1. Parties & roles
The Processor is TicketWave HQ Ltd, trading as VerySEOly, registered in England and Wales, company number 17143167, registered office Radley House, Richardshaw Road, Pudsey, LS28 6LE. Contact for DPA matters: hello@veryseoly.com.
The Controller is you (the client named on the engagement). Where you are a clinic, practice, school, firm, or other regulated entity, you remain the data controller of any personal data we process on your behalf, the agency is not the controller.
2. Subject matter, duration, nature & purpose
Subject matter: personal data processed in the course of designing, building, hosting, and operating your website and associated services (CRM, newsletter, lead-magnet flows) under your engagement.
Duration: for as long as you have an active engagement with us, plus the retention windows in section 9 below.
Nature & purpose: hosting your website on UK/EU-based, GDPR-friendly infrastructure (Vercel London), delivering form submissions and audit reports by email (Scaleway TEM, Paris), routing inbound mail where that was set up before 10 October 2026 (Cloudflare Email Routing), error monitoring (Sentry, EU region), giving attended remote support when you ask for a session, through our own relay (OVHcloud, Gravelines), with nothing recorded and files moved only at your request, and, where your build includes a newsletter, sending it via MailerLite (EU). A CRM we set up for you is opened in your name under your own contract with its provider and does not process data on our behalf.
3. Categories of data subject
- Visitors to your website (form submitters, lead-magnet requesters).
- Your customers, patients, clients, parents, pupils, or other end-users whose personal data you input into systems we operate.
- Your staff (where staff details appear on the site or in CRM records we host).
4. Categories of personal data
Standard small-business contact data: name, email address, phone number, organisation, the message text, and any vertical / sector self-identification provided. We do not solicit special-category data (UK GDPR Article 9, health, religious belief, sexual orientation, etc.) and you agree not to route special-category data through our forms or CRM without telling us first so we can confirm appropriate safeguards.
For regulated-sector clients (clinics, solicitors, schools, accountants), additional categories may apply by virtue of the form fields you design, section 6 covers the security measures and section 8 governs international transfers.
5. Our obligations as processor
We will:
- Process personal data only on your documented instructions (this DPA, the Terms, and any reasonable written instruction from you);
- Ensure everyone authorised to process personal data is bound by confidentiality;
- Implement the technical and organisational security measures set out in section 6;
- Engage sub-processors only on the terms in section 7;
- Help you respond to data subject rights requests (Articles 12-23) by providing tooling, exports, and deletion within a reasonable time;
- Help you meet your obligations under Articles 32-36 (security, breach notification, DPIA support);
- Notify you without undue delay (within 72 hours of awareness) of any personal data breach affecting your data;
- On termination of the engagement, at your choice, delete or return all personal data we hold for you (subject to section 9);
- Make available to you all information necessary to demonstrate compliance with Article 28 and allow for audits or inspections at reasonable cadence (typically annual self-assessment summary; on-site audit available with reasonable notice and cost-recovery for time).
6. Security measures
We maintain appropriate technical and organisational measures, including:
- Encryption in transit, TLS 1.3 on every page (Vercel automatic HTTPS); HSTS preload; secure cookies where used.
- Encryption at rest, provided by sub-processors (Vercel, Resend) under their respective security baselines; database backups are encrypted on our own server before they are stored off-site, and only we hold the keys.
- Access control, least-privilege access; two-factor authentication required on every administrative account (GitHub, Vercel, Resend). The database accepts connections only over TLS with a client certificate we issue, each application limited to its own database.
- Network controls, Vercel-managed DDoS protection; Cloudflare for DNS, and for email routing where set up before 10 October 2026; restrictive Content-Security-Policy headers on the site itself.
- Application hardening, semantic HTML, no inline scripts beyond what is necessary, strict CSP, defence-in-depth against XSS.
