Data Processing Agreement

Dashient Ltd ("we", "us", "Processor") is a UK digital growth agency registered in England & Wales under company number 17262776, with registered office at 124 City Road, London, EC1V 2NX. This Data Processing Agreement ("DPA") forms part of the contract between Dashient Ltd and the client ("Controller") and governs how we process personal data on the client's behalf when delivering our services, in accordance with UK GDPR Article 28 and the Data Protection Act 2018.

1. Parties

Data Controller: The client organisation that has engaged Dashient Ltd for digital growth services

Data Processor: Dashient Ltd, company number 17262776, 124 City Road, London, EC1V 2NX — contact@dashient.co.uk

2. Definitions

Terms used in this DPA have the meanings given in the UK GDPR and the Data Protection Act 2018, including: Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach, and Supervisory Authority (the UK Information Commissioner's Office).

3. Scope of Services and Data Processed

Dashient processes personal data on behalf of the Controller when delivering the following services:

• Local SEO — optimisation of service pages, Google Business Profile, and technical SEO; processing includes website visitor data, search query data, and GBP listing engagement data
• Paid Advertising — management of Google Ads and Meta Ads campaigns; processing includes campaign performance data, audience data, conversion data, and cost data
• Dashient Reporting Dashboard (DRD) — daily-updated unified reporting across Google Ads, Meta Ads, GA4, Google Search Console, and Google Business Profile; processing is read-only retrieval and display of marketing performance data
• Lead Attribution — tracking enquiries by channel and type (form submissions, click-to-call taps and direction requests); processing includes lead source data and conversion records
• Unlimited Reports & Exports — PDF reports, leads CSV, and keyword rankings CSV; processing includes aggregated performance data
• Weekly review flags: analysis of marketing data to surface week-on-week changes and recommended focus areas; processing includes aggregated campaign and lead data

All data is processed solely for the purpose of delivering the agreed services. No data is sold, shared with unauthorised third parties, or used for any other purpose.

4. Processor Obligations

Dashient Ltd agrees to:

• Process personal data only on documented instructions from the Controller
• Ensure all authorised personnel are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (see Section 6)
• Not engage new sub-processors without prior written consent of the Controller
• Assist the Controller in fulfilling data subject rights requests within 72 hours of notification
• Notify the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware
• Delete or return all personal data within 30 days of termination of the service agreement
• Provide all information necessary to demonstrate compliance with UK GDPR Article 28

5. Sub-processors

Dashient Ltd currently uses the following sub-processors:

• Supabase Inc — database and authentication hosting (EU region)
• Railway Corporation — application hosting (EU region)
• Google LLC — GA4, Google Ads, Search Console, and GBP API data retrieval (covered by Google Ads Terms and Google API Terms of Service)
• Meta Platforms Inc — Meta Ads API data retrieval (covered by Meta Business Terms)
• Zoho Corporation — email communications
• Cloudflare Inc — DNS, CDN, and bot protection

The Controller will be notified of any changes to this sub-processor list with reasonable notice.

6. Security Measures

Dashient implements the following technical and organisational security measures:

• Encrypted data transmission (HTTPS/TLS) for all connections
• OAuth 2.0 for all third-party platform API connections — no raw credentials stored
• Role-based access control (RBAC) within the DRD platform (Founder, Editor, and Client roles)
• Supabase Row Level Security (RLS) policies ensuring clients can only access their own data
• Audit logging of all data access and changes within the DRD platform
• Regular security reviews and dependency updates

7. Data Retention

Client data is retained for the duration of the service agreement. Upon termination, all client personal data will be securely deleted within 30 days unless retention is required by applicable law.

8. International Data Transfers

Some sub-processors may process data outside the United Kingdom. All international transfers are subject to appropriate safeguards under UK GDPR Article 46, including adequacy decisions, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses.

9. Data Subject Rights

Dashient will assist Controllers in responding to data subject rights requests, including rights of access, rectification, erasure, restriction, and portability, within 72 hours of notification by the Controller.

10. Breach Notification

In the event of a personal data breach affecting Controller data, Dashient will notify the Controller without undue delay and no later than 48 hours after becoming aware of the breach, providing details of the nature of the breach, data affected, likely consequences, and measures taken.

11. Audit Rights

The Controller may request information necessary to demonstrate Dashient's compliance with this DPA. Dashient will provide a written response within 14 days of any such request.

12. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

13. Contact

For any DPA-related queries or to exercise data subject rights: contact@dashient.co.uk