Data Processing Addendum

Last updated: 6 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the customer) and Growthworks Consulting Ltd ("we"). It applies where we process personal data on your behalf in providing GrowthBuilder, as required by Article 28 UK GDPR.

1. Roles

For personal data in enquiries submitted through your websites, and any personal data you add to your sites, you are the controller and we are your processor. If you are an agency acting for a client, your client is the controller, you are a processor, and we are your sub-processor; you confirm you have your client's authority to use us.

2. Details of the processing

• Subject matter and duration: providing the Service, for as long as your account is open and until return or deletion under section 7.
• Nature and purpose: receiving, storing and displaying enquiries; hosting site content; generating and publishing your websites.
• Personal data: contact details and message contents submitted by website visitors; names or other personal data you include in site content.
• Data subjects: visitors to and customers of your websites; people named in your site content.

3. Our obligations

• We process the personal data only on your documented instructions — these terms and your use of the Service are your instructions — unless the law requires otherwise, in which case we will tell you unless the law prohibits it.
• We tell you immediately if, in our opinion, an instruction infringes data protection law.
• Everyone we authorise to process it is under a duty of confidentiality.
• We apply appropriate technical and organisational security measures, including encryption in transit, access control and encryption of stored hosting tokens.
• We help you, taking into account the nature of the processing, to respond to requests from data subjects and to meet your obligations on security, breach notification, impact assessments and consultation with the ICO.
• We tell you without undue delay after becoming aware of a personal data breach affecting your data.
• We make available the information reasonably needed to show compliance with this DPA, and allow for and contribute to reasonable audits, on reasonable notice, at your cost.

4. Sub-processors

You authorise us to use the sub-processors listed in our Privacy Policy. Before we add or replace a sub-processor we will email you and update that list at least 14 days before it starts processing your data, and you may object in that time; if we cannot reasonably accommodate the objection, you may cancel before the change takes effect. We impose data protection obligations on each sub-processor equivalent to this DPA and remain responsible for them.

5. International transfers

Where a sub-processor processes personal data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

6. Your obligations

You are responsible for having a lawful basis for the processing, for your websites' privacy notices, and for the accuracy of your instructions.

7. Return and deletion

You can delete enquiries in your dashboard at any time. When the Service ends you may choose, by email, to have us return the personal data we process for you (enquiries and any personal data in your site content) in a standard electronic format before deletion; otherwise, or after returning it, we delete it from our systems within 30 days, unless the law requires us to keep it. Copies in our hosting providers' backups are removed when those backups expire on the provider's schedule.

8. Contact

Growthworks Consulting Ltd, Office 2 Falcon House, Albion Mills, Hutson Street, Bradford, BD5 7LZ, United Kingdom. Email: info@growth-works.co.uk.