- Backup & recovery, our database is backed up nightly with point-in-time recovery, the backups encrypted before they leave the server and restoration rehearsed on a schedule; Vercel maintains daily backups of static assets; source code lives in version control (GitHub); CRM records exported on cancellation per section 9.
- Monitoring, Vercel Analytics + Speed Insights (first-party, cookieless) and our own Plausible Community Edition server (cookieless, OVHcloud, France) for traffic; Sentry (EU region) for error monitoring; alerting on availability and error rates.
- Staff training, every person with access to client systems is briefed on UK GDPR data-handling, phishing, and breach reporting.
7. Sub-processors
You authorise us to engage the sub-processors listed on our sub-processors page. Headline:
- Vercel Inc., website hosting (served from London, lhr1), plus Vercel Analytics and Speed Insights. DPA in place; ISO 27001 certified.
- Hetzner Online GmbH (Germany), infrastructure for the server that runs our database (PostgreSQL, operated by us), Nuremberg (EU). Hetzner's standard Article 28 data processing agreement.
- Scaleway SAS (France), transactional email for this site's forms (Scaleway TEM, Paris) and off-site storage of that database's nightly backups, encrypted on our server before upload. Scaleway's standard Article 28 data processing agreement.
- Cloudflare, Inc., DNS, and Cloudflare Email Routing (inbound) where set up before 10 October 2026. DPA in place.
- Resend, Inc., outbound email for account and billing notices, engaged only when those flows are switched on; not in use at 11 October 2026 (EU region). DPA in place.
- OVH Limited (OVHcloud), servers in Gravelines, France: hosts our own analytics server (Plausible Community Edition: cookieless pageview records, kept 24 months) and our remote-support relay (engaged only for remote sessions; connection records, never session content). DPA in place.
- Plausible Insights OÜ (Plausible Analytics cloud, EU/Germany), only for a client site whose analytics we still run in Plausible's cloud, until it moves to our own analytics server. DPA in place.
- Functional Software, Inc. (Sentry), error monitoring; captures the visitor IP at the point of an error. EU ingest region (de.sentry.io). DPA + UK IDTA Addendum in place.
We will give you at least 30 days' notice of any new sub-processor (by email to the address on file). You may object on reasonable data-protection grounds within that window; if we cannot accommodate your objection, you may terminate the engagement with a pro-rata refund of any prepaid Fees for the period after termination.
8. International transfers
Our default architecture keeps personal data on UK or EU infrastructure. Several sub-processors are US-incorporated but hold the relevant personal data inside the UK or EEA: Vercel (London hosting) and Sentry (EU ingest region, de.sentry.io). Our database and its backups sit with EU companies in EU data centres (Hetzner, Nuremberg; Scaleway, Paris), so no international transfer arises for them. Where any sub-processor processes data outside the UK / EEA (for example, Cloudflare operates a global network, a documented exception kept by design), transfers are protected by an appropriate safeguard: the UK International Data Transfer Agreement / Addendum to the EU SCCs, UK adequacy regulations, or equivalent. The sub-processor disclosure documents this per vendor.
9. Retention & deletion
For the duration of your engagement, we process personal data as needed to deliver the service. On termination:
- Within 14 days of cancellation, we export all CRM records, newsletter subscribers, and form submissions to a format of your choice (CSV is default) and deliver them to the email address on file. Any CRM or newsletter account opened in your name stays yours.
- Within 60 days we delete personal data from our active systems, unless you have asked us to keep it longer for a specific reason.
- We may retain a minimum set of metadata (invoice records, audit logs, billing reconciliation) for up to 6 years to meet UK tax and accounting obligations. This is held by us as a controller, not as your processor.
10. Data subject rights
Where a data subject contacts us directly with a rights request (access, rectification, erasure, portability, objection), we will promptly forward it to you, you, as controller, are responsible for the response under Articles 12-23. We will provide reasonable technical assistance to you in fulfilling the request.
11. Breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of awareness, providing, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.
