Data processing, on paper, when you need it.

For the personal data we process to deliver the engagement, you are the data controller and we are the data processor. For our own business contact and accounting records, we are the controller (see Privacy Policy).

Processing is limited to what is necessary to perform the services in your statement of work: producing the deliverables, communicating about the project, and storing the project files for the agreed retention period.

We engage subprocessors for hosting, storage, email and specialist generative production. A current list is available on request. We give 30 days' notice before adding or replacing a subprocessor that processes your data, and you have a right to object on reasonable grounds.

Where personal data is transferred outside the EEA or the UK, the transfer is made under the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, supplemented by appropriate technical and organisational measures.

We maintain industry standard technical and organisational measures: access controls on least privilege, encryption in transit, encryption at rest for stored personal data, signed contracts with subprocessors, and confidentiality undertakings from personnel.

We will notify you without undue delay (and in any event within 72 hours) of becoming aware of a personal data breach affecting your data, with the information needed for you to meet your own notification obligations.

We will reasonably assist you with data subject requests, data protection impact assessments and prior consultations. We accept independent audits on reasonable notice, subject to confidentiality, no more than once per year unless a breach has occurred.

On termination, we will return or securely delete the personal data we hold for you, at your choice, save where retention is required by law.

Email privacy@vidadfx.com and we will send a countersignable PDF version of our standard DPA within one business day.