Data-processing agreement
The proposed controller-to-processor terms for business customer content, accompanying the service terms.
1. Scope and instructions
This agreement applies where a business customer determines the purposes of processing personal information in Client Ready and Elias Digital Studio processes that content for it. It supplements the service terms and takes priority on that processing if inconsistent. The customer’s use of the permitted workspace functions, account settings and written support instructions forms its documented instructions. We will not process for an unrelated purpose. If law requires other processing, we will notify the customer where legally permitted.
2. Processing schedule
Subject: collection and management of client information for the customer’s business projects. Duration: the service relationship plus the agreed return/deletion and applicable backup lifecycle. Operations: hosting, storage, organisation, access, transmission, review, export, support and deletion needed for those projects.
People: the customer’s staff, business contacts, clients and their authorised representatives. Information: ordinary contact and company details, addresses, deadlines, project instructions, drafts, answers, uploaded documents/images, review records, internal notes and scheduling information. Highly sensitive information, identity documents, payment-card details, credentials, children’s information and special-category records are outside the permitted service scope.
3. Customer obligations
The customer remains responsible for lawful collection, necessary notices, appropriate permissions, accuracy, data minimisation, retention decisions and deciding whether the service fits the risk of its use. It must give lawful instructions and inform us of relevant restrictions. We will inform it if an instruction appears to infringe applicable data-protection law and may pause that instruction while it is resolved.
4. Confidentiality and security
Access by the operator and any authorised personnel must be limited to what their role requires and subject to confidentiality obligations. Measures include business authentication, business ownership checks, private file handling, limited download links, configurable client-link protection, encrypted authenticator material, hashed recovery records and controlled verified sessions. Our security notice distinguishes application controls from provider assurances. Neither party represents that all security risk is eliminated.
5. Sub-processors and transfers
The proposed primary infrastructure provider is Wix.com Ltd. and its relevant group/service providers for hosting, identity, database and media services. Wix’s published DPA and security documentation are provider materials, not certifications of this application. Operator review must confirm that the contractual roles, flow-down terms and international-transfer arrangements fit the customer-content processing before production is opened.
For production service, the customer’s general authorisation will cover only the documented provider list. We will notify it of a material proposed sub-processor change in advance where practicable, allow a reasonable opportunity to object on data-protection grounds, and seek a workable alternative or allow termination of the affected service if the issue cannot be resolved. Equivalent contractual protections must be imposed; we remain responsible for our sub-processor obligations under applicable law. No UK-only data-residency commitment is made.
6. Assistance and incidents
Taking account of the nature of processing and information available, we will reasonably assist the customer with individual rights requests, security obligations, impact assessments and supervisory-authority consultation. If we become aware of a personal-data breach affecting its content, we will inform the customer without undue delay, provide the facts then available, describe containment and mitigation, and provide useful updates. The customer decides its own regulatory and individual notifications unless law requires otherwise. We will not make a statement on its behalf without authority.
7. Return, deletion and backups
At the end of processing, the customer may choose an available export or deletion of its client content, subject to legal retention obligations. Requests should be made promptly before access ends. Operational copies must be removed under the confirmed deletion procedure; temporary backup copies must be isolated from normal use, expire under the provider’s applicable lifecycle and be protected. A restoration must reapply prior deletion instructions before reopening ordinary access.
8. Evidence and audits
We will make reasonably available information needed to demonstrate these obligations and cooperate with proportionate audits or inspections, including a competent regulator’s lawful requirements. Customer audits must protect other customers’ data, credentials and service availability; reasonable confidentiality, scope and scheduling arrangements may be required. Unusual assistance outside the ordinary service may be subject to an agreed reasonable charge, without limiting duties the law requires us to fulfil.
9. Activation
This document is prepared for review, not a claim of completed worldwide compliance. Confirmed operator identity, address, provider arrangements, actual retention/backup behaviour and commercial terms are required before businesses are invited to process production client information. Existing access remains restricted to permitted test content.