Data Processing Agreement

Little Ridge Data Processing Agreement

This agreement is between Little Ridge Services Limited (company number 13653762, Sidings House, Sidings Court, Doncaster DN4 5NU, ICO reference ZB857472), "we" or "us", and the customer named in your Order, "you". You agree to it when you accept your Order online, or when you sign a copy of it.

It forms part of the Little Ridge Terms and Conditions and any service-specific terms that apply to you, such as the Little Ridge Connect Terms and Conditions (together, the "Terms"). It covers the personal data we handle for you when we provide the services in your Order (the "Services"). Where this agreement and the Terms disagree about personal data, this agreement wins.

The main agreement applies to all the Services. Each schedule at the end covers one kind of service, and applies only if you use that service:

• Schedule A: Little Ridge Connect
• Schedule B: Websites, apps and systems, including Little Ridge Base
• Schedule C: Campaigns we run for you

Words like "personal data", "controller", "processor", "processing" and "data subject" mean what they mean in UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. Who does what

1. You decide whose personal data goes into the Services and why. For that data, you're the controller and we're your processor.
2. If you use the Services for your own clients, for example as a partner or agency, your client is usually the controller, you're their processor, and we're your sub-processor. In that case, this agreement covers what we do for you, and you're responsible for having a matching agreement with your client. Instructions from your clients come to us through you.
3. The details of what we process for each service are in the schedules.
4. This agreement doesn't cover personal data we decide to collect and use for our own purposes, such as our own marketing or contact details we find ourselves. That's covered by our Privacy Policy.

2. What we promise

1. Your instructions. We only process your personal data to provide the Services and as you instruct us in writing, including through the Terms, your Order, and what you set up in your accounts. If we think an instruction breaks data protection law, we'll tell you straight away. The only exception is where the law requires us to process data, in which case we'll tell you first unless the law stops us.
2. Confidentiality. Everyone at Little Ridge who can access your personal data is bound to keep it confidential.
3. Security. We keep appropriate technical and organisational measures in place to protect your personal data. They're described in the schedules. We may improve them over time, but we won't make them weaker.
4. Sub-processors. You agree to us using the sub-processors listed in the schedules for the services you use. Before we add or replace a sub-processor for a service you use, we'll give you at least 30 days' notice by email. If you have a reasonable data protection objection, tell us within that time. If we can't resolve it, you can end the affected service without penalty. Each sub-processor is bound by data protection terms that protect your data at least as well as this agreement, and we remain responsible to you for what they do.
5. People's rights. If someone asks to see, correct, delete or stop the use of their data, we'll pass the request to you if it comes to us, and help you respond. Where you have your own account or system, you can usually do much of this yourself.
6. Helping you meet your obligations. We'll reasonably help you with security, breach notifications, data protection impact assessments and any consultation with the ICO, taking into account what we do and the information we have.
7. Outside the UK. We won't transfer your personal data outside the UK unless the safeguards UK data protection law requires are in place, such as the UK International Data Transfer Agreement or Addendum. Where a sub-processor in the schedules is outside the UK, those safeguards are already in place.

3. If something goes wrong

1. If we become aware of a personal data breach affecting your data, we'll tell you without undue delay, and in any case within 72 hours of us becoming aware of it.
2. We'll tell you what we know: what happened, what data and roughly how many people are affected, what we're doing about it, and who you can talk to. If we don't know everything straight away, we'll give you what we have and follow up as we find out more.
3. We'll help you with any notifications you need to make to the ICO or the people affected. We won't contact the ICO or the people affected about your data ourselves unless you ask us to or the law requires it.

4. Checking we keep our word

1. We'll give you the information you reasonably need to show that we're meeting this agreement, including summaries of the security testing and certifications that apply to the Services you use.
2. If that isn't enough, you or an independent auditor you appoint (who isn't a competitor of ours) can audit our compliance once a year, with at least 30 days' notice, during working hours, and in a way that doesn't disrupt our other customers or break confidentiality. You pay for the audit. Audits of our sub-processors are carried out through the information and audit rights we have with them.

