Data Processing Agreement (DPA)

Plain English Summary

This Data Processing Agreement ("DPA") explains how Fast Thinking Limited ("Fast Thinking", "we", "us" or "our") processes personal data on behalf of our customers when they use the Fast Thinking Marketing Platform or our marketing services.

It outlines the responsibilities and commitments we have under UK GDPR and other applicable data protection laws to protect your data and respect your privacy.

If you have any questions about this DPA or data protection generally, please contact our Data Privacy Officer at privacy@fast-thinking.co.uk.

1. Introduction

This DPA forms part of the contractual relationship between Fast Thinking and you ("Customer") and governs the processing of personal data on your behalf.

The terms in this DPA apply whenever Fast Thinking processes personal data in connection with providing the Fast Thinking Marketing Platform or marketing services.

2. Roles and Responsibilities

• Data Controller: You (the Customer) determine the purposes and means of processing personal data.
• Data Processor: Fast Thinking acts as process.

3. Subject Matter and Duration

• The subject matter is the processing of personal data for the purpose of delivering the Platform and marketing services.
• This DPA remains effective for the duration of our business relationship.

4. Types of Personal Data and Categories of Data Subjects

• We may process user account data such as names, emails, avatars, and passwords.
• We may process end-user behavioural data collected on your websites as part of the Platform.

5. Processing Instructions

We only process data according to your documented instructions and applicable laws.

6. Security Measures

• We implement appropriate technical and organisational measures to protect personal data.
• Our platform is hosted on AWS London data centres, with strict access controls.

7. Subprocessors

• We may engage subprocessors to help deliver the Platform and services.
• Our current subprocessors are listed here.
• We will notify customers in advance of any intended changes to subprocessors via email or a notification on our website. Customers may object to a new subprocessor in writing within 14 days if they have reasonable data protection concerns.

8. Data Subject Rights

We assist you in responding to data subject requests where applicable.

9. Data Breach Notification

We will notify you without undue delay of any personal data breach affecting your data.

10. Data Retention and Deletion

• We retain personal data in line with documented retention policies. For example, log data is typically retained for up to 6 months unless otherwise agreed.
• Upon termination of services, we will delete or return all personal data as instructed by the Customer, unless retention is required by law.

11. International Data Transfers

We use AWS London data centres to limit international transfers.

12. Liability

Each party is responsible for compliance with their data protection obligations.

13. Governing Law

This DPA is governed by UK law.

14. Legal Requirements under Article 28 UK GDPR

In accordance with Article 28 of the UK GDPR, Fast Thinking agrees to:

• Process personal data only on documented instructions from the Customer;
• Ensure all authorised personnel are under appropriate confidentiality obligations;
• Implement appropriate technical and organisational security measures;
• Assist the Customer in fulfilling their data protection obligations, including data subject rights and DPIAs;
• Make available information necessary to demonstrate compliance and allow for audits (subject to reasonable notice);
• Delete or return all personal data at the end of the provision of services, unless retention is required by law.

‍

For questions or support, please contact our Data Privacy Officer at privacy@fastthinking.co.uk.

*This document is provided for informational purposes and does not replace a signed contract where required.*