Data processing agreement

1. Parties and roles

The processor is TicketWave HQ Ltd, trading as Custodiance, registered in England and Wales, company number 17143167, registered office Radley House, Richardshaw Road, Pudsey, LS28 6LE. There is no separate Custodiance company. Contact for this agreement: hello@custodiance.com.

The controller is the practice named in the engagement letter or order. Whether you are a law firm, an accountancy practice, a clinic, a school or another regulated body, you remain the controller of the personal data in your estate. We do not become its controller by running the estate, and your regulatory obligations remain yours.

Clinics. We act for private clinics only, and we do not process NHS patient data. That stays the position until we hold both a Data Security and Protection Toolkit submission as a supplier at Standards Met and Cyber Essentials certification, and we hold neither today (section 6). A clinic engagement therefore covers the data of the clinic's private patients only, and you will not route NHS patient data through anything we host or operate for you.

2. Subject matter, duration, nature and purpose

Subject matter: the personal data in the estate we host and run for you: your website and the enquiries and form submissions it receives; your applications and their databases; the files you store with us; the backups of all of these; your mailboxes; and, where they are in scope, booking and newsletter data.

Duration: for as long as the engagement runs, plus the return and deletion periods in section 9.

Nature and purpose:

• Your environment. We host your website, applications, databases and file storage on servers we administer, at OVHcloud in France and at Hetzner Online GmbH in Germany, in an environment of your own, kept apart from our own systems and from other clients' environments. Your schedule names the provider and the data centre for each part of your estate.
• Backups. We back up the databases and files we host for you every night. Each backup is encrypted on the server that makes it, to two keys that we hold, before it is stored at Scaleway in Paris, France. The servers that make the backups hold no key that can read them, and Scaleway holds only the encrypted copies.
• Mailboxes. We provide your practice's mailboxes at Proton AG in Switzerland, under our contract with Proton, and we administer them for you. Where you keep your own Microsoft 365 or Google Workspace tenant instead, it stays in your name under your own contract with that provider, it is your processor rather than ours, and administering it is not part of this agreement.
• Source code. The code, content and configuration of your website and applications are kept in a repository on GitHub (United States), from which they are deployed. The personal data in your databases, files and mailboxes, and credentials, are not kept there.
• Websites on Vercel, where your schedule says so. Where your schedule keeps your website on Vercel rather than on the servers above, Vercel hosts it, with the server-side code pinned to Vercel's London region in the project's configuration and checked on each deployment. Vercel keeps request logs.
• Domain names. Where we host your domain's name records, they are held at Cloudflare as DNS only. No website traffic and no email passes through Cloudflare.
• Form email. Where a form on your site sends email, we relay it through Scaleway Transactional Email (Paris) to your mailbox.
• Analytics, where they are in scope: we count pageviews on our own Plausible Community Edition server, on OVHcloud hardware in Gravelines, France, without cookies and without personal profiles.
• Newsletters, where your estate includes one that we send for you: we send it through MailerLite (Lithuania) with double opt-in, named in your schedule.
• A CRM, a booking system, a payment provider or an e-signature platform included in an estate is opened in your name under your own contract with its provider, so it processes data for you, not for us. We connect it to the estate.

We do not run a bulk mail sender or a payment service of our own, and we take no card payments. Where your estate needs one, it is scoped with you and added to your schedule before it handles any data.

3. Categories of data subject

• Visitors to your website and users of your applications, including people who submit a form or book.
• Your clients, patients, pupils and their parents or carers, and other people whose personal data enters the estate.
• Your staff, and the people who write to your mailboxes or receive mail from them.

4. Categories of personal data, and special-category data

Ordinary contact data: names, email addresses, telephone numbers, organisation, the text of a message, and booking or subscription details where those are in scope. Beyond that, whatever you keep in the estate: the records in your applications' databases, the files you store with us and the content of your mailboxes.

Special-category data under UK GDPR Article 9 is likely in a clinic's or a school's estate, and the data in a law firm's or an accountancy practice's estate can reveal it. Mailboxes, stored files and application databases can hold it in any practice. We build intake to collect the minimum: a general reason for contact rather than a condition, a diagnosis, a matter or a pupil's circumstances, with the sensitive detail taken through a channel inside your own duty of confidentiality. Where your estate will handle special-category data, we handle it only after a data protection impact assessment for the engagement has been completed and its measures agreed with you (our register reference DPIA-05). The Article 9 condition for the processing, and any appropriate policy document, are yours as controller, and you will tell us before routing special-category data through anything we operate.

