Data Processing Agreement

Last updated: 21 October 2026

About this agreement

This Data Processing Agreement (the DPA) applies whenever M4TRIX DEV Limited processes personal data on behalf of a client. It forms part of every proposal, quote, order or set of terms that a client accepts with us (the Services Agreement), and no separate signature is needed.

Processor: M4TRIX DEV Limited, company number 12342375, registered office 71 to 75 Shelton Street, Covent Garden, London WC2H 9JQ (M4TRIX DEV, we, us).

Controller: the client named in the Services Agreement (the Client, you).

This DPA meets the requirements of Article 28(3) of the UK GDPR. It supplements the Services Agreement and does not replace it. Where we have signed a separate data processing agreement with a Client, that signed agreement applies instead of this DPA for the services it covers.

We may update this DPA from time to time. We will give Clients at least 30 days notice of any change that reduces the protection given to personal data, and the version in force is always the one published at this address.

Terms

1. Definitions

1.1 Controller, processor, data subject, personal data, personal data breach and processing have the meanings given in the UK GDPR.

1.2 Data Protection Legislation means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and any legislation amending or replacing them, including the Data (Use and Access) Act 2025. Where the EU GDPR applies to the Client, it is included.

1.3 Protected Data means the personal data described in Schedule 1 that we process on behalf of the Client in connection with the Services Agreement.

1.4 Services means the services the Client buys from us under the Services Agreement. Only the parts of Schedule 1 that match the Services apply to a given Client.

1.5 Subprocessor means any third party we engage to process Protected Data, including software platforms and freelance contractors.

1.6 Supervisory Authority means the Information Commissioner’s Office or any body replacing it.

2. Roles and scope

2.1 The Client is the controller and M4TRIX DEV is the processor of the Protected Data.

2.2 The Client is responsible for having a lawful basis for the processing, for the accuracy and lawful source of any data it supplies, for the privacy notices shown to data subjects, and for the content of any communication sent on its behalf. Where the Services include direct marketing, the Client is responsible for compliance with PECR.

2.3 We process Protected Data only to deliver the Services and for no other purpose.

2.4 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject for each Service.

2.5 This DPA does not cover personal data we process as a controller for our own purposes, such as our client records, invoicing and the analytics of our own website. Our privacy policy covers that processing.

3. Processing on documented instructions

3.1 We process Protected Data only on the Client’s documented instructions, including in relation to transfers outside the United Kingdom, unless the law requires otherwise.

3.2 The Services Agreement, this DPA and Schedule 1 are the Client’s initial instructions. Further instructions may be given in writing, including by email, and we will keep a record of them.

3.3 If the law requires us to process Protected Data other than on the Client’s instructions, we will tell the Client before processing, unless the law prohibits this.

3.4 We will tell the Client immediately if, in our opinion, an instruction infringes the Data Protection Legislation. We do not provide legal advice, and the lawfulness of an instruction remains the Client’s responsibility.

4. Confidentiality

4.1 Everyone we authorise to process Protected Data, including employees and contractors, is bound by a duty of confidentiality, by contract or by law.

4.2 Access is limited to the people who need it to deliver the Services, on a least privilege basis, and is withdrawn when no longer needed.

5. Security

5.1 Taking account of the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to data subjects, we implement appropriate technical and organisational measures in line with Article 32 of the UK GDPR.

5.2 The measures in place are set out in Schedule 2. We may update them as long as the level of protection is not reduced.

6. Subprocessors

6.1 The Client gives general written authorisation for us to engage the Subprocessors in our current Subprocessor list.

6.2 Our current Subprocessor list is available to Clients on request by email to info@m4trixdev.com. It is shared with Clients in confidence and may not be published or passed to third parties without our consent.

6.3 We will inform the Client by email at least 14 days before adding or replacing a Subprocessor that will process the Client’s Protected Data. The Client may object on reasonable data protection grounds within that period. If we cannot resolve the objection, either party may end the affected Services without penalty.

6.4 Each Subprocessor is bound by a written contract with data protection obligations that meet Article 28 of the UK GDPR. For standard online platforms, this may be the platform’s published data processing terms.

6.5 We remain fully liable to the Client for the performance of each Subprocessor’s obligations.

7. Data subject rights

7.1 Taking into account the nature of the processing, we will assist the Client, as far as possible, to respond to requests from data subjects exercising their rights under Chapter III of the UK GDPR.

7.2 If we receive a request from a data subject about Protected Data, we will pass it to the Client without undue delay, and in any event within two working days. We will not respond to it ourselves except to confirm receipt and direct the person to the Client, unless the Client instructs us otherwise.

7.3 Where the Services include outreach or marketing, unsubscribe requests and objections received through our sending systems are actioned on the day of receipt by blocking the contact in our systems. This does not need a separate instruction.

7.4 We will tell the Client of every unsubscribe or objection within two working days, so the Client can update its own systems, and we will screen every later send against our own record of unsubscribes and objections.

8. Assistance to the Client

8.1 Taking into account the nature of the processing and the information available to us, we will give the Client reasonable assistance with its obligations under Articles 32 to 36 of the UK GDPR. This covers security, breach notification, data protection impact assessments and prior consultation with the Supervisory Authority.

8.2 Assistance that goes beyond what is reasonably included in the Services may be charged at our standard rates, agreed with the Client in advance.

9. Personal data breach

9.1 We will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Protected Data.

9.2 The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first will follow as it becomes available.

9.3 We will not notify the Supervisory Authority or any data subject of a breach affecting Protected Data unless the Client instructs us or the law requires it.

