Data processing agreement

Version 1.0. Last updated 4 September 2026. This agreement has not yet been reviewed by a solicitor. The sub-processor list must be confirmed once the storage and email providers are chosen.

This agreement is between you, the agency ("the controller"), and Yarqat LTD trading as SiteBench ("the processor"). It forms part of the terms of service and applies whenever we process personal data on your behalf. It is written to meet Article 28 of the UK GDPR.

1. Roles

You are the controller. Where the personal data belongs to your own client, that client is usually the controller and you are their processor; in that case you appoint us as a sub-processor and you confirm you have the authority to do so.

We act only on your documented instructions. These terms, the portal settings you choose, and the tickets you raise are your instructions. If we think an instruction breaks data protection law we will tell you and may decline it.

2. What we process, and why

Category	What it is	Why we have it
Your staff	Name, work email, hashed password, two-factor secret, role, IP address and timestamps in the audit log	Running the portal and keeping it secure
Site credentials	WordPress administrator accounts, SFTP or SSH details, hosting logins	Doing the maintenance you have asked for
Site backups	A full copy of each site's database and files, which will contain whatever personal data the site holds: customer accounts, orders, form submissions, comments	Restoring a site after a failure
Operational records	Update runs, uptime history, scan results, tickets and time logged	Delivering and reporting on the service
Health check leads	Agency name, email address, site addresses	Sending the report you asked for

Site backups are the significant one. We do not read them, index them or use them for anything but restoring a site, and they are encrypted at rest.

Data subjects are your staff, your clients' staff, and the visitors and customers of the sites we maintain.

3. How long we keep it

Backups: 30 days on Care, 60 days on Care Plus, then automatically deleted.
Operational records and reports: for the life of the agreement and 12 months afterwards.
Portal accounts and audit log: for the life of the agreement and 12 months afterwards.
Credentials: deleted 30 days after a site is removed.
Health check leads: 24 months, or sooner on request.

4. Security

The measures we take, stated plainly so you can check them:

Encryption in transit for everything, using current TLS.
Encryption at rest for backups and for stored credentials.
Two-factor authentication required for every account that can change anything.
Access on a need-to-know basis, with a named engineer per account and an audit log of every write.
Server hardening: firewall, automatic security updates, brute-force protection, key-based administrative access.
Backups tested by restoring them, at least monthly, not merely written and hoped for.
Separate databases per system, with separate credentials.

5. Sub-processors

You give us general authorisation to use the sub-processors below. We will give you 30 days' written notice before adding or replacing one, and you may object; if we cannot resolve your objection you may cancel the affected sites without penalty.

Sub-processor	What they do	Where
The hosting provider of this platform	Runs the servers holding the portal and backups	To be confirmed
Object storage provider	Holds off-site backups	To be confirmed
Transactional email provider	Delivers reports and notifications	To be confirmed
Stripe Payments Europe Ltd	Takes payment. Stripe is a controller for payment data and we never see full card numbers	Ireland, with transfers to the United States under Stripe's own safeguards

The first three entries are marked to be confirmed because the providers have not yet been chosen. This table will be completed, and you will be told, before any client data is processed.

6. Transfers outside the United Kingdom

We aim to keep all personal data in the United Kingdom or the European Economic Area. Where a sub-processor transfers data elsewhere, that transfer relies on UK adequacy regulations or on the International Data Transfer Addendum to the European Commission's standard contractual clauses, together with a transfer risk assessment.

7. Helping you meet your obligations

Data subject requests. If a data subject contacts us directly we will not respond to the substance; we will pass the request to you within two working days. We will help you answer it, at no charge for a reasonable volume.
Breaches. We will tell you without undue delay and in any event within 24 hours of becoming aware of a personal data breach, with what we know, what we are doing and what we advise. We will not notify the Information Commissioner on your behalf unless you ask us to in writing.
Assessments and audits. We will give you the information you reasonably need for a data protection impact assessment or to demonstrate compliance. You may audit us once a year on 30 days' notice, at your cost, or accept a written response to a security questionnaire instead.

8. Confidentiality

Everyone who can reach your data is bound by a written confidentiality obligation that survives the end of their engagement with us.

9. When this ends

On cancellation, and as set out in the terms of service, we take a final backup and make it available to you for 30 days, give you a written list of the credentials we hold, and remove monitoring. Thirty days later we delete all personal data we hold on your behalf, including backups, unless you have asked in writing for longer or the law requires us to keep it. We will confirm the deletion in writing if you ask.

10. Liability and precedence

The liability limits in the terms of service apply to this agreement. Where this agreement and the terms of service conflict on the processing of personal data, this agreement wins.

Contact

Data protection enquiries: engineering@wpcare.yarqat.com, Yarqat LTD, registered in England and Wales.