CUSTOMER WEBSITE DATA

Data processing schedule.

Draft Article 28 schedule. Complete the project-specific annex, approved sub-processors, security details and transfer safeguards before processing visitor data for a customer.

Roles and instructions

The customer is controller of personal data collected through their website; Bramlo is processor only where acting on documented instructions to host, maintain and administer it. Processing lasts for the service and agreed return/deletion period. Processing includes storage, transmission of enquiries, access for support, backup, restoration and deletion. Likely subjects are visitors, enquirers and customer staff; likely data are names, business contact details, enquiry text and technical security information. Special-category data, criminal records and sensitive uploads are excluded unless separately assessed and agreed.

Confidentiality and security

Bramlo must bind authorised personnel to confidentiality, restrict access by role, protect secrets, secure transmission, maintain appropriate access controls and backups, restore availability after incidents and regularly assess measures appropriate to risk. Bramlo informs the customer without undue delay after becoming aware of a personal data breach and supplies available information and assistance, without delaying for a complete investigation.

Sub-processors and transfers

The annex must list each provider, purpose, location and contractual safeguards. With documented general written authorisation, Bramlo gives prior notice of proposed additions or replacements and a reasonable opportunity to object before use; the resolution process must be agreed. Equivalent Article 28 obligations must bind each sub-processor and Bramlo remains responsible for their performance under this schedule. Transfers outside the UK require documented instructions and a valid transfer mechanism.

Assistance, audit and deletion

Bramlo assists the controller with rights requests, security, breach notifications, impact assessments and prior consultation where required, considering the processing and available information. It promptly tells the controller if an instruction appears to infringe data-protection law. It provides compliance information and permits and contributes to reasonable audits and inspections. On termination, at the controller’s choice it returns or deletes processed personal data and deletes copies unless law requires retention; any backup isolation and expiry must be documented.

Annex to complete with every customer

Record: legal controller and processor identities; authorised instructions/contact; systems and forms; exact subject and data categories; purposes/duration; approved sub-processors; locations/transfer mechanism; technical measures; incident contacts; support/audit procedures; return format; active and backup deletion dates. Do not launch a data-collecting customer site with an incomplete annex.