Data Processing Addendum

Last updated: 19 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the account holder, "you") and JW Digital Services Ltd ("we", "us"). It applies whenever we process personal data on your behalf under UK data protection law — in practice, when visitors submit enquiries through a site you publish with the Service. For that data you are the controller and we are your processor.

1. What we process

• Data subjects — visitors to your published site who submit its contact form.
• Categories of data — the name, contact details (email address and/or phone number), and message text the visitor submits, together with the submission's IP address and browser identifier, which are recorded to protect the form from spam and abuse.
• Nature and purpose — receiving, storing, and displaying enquiries to you in your dashboard; filtering spam; no other use. We do not use enquiry data for our own purposes, and we never sell it.
• Duration — each enquiry is deleted automatically 12 months after it is received, or earlier if you delete it or close your account.

2. Our obligations

• We process enquiry data only to operate the Service as documented — your use of the Service is your documented instruction — and not for any other purpose.
• We protect it with appropriate technical and organisational measures, including encryption in transit, access controls that scope every read and write to the owning account, and a least-privilege database role for the public-facing part of the Service that cannot read enquiry data at all.
• People with access to enquiry data are bound by obligations of confidentiality.
• We will tell you without undue delay if we become aware of a personal data breach affecting your enquiries, with enough detail for you to meet your own obligations.
• We will assist you, so far as reasonably possible, with data subject requests and with your security and impact-assessment obligations — your dashboard already lets you view and delete individual enquiries.
• When this DPA ends (your account closes), enquiry data is deleted. We will provide information reasonably necessary to demonstrate compliance with this DPA on request.

3. Subprocessors

You authorise the subprocessors we use to run the Service: Neon (database hosting), Vercel (application hosting), Cloudflare (storage and delivery of uploaded files), and Google (Gmail, which delivers the enquiry notification emails we send you — those emails contain the enquiry itself, including the sender's name and contact details), and Anthropic (AI help with wording, where you switch it on; United States). We remain responsible for their processing. If we change subprocessors we will update this page and the Privacy Policy; continuing to use the Service after a change constitutes acceptance, and if you object your remedy is to stop using the Service and close your account.

4. International transfers

Where a subprocessor processes data outside the UK or EEA, the transfer is protected by appropriate safeguards such as the UK Addendum to the EU Standard Contractual Clauses or an adequacy decision.

5. Your obligations

You are responsible for having a lawful basis for the enquiries you collect, for telling your visitors how you use their details (your site's own privacy information), and for responding to their data protection requests. The 12-month retention period is fixed by the Service; if your business needs an enquiry for longer, keep your own copy of it before it expires.

6. Who we are

JW Digital Services Ltd, company number 15243830, 266 Altrincham Road, Manchester M22 4AA.