Source: https://deftridge.com/dpa/ Title: Data processing addendum | Deftridge Summary: The terms that apply when a company gives us personal data to process on its behalf. A plain-language summary comes first, then the full text. **Privacy** # Data processing addendum The terms that apply when a company gives us personal data to process on its behalf. Applies to: Companies Version 1.0 Updated 4 November 2026 ## The short version - Applies when a company gives Deftridge personal data to process for an engagement. - We process it only on your instructions and only for the engagement. - Sub-processors, security measures and breach notice are listed below. Contents 1. Parties and roles 1. Subject matter and instructions 1. Security measures 1. Sub-processors 1. Assistance and breach notice 1. International transfers and audit 1. Return and deletion 1. Questions ## 01 Parties and roles# This addendum forms part of the [Terms for companies](https://deftridge.com/terms-companies/). The company is the controller (or a processor for its own clients) of the personal data it shares for an engagement, and Deftridge, Inc. or Deftridge Ltd, according to the order confirmation, is the processor. Where Deftridge uses data for its own purposes, such as managing a professional's account, it acts as an independent controller as described in the [privacy notice](https://deftridge.com/privacy/). ## 02 Subject matter and instructions# Deftridge processes the personal data contained in the files, systems and briefs the company provides, only to carry out the engagement and only on the company's documented instructions. The data may include names, work contact details and business records of the company's staff and customers. The processing lasts for the engagement and ends with return or deletion of the data. ## 03 Security measures# Deftridge maintains encryption in transit and at rest for data it stores, role-based access limited to people working on the engagement, access logging, confidentiality duties for staff and for professionals, and a process for removing access when an engagement ends. Professionals work under written confidentiality terms. ## 04 Sub-processors# The company authorises the use of sub-processors for hosting, email delivery and payments, bound by terms no less protective than this addendum. Deftridge keeps the list of sub-processors available on request at [legal@deftridge.com](mailto:legal@deftridge.com) and tells the company at least 14 days before adding one, so that it can object. ## 05 Assistance and breach notice# Deftridge helps the company respond to requests from individuals about their data, and to carry out impact assessments where needed. We tell the company without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data. ## 06 International transfers and audit# Where personal data moves from the UK or the EEA to a country without an adequacy decision, the parties rely on the standard contractual clauses (and the UK addendum) in the form published by the competent authority, which are incorporated here. On written request, not more than once a year, Deftridge provides the information needed to show compliance with this addendum. ## 07 Return and deletion# When the engagement ends, Deftridge returns or deletes the company's personal data within 30 days, unless the law requires it to keep a copy. ## 08 Questions# Write to [legal@deftridge.com](mailto:legal@deftridge.com). Data processing addendum · version 1.0 · updated 4 November 2026 Need something clarified? Email [legal@deftridge.com](mailto:legal@deftridge.com). This is general information about Deftridge; it does not replace a lawyer's view on your own situation. Keep reading ## More about how we handle things ### - [Terms of useThe rules for using Deftridge as a professional: your profile, tasks, rates, payments and conduct. Open](https://deftridge.com/terms/) ### - [Terms for companiesThe rules for companies that hire through Deftridge: shortlists, prepayment, guarantees and hiring a professional directly. Open](https://deftridge.com/terms-companies/) ### - [Privacy noticeWhat personal data we collect, why, how long we keep it, and the rights you have in the US, Canada, the UK and the EU. Open](https://deftridge.com/privacy/) ### - [Cookie policyThe storage this site uses, what each item does and how to change your choice. Open](https://deftridge.com/cookies/)