5. Our obligations as processor

We will:

• process personal data only on your documented instructions: this agreement, your engagement letter or order, and any reasonable written instruction from you; and tell you if we believe an instruction breaks data protection law;
• ensure that everyone authorised to process personal data is bound by confidentiality;
• implement the technical and organisational measures in section 6;
• engage sub-processors only on the terms in section 7;
• help you respond to data subject rights requests (Articles 12 to 23) with exports, corrections and deletion within a reasonable time;
• help you meet your obligations under Articles 32 to 36: security, breach notification and impact assessments, including the information you need for an ICO or a Data Security and Protection Toolkit report;
• notify you of a personal data breach affecting your data within 24 hours of becoming aware of it (section 11);
• at the end of the engagement, at your choice, return or delete the personal data we hold for you (section 9);
• make available the information needed to demonstrate compliance with Article 28, and allow audits and inspections as section 12 sets out.

6. Security measures

• Encryption in transit. TLS on every connection to your website and applications, with HSTS. Mail between our systems and yours travels over TLS.
• Encryption at rest. Backups are encrypted on the server that makes them, to two keys we hold, before they leave it, so neither the storage provider nor that server can read them. Whether live data on a server is also encrypted at rest is stated, system by system, in your schedule.
• Separation. Your environment is your own, apart from our own systems and from other clients' environments. Each application listens only on its own server, behind a web server that handles TLS. Any database that accepts connections from elsewhere accepts them only over TLS with a client certificate we issue, and each application is limited to its own database.
• Where the data sits. In the data centres your schedule names, in France and Germany. Where your schedule keeps a website on Vercel, its server-side code is pinned to Vercel's London region in the project's configuration and checked on each deployment.
• Application hardening. A strict Content Security Policy with a fresh nonce on every request; no third-party scripts, no tracking code and no cookies by default; fonts served from the site itself; security headers that stop framing and content sniffing.
• Access control. Administrative access held to the named technical partner and to anyone else named to you in writing. Two-factor authentication on every administrative account (GitHub, Vercel, Proton and the providers of the servers we administer).
• Backup and recovery. Nightly backups of the databases and files we host for you, encrypted before they are stored off-site; source code in version control; a restore from the encrypted backups rehearsed every week.
• Monitoring. Availability monitoring with alerts to the named partner.
• People. Everyone with access to your systems is bound by confidentiality and briefed on UK GDPR data handling, phishing and breach reporting.

What we do not hold. We hold no Cyber Essentials or ISO 27001 certification, and we have made no NHS Data Security and Protection Toolkit submission as a supplier. No ICO registration number appears on this site. We state this plainly so that you can record it in your own supplier review rather than infer it from a blank.

7. Sub-processors

You authorise us to engage the providers on our sub-processor list: a standing list that applies to every engagement, and per-estate additions that apply only where your estate needs them and that your engagement letter names in a schedule. Systems held in your own name (a Microsoft 365 or Google Workspace tenant you keep, a CRM, a booking system, a payment provider) are your own processors under your contracts with them, not ours.

We give you at least 30 days' written notice, by email to the address on file, before we add a provider that will process your personal data. You may object on reasonable data-protection grounds within that window; if we cannot accommodate the objection, you may end the engagement and we refund any fees prepaid for the period after it ends. We remain responsible to you for every sub-processor we engage.

8. International transfers

The servers we administer for you are in France and Germany, and your backups are stored in France. The EU is covered by the UK's adequacy regulations, and so is Switzerland, where your mailboxes and ours are held. Three providers are US-incorporated: GitHub (source control), Cloudflare (DNS only) and, where your schedule keeps your website there, Vercel (hosting, London region). For each, the safeguard for any transfer outside the UK and EU is in the provider's own terms: the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the provider's certification under the UK Extension to the EU-US Data Privacy Framework. We name them as exceptions because a US company can be subject to US law wherever the data is held. The sub-processor list records the safeguard for every provider.

