We use cookies
We use essential cookies to run this site, and, with your permission, analytics and advertising cookies to understand how it is used and improve our marketing. Cookie Policy
Last updated: 14 October 2026
This Data Processing Agreement sets out the terms under which DLR Media Limited processes personal data on behalf of its customers, in line with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
This Data Processing Agreement ("DPA") is between the customer named in the Contract Details (the "Controller") and DLR Media Limited, registered in Scotland under company number SC600110, registered address Affinity House, Harrison Road, Dundee, DD2 3SN, ICO registration ZB641897 (the "Processor" or "DLR Media").
1.1 This DPA forms part of the Contract between the Controller and DLR Media under our Terms and Conditions of Service. Where the Terms and Conditions and this DPA conflict on the processing of personal data, this DPA takes priority.
1.2 This DPA starts on the Services Start Date in the Contract Details and continues for as long as DLR Media processes personal data on the Controller's behalf, including after the Contract ends until the data has been returned or deleted under clause 11.
1.3 The Controller determines the purposes and means of processing. DLR Media processes personal data only on the Controller's behalf, as its processor, to deliver the Services.
"Data Protection Legislation" means all data protection and privacy laws in force in the United Kingdom from time to time, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, including by the Data (Use and Access) Act 2025.
"UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.
"EU GDPR" means Regulation (EU) 2016/679, which applies only where the Controller is subject to it.
"Personal Data", "Controller", "Processor", "Data Subject", "Personal Data Breach", "Processing" and "Special Category Data" have the meanings given in the Data Protection Legislation.
"Sub-processor" means any third party engaged by DLR Media to process Personal Data on the Controller's behalf.
"Restricted Transfer" means a transfer of Personal Data from the UK to a country that is not covered by UK adequacy regulations.
3.1 Subject matter and purpose. DLR Media processes Personal Data to deliver the Services described in Appendix 1, such as websites and applications, hosting, AI chatbots and agents, advertising, social media, email and SMS campaigns, CRM work and outbound prospecting.
3.2 Duration. For the term of this DPA set out in clause 1.2.
3.3 Types of Personal Data. Contact details (name, email address, phone number, job title, company), enquiry and message content, account and login data, customer and order data, marketing preferences and engagement data, chat and conversation content, and website usage data, as applicable to the Services.
3.4 Categories of Data Subjects. The Controller's website visitors, enquirers, customers, prospects, subscribers, users and staff.
3.5 Special Category and criminal offence data. The Services are not designed to process Special Category Data or criminal offence data. The Controller must not provide or collect such data through the Services unless DLR Media has agreed in writing. If such data is entered into a free-text field or chat, DLR Media will treat it with the same protection as all other Personal Data.
4.1 process Personal Data only on the Controller's documented instructions, including on transfers, unless the law requires otherwise, in which case DLR Media will tell the Controller first unless the law prevents it;
4.2 tell the Controller promptly if, in its opinion, an instruction breaches the Data Protection Legislation;
4.3 make sure that everyone authorised to process the Personal Data is bound by a duty of confidentiality, and limit access to the people who need it to deliver the Services;
4.4 put in place and maintain the technical and organisational measures in Appendix 2, appropriate to the risk;
4.5 assist the Controller, taking into account the nature of the processing, in responding to requests from Data Subjects exercising their rights, and pass any such request it receives to the Controller without undue delay and in any event within 5 Business Days;
4.6 assist the Controller with its security, breach notification, data protection impact assessment and prior consultation obligations;
4.7 not sell Personal Data or use it for its own purposes, including for training AI models.
5.1 DLR Media will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data.
5.2 The notification will describe, as far as known at the time, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where all the information is not available at once, DLR Media will provide it in phases without further undue delay.
5.3 DLR Media will take reasonable steps to contain and investigate the breach and will cooperate with the Controller. The Controller is responsible for deciding whether to notify the ICO or any other supervisory authority, and Data Subjects.
6.1 The Controller gives DLR Media general written authorisation to engage Sub-processors, including those listed in Appendix 3.
6.2 DLR Media will give the Controller at least 14 days' notice of any intended addition or replacement of a Sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, either party may terminate the affected Services without penalty.
6.3 DLR Media will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains fully liable to the Controller for the performance of each Sub-processor's obligations.
7.1 DLR Media will only make a Restricted Transfer, or allow a Sub-processor to make one, where an appropriate safeguard is in place under the Data Protection Legislation. These are UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified), the UK International Data Transfer Agreement, or the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum.
7.2 Some of the Sub-processors in Appendix 3 process Personal Data in the United States. DLR Media will provide details of the safeguard used for any Restricted Transfer on request.
7.3 DLR Media will not transfer Special Category Data outside the UK without the Controller's prior written consent.
8.1 DLR Media will make available to the Controller all information reasonably needed to demonstrate compliance with this DPA and Article 28 of the UK GDPR.
8.2 DLR Media will allow and contribute to audits, including inspections, by the Controller or an auditor it appoints, on at least 30 days' written notice, during business hours, no more than once in any 12-month period unless required by a supervisory authority or following a Personal Data Breach, and subject to reasonable confidentiality obligations. DLR Media may first offer written answers, policies and third-party certifications to reduce the need for an on-site audit.
