Data Processing Addendum

The customer determines the permitted purposes as the responsible data fiduciary or controller; Imaginex acts as the processor or service provider for that activity. For its own billing, support and security purposes, Imaginex has the separate role described in the Privacy Notice. Terminology is applied consistently with the law in force.

Processing scope

The subject is configuration, hosting, maintenance and support of the named website, including approved ordinary enquiry routing and any agreed records held under our control. Processing lasts during the service and the agreed exit and deletion period. Data subjects may include ordinary enquirers, customer personnel and an approved portfolio beneficiary or adult guardian. Data ordinarily comprises name, email or phone, a short enquiry, supplied public profile content, service records and necessary technical logs. High-risk data is excluded unless separately agreed.

Before a form or data-dependent function is enabled, the customer's instructions identify its purpose, required fields, recipient, retention, account access, notices and consent, applicable location and transfer requirements and any special restrictions. A separate processing schedule supplies actual provider and location information where necessary. An incomplete or unlawful instruction does not authorise collection.

Instructions and responsibilities

Imaginex processes only documented, lawful instructions and necessary service operations, unless law requires otherwise. Where lawful, we tell the customer about a mandatory processing requirement or an instruction we believe is unlawful. We do not independently repurpose visitor data for our marketing, data sale, customer profiling or general AI training.

The customer is responsible for authority over the data, an appropriate lawful purpose, accurate notices and consent, sector requirements, data minimisation, the designated recipient and timely handling of visitor rights. The customer must not direct collection through a standard form that conflicts with the Privacy Notice or the Acceptable Use Policy. Imaginex remains responsible for its own processing duties.

Authorised personnel receive appropriate confidentiality commitments and limited access. We use reasonable security controls suited to the agreed risk, protect privileged access and credentials, and maintain the supported website backup and recovery process. Backup frequency is not permission for unlimited collection or an indefinite archive. Neither party may treat this addendum as a security certification.

Providers and transfers

We use suitable service providers under appropriate data and confidentiality terms and keep the relevant internal records. Providers process only what is necessary for the authorised service. Where the processing agreement or law requires notice or authorisation for a provider or a material change, we supply the information and obtain it before the affected processing. A justified data-protection concern is assessed in good faith.

Transfers and processing locations must comply with the actual legal requirements, the contract and provider capability. We do not guarantee a specific country of storage without an expressly accepted service schedule. A localisation, regulated-data or unusual audit requirement may need a separately assessed service and quotation.

Rights assistance and incidents

We reasonably assist the customer with applicable access, correction, export, deletion, consent and grievance requests about data under our control, promptly route visitor requests to the customer where appropriate, preserve necessary evidence and avoid unauthorised disclosure.

We notify the customer without undue delay after becoming aware of a personal-data breach or security incident affecting, or reasonably likely to affect, data processed on its behalf, with the available facts, mitigation actions and updates, and we assist with legally required notifications. Initial notification does not wait for a final root-cause report. Each party performs its own regulator and reporting duties, and required cyber-incident reporting is never postponed by ordinary support hours.

Return, deletion and retained records

On effective termination or expiry, the one free export and the day-30, day-60 and day-90 timetable in section 9 apply to relevant service data. Imaginex deletes or anonymises ordinary production copies and lets backup rotation expire within those limits, except documented lawful holds or mandatory records. Backup recovery does not create a fresh indefinite retention period. Records in customer-owned external accounts remain under those providers' controls.

Evidence and review

We provide reasonable information to demonstrate the relevant contractual data-processing controls, subject to confidentiality, security and the protection of other customers. Any additional audit is scoped reasonably for method, timing, access and costs, without restricting a regulator's lawful powers. No standard subscription grants access to platform source, other customers' records or production secrets. New purposes, new data categories, material provider changes and minors' information are reviewed before processing changes.

What the processing record contains

An order involving visitor data records the authorised adult or business account holder; the website; the processing purpose; fields and categories; the designated recipient; the notice and consent version; retention instructions; provider, access and location information where required; incident contacts; and the return and deletion arrangement. For a minor's portfolio it also records guardian authority, the approved public fields and media, publication consent and verification, the guardian-controlled contact route and the process for changes or withdrawal.