Data Processing Agreement for Website and Email Services

Millom Town Council

Minutes

GDPR Contract (Data Processing Agreement)

Data Processing Agreement (DPA)

Between:
Millom Town Council (“the Data Controller”)
and
Whamos Ltd (“the Data Processor”)

1. Purpose

This agreement governs Whamos Ltd’s provision of website hosting, email hosting, and technical account management services to the Council. Whamos Ltd processes personal data on behalf of the Council only to deliver these services.

2. Roles

• The Council remains the Data Controller and determines the purpose and means of processing personal data.
• Whamos Ltd acts solely as a Data Processor.

3. Scope of Processing

• Creating, and supporting email accounts for councillors and staff.
• Providing technical hosting, maintenance, and security for council websites and email servers.
• Resetting passwords upon request from authorised users.
• Whamos Ltd does not monitor, read, or use the content of emails.

4. Security Measures

• Access to servers and email accounts is restricted to authorised Whamos Ltd staff.
• Passwords are not stored by Whamos Ltd. Password resets are provided to councillors who remain responsible for their own access credentials.
• Industry-standard measures are in place to protect servers against unauthorised access, loss, or misuse.

5. Confidentiality

• Whamos Ltd staff are bound by confidentiality obligations.
• Personal data processed under this agreement will not be disclosed to third parties without the Council’s written instruction, unless required by law.

6. Sub-Processing

• If Whamos Ltd uses third-party providers (e.g. data centre or hosting partners), these will be bound by GDPR-compliant terms.

7. Data Subject Rights

• Whamos Ltd will assist the Council, where technically possible, in responding to subject access requests, erasure, rectification, or restriction of processing requests.

8. Breach Notification

• Whamos Ltd will notify the Council without undue delay if it becomes aware of a personal data breach affecting Council data.

9. Termination

• Upon termination of services, all council data will be deleted or returned, unless retention is required by law.

10. Governing Law

This agreement is governed by UK GDPR and Data Protection Act 2018.

Signed:

For Whamos Ltd: W H Amos
Position: Managing Director
Date: 17 May 2023

For Millom Town Council: Cath Jopson
Position: Town Clerk
Date: 17^th May 2023