Data Processing Terms

Last updated: 9 September 2026

These Data Processing Terms apply where a business customer is a controller and FAFF IT OFF acts as its processor for personal data supplied or made available for a job. They supplement our Terms & Conditions.

1. Processing on documented instructions

We will process the relevant personal data only on documented instructions from the customer, including instructions set out in the accepted quote, job brief and related correspondence, unless UK law requires otherwise. If a legal requirement applies, we will inform the customer before processing unless the law prohibits us from doing so.

2. Subject matter, duration, nature and purpose

The subject matter and purpose of processing are the services described in the accepted quote and job instructions. Processing may include receiving, accessing, organising, reviewing, transforming, extracting, formatting, checking, storing temporarily and returning or deleting personal data as reasonably necessary to perform the agreed service. Processing lasts for the duration of the job and any agreed support or retention period, subject to legal obligations.

3. Types of personal data and data subjects

The categories of personal data and data subjects are those reasonably apparent from the accepted quote and job instructions. They may include ordinary contact, customer, employee, supplier, transactional or business information. Unless expressly agreed in advance, the customer must not provide special-category data, criminal-offence data, children’s data, biometric data, payment-card security data or other unusually sensitive information.

4. Confidentiality

We will ensure that anyone authorised to process personal data on our behalf is subject to appropriate confidentiality obligations and only has access where reasonably necessary.

5. Security

We will implement appropriate technical and organisational measures having regard to the nature of the data, the processing and the risks involved. Measures may include access controls, data minimisation, secure hosting, reasonable authentication practices, restricted sharing and deletion of working files in accordance with our retention arrangements.

6. Sub-processors

The customer gives FAFF IT OFF general written authorisation to use appropriate sub-processors where reasonably necessary to provide the service, including hosting, email, cloud software, security, backup, automation and AI-assisted service providers.

We will impose data-protection obligations on sub-processors as required by law and remain responsible for our processor obligations. Where a material new sub-processor is introduced for an ongoing processing arrangement, we will provide reasonable notice where practicable so the customer can raise a legitimate data-protection objection. If an objection cannot reasonably be resolved, either party may end the affected processing arrangement.

7. International transfers

Where use of a sub-processor involves a restricted transfer of personal data outside the UK, we will ensure an appropriate transfer mechanism is used where required by UK data-protection law, such as an adequacy regulation or approved contractual safeguards.

8. Data-subject rights

Taking account of the nature of the processing, we will provide reasonable assistance to the customer, using appropriate technical and organisational measures where possible, to help the customer respond to requests from individuals exercising their data-protection rights.

9. Security incidents and personal-data breaches

If we become aware of a personal-data breach affecting data we process for the customer, we will notify the customer without undue delay and provide information reasonably available to us to help the customer meet its legal obligations.

10. Other compliance assistance

Taking account of the nature of processing and the information available to us, we will provide reasonable assistance with security obligations, breach notifications, data-protection impact assessments and prior consultation with the ICO where UK data-protection law requires it.

11. Deletion or return at the end of processing

At the end of the service, we will delete or return processor-held personal data as required by the customer and applicable law, unless UK law requires continued retention. Our standard working-file retention rule is described in our File & Data Rules.

12. Information and audits

We will make information reasonably necessary to demonstrate compliance with our processor obligations available to the customer. Where legally required, we will allow and contribute to reasonable audits or inspections, subject to appropriate confidentiality, security, proportionality, notice and cost arrangements.

13. Unlawful instructions

If we believe an instruction infringes UK data-protection law, we will inform the customer without undue delay unless the law prevents us from doing so. We may suspend the affected processing until the issue is resolved.

14. Customer responsibilities

The customer remains responsible for determining the purposes and lawful basis of its processing, providing lawful and sufficiently clear instructions, giving required privacy information to individuals, responding to data-subject rights, and ensuring that it is entitled to disclose the personal data to us.

15. Sensitive or high-risk processing

If a job involves material volumes of personal data, special-category or criminal-offence data, vulnerable individuals, systematic monitoring or other processing that presents elevated risk, we may require a separate written processing schedule, additional safeguards or a data-protection impact assessment before accepting the work.

16. Order of precedence

If there is a conflict between these Data Processing Terms and our general Terms & Conditions on a matter relating specifically to processor obligations, these Data Processing Terms take priority for that matter.