12. Audits
We will make available to you all information necessary to demonstrate compliance with this DPA. On reasonable written notice (at least 30 days), and not more than once per year except in response to a regulator's request or a breach affecting your data, you may audit our compliance via a written questionnaire we will complete within 30 days. On-site audits are available at cost-recovery for our time.
13. Liability & precedence
Each party's liability under this DPA is subject to the liability limits in the Terms & Conditions. In the event of any conflict between this DPA and the Terms, this DPA takes precedence on data-processing matters only.
14. Governing law
This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
15. How to sign or amend
By starting or maintaining an engagement with VerySEOly, you accept this DPA. If your organisation requires a signed paper copy (some clinics, schools, and law firms do), email hello@veryseoly.com and we will sign and return a PDF executed copy within 5 working days. We can also accept your own DPA template by negotiation, typical for larger institutions with their own procurement framework.
16. Related documents
Sub-processors (canonical list, referenced from §7) · Privacy Policy · Cookie Policy · Vulnerability Disclosure · All legal documents
17. Changelog
- v1.10, 2026-10-20, §2 no longer says that we store form submissions and enquiry records in our database. None of the enquiries sent through this site's forms has ever been written to it: they are emailed to us and recorded in our own business system, as our Privacy Policy says. What this site keeps in the database is Site Score report requests and the records of the proposals we send, so §6, §7 and §8 now call it our database rather than our lead/client database. No sub-processor is added or removed.
- v1.9, 2026-10-12, removed Capsule CRM from the authorised sub-processors, the security measures and the nature-of-processing paragraph: we keep no CRM of our own, and a CRM set up for you is your own account and contract with its provider, not processing on our behalf.
- v1.8, 2026-10-12, removed Stripe Payments Europe Ltd. from the list of authorised sub-processors and from the security-measures and international-transfers paragraphs: VerySEOly no longer takes card payments or subscriptions, so no payment processor handles personal data on our behalf.
- v1.7, 2026-10-11, analytics for veryseoly.com moved to our own Plausible Community Edition server on OVHcloud (§6, §7); Plausible Insights OÜ stays listed only for a client site still on its cloud. The version line at the top now matches this changelog (it still said 1.4).
- v1.6, 2026-10-11, corrected the email provider in §2 and §7: this site's forms and audit reports are sent through Scaleway TEM (Paris), not Resend; Resend is engaged only when account and billing notices are switched on; newsletters go through MailerLite, as §7 already said.
- v1.5, 2026-10-11, the lead/client database moved from Neon Postgres (Frankfurt) to PostgreSQL on a server we operate at Hetzner (Nuremberg, EU), with encrypted nightly backups at Scaleway (Paris, EU): Neon Inc. removed from §2, §6, §7 and §8; Hetzner Online GmbH and Scaleway SAS added to §7; backup, access-control and encryption measures in §6 updated to match.
- v1.4, 2026-10-10, added attended remote support to §2's nature and purpose, and OVHcloud, which hosts the relay, to the §7 sub-processor list.
- v1.3, 2026-10-10, inbound email routing is listed only for arrangements set up before 10 October 2026, since new business email is set up by Dacros, another trading name of TicketWave HQ Ltd; "monthly retainer" and "retainer billing" now read as engagement and recurring billing.
- v1.2, 2026-10-07, removed Cal.com (scheduling) from the §7 sub-processor list and the §2 nature/purpose: it is no longer used, and calls are booked by phone or through the contact form.
- v1.1, 2026-06, added Neon Postgres (lead/client database, Frankfurt/EU), Sentry (error monitoring, captures visitor IP, EU ingest), and Cal.com (scheduling) to the §7 sub-processor list, the §2 nature/purpose, the §6 security measures, and the §8 international-transfers narrative. Disclosed Plausible as running on veryseoly.com itself.
- v1.0, June 2026, initial publication. Sub-processor list now mirrored at /sub-processors as the canonical reference.