Data Processing Agreement

For the purposes of this Agreement:

• Personal Data means any information relating to an identifiable individual
• Processing means any operation performed on personal data, such as collection, storage or use
• Controller means the party determining the purposes and means of processing
• Processor means the party processing personal data on behalf of the Controller
• Sub-processor means any third party engaged by the Processor

• The Client acts as the Data Controller
• Larkspire Inc LTD acts as the Data Processor

Larkspire Inc LTD will process personal data only on documented instructions from the Client unless required to do so by law.

Larkspire Inc LTD may process personal data to provide services including:

• Digital, AI and web services, including design, development and delivery
• Website hosting and maintenance where applicable
• AI assistants, automation and systems integration where applicable
• Client dashboard access and functionality
• Performance analytics and reporting
• Customer support and communications
• Content management and updates

Data subjects may include:

• Client employees and representatives
• Website visitors
• End users or customers of the Client
• Leads or enquiry form submitters

Depending on the services provided, Larkspire Inc LTD may process:

• Names
• Email addresses
• Phone numbers
• Business information
• IP addresses and technical data
• Website usage data and analytics
• Data submitted through forms on the Client’s website

Larkspire Inc LTD does not intentionally process special category data unless explicitly agreed.

Personal data will be processed for the duration of the service agreement and for any reasonable period afterwards required for legal, operational or backup purposes.

Larkspire Inc LTD shall:

• Process personal data only in accordance with documented Client instructions
• Ensure authorised personnel are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the Client in meeting data protection obligations where reasonably required
• Notify the Client without undue delay of a personal data breach
• Delete or return personal data when services end unless retention is legally required
• Maintain records of processing activities where required

Larkspire Inc LTD implements appropriate security measures, including:

• Secure hosting environments
• Encryption where appropriate
• Access control and authentication systems
• Regular monitoring and system updates

No system is completely secure and Larkspire Inc LTD cannot guarantee absolute security.

Larkspire Inc LTD may use trusted third-party sub-processors to deliver services, including hosting providers, cloud infrastructure services, analytics providers, communication tools and payment processors such as Stripe.

All sub-processors must be subject to data protection obligations and provide sufficient guarantees of security and compliance. A list of sub-processors can be provided on request.

Where personal data is transferred outside the UK, Larkspire Inc LTD will ensure appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses.

Where reasonably possible, Larkspire Inc LTD will assist the Client with:

• Data subject requests, including access and deletion
• Data protection impact assessments
• Security and breach notifications

The Client is responsible for responding to data subject requests. Larkspire Inc LTD will notify the Client if it receives such a request and provide reasonable assistance where required.

In the event of a personal data breach, Larkspire Inc LTD will:

• Notify the Client without undue delay
• Provide relevant information about the breach
• Take reasonable steps to mitigate its impact

The Client may request reasonable information to verify Larkspire Inc LTD’s compliance with this Agreement.

Audits must be reasonable in scope, subject to confidentiality and must not disrupt normal business operations.

Each party is responsible for its own compliance with data protection laws.

Larkspire Inc LTD is not liable for processing carried out in accordance with Client instructions or for data provided inaccurately by the Client.

When services end, Larkspire Inc LTD will delete or return personal data on request unless retention is required by law or for legitimate business purposes.

This Agreement is governed by the laws of England and Wales.

For any data protection matter, email contact@larkspire.co.uk.