Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the controller) and Blazed Digital (trading as The Revamp Company) (the processor), and applies only to the extent we process personal data on your behalf in the course of a Plan, project or other Service ("Processor Services"). It does not apply to data we process as an independent controller, which is described in the Privacy Policy.

Where the CCPA or a similar US state privacy law applies, we act as your "service provider" or "processor". We will not sell or share the personal data, will not retain, use or disclose it outside our direct business relationship with you or for any purpose other than the Processor Services, and will not combine it with personal data we receive from others except as those laws allow. We will tell you if we can no longer meet these obligations.

If UK GDPR or EU GDPR does not apply to a particular processing activity, this DPA still sets the commercial allocation of responsibility between us, but statutory Article 28 wording applies only where that law applies.

In the event of conflict on a data-protection obligation for Processor Services, this DPA prevails over the Terms of Service, except that the liability cap, exclusions, indemnity, governing law and jurisdiction in the Terms of Service prevail over this DPA.

• Subject matter: marketing, outreach, advertising, website, booking, lead-tracking and follow-up work, and support of business systems you instruct us to work on.
• Duration: the engagement and a short wind-down for deletion or return, unless law requires longer retention of our own records.
• Nature and purpose: access, copying, migration, storage, alteration, combination, disclosure to subprocessors, and deletion, solely to provide the Processor Services.
• Types of personal data: those present in the systems you give us access to, which typically include names, contact details, enquiries, bookings, prospect and customer lists, and similar marketing and operational data. You must not provide special-category, children's or payment-card data unless a Statement of Work expressly covers it.
• Categories of data subjects: your customers, prospects, staff, contractors and suppliers, as determined by you.

You warrant and undertake that: (a) you are a controller with a lawful basis for the processing; (b) you have provided all notices and obtained all consents the law requires; (c) your instructions are lawful and documented; (d) you will not instruct us to process data in a way that would put us in breach of US state privacy laws, the CAN-SPAM Act, the Telephone Consumer Protection Act, UK GDPR, EU GDPR, PECA or other applicable law; and (e) you will not send us data that a Statement of Work does not cover.

You remain responsible for your own compliance, for data-protection impact assessments, for answering data-subject requests that relate to your business, and for the lawfulness of the personal data you place in the systems. You must indemnify us against any claim, fine or cost arising from your breach of this section.

We will: (a) process personal data only on your documented instructions, including in the Statement of Work and these Terms, unless law requires otherwise, in which case we will tell you if legally permitted; (b) ensure persons we authorise to process the data are bound by confidentiality; (c) implement appropriate technical and organisational measures having regard to the nature of the Processor Services and the fact that we are a small professional-services provider, not an enterprise hosting company; (d) respect the conditions for engaging subprocessors set out below; (e) assist you, taking into account the nature of processing and the information available to us, with your obligations regarding data-subject rights, security, breach, impact assessments and prior consultation, at your cost and at our then-current rates; (f) delete or return personal data at the end of the Processor Services as set out below; and (g) make available information reasonably necessary to demonstrate compliance with this DPA, as set out in the audit section.

Your instructions are the Statement of Work, requests you raise in the designated support channel, and written instructions sent to jarvis@therevampcompany.com. We may refuse an instruction that we reasonably believe is unlawful, unsafe, or outside the scope of the Fees, and we may treat additional processing as a change request.

You authorise us to use subprocessors who provide hosting, email, calendar, infrastructure, communications and similar services, including Google and our hosting providers, and contractors who assist on the engagement under confidentiality obligations. We will impose data-protection obligations on subprocessors that are materially no less protective than this DPA, to the extent applicable to the service they provide.

We may add or replace a subprocessor. If UK or EU law requires us to give you a chance to object, we will give notice where practicable. If you object on reasonable data-protection grounds and we cannot accommodate the objection, your sole remedy is to cancel the affected Processor Services under the Refund and Cancellation Policy. No refund of Fees already earned is due.

Processor data will be accessed from Pakistan and may pass through other countries where subprocessors operate. Where a restricted transfer requires a transfer tool, we will use standard contractual clauses or the UK addendum with the subprocessor where that subprocessor offers them, or another lawful mechanism. You authorise those transfers as part of your instructions.

We will notify you without undue delay after becoming aware of a personal-data breach affecting Processor Services, and will provide information we can reasonably obtain to help you meet your own notification duties. You are responsible for notifying regulators and data subjects unless law makes us directly responsible. Our notice is not an admission of fault or liability.

Assistance under this DPA, including help with data-subject requests, impact assessments, audits and breach support, is chargeable at our then-current rates plus costs, unless the need for assistance is caused by our proven breach of this DPA. We are not obliged to drop billable project work to meet a deadline you have left late.

You may, not more than once in any twelve (12) month period and on not less than thirty (30) days' written notice, request information or a remote review reasonably necessary to verify our compliance with this DPA. Any on-site inspection requires our prior written consent, must not disrupt our business or other clients, and is at your cost, including our time at then-current rates. We may satisfy an audit by providing third-party certifications or a written questionnaire. You must keep all audit information confidential.

When Processor Services end, we will, at your written election received within fourteen (14) days, return a copy of the personal data we still hold in a reasonable common format or delete it from systems we control, unless law or our own controller records require retention, or the data also resides in a third-party account you control. If you give no election, we may delete. Backups expire on their ordinary cycle. Deletion from a third-party product you own is your responsibility.

Each party is responsible for its own administrative fines to the extent the law attributes them. As between us, and to the maximum extent permitted by law, our aggregate liability under or in connection with this DPA is subject to the exclusions and the three-month Fees cap in the Terms of Service. You must indemnify us for claims by data subjects, regulators or third parties that arise from your instructions, your failure to have a lawful basis, or data you should not have sent.