 10.3. Verify the actual incident-escalation, response and audit procedures.
- Confirm health-related HR safeguards and processing authority where an agency is itself a Processor for an end-client.
- The user chose all customer workspace content for active-service deletion completed at the end of the full 30-day export window, not a later deletion period. The Terms cover personal and non-personal content and configuration; this DPA continues to govern personal-data processing. Verify the scope, boundary, exports in progress, backup/provider retention and lawful exceptions before contractual activation. This document work does not authorise destructive cleanup.
- Obtain UK legal review of the liability cap, data-protection rights, sensitive-data provisions and completed processing schedules. No home address or invented company-registration details are included.
UK breach-notification sources
Checked on 12 October 2026 for this review. These sources support the distinction between processor-to-controller notification without undue delay and a Controller's reporting obligation; they do not verify Prospexe's operational response arrangements.
- UK GDPR Article 33, including paragraphs (1), (2) and (4): https://www.legislation.gov.uk/eur/2016/679/article/33
- ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/