Data Processing Agreement

1. Parties

This Data Processing Agreement applies when a client engages NA Designs to process personal data on the client’s behalf while delivering website design, development, maintenance, forms, integrations, support or related services.

2. Roles

The client is usually the Controller of personal data collected through the client’s business, website, forms, customers or users. NA Designs acts as a Processor when we process that data only to provide agreed services to the client.

3. Subject matter and duration

Processing may include accessing, organising, transferring, storing, editing, testing, configuring or deleting personal data during the project and support period. The duration is the project term plus any agreed maintenance, support, legal retention or backup period.

4. Types of personal data

• Names, email addresses, phone numbers and enquiry details.
• Customer messages, booking details, order-related details or form submissions if included in the project.
• Website user data, admin user details or account identifiers where required.
• Any other data the client provides or asks NA Designs to handle for the project.

5. Categories of data subjects

Data subjects may include the client’s customers, leads, employees, contractors, website visitors, newsletter subscribers, event participants, buyers or other people whose data is processed through the client’s website or systems.

6. Processing instructions

NA Designs will process personal data only as needed to provide the agreed services, follow written client instructions, maintain security, troubleshoot issues, comply with law, or protect the rights and systems of NA Designs and its clients.

7. Confidentiality

NA Designs will treat client personal data as confidential and will not intentionally disclose it except as required for service delivery, legal compliance, security, support, authorised subprocessors or written client instruction.

8. Subprocessors

NA Designs may use subprocessors such as hosting providers, domain registrars, form tools, email providers, file storage, payment tools, analytics, security tools, design/development platforms or communication services. NA Designs will choose reputable tools and use them only as needed for service delivery.

9. Security measures

NA Designs will use reasonable organisational and technical measures such as access limitation, HTTPS-enabled tools where available, careful credential handling, backups where relevant, and trusted third-party platforms.

10. Assistance to client

Where reasonably possible and within the service scope, NA Designs will help the client respond to data correction, deletion, export, security or access requests related to systems we built or manage. Extra work may require additional charges.

11. Deletion or return of data

At the end of the project or support period, the client may request return or deletion of project data where reasonably possible. Some information may remain in backups, invoices, communication records, legal records or security logs for a limited time.

12. Client responsibility

The client remains responsible for lawful collection of data, consent notices, privacy policy accuracy, cookie/analytics choices, customer communication, business compliance and deciding what personal data their website or business collects.