Skip to content
parish.digital
parish.digital
Get a quote

Data processing agreement

This agreement is between the council that appoints us (the controller, “you”) and Room Filler Ltd, which trades as Parish Digital (the processor, “we”). Company number: 14967234. Registered office: Office 2b Bank Chambers, Belgrave Square, Darwen, BB3 1BU. ICO registration: ZB709086. Email: info@parishdigital.co.uk.

It covers personal data we process while we host or support your council website, including related hosting and email. It does not cover enquiries sent to parishdigital.co.uk. For those, Room Filler Ltd is the controller, and the privacy notice explains that.

Clause 9 of the terms incorporates this agreement. It is part of the contract. The terms are governed by the law of England and Wales. The headings follow the Information Commissioner’s guidance on contracts between a controller and a processor. The details of the processing are in the schedule at the end.

This is our standard agreement. A council may ask us to change it. Email info@parishdigital.co.uk.

1. Documented instructions

We process the personal data only on your documented instructions, unless UK law requires us to do otherwise. Your documented instructions are this agreement, the terms, and any further instruction you give us in writing, including by email.

Those instructions include transfers of personal data to another country or to an international organisation. We do not make a transfer of that kind except on your documented instructions, and only as section 9 allows.

If UK law requires us to process the personal data, we will tell you what the law requires before we do it, unless the law forbids us to tell you.

2. Confidentiality

Anyone we authorise to process the personal data is under a duty of confidence. That duty is in their contract with us, or it is a duty the law already imposes on them.

3. Security

We put in place the security measures required by Article 32 of the UK GDPR, appropriate to the risk of hosting and maintaining a council website. The measures we use are:

4. Sub-processors

You give us general written authorisation to use sub-processors, by entering the contract that incorporates this agreement. Article 28(2) of the UK GDPR is the rule this section follows.

The sub-processors we use now are:

We will tell you before we add or replace a sub-processor that processes the personal data. You may object. If you object and we cannot reasonably use a different supplier, either of us may end the contract under clause 5 of the terms.

Before a sub-processor processes the personal data, we will bind them in writing to the same data-protection obligations that this agreement places on us. We remain liable to you for a sub-processor’s performance of those obligations. That is the flow-down and liability required by Article 28(4) of the UK GDPR.

5. People’s rights

Taking into account the nature of the processing, we will help you, so far as we are able and with appropriate technical and organisational measures, to respond to people exercising their rights under UK GDPR. Those rights include access, rectification, erasure, restriction, data portability and objection.

If a person contacts us about personal data on your website, we will pass the request to you where the law allows. We will not answer it as if we were the controller.

6. Security duties, breaches and assessments

Taking into account the nature of the processing and the information available to us, we will help you meet your duties under Articles 32 to 36 of the UK GDPR:

We will tell you without undue delay, and in any event within 48 hours of becoming aware, if we become aware of a personal-data breach affecting the personal data. The notice will say what we know about what happened, which data and which people are affected, and what we are doing about it. You decide whether to notify the Information Commissioner or the people affected, unless you instruct us in writing to do something else.

7. Deletion or return

At the end of the contract, you choose whether we delete the personal data or return it to you. We will also delete existing copies, unless UK law requires us to keep them. Clause 5 of the terms explains the export of the site content and files. We will carry out your choice within a reasonable time after the contract ends, and we will confirm to you when it is done.

8. Information, audits and inspections

We will make available the information reasonably needed to show that we are meeting the duties in this agreement.

We will allow and contribute to audits, including inspections, by you or by an auditor you appoint. Give us reasonable notice. We will not unreasonably restrict an audit or inspection. The audit or inspection is of the processing this agreement covers.

9. International transfers

We transfer personal data outside the UK only on your documented instructions, and only with an appropriate safeguard in place. The safeguards we use are:

This agreement does not state that Railway, Krystal Hosting, Elastic Email, Rackspace or Google is certified under the UK-US data bridge or any other scheme.

10. If an instruction infringes the law

If we think an instruction infringes UK GDPR or another data-protection law, we will tell you. We will not carry out that instruction while the question is open, unless the law requires the processing. If the law requires it, section 1 applies: we tell you first, unless the law forbids us to tell you.

Schedule

Article 28(3) of the UK GDPR asks the contract to set out the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the controller’s obligations and rights. This schedule does that.

Subject matter. Hosting and maintaining the council’s website, and related email where we arrange it for the council.

Duration. For as long as the contract lasts, and afterwards until the personal data has been deleted or returned under section 7.

Nature and purpose. Storing, displaying and transmitting personal data so the council can publish its website and receive messages sent through it.

Types of personal data.

Categories of data subjects.

Your obligations and rights. You decide the purposes of the processing and you give the documented instructions. You may object to a change of sub-processor. You choose deletion or return at the end of the contract. You may ask for the information in section 8 and carry out an audit or inspection. You are responsible for your own privacy notice and for the other controller duties that sit with the council.

Questions about this agreement: info@parishdigital.co.uk.

Last updated: 24 October 2026

Cookies

We use one strictly necessary cookie to remember your choice. If you choose Accept, we load Google Analytics, which sets its own cookies. Nothing non-essential is set before you choose. We do not set advertising cookies. The choice lasts 12 months, and you can change it later with Cookie settings in the footer. Read about cookies.