1. Background and roles
This Data Processing Agreement ("DPA") forms part of the Signoff Terms of Service between Lost in TV (company number 04801855, registered office 82A James Carter Road, Mildenhall, Suffolk, IP28 7DE) and the Client, and applies whenever we process personal data on the Client's behalf in providing the Service.
For that processing, the Client is the controller and Lost in TV is the processor within the meaning of the UK GDPR. The details of the processing are set out in Annex 1, the security measures in Annex 2, and the authorised sub-processors in Annex 3.
"UK GDPR" means the retained EU law version of the General Data Protection Regulation as it forms part of the law of the United Kingdom, together with the Data Protection Act 2018. Terms such as "personal data", "processing", "data subject" and "personal data breach" have the meanings given there.
2. Our obligations as processor
We will:
- Instructions. Process the personal data only on your documented instructions (which include your configuration and use of the Service, these terms and this DPA), unless required to do otherwise by law — in which case we will inform you before processing unless the law prevents it. We will tell you immediately if, in our opinion, an instruction infringes data protection law.
- Confidentiality. Ensure that everyone we authorise to process the personal data is committed to confidentiality (by contract or statutory obligation).
- Security. Implement and maintain appropriate technical and organisational measures to protect the personal data, taking account of the nature of the processing, as described in Annex 2 (Article 32 UK GDPR).
- Sub-processors. Engage sub-processors only in accordance with clause 3.
- Data subject rights. Taking into account the nature of the processing, assist you with appropriate technical and organisational measures to respond to requests from individuals exercising their rights (access, rectification, erasure, restriction, portability, objection). If a data subject contacts us directly we will pass the request to you without undue delay and, save as required by law, will not respond substantively except on your instructions.
- Assistance. Assist you, taking into account the nature of the processing and the information available to us, in meeting your obligations regarding security of processing, personal data breach notification, data protection impact assessments and prior consultation (Articles 32–36 UK GDPR).
- Breach notification. Notify you without undue delay after becoming aware of a personal data breach affecting your personal data, and provide the information reasonably required for your own notification obligations as it becomes available.
- Deletion and return. At the end of the provision of the Service, delete or return the personal data as described in clause 5.
- Information and audit. Make available to you the information necessary to demonstrate compliance with Article 28 UK GDPR, and allow for and contribute to audits or inspections conducted by you or your appointed auditor — no more than once in any 12-month period except following a personal data breach or where required by a supervisory authority, on at least 30 days' written notice, during business hours, without disrupting other clients, and at your cost.
3. Sub-processors
You give general written authorisation for the sub-processors listed in Annex 3. We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you reasonably object on data protection grounds and we cannot offer an alternative, you may terminate the affected Service and export your data. We impose data protection obligations on each sub-processor equivalent to those in this DPA and remain fully liable to you for their performance.
4. International transfers
The personal data is hosted and processed in the United Kingdom and the European Economic Area. We will not transfer it outside the UK and EEA without ensuring an appropriate safeguard under Articles 44–49 UK GDPR (such as an adequacy regulation, or the ICO's International Data Transfer Agreement or Addendum) and giving you prior notice.
5. Deletion and return of data
- During the Service term you can export release records at any time (PDF + CSV).
- For 30 days after termination we will keep your data available for export (except on termination for serious breach involving unlawful use).
- We will then delete the personal data within 90 days of termination, unless UK law requires us to retain it. Copies in encrypted backups are deleted in the ordinary course of backup rotation and are not restored except for disaster recovery.
6. Liability
Each party's liability under this DPA is subject to the exclusions and limitations in the Terms of Service, except where data protection law does not permit liability to be limited in that way.
Annex 1 — Details of processing
| Subject matter | Operation of the Signoff digital release-form service. |
|---|---|
| Duration | The term of the Client's use of the Service, plus the export and deletion periods in clause 5. |
| Nature and purpose | Collection of release form submissions from data subjects at the Client's invitation; storage; display to the Client's authorised users; generation of signed PDF documents; export; audit logging. |
| Categories of data subjects | Contributors, audience members, location owners and other individuals invited by the Client to complete a release; the Client's own personnel who hold accounts. |
| Types of personal data | Name; contact details (email, phone, postal address); date of birth where the Client's form requires it; photograph; signature; role/contribution and fee details; answers to the Client's custom questions; technical data (IP address, device user-agent, timestamps). |
| Special category data | Not intended to be collected. Photographs are processed for identification convenience only and are not used for biometric identification. The Client must not configure forms to collect special category data without a separate written agreement with us. |
Annex 2 — Technical and organisational security measures
- All data in transit is encrypted (TLS 1.2 or higher); plain HTTP is redirected to HTTPS.
- Data is hosted on servers in the UK/EEA with access restricted to authorised personnel.
- Client console access requires individual credentials; passwords are stored only as salted adaptive hashes (bcrypt). Client data is segregated by tenancy checks enforced on every request, including document and photograph retrieval.
- Contributor photographs are stored outside the web-accessible file tree and served only to authenticated, authorised users.
- Signing links use unguessable 128-bit tokens and can be disabled by the Client at any time.
- An audit trail records the signing, status changes, edits and exports of each release record.
- Signed wording is version-pinned: the text a data subject agreed to is never altered retrospectively.
- Regular backups are taken and stored securely; access to production infrastructure is limited to named administrators.
Annex 3 — Authorised sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Lost in TV's hosting provider (dedicated server infrastructure) | Hosting and storage of the Service and its data | UK / EEA |
| Amazon Web Services (Simple Email Service, region eu-west-2, London) | Delivery of transactional email (account verification, password resets, service notices) | United Kingdom |
Registered office: 82A James Carter Road, Mildenhall, Suffolk, IP28 7DE · hello@lostintv.com