Draft, not yet in force. This document is being reviewed and will change before it applies to anyone. Last updated: 4 October 2026.
1. Who this is between, and what it covers
This agreement is between the customer who accepts the Terms of Service (“you”) and [TEAM TO CONFIRM: the legal name of the company] (“we”). It forms part of the Terms, and you accept it by accepting them. If you need a signed copy, write to [TEAM TO CONFIRM: legal contact email].
It covers personal data in the content you put into Brand Atlas, where you decide what is processed and why (you are the controller), and we process it for you (we are the processor). Personal data we handle for our own purposes, such as your account details, is covered by our Privacy Policy instead.
It is written to meet Article 28 of the UK GDPR and the EU GDPR.
2. The processing
3. What we promise
We will:
- process the data only on your documented instructions, which are these terms and how you use Brand Atlas, unless the law requires otherwise, in which case we tell you first unless the law forbids it;
- make sure everyone who can access it is bound to keep it confidential;
- protect it with the measures in the Annex;
- tell you if we think an instruction breaks data protection law.
4. Subprocessors
You give us general permission to use the subprocessors on our Subprocessors page. We put each under written terms that protect the data at least as well as this agreement, and we remain responsible for them.
We tell you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, we will try to find a way round it; if we cannot, you may end the affected service and we will refund any fees paid for the time after it ends.
5. Helping you
We help you, as far as is reasonable, to:
- answer requests from people using their data protection rights. Much of this you can do yourself in Brand Atlas;
- carry out data protection impact assessments and consult regulators, where the law requires it.
Breaches. If we become aware of a breach affecting your data, we tell you without undue delay, with what we know and what we are doing about it, and update you as we learn more.
6. At the end
When you delete a brand or your account, we keep the data for 30 days so it can be restored, then erase it from our live systems. Backups expire within a further 30 days. Before you delete, you can export your content. We keep only what the law requires us to. [TEAM TO CONFIRM: the deletion timings we promise.]
7. Audits
We make available the information you need to show we meet this agreement, mainly by answering a reasonable security questionnaire once a year. Where the law requires more, we will agree an audit with you, at a reasonable time and at your cost.
8. International transfers
Some subprocessors process data outside the UK and the EU, as shown on the Subprocessors page. Where they do, we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision. [TEAM TO CONFIRM: the transfer safeguard with each subprocessor.]
9. Liability
Each party’s liability under this agreement is subject to the limits in the Terms of Service.
Annex: security measures
- Hosting. The database is in Frankfurt, Germany, on Supabase. Files and backups are in Cloudflare’s EU storage.
- Encryption. Data is encrypted in transit and at rest by our providers. Backups are encrypted before they leave the database. AI keys you give us are encrypted again on their own.
- Access. Row-level rules in the database keep each brand’s data apart. Only a small number of named staff have administrative access, and only to provide and support the service.
- Sign-in. Passwords are stored only as secure hashes. Sign-in codes expire after 10 minutes and are limited in number. Sign-up and sign-in forms check for bots.
- Links. Share links use long random tokens, can expire, and can be switched off at any time. File downloads use short-lived signed links.
- Backups. The database is backed up every night and backups are kept for 30 days.
- Monitoring. Errors are tracked with personal data stripped out, and the service is checked for uptime.
The Security page describes these in more detail.
Changes
- 4 October 2026: first draft.
