# Data processing agreement

> This agreement applies whenever WharfCloud processes personal data on behalf of a business customer as its processor. It forms part of our terms of service and needs no separate signature. If you need a signed copy, ask us. If you use our services as an individual for your own purposes, our privacy notice and terms of service apply instead.

Source: https://wharfcloud.co.uk/legal/dpa · Last updated 22 October 2026 · WharfCloud

## 1. Details of the processing

Table: Description of processing under UK GDPR Article 28(3)

| Item | Detail |
| --- | --- |
| Subject matter | Hosting, managing, backing up and supporting the systems you use our services for. |
| Duration | For as long as we provide the services, plus 14 days after a service ends, when we delete the data (see our terms). |
| Nature and purpose | Storage, backup, restore, monitoring, transmission and access needed to provide and support the services. |
| Types of personal data | Whatever you or your users place on the services, which may include contact details, account data and business records. |
| Data subjects | Your staff, customers, clients and other people whose data you store on the services. |

## 2. Our obligations

1. We process personal data only on your documented instructions, which are these terms and the requests you make through the panel or tickets, unless the law requires otherwise; if so, we tell you unless the law forbids it.
2. Everyone who can access your data is bound by confidentiality.
3. We apply appropriate technical and organisational security measures, including encryption in transit, access control with two-factor authentication, least-privilege access, logging and tested backups.
4. We assist you, taking into account the nature of the processing, with data subject requests, security, breach notification, impact assessments and consultations with the ICO.
5. We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
6. At the end of the services we return your personal data if you ask within 14 days, then delete it, including backups, unless the law requires us to keep it.
7. We make available the information needed to show compliance with Article 28, and allow for and contribute to reasonable audits, with reasonable notice and at your cost.

## 3. Sub-processors

You give us general authorisation to use the sub-processors listed on our [sub-processors page](https://wharfcloud.co.uk/legal/subprocessors). We impose data protection obligations on them equivalent to these, and remain responsible for them. We give at least 30 days' notice of a new sub-processor by updating that page and emailing account owners. If you object on reasonable data protection grounds and we cannot address the objection, you may end the affected service without penalty.

## 4. International transfers

We transfer personal data outside the UK only where the transfer is covered by UK adequacy regulations or by appropriate safeguards under UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

## 5. Your obligations

You are responsible for having a lawful basis for the processing, for the instructions you give us, and for the content you place on the services.

---

WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered.
Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends.
Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact