Data Processing Agreement

Version: 12 November 2026

1. Parties and scope

This agreement is between Rori Hinds trading as Practice, Flat 13, Grand Union Building, 55 Northgate Street, Leicester, LE3 5BZ, United Kingdom (Practice), and the business customer identified in the accepted service order or account (Customer). It applies when Practice processes personal data on the Customer's behalf to provide the service (Customer Personal Data). It forms part of the service agreement and takes priority on data-processing matters. Mandatory international-transfer terms take priority where they apply.

The Customer is normally the controller and Practice its processor. If the Customer is itself a processor, it must have authority from its controller to appoint Practice as a subprocessor. References to the Customer's instructions include that controller's authorised instructions. Practice's independent account administration, billing, security and optional marketing analytics are described separately in the Privacy Policy; this agreement does not convert those purposes into processing on the Customer's instructions.

2. Instructions and responsibilities

Practice will process Customer Personal Data only on documented instructions, including the service agreement, this agreement, authorised workspace actions and agreed written requests. This includes instructions about transfers. If legally required to process otherwise, Practice will inform the Customer before doing so unless the law prohibits that notice.

Practice will promptly inform the Customer if, in its opinion, an instruction infringes applicable data-protection law, and may pause the affected processing while the issue is resolved. Practice will not use Customer Personal Data for an unrelated purpose or authorise a supplier to do so under this agreement.

The Customer is responsible for the lawfulness of its instructions, necessary notices and permissions, data accuracy and minimisation, and deciding whether the service is suitable for its use. Practice remains responsible for its own legal and contractual obligations.

3. Confidentiality and security

Practice will ensure that people authorised to process Customer Personal Data are bound by confidentiality duties and receive access only as needed for their work.

Taking account of risk, the nature of the data, the state of the art and implementation cost, Practice will maintain appropriate technical and organisational measures, including the security schedule below. These include appropriate access controls, confidentiality and integrity safeguards, availability and recovery measures, and regular assessment of their effectiveness. Practice will not materially reduce the overall agreed level of protection during the service term.

4. Suppliers and international transfers

The Customer gives general written authorisation for the approved subprocessors in Schedule 3. Before a new or replacement subprocessor receives Customer Personal Data, Practice will provide written notice in advance and allow the Customer a reasonable opportunity to raise a data-protection objection before the new processing starts. Practice will seek a workable resolution. If none is available, the parties may end the affected service without a penalty for that termination, with a proportionate refund of unused prepaid service.

Practice will impose data-protection obligations on subprocessors providing equivalent protection for the relevant processing and remains responsible to the Customer for their performance. An independent controller is not a subprocessor merely because it appears in a supplier list; any such disclosure needs its own lawful basis and clear explanation.

For transfers restricted by applicable data-protection law, Practice will establish the required safeguards before transfer, such as an applicable adequacy arrangement or the relevant approved standard clauses and UK addendum/IDTA where needed, with required assessments and supplementary measures. This agreement does not itself execute those transfer instruments or certify that a supplier's standard terms are sufficient.

5. Requests, incidents and assistance

Taking account of the processing, Practice will assist the Customer through appropriate measures with requests for access, correction, deletion, restriction, portability and other applicable rights. If Practice receives a request about Customer Personal Data directly, it will promptly inform the Customer and will not respond substantively except on instructions or as legally required.

Practice will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will provide available information about the nature of the breach, affected data and people, likely consequences, mitigation and a contact point, updating that information as its investigation progresses. Notification is not an admission of fault.

Practice will assist with security duties, breach notifications, data-protection impact assessments and prior consultation with regulators, taking account of the nature of processing and information available. The Customer normally decides its regulatory and individual notifications; Practice will not prevent either party from fulfilling its own legal duties.

6. Return and deletion

At the end of the affected service, the Customer may choose return or deletion of Customer Personal Data. Practice will act on that choice without undue delay under the deletion schedule, and delete remaining copies unless applicable law requires retention. Required retained data will be isolated, protected and used only for the reason justifying retention.

Backups will remain protected and beyond ordinary use until their documented expiry. Any restoration must reapply relevant deletion instructions. Practice will confirm completion and identify any remaining lawful retention and expiry. A subscription cancellation alone does not constitute a deletion instruction: customers may retain saved work for a return under the agreed retention policy until they request closure/deletion or the service relationship ends.

7. Evidence and review

Practice will provide information reasonably needed to demonstrate compliance and allow and contribute to audits, including inspections, by the Customer or an authorised independent auditor. The parties will arrange reasonable scope, confidentiality and timing to protect other customers and system security. Such arrangements must not prevent an urgent investigation, regulatory requirement or effective exercise of audit rights.

Contact hello@practice.cx for requests under this agreement. The governing law and courts follow the Terms of Service, without overriding applicable data-protection law or mandatory transfer clauses.

Schedule 1 — Processing details

Schedule 2 — Security and deletion measures

Workspace access is authenticated and subject to workspace permissions. Server-side authorisation scopes access to customer data. Sharing and publication controls govern access to artefacts; customers must check their chosen sharing settings. Provider credentials are held server-side. Background endpoints authenticate requests, and financial and external-action records support reconciliation after interrupted work.

Practice limits administrative access to people who need it for service delivery, support or security, maintains confidentiality duties, reviews changes before release and investigates reported vulnerabilities and incidents. These measures are not a claim that Practice holds a SOC 2 or ISO certification.

Send export and deletion instructions to hello@practice.cx. Practice verifies the requester's authority, scopes the affected workspace and agrees the return format where needed. Deletion is an operator-managed process: processing and scheduled writers must be stopped, shared resources and legally retained records reviewed, and provider cleanup tracked. Practice will act without undue delay, keep the Customer informed of progress and explain any impediment or required retention. Subscription cancellation alone does not erase saved work.

Deletion is confirmed only after the relevant steps have completed. Provider failures are recorded and retried rather than reported as successful. Data retained for a legal requirement is restricted to that purpose. Backup copies remain protected and outside ordinary use pending expiry or deletion; any restore must reapply recorded erasure instructions. Practice will identify outstanding backup or supplier copies and applicable retention in its completion report rather than represent partial deletion as complete.

Schedule 3 — Suppliers

The supplier register identifies the providers used for the service. Only providers processing Customer Personal Data on Practice's behalf fall within this agreement's subprocessor authorisation; independent-controller and customer-selected services retain their separate roles.