5. What you promise

1. You have a lawful basis for everything you ask us to do with your personal data, including permission to send marketing where the law requires it, and you'll tell people how their data is used.
2. Your instructions to us follow data protection law and any acceptable use policy that applies to the Services.
3. You won't give us special category data (such as health, religion or ethnic origin), criminal records data or children's data, or ask us to collect it, unless we've agreed it in writing first.
4. You're responsible for the accuracy of the data you give us and for keeping your own account logins secure.

6. When it ends

1. This agreement lasts as long as we process personal data for you.
2. When a service ends, you can ask us for a copy of your personal data for that service, or export it yourself where you have an account, at any time up to 30 days afterwards. After 30 days, we'll permanently delete it, unless the law requires us to keep it. Backups are deleted on their normal schedule.
3. If you ask us to delete data earlier, we'll do so.

7. Everything else

1. Liability. Each of us is liable under this agreement as set out in the Terms, including their limits, except where the law doesn't allow liability to be limited.
2. New services. If you start using a service covered by a schedule you didn't use before, that schedule applies from when you start. If we offer a new kind of service, we may add a schedule for it, and it only applies to you if you use that service.
3. Changes. If data protection law changes, we may update this agreement to keep it compliant, and we'll tell you before the change takes effect. Any other change to how this agreement applies to services you already use needs both of us to agree in writing.
4. Sub-processor names. We describe our sub-processors by what they do and where they are. If you need their names, for example for your own records or a data protection impact assessment, ask us and we'll share them in confidence.
5. Law. This agreement is governed by the law of England and Wales, and only the courts of England and Wales can settle disputes about it.

Schedule A: Little Ridge Connect

What we process

How we keep it safe

The platform

• Hosted on dedicated infrastructure (not shared with other businesses) in secure UK data centres in Manchester and Newport, with on-site security around the clock and access for authorised people only.
• Encrypted in transit (HTTPS, rated Grade A, for the web interface and API; email sent over TLS, signed with DKIM and backed by SPF) and encrypted at rest (AES disk encryption on all servers, and encrypted backups).
• Enterprise-grade firewalls, no direct public access to data, and active monitoring for threats, with logs protected from deletion or change.
• Independent penetration testing every year.
• Separate development, testing and live environments, and live data is never used for testing.
• Backups stored in a separate UK data centre, with restore tests carried out several times a year.
• A tested business continuity plan, reviewed every year.
• Our platform provider is certified under the UK government's Cyber Essentials scheme.

Little Ridge

• Access to your account is limited to the Little Ridge people who need it to provide Connect, with individual logins and two-factor authentication where available.
• Our own devices are encrypted, password protected, kept up to date and run anti-virus software.
• We don't download your contact lists to our own devices unless we need to for a task you've asked for, and we delete them when the task is done.
• In your account, you control your own security settings, including password rules and who on your team can do what.

Sub-processors

Schedule B: Websites, apps and systems

This covers websites, forms, booking flows, portals, apps, automations and connected systems we build, host or run for you, including Little Ridge Base.

What we process

How we keep it safe

• Hosted with established hosting and database providers, encrypted in transit (HTTPS) and at rest.
• Access to your data is limited by login, with the least access needed, and protected by two-factor authentication where available.
• Passwords, keys and other credentials are kept in secure storage, never written into code or shared by email.
• Data is backed up by our hosting and database providers.
• AI features only receive the data they need to do their job, and we'll tell you which parts of your build use AI.
• Our own devices are encrypted, password protected, kept up to date and run anti-virus software.
• We don't download your data to our own devices unless we need to for a task you've asked for, and we delete it when the task is done.

Sub-processors

Each build only uses the sub-processors it needs. We'll tell you which ones your build uses.

Schedule C: Campaigns we run for you

This covers email campaigns we run on your behalf using contact data you give us, or contacts you've chosen. Where we find and choose contacts ourselves, we're the controller of that data, and clause 1.4 applies instead.

What we process

How we keep it safe

• Campaigns are sent through the same UK-hosted platform as Little Ridge Connect, with the security measures in Schedule A.
• Unsubscribes and suppressions are applied across every campaign we send for you.
• The Little Ridge measures in Schedule A apply to your campaign data too.

Sub-processors

If you'd like a signed copy for your records, email hello@littleridge.co.uk and we'll send one.

Version: 1.0

Last updated: 14 November 2026