Data Processing Agreement

This page summarizes the standard Data Processing Agreement (DPA) that Idealdevs Corporation Ltd, Unit 104, The Light Box, 111 Power Road, London, W4 5PY, United Kingdom concludes with clients whenever our services involve processing personal data on the client's behalf under Article 28 GDPR. The executed DPA, signed as an annex to the Master Services Agreement, is always the legally binding document; this summary exists so prospective clients and their privacy teams can review our terms before contracting. A signature-ready copy is available from [email protected].

Roles and scope

Under the DPA, the client is the controller and Idealdevs is the processor. The DPA covers all processing of personal data that Idealdevs performs in delivering the contracted services, development, migration, operation, and support of client systems, as specified in an annex describing the subject matter, duration, nature and purposes of processing, categories of data subjects, and categories of personal data for the specific engagement. Processing takes place only on the client's documented instructions, including with regard to international transfers, unless EU or member state law requires otherwise, in which case we inform the client before processing unless the law prohibits it.

Our obligations as processor

The DPA commits Idealdevs to the full set of Article 28(3) obligations, including:

• Confidentiality: all persons authorized to process personal data are bound by contractual confidentiality obligations and receive data protection training.
• Security: technical and organizational measures under Article 32, detailed in a TOMs annex summarized below, maintained and improved over the term.
• Assistance: support for the client's obligations regarding data subject rights (Articles 12–23), security, breach notification, data protection impact assessments, and prior consultation (Articles 32–36), with reasonable assistance included and extensive assistance charged at agreed rates.
• Notification: informing the client without undue delay after becoming aware of a personal data breach affecting their data, with sufficient detail to meet the client's 72-hour obligation, and immediately informing the client if an instruction, in our view, infringes the GDPR.
• Deletion or return: at the client's choice, deletion or return of all personal data at the end of services, and deletion of existing copies unless law requires storage, with deletion certified in writing on request.

Sub-processors

The client grants general written authorization for the sub-processors listed in the DPA's sub-processor annex, typically cloud infrastructure, email delivery, and monitoring providers, EU-region by default. We give at least 30 days' prior notice of intended additions or replacements, during which the client may object on reasonable data protection grounds; if no resolution is found, the client may terminate the affected services. Every sub-processor is bound by a written contract imposing data protection obligations materially equivalent to those in our DPA, and we remain fully liable to the client for their performance.

Technical and organizational measures

The TOMs annex describes the measures behind our ISO/IEC 27001-certified security program, including: encryption of personal data in transit (TLS 1.2+) and at rest (AES-256); least-privilege, role-based access with multi-factor authentication and quarterly reviews; logical separation of client environments; segregation of production from development, with no production personal data in development or test systems; logging and monitoring of access to personal data; secure development practices with peer review and automated scanning; encrypted, regularly tested backups; and documented incident response and business continuity procedures. The full annex is part of the executed DPA.

Audits and demonstration of compliance

We make available all information necessary to demonstrate compliance with Article 28 and contribute to audits. In practice, this is satisfied first through our ISO/IEC 27001 certificate, current audit summaries, and completed security questionnaires; where a client requires an on-site or remote audit, the DPA provides for it with reasonable notice, during business hours, no more than annually absent a specific incident, under confidentiality, and at the client's cost.

Transfers, liability, and term

Processing takes place in the EU/EEA by default. Any transfer to a third country occurs only on the client's documented instruction or with sub-processors covered by adequacy decisions or Standard Contractual Clauses, which the DPA incorporates by reference where needed. Liability follows Article 82 GDPR and the liability framework of the Master Services Agreement. The DPA runs for the duration of the underlying services and survives as long as we process personal data on the client's behalf.

Contact

To request our signature-ready DPA, the current sub-processor list, or the TOMs annex: [email protected]. Idealdevs Corporation Ltd, Data Protection Officer, Unit 104, The Light Box, 111 Power Road, London, W4 5PY, United Kingdom.