10. International transfers

10.1 We do not transfer Protected Data outside the United Kingdom except as needed to deliver the Services through our Subprocessors, and only where an appropriate safeguard under Chapter V of the UK GDPR is in place. Safeguards include adequacy regulations, the International Data Transfer Agreement and the UK Addendum to the EU standard contractual clauses.

10.2 Where a Subprocessor uses its own subprocessors outside the United Kingdom, we rely on the safeguards in that Subprocessor’s data processing terms.

10.3 The Client authorises transfers made under this clause. Any other transfer needs the Client’s prior written instruction.

11. Deletion or return of data

11.1 When the Services end, or earlier on the Client’s written instruction, we will at the Client’s choice either return the Protected Data in a commonly used machine readable format or delete it.

11.2 Deletion will be completed within 30 days of the Client’s choice and covers the systems we operate. We will take reasonable steps to have copies held by Subprocessors deleted in line with their standard retention practices. This does not apply where the law requires us to keep a copy.

11.3 We will confirm deletion in writing on request.

11.4 Where the Services included outreach or marketing, we may keep a suppression record of the email addresses of people who unsubscribed or objected. It is kept only so those people are not contacted again and is used for no other purpose.

12. Audits and information

12.1 We will make available to the Client all information needed to demonstrate compliance with Article 28 of the UK GDPR.

12.2 We will allow for and contribute to audits by the Client or an auditor it appoints, on at least 30 days written notice, no more than once in any 12 months unless a personal data breach has occurred or the Supervisory Authority requires it, during normal business hours and without unreasonable disruption to our business. The Client bears its own audit costs.

12.3 We may meet an audit request by providing documents, policies, certifications or Subprocessor assurances where these adequately address the matters raised.

13. Records

13.1 We keep a written record of the categories of processing carried out on behalf of our Clients, in line with Article 30(2) of the UK GDPR, and make it available to the Supervisory Authority on request.

14. Liability

14.1 Each party is liable for its own compliance with the Data Protection Legislation.

14.2 Subject to clause 14.5, the total liability of each party to the other under or in connection with this DPA and the Services Agreement, whether in contract, tort (including negligence) or otherwise, will not exceed the total fees paid or payable by the Client under the Services Agreement in the 12 months before the event giving rise to the claim.

14.3 The Client will indemnify us, to the extent permitted by law, against claims, fines, penalties and reasonable costs arising from our acting on the Client’s documented instructions in line with this DPA. The limit in clause 14.2 does not apply to this indemnity.

14.4 Neither party is liable to the other for any indirect or consequential loss, or for any loss of profit, revenue or goodwill.

14.5 Nothing in this DPA limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law. Nothing in this DPA limits either party’s direct statutory liability to a data subject or to the Supervisory Authority.

15. Term

15.1 This DPA applies for as long as we process Protected Data on behalf of the Client.

15.2 Clauses 4, 9, 11, 12, 13 and 14 survive the end of the Services.

16. General

16.1 If this DPA and the Services Agreement conflict on the processing of personal data, this DPA prevails.

16.2 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

17. Contact

17.1 Our contact for data protection matters is Matteo Beroldo, Director, matteo@m4trixdev.com. The Client’s contact is the person named in the Services Agreement, unless the Client tells us otherwise in writing.

Schedule 1: Details of the processing

Only the rows for the Services a Client buys apply to that Client.

Duration: the term of the Services Agreement, and afterwards only as needed to complete return or deletion under clause 11.

Frequency: continuous while the Services are active.

Special category and criminal offence data: none. The Client will not supply such data, or ask us to collect it, unless we have first agreed in writing how it will be handled.

Client owned systems: where we work inside systems the Client owns, such as its CRM, Google Business Profile, social media or advertising accounts, the Client remains responsible for its own contract with that platform.

Schedule 2: Technical and organisational measures

Access control

• Access to Protected Data is limited to named people who need it to deliver the Services.
• Multi factor authentication is enabled on every account with access to Protected Data where the platform supports it. Elsewhere, access uses a unique strong password held in a password vault and not reused.
• Credentials are stored in a password vault, separated by Client.
• Access is reviewed on any change of personnel and withdrawn on the day it is no longer needed.
• Everyone with access, including contractors, is briefed on this DPA before access is granted.

Data handling

• Protected Data is held within the platforms used to deliver the Services. Local copies are kept on devices only for the time a specific task needs and are deleted afterwards.
• Data is sent over encrypted connections (HTTPS or TLS). Encryption at rest is provided by our platform providers.
• Client websites are served over SSL and kept updated.
• Data is shared with contractors only to the extent their task needs.

Devices and accounts

• Devices used for Client work are protected by a password or biometric lock, full disk encryption and up to date operating systems.
• Business accounts are kept separate from personal accounts.

Incidents and continuity

• We follow a written process to detect, contain, assess and report personal data breaches within the times set in clause 9.
• Platforms we use provide backups and resilience in line with their published standards.

Suppliers

• We choose Subprocessors that offer data processing terms meeting Article 28 and review them when we add or replace a supplier.

Schedule 3: Subprocessors

The full list of our Subprocessors, with their names, roles and locations, is available to Clients on request by email to info@m4trixdev.com. It is shared in confidence under clause 6.2.

We use Subprocessors in these categories:

Some Subprocessors are based, or use their own providers, outside the United Kingdom. Clause 10 sets out the safeguards that apply.