These terms apply from 29 October 2026.
1. About these terms
1.1 When we host, maintain or support your website, we handle personal data on your behalf: for example, enquiries sent through your website, customer orders, and user accounts. For this data, you are the controller and we are your processor.
1.2 These terms form part of our Terms of business, and apply whenever we process personal data on your behalf. Personal data about you as our client is covered separately by our Privacy policy (our services).
2. The processing we carry out
| What we do with the data | Hosting, storing, transmitting and backing up your website and its data; sending email from your website’s forms; protecting your website against attacks; and providing support and maintenance |
| Why | To provide the services you have asked us for, and for no other purpose |
| Types of personal data | Whatever your website collects or contains, for example: form enquiries; customer, order and booking details; user accounts; personal data within your website’s content; and technical data about visitors, such as IP addresses, in server and security logs |
| Whose data | Your website’s visitors, customers, enquirers and users, and your own staff where they use your website |
| How long | For as long as we provide the service, and afterwards as set out in section 9 |
3. Your instructions
3.1 We process personal data only on your documented instructions. These terms, our Terms of business and Hosting service agreement, and the requests you make to us are your instructions.
3.2 If we are required by law to process personal data in another way, we will tell you before doing so, unless the law prevents us.
3.3 If we believe an instruction from you breaks data protection law, we will tell you.
3.4 We do not use your website’s personal data for our own purposes, and we do not sell it.
4. Confidentiality
4.1 Everyone at Roslin Design who can access personal data on your behalf is bound to keep it confidential.
5. Security
5.1 We take appropriate technical and organisational measures to protect personal data, as described in the Hosting service agreement (sections 2.2 to 2.5).
6. Sub-processors
6.1 You give us general authorisation to use the sub-processors below, and to add or replace sub-processors as described in section 6.3.
| Sub-processor | What for | Where |
|---|---|---|
| Cloudflare | Delivering and protecting every website; hosting Astro and Payload websites, including their databases and files; spam protection on forms | Global network |
| Amazon Web Services | Hosting WordPress websites, their databases and media; sending email from website forms; backups; security monitoring | United Kingdom (London) and Ireland |
| Backblaze | Backups | European Union |
| RunCloud | Managing our WordPress server | Malaysia |
| CPGuard (OPSSHIELD) | Firewall and intrusion detection on our WordPress server. It reports the IP addresses of attackers to its provider | India |
| GitHub | Storing website code, which occasionally contains personal data | United States |
| Microsoft (Microsoft 365) | Our email, and project files in SharePoint and OneDrive, for example where a support request or project file includes personal data | United Kingdom / European Union |
| Freshdesk (Freshworks) | Our support ticketing system, where support requests can include personal data | United States |
| Anthropic (Claude) and OpenAI (ChatGPT) | AI assistants that help us with code, documents and support. We have switched off the use of our data to train their models, and we keep the personal data we share with them to a minimum | United States |
6.2 We remain responsible to you for the work of our sub-processors.
6.3 We will tell you at least 30 days before adding or replacing a sub-processor, by email or by updating this list. If you object on reasonable data protection grounds, we will discuss it with you. If we can’t resolve it, you may cancel the affected service without the usual notice, and we will refund any fees you have paid for the period after it ends.
7. Transfers outside the UK
7.1 Some sub-processors process data outside the UK, as shown in section 6. Where they do, the transfer is protected by UK adequacy regulations or other safeguards recognised by UK law.
8. Helping you meet your obligations
8.1 Requests from individuals. If someone asks you to see, correct or delete their data, we will help you find and deal with the data we hold on your behalf. If such a request comes to us directly, we will pass it to you and not respond ourselves unless you ask us to.
8.2 Data breaches. If we become aware of a breach affecting personal data we process on your behalf, we will tell you without undue delay. We will tell you what happened, what data is affected, and what we are doing about it, as far as we know at the time, and keep you updated. We will help you meet your own obligations, including any report you need to make to the Information Commissioner’s Office.
8.3 Other help. We will also help you, where reasonable, with assessments of how your website processes personal data, and with any consultation with the Information Commissioner’s Office.
8.4 Cost. Help under this section is treated as support (Terms of business, section 6): it comes from your included support time, and anything beyond that is charged at the hourly rate for plan clients, or our standard hourly rate if you don’t have a plan.
9. When a service ends
9.1 When a hosting service ends, we will delete personal data we hold on your behalf as set out in the Hosting service agreement (section 6):
- backups are deleted automatically within 6 months;
- website code is archived and deleted after 6 months;
- you can ask us to delete data sooner;
- you can have a full backup of your website and its data, at no extra charge, if you ask when your service ends.
9.2 We may keep personal data for longer only where the law requires us to.
10. Information and audits
10.1 Information. We will answer reasonable questions, and complete reasonable security questionnaires, about how we protect personal data on your behalf, and share relevant information. This is treated as support (section 8.4).
10.2 Audits. If the information under 10.1 isn’t enough to show that we are meeting these terms, or if a regulator requires it, you, or an auditor you appoint, may audit our compliance, provided that:
- you give us at least 30 days’ notice, and the audit takes place during our working hours;
- audits take place no more than once a year, unless there has been a breach affecting your data or a regulator requires one;
- the auditor agrees to keep confidential what they learn, and does not access other clients’ data;
- you pay your auditor’s costs, and our time at our standard hourly rate.
10.3 For the systems of our sub-processors, such as Cloudflare, Amazon Web Services and Backblaze, we rely on their own independent certifications and audit reports, which we can point you to on request.
11. Liability
11.1 Section 10 of our Terms of business applies to these terms. Nothing in these terms limits any liability that cannot be limited under data protection law.