Document release: 2026-09-18.6 · Effective: 2026-09-18

Save this document (.md)

Data Processing Agreement

This Data Processing Agreement (DPA) is between Backends (the Provider) and the customer accepting the Terms (the Customer). It applies where the Provider processes personal data in Customer objects or related instructed operations on the Customer's behalf. It is not a claim that the service is suitable for every regulated workload.

The DPA forms part of the service contract and takes priority over inconsistent service terms for the processing it governs. It supplements rather than displaces applicable data protection law. There is no additional charge merely to enter this DPA.

1. Definitions, roles and instructions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and applicable amendments, together with other applicable data protection requirements. "Personal Data", "Controller", "Processor", "Personal Data Breach" and "processing" have the meanings given by that law. "Customer Data" is Personal Data processed on the Customer's behalf in providing the service.

The Customer is the Controller, or a Processor authorised by its Controller. The Provider is respectively the Processor or sub-processor. The Customer confirms it is authorised to issue instructions and to appoint the Provider where it acts for another Controller. The Provider's separate Controller activities, such as necessary account management, are explained in the Privacy Notice, not converted into instructed processing by this DPA.

The Provider processes Customer Data only on documented instructions, including these documents, authenticated S3/API operations and subsequently agreed written instructions. Instructions include any international transfer. If law requires other processing, the Provider informs the Customer before it occurs unless that law prohibits notice on important public-interest grounds. The Provider will promptly tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and will pause the affected operation while seeking clarification where appropriate.

2. Processing schedule

The Customer must provide enough further information for an appropriate risk assessment if its proposed processing differs materially from this schedule. Service restrictions do not remove obligations that apply to data actually received.

3. Confidentiality and personnel

The Provider limits access to authorised personnel with a legitimate need. People authorised to process Customer Data must be bound by confidentiality commitments or an appropriate statutory duty, receive suitable guidance, and access only what their role requires. These safeguards continue after their access or employment ends.

4. Security measures

Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing and risks to people's rights, the Provider implements appropriate technical and organisational measures under Data Protection Law. It maintains measures for confidentiality, integrity, availability and resilience; restoration of availability and access in a timely manner after an incident; and regular testing and evaluation.

The service-specific baseline is described in Schedule A below. The Provider may improve or change individual controls without materially reducing the overall protection. It gives reasonable notice of a material change that affects the Customer's assessment, except where urgent security or legal action requires faster implementation.

The free tier does not include a numerical recovery or uptime SLA. That does not exclude mandatory security or recovery obligations. Customers remain responsible for assessing whether the risk profile and agreed controls suit their processing, and must keep appropriate independent copies.

5. Sub-processors

The Customer gives general written authorisation for the sub-processors specifically identified as having Customer Data processing functions in the Provider and Location Register at the time of agreement. A provider used only for the Provider's Controller activities is identified separately and is not thereby authorised to process Customer objects.

Before appointing or replacing a sub-processor for Customer Data, the Provider gives at least 30 days' prior written notice, describing its identity, function and relevant locations. The Customer may object on reasonable data-protection grounds during that period. The parties will seek a reasonable alternative. If they cannot resolve the objection, the Customer may end the affected service without penalty and obtain return or deletion before the new processing starts. The Provider will not begin the disputed new processing while relying on an unresolved objection as consent.

The Provider imposes written obligations on each sub-processor offering the same level of protection for relevant processing, including confidentiality, security, assistance and deletion. The Provider remains responsible to the Customer for the sub-processor's performance of those obligations. Emergency service measures do not dispense with required authorisation or transfer safeguards.

6. Assistance with individuals' rights

Taking account of the nature of processing, the Provider uses appropriate technical and organisational measures, so far as possible, to help the Customer respond to individuals exercising their rights. It promptly forwards a request relating to Customer Data where the Customer is the appropriate decision-maker, unless prohibited by law.

The Provider does not decide the merits of such a request or disclose Customer Data directly unless instructed or legally required. It may make a proportionate identity/scope check and assist with locating, exporting, correcting, restricting or deleting data. The Customer supplies sufficient identifiers without requesting unnecessary access to other people's data.

