Data processing agreement

Last updated: 28 October 2026

This data processing agreement ("DPA") forms part of the terms of service between Devigo Digital Limited ("Devigo", the "Processor") and the customer using Devigo Studio ("you", the "Controller"). It applies whenever we process personal data on your behalf in providing the Service, and it takes effect automatically when you accept the terms of service. If you need a signed copy, email support@devigo.co.uk.

It's written to meet Article 28 of the UK GDPR and, where it applies, the EU GDPR. Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in those laws.

1. Roles

You're the controller of personal data contained in Your Content, including data your sites collect from their visitors and customers. Devigo is your processor. You're responsible for having a lawful basis for that processing, for giving the people concerned the information the law requires (for example, in your site's privacy policy), and for the instructions you give us.

2. Details of the processing

  • Subject matter and purpose: hosting, building and running your websites and the features of the Service you use.
  • Duration: for as long as you use the Service, and up to 30 days after, before deletion.
  • Nature: collecting, storing, organising, displaying, transmitting and deleting data, including AI-assisted editing at your instruction.
  • Types of personal data: contact details and messages sent through your forms; names, emails, addresses and order details from your shop; booking details; newsletter sign-ups; your team members' and clients' login details; anonymous visit counts; and any personal data you include in your pages.
  • Data subjects: your site's visitors, enquirers, customers and subscribers, and your staff and clients who use Studio.
  • Special category data: the Service isn't designed for it. Don't collect it through Devigo unless you've assessed that it's appropriate and lawful.

3. Our obligations

We will:

  • process personal data only on your documented instructions, which are these terms and how you configure and use the Service, unless the law requires otherwise, in which case we'll tell you first if we're allowed to;
  • tell you if we think an instruction breaks data protection law;
  • make sure everyone authorised to process the data is bound by confidentiality;
  • apply the security measures in section 5;
  • help you, taking into account what we know, to respond to requests from data subjects exercising their rights, and with data protection impact assessments and consultations with regulators;
  • at the end of the Service, delete the personal data within 30 days, unless the law requires us to keep it. You can export your content at any time before then.

4. Sub-processors

You give us general authorisation to use sub-processors. We'll bind each to data protection terms at least as protective as this DPA, and we stay responsible to you for their work. Our current sub-processors are:

  • Amazon Web Services EMEA SARL: hosting, databases, file storage, site builds and content delivery. Data stored in the EU (Stockholm, Sweden).
  • Stripe Payments UK Ltd: subscription billing. Shop and booking payments go through your own Stripe account, under your agreement with Stripe.
  • Anthropic, PBC: AI site generation and editing (United States).
  • OpenAI, L.L.C.: AI features, where used (United States).
  • Our email delivery provider: account, notification and form-submission emails.

We'll give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you can end the affected part of the Service and receive a refund for any period you've paid for and not used. If you connect your own AI key, storage bucket or third-party integration, that provider acts on your instructions, not as our sub-processor.

5. Security

We maintain appropriate technical and organisational measures, including:

  • encryption of data in transit (TLS) and at rest;
  • separation of each customer's data, and role-based access within accounts;
  • staff access limited to those who need it, protected by multi-factor authentication and logged;
  • two-factor authentication available to every user;
  • regular backups, and infrastructure spread across separate data centres;
  • monitoring, vulnerability patching and logging of changes;
  • protection of passwords by one-way hashing.

6. Personal data breaches

We'll notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We'll give you the information you reasonably need to meet your own obligations to report it, and take reasonable steps to contain it and stop it happening again.

7. International transfers

We won't transfer personal data outside the UK or EEA unless it's protected by an adequacy decision or regulations (including the UK–US data bridge and EU–US Data Privacy Framework), or by the UK International Data Transfer Agreement, the UK Addendum, or the EU Standard Contractual Clauses, which are incorporated into this DPA where needed.

8. Audits

We'll make available the information reasonably needed to show we comply with this DPA. If that's not enough, you can, at your cost, audit our compliance once a year, with at least 30 days' notice, during business hours and under confidentiality, in a way that doesn't put other customers' data at risk.

9. Liability and precedence

Each party's liability under this DPA is subject to the limits in the terms of service, except where the law doesn't allow that. If this DPA conflicts with the terms of service about personal data, this DPA wins.

10. Law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.