Data processing agreement
Version 1.0. Effective from 15 November 2026.
This agreement forms part of our customer terms. It applies whenever your business stores personal data in one of our products, and sets out the terms UK GDPR (Article 28) requires between a controller and a processor.
Your business is the controller of the personal data in the products you use, such as your staff, your clients and their contacts, and your patients or customers. We, Gotham Projects Ltd, trading as CloudBusiness.Software, are your processor. For the personal data on your CloudBusiness account itself (the people who manage it and pay for it), we are the controller, as our privacy notice explains.
1. What we process
| Item | Detail |
|---|---|
| Subject matter | Providing the products you subscribe to, and supporting you in using them |
| Duration | While you hold a subscription, then until the data is deleted under section 8 |
| Nature and purpose | Storing, organising, displaying, transmitting, backing up and deleting the data you and your users enter, only to provide the product and its support |
| Types of personal data | Names, work contact details, sign-in details and roles of your users; names and contact details of your clients, their staff and delivery recipients (Stockist WMS); names, contact details, appointment, sales and invoice details of your clients or patients (TinyBiz); anything else you choose to enter |
| Categories of people | Your staff and users; your clients and their staff; the people your clients deliver to; your patients or customers |
| Special category data | None is needed by our products. If you choose to enter health data (for example, in an optician’s notes), you must have a lawful basis to do so, and you tell us so we can agree any extra measures |
2. Your instructions
We process the data only on your documented instructions, which are these terms and the way you and your users use the product, unless the law requires otherwise. If we think an instruction breaks data protection law, we tell you.
3. Our people
Everyone at Gotham Projects who can reach your data is bound by confidentiality, and reaches it only when needed to provide or support the product.
4. Security
We protect your data with measures suited to the risk, including:
- encryption of data in transit (HTTPS) and of backups;
- each business’s data kept separate from every other business’s;
- access for our staff limited to those who need it, protected by two-factor sign-in;
- a record of every change in the product, with who made it and when;
- regular backups, and tested restores;
- prompt security updates to the systems we run.
Each product’s trust page describes its own measures in more detail.
5. Sub-processors
You authorise us to use the sub-processors listed below. Our products run on both Hetzner Online and Laravel Cloud, so your data is held in both the European Union and the UK. We have a written contract with each that gives your data the same protection as this agreement, and we remain responsible to you for them. We tell account owners by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can’t resolve it, you can cancel the affected subscription and we refund any period you have paid for beyond the date the change takes effect.
| Sub-processor | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts the products and their databases | European Union |
| Laravel Holdings Inc. (Laravel Cloud) | Hosts the products and their databases | London, UK |
| Cloudflare, Inc. | Routes traffic to the products, protects them with a web application firewall and delivers their pages | Global network |
| Postmark (ActiveCampaign, LLC) | Delivers emails the products send | United States, under approved safeguards |
| DigitalOcean, LLC | Stores encrypted backups | London, UK |
Paddle, which takes payments, is not a sub-processor: your business data never reaches it.
6. Transfers outside the UK
Where a sub-processor processes data outside the UK, we make sure the transfer is covered by UK adequacy regulations or by the International Data Transfer Addendum to the EU standard contractual clauses, or another safeguard UK law approves.
7. Helping you
- People’s rights. The products let you find, correct, export and delete the data you hold. If we receive a request from one of your clients or users about their data, we pass it to you and don’t answer it ourselves.
- Breaches. If we become aware of a personal data breach affecting your data, we tell you without undue delay, and within 48 hours, with what we know, and keep you updated. We help you meet your own duty to report it.
- Assessments. We give you the information you reasonably need for a data protection impact assessment or a consultation with the Information Commissioner’s Office.
- Checks. We give you the information you reasonably need to show we meet this agreement, and answer reasonable security questionnaires once a year. Any on-site audit needs 30 days’ notice and agreement on cost and confidentiality.
8. When a subscription ends
The account owner can export the product’s data whenever the subscription is cancelling, suspended or ended, and for 90 days after it ends. After those 90 days we delete your data from the product, and from our backups as they expire within 30 days, unless the law requires us to keep it.
9. Our details
Gotham Projects Ltd, trading as CloudBusiness.Software, registered in England and Wales with company number 06554421. Registered office: 1 Crow Hill Drive, Mansfield, Nottinghamshire, NG19 7AE. ICO registration ZB402964. Data protection questions: hello@cloudbusiness.software.