9. Retention, return and deletion

During the engagement we process personal data as needed to deliver the service. When the engagement ends:

• Within 14 days we export the personal data we hold for you (the contents of your databases, your stored files, your mailboxes, and form, newsletter and booking data where we hold it) in standard formats, CSV for tables by default, and make the export available to you securely. Accounts held in your name stay yours.
• Your domain, its DNS records, your mailboxes and your content are yours throughout. We hand them, and the repositories for your website and applications, to you or to your next provider as your engagement letter sets out, and remove our own access. Any transition period during which your statutory pages stay live is set in your engagement letter.
• Within 60 days we delete your personal data from our active systems, unless you ask us in writing to keep it longer for a stated reason, and we confirm the deletion to you in writing. Copies in our encrypted backups are deleted when the backup retention period stated in your schedule runs out, and we confirm that in writing too.
• We keep the records of the engagement itself (the contract, correspondence, invoices and payments) for six years after it ends, as our privacy notice sets out. We hold those as a controller, not as your processor.

10. Data subject rights

If a data subject contacts us directly with a request (access, rectification, erasure, restriction, portability or objection), we forward it to you promptly: you, as controller, are responsible for the response under Articles 12 to 23. We give you reasonable technical help to fulfil it, including exports and deletion from the systems we operate and the mailboxes we administer.

11. Breach notification

If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any event within 24 hours of becoming aware of it, by email and by telephone to the contacts on file. We give you, as far as we know it, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed, and we keep updating you as we learn more. The 24 hours leave you margin inside your own 72-hour window for reporting to the ICO, and we give you what you need for that report and for any Data Security and Protection Toolkit incident record.

12. Audits, and your regulator

We make available to you the information needed to demonstrate compliance with this agreement. On at least 30 days' written notice, and not more than once a year except after a breach affecting your data, you may audit our compliance by a written questionnaire, which we complete within 30 days. An audit on our premises or by a third party you appoint is available on reasonable notice, at cost recovery for our time.

Where your regulator's or supervisory body's rules require it of an outsourced function (the SRA Code of Conduct for Firms is one example), we will on request give information to, allow the inspection of our records relating to the services by, and give access to any premises from which the services are provided to, your regulator or supervisory body, including the ICO, the SRA, ICAEW or another anti-money-laundering supervisor, the CQC and an NHS Data Security and Protection Toolkit reviewer. The once-a-year limit does not apply to them.

13. Liability and precedence

Each party's liability under this agreement is subject to the liability terms in the engagement letter or the terms of business that govern your engagement. If this agreement conflicts with them, this agreement prevails on data-processing matters only.

14. Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. How we sign and amend it

We sign this agreement with each practice. The version that applies to you is the one in force at the date of your engagement letter, unless we agree a later one in writing or a change in the law requires one. On request we provide a PDF copy, executed by us, within five working days, for your countersignature and your file, and we can work from your own template by negotiation where your procurement requires it.

Amendments between us are made in writing and signed by both parties. We update the published version when what we do changes; each change is listed in the changelog below with its version and date, and we tell current clients of any change that affects them.

16. Related documents

Sub-processor list (the canonical list referred to in section 7) · Privacy notice · The Custodiance Standard

17. Changelog

• v2.0, 16 October 2026: rewritten for managed hosting. The agreement now covers the hosting of a practice's website, applications, databases, file storage, backups and mailboxes, on servers we administer at OVHcloud in France and Hetzner in Germany, in an environment of the practice's own, with backups encrypted to two keys we hold and stored at Scaleway in France, and mailboxes at Proton in Switzerland. Vercel is used only where a practice's schedule keeps its website there. Clinics: private practice only, with no NHS patient data, until we hold both a DSPT submission as a supplier and Cyber Essentials (section 1). Encryption of live data at rest, and how long backups are kept, are stated per system in the practice's schedule rather than assumed. Unchanged: breach notice within 24 hours, 30 days' notice before a new sub-processor, the audit terms and the DPIA before special-category data.
• v1.0, 15 October 2026: first publication. Adapted from the VerySEOly data processing agreement v1.9 of the same company for regulated practices: the practice as controller; breach notice within 24 hours; special-category data handled only after a data protection impact assessment for the engagement; audit and inspection rights for the practice's regulator; signed with each practice; what we do not hold stated in section 6.