Data Processing Agreement

This agreement forms part of our Terms of Business. It applies whenever Developed With Style Limited, trading as Structurell, company no. 10176636, registered office Hyde Park House, Cartwright Street, Hyde, SK14 4EH ("we"), processes personal data on behalf of a customer ("you") in providing our services, including Portal and work on your own systems. Under UK GDPR, you are the controller and we are the processor. Words such as "personal data", "processing" and "personal data breach" have their UK GDPR meanings. If this agreement and the Terms of Business conflict on data protection, this agreement wins.

1. Scope. We process personal data only to provide the services in your Order, for as long as the contract runs and until the data is deleted or returned under clause 9. The subject matter, types of data and data subjects are in the Annex.

2. Instructions. We process personal data only on your documented instructions: our Terms of Business, your Order, and how you use and configure Portal. If UK law requires us to process it otherwise, we tell you first, unless the law prevents it. We tell you if we believe an instruction breaks data protection law.

3. Confidentiality. Everyone we authorise to process the data is bound to keep it confidential.

4. Security. We keep appropriate technical and organisational measures under Article 32 of UK GDPR, including encryption in transit, access limited to named individual accounts, logging of access to production systems, UK hosting for Portal, and regular backups.

5. Sub-processors. You authorise us to use the sub-processors in the Annex. We give you at least 30 days' notice of any new or replacement sub-processor, by email to your contact in the Order, and you may object on reasonable data protection grounds. If we can't resolve your objection, you may end the affected services. Each sub-processor is bound by terms that protect the data at least as well as this agreement, and we remain responsible to you for it.

6. Transfers outside the UK. Where data leaves the UK, we rely on UK adequacy regulations, the UK–US Data Bridge, or the International Data Transfer Agreement or UK Addendum.

7. Assistance. Taking into account the nature of the processing and the information we have, we help you with data subject requests, security, breach notification, data protection impact assessments and consultation with the Information Commissioner. If a data subject or a regulator contacts us about your data, we pass the request to you promptly and don't respond without your approval, unless the law requires us to.

8. Breaches. We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with the information we have, and keep you updated as we learn more.

9. Deletion or return. When the services end, you can export your data for 30 days. Within 90 days of the end, we delete or return the data, at your choice, and backups expire within a further 30 days, unless UK law requires us to keep it. We confirm deletion in writing on request.

10. Audit. We make available the information you reasonably need to show we comply with this agreement. If that isn't enough, you, or an auditor bound by confidentiality, may audit our compliance on 30 days' written notice, no more than once a year unless there has been a personal data breach, at your cost.

11. Liability. Each party's liability under this agreement is subject to the limits in our Terms of Business.

Annex: details of processing

Subject matter and purpose: providing the services in your Order, including hosting and running Portal, and developing, maintaining and supporting your systems.

Duration: the term of the contract, plus the period until deletion under clause 9.

Data subjects: your staff and users, and your customers, suppliers and contacts whose data you hold in Portal or in systems you give us access to.

Types of data: contact details, user account details, order and customer records, CRM records, content, and any personal data in systems you give us access to. We don't process special category data unless we've agreed it in writing.

Sub-processors:

Sub-processor	What for	Where
Akamai Connected Cloud (Linode)	Servers and databases for Portal	London, UK
Laravel Forge	Server management	US company
Vercel	Portal's front end	Global network; US company
Microsoft 365	Email and documents	UK and EU
OpenAI	AI features in Portal	US
Anthropic	AI assistance with development and support work	US