9.1 The Controller is responsible for having a lawful basis for the processing, for providing privacy information to Data Subjects, for obtaining any consents required (including for cookies and electronic marketing under PECR), and for the lawfulness of its instructions.
9.2 The Controller decides the categories of Personal Data collected, the retention periods, and the access permissions and user roles within its websites, applications and accounts.
9.3 Where the Services include AI-assisted features, such as chatbots, AI agents or content generation, the Controller is responsible for telling users when they are interacting with an AI system, and for reviewing and approving outputs before relying on them.
DLR Media will provide the assistance described in clauses 4.5, 4.6 and 8 as part of the Services where it is limited in scope. Where assistance requires significant additional work, DLR Media may charge for it at £100 per hour plus VAT, agreed with the Controller in advance. No charge applies where the assistance is needed because of DLR Media's own breach of this DPA.
11.1 On termination or expiry of the Services, DLR Media will, at the Controller's choice, return or delete the Controller's Personal Data within 30 days, and delete existing copies, unless UK law requires it to keep them.
11.2 If the Controller has not made a choice within 30 days of termination, DLR Media will delete the Personal Data.
11.3 On request, DLR Media will confirm in writing that it has complied with this clause.
11.4 Any Personal Data DLR Media is required by law to keep remains subject to this DPA for as long as it is kept.
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms and Conditions of Service, except to the extent that the Data Protection Legislation does not permit such limitation.
This DPA, and any dispute or claim arising out of or in connection with it, is governed by the law of Scotland. The courts of Scotland have exclusive jurisdiction, except where the EU Standard Contractual Clauses or the UK International Data Transfer Agreement require otherwise.
DLR Media may update this DPA to reflect changes in the Data Protection Legislation or guidance from the ICO, on 30 days' written notice to the Controller, provided the update does not reduce the protection given to Personal Data.
Where a signed copy is required, this DPA is signed on behalf of each party by its authorised representative.
Signed on behalf of the Controller: ________________________ Name and title: ________________________ Date: __________
Signed on behalf of DLR Media Limited: ________________________ Name and title: ________________________ Date: __________
Depending on the Services in the Contract Details, DLR Media processes Personal Data to deliver:
Websites and applications: design, development, maintenance and hosting, including forms, user accounts and login systems.
AI chatbots and AI agents: setting up, running and improving AI enquiry and support assistants, including processing chat conversations and the contact details users provide.
Paid advertising and SEO: Google Ads, Meta Ads and other platforms, including audience lists, conversion tracking and performance reporting.
Social media and content: managing accounts, content, comments and messages where agreed.
Email and SMS campaigns: building and sending campaigns using the Controller's lists in tools such as Klaviyo or Mailchimp.
CRM set-up and management: configuring and maintaining customer records and automations.
Outbound prospecting (B2B): building lead lists and running approved email and LinkedIn sequences.
Ecommerce services: Shopify builds, migrations and growth marketing, including access to store, customer and order data.
Domain registration and renewals: managing registrations and DNS for the Controller.
Access control: access to Personal Data limited to named staff and subcontractors who need it, with individual accounts, a password manager and multi-factor authentication wherever the platform supports it.
Encryption: data encrypted in transit (HTTPS/TLS) and, where the platform provides it, at rest.
Least privilege: platform permissions, user roles and API keys set to the minimum needed, and removed when no longer needed.
Secure development: security settings and access rules reviewed before launch, and secrets kept out of public code.
Supplier checks: Sub-processors reviewed for data protection and security before use and periodically after.
Separation: each client's data kept in separate accounts, projects or applications.
Incident management: a documented process to detect, contain, assess, record and report incidents, following ICO guidance.
Staff: confidentiality obligations and data protection guidance for everyone with access.
Base44, Inc. (part of Wix.com Ltd): website and application hosting, database and AI features. Processes data outside the UK, including the United States.
AI model providers used through our platforms: processing prompts and outputs for AI features, chatbots and agents. Processes data outside the UK, including the United States.
Plus Five Five, Inc. (Resend): sending transactional and notification emails. Processes data in the United States.
Klaviyo, Inc.: email and SMS marketing where used for the Services. Processes data in the United States.
Slack Technologies, LLC: internal team notifications and communication. Processes data outside the UK, including the United States.
Google LLC and Google Ireland Limited: advertising, analytics and business software. Processes data outside the UK, including the United States.
Meta Platforms Ireland Limited: advertising and WhatsApp messaging. Processes data outside the UK, including the United States.
Capsule (Zestia Ltd): customer relationship management. Hosted on Amazon Web Services.
BWF Hosting Ltd: hosting for client websites not built on Base44, in UK data centres.
DLR Media also engages specialist development, marketing and support subcontractors to deliver some Services. They are bound by written agreements meeting clause 6.3. Because these arrangements are commercially confidential, DLR Media discloses their names, locations and safeguards to the Controller in confidence on request, and notifies the Controller of changes under clause 6.2.