Data processing agreement
The Article 28 terms that apply when TeshTech processes personal data on behalf of a client whose website we host.
Version 2026-08-18
1. Who this is between
This agreement is between you, our client, and TeshTech. It applies to personal data we process on your instructions — chiefly the data your own website's visitors give you through forms, accounts and orders.
You are the controller of that data: it is your website, your relationship with those people, and your decision what to collect and why. We are your processor, and we act only on your instructions.
Data about you and your own staff — your contract, your invoices, your portal accounts — is not covered here. For that we are the controller, and our privacy policy applies.
- Who we are
- TeshTech Ltd
- VAT number
- GB517507885
- Contact
- hello@teshtech.co.uk
Not yet recorded: company number, registered address. These are required on this page and will be published as soon as they are registered.
2. Subject matter, duration, nature and purpose
| Subject matter | Hosting, running and supporting the website or application we built for you |
|---|---|
| Duration | For as long as your care plan or project agreement is in force, plus the return-and-deletion period below |
| Nature and purpose | Storing, serving, backing up, and where you have asked for it, emailing and reporting on the data your site collects |
| Types of personal data | Whatever your site collects. Typically names, email addresses, phone numbers, postal addresses, order details and message content |
| Categories of data subject | Your website's visitors, enquirers and customers |
If your site needs to collect health data, or anything else UK GDPR calls special category data, tell us before it does. That changes what we both have to put in place and is not covered by this agreement as it stands.
3. What we commit to
- We process the data only on your documented instructions, including on transfers out of the UK, unless the law requires otherwise — and if it does, we tell you first unless we are forbidden to.
- Everyone we let near the data is bound by confidentiality.
- We keep the security measures set out below, and review them.
- We do not engage another processor without telling you first and giving you a chance to object.
- We help you respond to requests from your visitors exercising their data rights.
- We help you with security, breach notification, impact assessments and consulting the regulator, taking account of what we know that you do not.
- At the end of our agreement we return or delete the data, as you choose.
- We give you the information you need to show all of this is true, and allow audits.
4. Security measures
- Encryption in transit and at rest, with separate field-level encryption for the most sensitive fields.
- Database-level isolation between clients, enforced by the database itself rather than by application code alone.
- An audit record of every change, naming who made it and what changed.
- Role-based access, with staff access limited to what their role needs.
- Backups on the schedule set by your care-plan tier, with tested restores.
- Monitoring and error tracking, with logs that exclude personal data.
5. Sub-processors
We use these suppliers to deliver the service. Each is bound by terms no weaker than these.
| Supplier | What they do | Where |
|---|---|---|
| Google (Firebase Hosting) | Serves your website and stores its files | European Union |
| Neon | Hosts the database behind the platform | European Union |
| Vercel | Hosts and serves the platform and its APIs | European Union |
| Resend | Sends email your site generates, such as form notifications | United States |
| Stripe Payments Europe, Ltd. | Takes payments, where your site takes payments | Ireland, with transfers to the United States |
We give you 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data-protection grounds within that time, we will work with you to find an alternative, and if we cannot, you may end the affected service without penalty.
6. Transfers outside the UK
Data is held in the UK or the European Economic Area by default. Where a sub-processor processes data outside it, the transfer relies on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we hold a transfer risk assessment for it.
7. If there is a breach
We tell you without undue delay once we become aware of a personal data breach affecting your data, and in any event within 24 hours. You are the controller, so reporting it to the Information Commissioner's Office is your decision and your deadline — ours is to give you what you need to make it in time.
We will tell you what happened, whose data was affected as far as we can establish it, the likely consequences, and what we have done about it.
8. Your visitors' rights, and your audits
If one of your visitors contacts us directly to exercise a data right, we do not answer for you. We pass it to you promptly and help you respond.
You may audit our compliance with this agreement once a year, or after a breach, on 30 days' notice. In most cases our own documentation will answer the question faster than an on-site visit, and we will provide it first.
9. When our agreement ends
You tell us whether to return the data or delete it. We do it within 30 days, and confirm in writing when it is done. We keep nothing except where the law requires us to, and where it does we tell you what and for how long.
Backups are deleted on their normal rotation rather than individually — that cycle is at most 365 days, and nothing is restored from them in the meantime.
10. Putting this in place
We do not yet have electronic signing in place, so this agreement is not executed automatically. Email us and we will send you a countersigned copy — please do ask, because you need one on file to meet your own Article 28 obligation. Tracked as ADR-019 trade 4.