7. Incidents and other assistance

The Provider notifies the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data. It does not wait to finish a full investigation or to decide whether the Customer must notify a regulator.

As information becomes available, it provides the nature of the breach, affected data/people and approximate scale where known, a contact for follow-up, likely consequences, and measures taken or proposed to contain, remedy and mitigate it. It may provide information in phases and will cooperate with the Customer's response. Security incident records and communications must not unnecessarily expose secrets or unrelated customers.

Taking account of the nature of processing and information available, the Provider assists the Customer with security obligations, notifications to regulators and individuals, data protection impact assessments and prior consultation where required. The Customer normally decides its own notifications; this does not prevent the Provider meeting independent legal duties. Appropriate preservation of incident evidence is subject to legal basis, access restriction and retention review.

8. International transfers

Primary processing and remote-access locations are in the Provider and Location Register. The Provider does not make a restricted transfer of Customer Data without the Customer's documented instruction/authorisation and a valid transfer mechanism under applicable law.

Where contractual safeguards are needed, the parties complete the applicable UK International Data Transfer Agreement or UK Addendum and any necessary assessment/supplementary measures before the transfer. Merely mentioning them in this DPA does not incorporate completed transfer terms. EU SCCs alone are not represented as a UK transfer solution. The Provider supplies relevant safeguard information on request, subject only to necessary, proportionate redaction.

The Customer is responsible for the lawfulness of its own decisions to instruct delivery of objects to its users or other recipients abroad. The Provider remains responsible for transfers it makes through its own processing arrangements.

9. Return and deletion

At the Customer's choice, on ending the service the Provider returns Customer Data in an accessible S3 download/export form or deletes it, and deletes existing copies unless law requires storage. Routine export is through the Customer's authenticated S3 client. Where ordinary access is unavailable, the parties arrange a safe alternative where lawful and technically possible.

The Return and Deletion Policy specifies the agreed process. The period for removing active Customer Data is 30 days after the confirmed deletion instruction or agreed end of the export window. The Customer may instruct earlier deletion, which the Provider will address without undue delay where feasible. A service restriction does not itself constitute a deletion instruction.

Residual backup copies, where present, are put beyond ordinary use, protected, and expire according to Daily backups retained 30 days; monthly restore tests; deletion reapplied after restore. Any legally required retained data is isolated for that purpose, not processed commercially, and deleted when the requirement ends. Relevant deletion instructions are reapplied after restoration. The Provider confirms completion or explains the limited retained categories and reason on request.

10. Information, audits and records

The Provider makes available the information necessary to demonstrate compliance with these obligations, and allows and contributes to audits and inspections by the Customer or its mandated independent auditor. Documentation and remote review may be used where suitable, but are not the exclusive remedy where an inspection is reasonably needed or required by law.

The parties agree reasonable notice, confidentiality, scope and measures to protect other customers, secrets and service availability. Urgent incidents, credible non-compliance or a regulator's requirement may justify shorter notice. These arrangements must not render the audit right ineffective or let the Provider refuse it in its sole discretion.

The Provider keeps appropriate processing/security records and supplies proportionate evidence. Normal assistance required by this DPA is included in the free service. Any exceptional additional work and reasonable charge must be agreed beforehand and may not prevent mandatory assistance, breach reporting or an effective audit right. No fee is automatically imposed merely because a customer exercises these rights.

11. Ending and responsibility

The confidentiality, information, security and deletion obligations continue for as long as the Provider or its sub-processors hold Customer Data. The Customer may end the affected service for a material unresolved breach, subject to return/deletion and lawful preservation. Each party remains responsible for its own obligations; no term restricts an individual's statutory compensation or complaint rights or a regulator's powers.

Schedule A: baseline technical and organisational measures

There is no claim of ISO certification, end-to-end encryption, guaranteed at-rest encryption, a dedicated customer security team or a specific durability percentage. Additional controls must be expressly agreed and actually implemented before being represented as part of this schedule.