Data Processing Agreement
Version 1.0 · 29 October 2026 · forms part of the Terms of Service
Your business is the controller of the personal data it puts into Aftermade about its customers. Aftermade is your processor. This agreement contains what Article 28 of the GDPR requires: we act only on your instructions, keep the data confidential and secure, use only approved sub-processors, help you meet your obligations, tell you about breaches, and delete or return the data when you leave.
1. Parties and scope
This Data Processing Agreement ("DPA") is between the business that accepts the Terms of Service ("Customer", the controller) and Daniel Brennan, sole trader trading as Aftermade ("Aftermade", the processor). It applies to all personal data Aftermade processes for the Customer when providing the service ("Customer Personal Data"). If this DPA conflicts with the Terms, this DPA prevails on data protection matters. Terms used here have the meaning given in Regulation (EU) 2016/679 (the "GDPR").
2. Details of the processing (Article 28(3))
| Subject matter | Providing Aftermade: workshop tracking, private customer order pages, shipping updates, certificates and related emails. |
|---|---|
| Duration | For the term of the Customer's use of Aftermade, plus the deletion periods in section 10. |
| Nature and purpose | Storing, organising, displaying (to the Customer's staff and, via private links, to the relevant customer), emailing, backing up, exporting and deleting data, as the Customer directs through the service. |
| Types of personal data | Customer contact details (name, email, phone); order details, item specifications and notes; workshop photographs; delivery town, country, coordinates and carrier tracking details; email delivery records; page visit times and in-page actions (opening the carrier tracking link, saving a certificate); staff names and emails. |
| Categories of data subjects | The Customer's own customers; the Customer's staff and users. |
| Special categories | None. The Customer must not enter special categories of data (Article 9) or data about criminal convictions (Article 10). |
3. Instructions
Aftermade processes Customer Personal Data only on the Customer's documented instructions (Art. 28(3)(a)). These are the Terms, this DPA, and the Customer's use and configuration of the service. If Aftermade believes an instruction infringes data protection law, it will tell the Customer immediately. If EU or Member State law requires other processing, Aftermade will inform the Customer before processing unless that law forbids it.
4. Confidentiality
Aftermade ensures that everyone authorised to process Customer Personal Data is bound by confidentiality (Art. 28(3)(b)), and only gives access where it is needed to provide or support the service.
5. Security
Aftermade implements the technical and organisational measures in Annex 1, appropriate to the risk (Art. 28(3)(c) and Art. 32). Aftermade may update them, provided the overall level of protection does not fall.
6. Sub-processors
The Customer gives general authorisation for Aftermade to use sub-processors (Art. 28(2)). The current ones are listed on our sub-processors page.
Aftermade will give at least 30 days' notice of any intended addition or replacement. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the service, and fees paid in advance for the unused period will be refunded.
Aftermade imposes the same data protection obligations on each sub-processor by contract (Art. 28(4)) and remains responsible to the Customer for their performance.
7. Help with data subjects' rights
The service lets the Customer access, correct, export and erase customer data itself (Art. 28(3)(e)). If Aftermade receives a request from one of the Customer's data subjects, it will pass it on to the Customer without undue delay and will not answer it except on the Customer's instructions.
8. Help with security, breaches and assessments
Aftermade will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data (Art. 33(2)). The notice will contain the information Article 33(3) requires, as far as it is available, and will be updated as more becomes known.
Taking into account the nature of processing and the information available to it, Aftermade will reasonably help the Customer with breach notifications, data protection impact assessments and prior consultations (Art. 28(3)(f), Arts. 32–36).
9. International transfers
Customer Personal Data is stored in the EU. Where a sub-processor processes it outside the EU/EEA, Aftermade ensures a transfer mechanism under Chapter V of the GDPR is in place: an adequacy decision, or the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3) with supplementary measures where needed.
10. Deletion and return at the end
The Customer can export all its data at any time from the Business page (structured, machine-readable JSON), and must be able to retrieve it for at least 30 days after giving notice of termination.
When the Customer deletes its business, or at the end of the service, Aftermade deletes Customer Personal Data from live systems at once and from backups within 7 days, unless EU or Member State law requires it to be kept (Art. 28(3)(g)). On request, Aftermade will confirm deletion in writing.
11. Audits and information
Aftermade will make available all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, by the Customer or an auditor it mandates (Art. 28(3)(h)). Audits must be on reasonable notice (at least 30 days unless a supervisory authority requires otherwise), during business hours, no more than once a year unless a breach has occurred, at the Customer's cost, and subject to confidentiality. Aftermade may first answer by providing documentation, such as security descriptions and test evidence.
12. Liability and term
Liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not allow liability to be limited (including Article 82). This DPA lasts as long as Aftermade processes Customer Personal Data for the Customer.
Annex 1: Technical and organisational security measures
- Separation of customers: every business's data is tagged and isolated by row-level security in the database. Cross-business access is tested automatically on every change.
- Access control: two-step sign-in is required; roles are owner, admin and staff, on least privilege; administrative database keys are used only on the server.
- Private links: customer page links contain 256-bit random codes, stored only as a hash (plus an encrypted copy for resending). Links can be replaced or switched off. Abuse is rate-limited.
- Encryption: HTTPS everywhere, and encryption at rest by the database and storage provider.
- Data minimisation: customer pages show only allow-listed fields (first name, never contact details or internal notes). Error reports have personal details removed before sending.
- Resilience: daily backups, with periodic restore tests, and hosting in the EU.
- Development: secret scanning, automated tests and security review for every milestone; dependency updates held 14 days and tested before use.
- People and process: confidentiality duties; a breach response procedure (detect, contain, assess, notify the controller within 48 hours, record); a record of processing activities (Art. 30).
Annex 2 (sub-processors) is the sub-processors page.