Data processing agreement

Lupe Platform – Terms of Service and Data Processing Agreement, Part 2
Version: October 2026 · Last updated: 9 October 2026

This Data Processing Agreement ("DPA") forms part of the agreement between TDS and the Client. It sets out the terms on which TDS processes personal data on the Client's behalf, as required by Article 28 of the UK GDPR (and the EU GDPR where it applies).

1. Scope and roles

• Client as Controller: the Client determines the purposes and means of processing personal data in its websites, advertising platforms, analytics platforms and First Party Data Infrastructure.
• TDS as Processor: TDS acts as a processor when it sets up, tests and maintains the First Party Data Infrastructure and the Client's connected platforms through the access described in Annex D.
• Lupe dashboard: Lupe reads only non-personal statistical, aggregated, diagnostic and configuration information. TDS does not process the Client's end-user personal data through Lupe.
• TDS as Controller of account data: TDS is an independent controller of the business contact details of the Client's staff who use Lupe or correspond with TDS (for example names, work email addresses and login records), and of billing records. TDS handles this data under its own privacy notice and applicable law.

The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects, are set out in Annex A.

2. TDS's obligations

When acting as processor, TDS will:

1. process personal data only on the Client's documented instructions, including these Terms and the Client's written requests, unless required to do otherwise by law (in which case TDS will tell the Client first, unless the law prohibits it);
2. tell the Client promptly if it believes an instruction infringes data protection law;
3. ensure that everyone it authorises to process personal data is bound by confidentiality;
4. implement the technical and organisational security measures in Annex C;
5. engage sub-processors only in accordance with section 3;
6. assist the Client, taking into account the nature of the processing, in responding to data subject requests (section 7);
7. assist the Client with its obligations on security, breach notification, data protection impact assessments and prior consultation with the regulator, taking into account the information available to TDS;
8. delete or return personal data at the end of the services in accordance with section 5;
9. make available the information needed to demonstrate compliance with this DPA and allow audits in accordance with section 8.

TDS does not use the Client's data for its own purposes, including marketing or training its own models or algorithms.

3. Sub-processors

The Client gives general written authorisation for TDS to use the sub-processors listed in Annex B. TDS will:

• give the Client at least 30 days' written notice before adding or replacing a sub-processor, so that the Client can object on reasonable data protection grounds. If the objection cannot be resolved, the Client may terminate the affected services without penalty;
• bind each sub-processor by written terms that offer at least the same level of protection as this DPA;
• remain responsible to the Client for its sub-processors' performance of those obligations.

Client-owned platforms are not TDS sub-processors. Stape, the Client's CMP (such as CookieYes), Shopify, Meta, TikTok and Google (GTM and GA4) are accounts held and contracted by the Client directly. They are the Client's own processors or independent controllers under the Client's agreements with them, and are listed in Annex B for transparency only.

4. Data hosting locations and international transfers

• Lupe: the Lupe platform and its data (configuration metadata, aggregated statistics, user accounts and logs) are hosted in the United Kingdom, in the London regions of DigitalOcean and Google Cloud.
• First Party Data Infrastructure: the server-side GTM container is hosted in the Client's own Stape account, in the region the Client selects. TDS recommends a UK or EU region.
• Transfers: TDS will not transfer personal data it processes for the Client outside the UK or EEA unless appropriate safeguards are in place, such as an adequacy decision or UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
• Data sent to advertising and analytics platforms (such as Meta, TikTok and Google) is sent on the Client's instructions under the Client's own agreements with those platforms, which govern where those platforms store it.

5. Retention and deletion

On termination, TDS will also remove its own partner and collaborator access from the Client's platforms, and confirm in writing that deletion is complete on request. Where the law requires TDS to keep any data longer, TDS will keep it confidential and process it only for that purpose.

6. Personal data breach notification

If TDS becomes aware of a personal data breach affecting personal data it processes for the Client, TDS will:

1. notify the Client without undue delay, and in any event within 48 hours of becoming aware of it, by email to the Client's nominated contact;
2. provide, as far as it is available at the time: a description of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed to address it and reduce its effects, and a contact point for further information;
3. provide further information in stages as it becomes available, without undue delay;
4. take reasonable steps to contain and investigate the breach, and cooperate with the Client so that the Client can meet its obligation to notify the Information Commissioner's Office (or another supervisory authority) within 72 hours where required;
5. not notify regulators or data subjects on the Client's behalf unless the Client instructs it to or the law requires it;
6. keep a record of the breach and the actions taken.

TDS's breach contact is Mark at mark@transparentdigitalservices.com, 07540 388706. The Client will provide TDS with a nominated contact for breach notices.

7. Data subject rights

Because the Client's end-user data is held in the Client's own platforms, the Client will normally handle data subject requests directly. If TDS receives a request relating to the Client's data, it will pass it to the Client without undue delay and will not respond except on the Client's instructions. TDS will provide reasonable assistance, for example locating data flows in the First Party Data Infrastructure.

8. Audits and information

TDS will make available the information reasonably needed to demonstrate compliance with this DPA, including completing reasonable security questionnaires. The Client (or an independent auditor bound by confidentiality) may audit TDS's compliance no more than once in any 12-month period, on at least 30 days' written notice, during business hours, and at the Client's cost, unless the audit follows a personal data breach caused by TDS or is required by a supervisory authority.

9. Consent responsibilities

• The Client is responsible for obtaining valid consent through its chosen CMP, for the content of its cookie banner and privacy notice, and for deciding which platforms receive data.
• TDS configures the infrastructure so that tags and events respect the consent signals provided by the Client's CMP, and Lupe raises alerts when it detects consent signals failing.
• TDS is not responsible for processing that breaches data protection law because the Client changed its website, theme, CMP, GTM containers or platforms independently of TDS.

10. Duration

This DPA applies for as long as TDS processes personal data on the Client's behalf, and its obligations on deletion, confidentiality and breach notification continue until all such data has been deleted or returned.

Annex A – Details of processing

| Purpose | To deliver accurate, consent-aware