Data Processing Terms

When These Terms Apply

These terms apply when Adgency Media (a sole proprietorship registered in India, Udyam UDYAM-JK-21-0017982) processes personal data on your behalf (you are the "controller", we are the "processor") while building, hosting, supporting or maintaining your website or software. They are intended to meet Article 28 of the UK GDPR and EU GDPR where those laws apply, and the processor-contract requirements of US state privacy laws. They do not apply to our own use of data about our own website visitors, which is covered by our Privacy policy. To ask for a signed copy or a change, write to help@adgencymedia.com.

Instructions

We process personal data only on your documented instructions, which are the Agreement, these terms and your reasonable written requests, unless the law requires otherwise. We will tell you if we think an instruction breaks data protection law.

What We Process

The types of data, data subjects, nature and purpose are those needed to build and support your system, for example customer and contact records in a CRM or order and customer details in an inventory system. The duration is the project and any support period. You tell us if special-category data is involved, and we agree extra safeguards first.

Confidentiality

Everyone at Adgency Media with access to the data is bound by confidentiality duties and has access only where needed for the work.

Security

We apply appropriate technical and organisational measures, which may include access control with least privilege, authentication, encryption in transit, encryption at rest where appropriate, logging, backups and review of dependencies, as agreed for the project. The measures we agree are recorded in the project documents.

Subprocessors

You give us general authorisation to use subprocessors. Those we currently use for hosting and delivery include Cloudflare (hosting and network), Resend (transactional email) and Zoho (business email), plus any named in your project documents. We bind them to data protection terms no less protective than these and stay responsible for them. We tell you about new subprocessors by email, and you may object on reasonable data protection grounds within 14 days.

International Transfers

We are based in India. If you are in the UK or EU and send us personal data, that is a transfer to a country without an adequacy decision, so before we process such data we and you will put in place an appropriate transfer mechanism: the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable. Our subprocessors may also process data in Ireland, the United States and other countries under their own safeguards.

Data Subject Requests

If someone asks us to use their rights over your data, we will tell you promptly and not respond ourselves unless you ask. We give reasonable help so you can respond within the legal time limits.

Breach Assistance

We will tell you without undue delay, and normally within 48 hours, after becoming aware of a personal data breach affecting your data, and give the information and help you reasonably need to meet your legal duties.

Retention and Deletion

At the end of the services, or when you ask, we return or delete your personal data and delete existing copies unless the law requires us to keep them. Backups are removed on their normal cycle.

Audits

On reasonable notice, and not more than once a year unless there has been a breach, we provide information needed to show we meet these terms, including answering reasonable security questionnaires. On-site audits are agreed in advance and kept proportionate.