Legal
Data processing agreement
Last updated: 15 October 2026
Applies from launch. Digital Adept isn't open to the public yet. Items in [square brackets] are filled in once the company's details are final.
This agreement forms part of our terms of service. It applies where Cloud Adept Limited (“we”, the processor) processes personal data for an agency (“you”, the controller) in providing Digital Adept, under Article 28 of the UK GDPR and, where it applies, the EU GDPR.
1. The processing
| Subject matter and duration | Providing Digital Adept to you, for as long as you have an account |
| Nature and purpose | Storing and analysing your clients' website, search and business data; making reports; emailing your clients; running the client portal and lead widget |
| Personal data | Names and email addresses of your clients' contacts and portal users; names, emails and websites of leads; review authors' names and reviews from Google; anything you add to notes or tasks |
| Data subjects | Your clients' staff, your leads, and people who review your clients on Google |
2. Our commitments
- We process the data only on your documented instructions (using Digital Adept is your instruction), unless the law requires otherwise, in which case we'll tell you first if we may.
- Everyone who can access it is bound by confidentiality.
- We keep it secure: encryption in transit and at rest, authenticator sign-in for every account that turns it on (required for our own staff), least-privilege access and logged admin actions (Article 32).
- We use the sub-processors listed below. We'll give you 30 days' notice by email before adding or replacing one, and you may object; if we can't resolve it, you may end the agreement.
- We help you respond to data subjects' requests and with security, breach notification and impact assessments, as far as we reasonably can.
- We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
- When you close your account, we delete the data (backups are overwritten within 35 days), unless the law requires us to keep it.
- We make available the information needed to show we meet these obligations, and allow reasonable audits, on 30 days' notice and at your cost.
3. Sub-processors
| Who | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, email sending, Claude on Amazon Bedrock (no data kept) | London, UK (AI: London and EU) |
| Stripe Payments Europe Ltd | Payments (your billing details only) | EU and US |
| Microsoft Ireland Operations Ltd | Our support mailbox | EU and UK |
| Google Ireland Ltd | Search Console, Analytics and Business Profile data, when you connect them | EU and US |
AI search checks with OpenAI, Perplexity or Anthropic receive only the questions you track, which shouldn't contain personal data. International transfers are covered by the UK adequacy regulations, the International Data Transfer Addendum or standard contractual clauses.
4. Your commitments
You have a lawful basis for the data you add and for asking us to process it, you've told the people concerned as the law requires, and you have your clients' permission to connect their Google accounts.
5. Contact
Questions about this agreement, or a signed copy: support@digitaladept.io.