Data processing agreement
Version 1.0, 21 October 2026.
This agreement is between Red Squirrel Publishing Ltd, trading as Oakleaf Press (“we”), and each customer of our Managed EU Hosting service (“you”). It forms part of the hosting service and applies whenever we process personal data on your behalf. In it, words such as controller, processor, personal data and personal data breach have the meaning given in the UK GDPR and the EU GDPR.
1. Roles
You are the controller of the personal data your app holds. We are your processor. You are responsible for having a lawful basis for that data and for telling your app's users how it is used.
2. Your instructions
We process the personal data only to provide the hosting service and on your documented instructions, including these terms and the requests you send us. If the law requires us to do something else, we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.
3. Confidentiality and access
Only Chris Williams can access your data, and only when you ask him to. He is bound by confidentiality. We keep a record of each time your data is accessed and why.
4. Security
We use the security measures in Schedule 2 and keep them under review.
5. Sub-processors
You authorise us to use the sub-processors listed in Schedule 3. We will give you at least 30 days' notice by email before adding or replacing one. If you object on reasonable data protection grounds, we will discuss it with you, and you may end the service without penalty if we cannot resolve it. We place the same data protection duties on each sub-processor and remain responsible for them.
6. Helping you
We will help you, as far as we reasonably can, to respond to requests from people exercising their data protection rights, and with security, breach notifications, data protection impact assessments and consultations with a regulator.
7. Personal data breaches
If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and within 48 hours at most. We will tell you what happened, the data and people likely to be affected, the likely effects and what we are doing about it, and send further details as we learn them.
8. Where the data is processed
Your app's data is stored and processed in Amsterdam, the Netherlands, and backups are held in Frankfurt, Germany. We manage the service from the United Kingdom, and for access from the UK we rely on the European Commission's adequacy decision for the United Kingdom. We will not move your data to another country without telling you first under section 5.
9. End of the service
When the service ends, we delete your data from the live service straight away and it is removed from backups within 30 days, unless the law requires us to keep it. If you want a copy, ask us before the service ends and we will provide an export.
10. Information and audits
We will make available to you the information you reasonably need to show that we meet this agreement, and allow and contribute to audits by you or an auditor you appoint, on reasonable notice.
11. General
This agreement lasts as long as we process personal data for you. If it conflicts with other service terms on data protection, this agreement wins. It is governed by the law of England and Wales.
Schedule 1: details of processing
| Subject matter | Hosting the database and gateway that your app uses. |
|---|---|
| Duration | For as long as you use the service, plus up to 30 days for backups to expire. |
| Nature and purpose | Storing, backing up and serving your app's data so your app works, and restoring it when you ask. |
| Types of personal data | Whatever your app collects, typically names, email addresses, account and membership details and activity in the app. Payment card details are handled by your payment provider, not by us. |
| People concerned | Your app's users and members, and your own staff who use the app. |
Schedule 2: security measures
- A separate gateway and a separate database for each customer, with their own settings and logs.
- Signed-in access with permissions, and row-level security where your app is set up for it.
- Encrypted connections between your app and the service, and protected connections inside the hosting environment.
- Daily encrypted backups held in a separate location, which only the service itself can restore from.
- Infrastructure monitoring, and records of access and security events.
- Access to customer data limited to one named person, only on your request.
- Security updates applied as part of running the service.
Schedule 3: sub-processors
| Supplier | What for | Location |
|---|---|---|
| DigitalOcean | Hosting your app's data | Amsterdam, the Netherlands |
| DigitalOcean | Encrypted backups | Frankfurt, Germany |
| DigitalOcean | Support email server, for anything you choose to email us | London, UK |
DigitalOcean is a US-headquartered company. Please do not email us your members' personal details.
Questions about this agreement: support@oakleaf-press.com.