01Parties and application

These Data Processing Terms apply automatically where a customer uses Ident.ink to process personal data for which that customer is controller and Ident Group Ltd, trading as Ident.ink, acts as processor. They form part of the Terms of Service. Account, billing, security and Ident.ink’s own analytics remain controller activities described in the Privacy Notice.

02Processing details

Subject matter: hosting and operating the customer-configured project, workspace, communications, publishing, automation and connected capabilities. Duration: the service term plus documented deletion and backup periods. Nature and purpose: storage, organisation, retrieval, transmission, access control, support, security, export and deletion according to the customer’s use.

Data subjects may include the customer’s staff, contractors, players, clients, suppliers, contacts and authorised users. Data can include identity, contact, role, work, communications, project, transaction-status and technical information selected by the customer. Customers must not add special-category or criminal-offence data unless the feature, lawful basis and safeguards are appropriate.

03Documented instructions

Ident.ink processes customer data only on documented instructions expressed through the contract, configured features, authorised API calls and support requests, unless law requires otherwise. We will notify the customer before legally required processing unless prohibited.

We will inform the customer if an instruction appears to infringe applicable data-protection law. This is not legal advice and does not transfer the customer’s controller duties.

04Controller allocation and demonstrable instructions

The customer determines the lawful purpose, data subjects, data fields, access, retention and connected recipients for its processor data. Ident.ink determines only the security and technical means necessary to provide the contracted service. If Ident.ink independently determines a new purpose, it acts as controller for that purpose and must identify an applicable lawful basis and notice.

Project configuration, authenticated API calls, permission changes, support instructions and signed order terms form the instruction record. Ident.ink may reject an instruction that is unlawful, technically unsafe, outside the service or likely to expose another customer, and will explain the contractual or legal basis where it can safely do so.

05Confidentiality and personnel

People authorised to process customer data are subject to confidentiality duties and receive access only for their role. Administrative access is logged and restricted. Staff and contractors must follow security, acceptable-use and incident procedures.

06Security measures

Ident.ink maintains measures appropriate to the risk, including tenant and project authorisation, strong authentication for privileged accounts, encryption in transit, protected credential storage, input validation, rate controls, security logging, backups, vulnerability management, least privilege and restoration procedures.

No service can guarantee prevention of every incident. The customer must use available access controls, secure its endpoints and credentials, review memberships, minimise data and maintain independent copies of critical records.

07AI processing boundary

Customer processor data is not used to train a general-purpose model for Ident.ink or an external provider unless the customer gives a separate, specific instruction and an appropriate lawful and contractual basis exists. A product may send the minimum necessary content to a configured AI provider only where the customer enables that function and the provider, model and material limits are identified.

Secrets, complete payment credentials and material marked as excluded from AI processing must not be sent to a model. Ident.ink applies provider minimisation and retention settings where available, but the customer remains responsible for choosing whether its content is suitable for an enabled AI operation.

08Subprocessors

The customer gives general authorisation for subprocessors required to provide infrastructure, email, security, support, payments and deliberately enabled integrations. The current categories and named providers are published through the Trust Centre or Privacy Notice.

Ident.ink will impose data-protection obligations appropriate to the service and remains responsible for its processor duties. Material additions will receive reasonable notice where required, allowing a substantiated data-protection objection before the change takes effect where practicable.

09Data-subject requests

Taking account of the nature of processing, Ident.ink will provide reasonable technical and organisational assistance for access, correction, deletion, restriction, portability and objection requests. The customer remains responsible for verifying the requester, deciding the response and meeting statutory deadlines unless Ident.ink is controller for that request.

10Complaints and regulator cooperation

Ident.ink will provide reasonable assistance with a complaint concerning processor data and will direct a requester to the customer where the customer controls the response. Each party must promptly provide the other with information reasonably required to meet its legal complaint, regulator and court obligations.

Nothing in these terms prevents either party or a data subject from contacting the ICO or another competent authority. A party receiving a regulator request relating primarily to the other party will notify it where lawful and coordinate a truthful, timely response.

11Personal-data incidents

Ident.ink will notify the customer without undue delay after becoming aware of a personal-data breach affecting processor data and will provide available information reasonably needed for assessment and notification. Notice is not an admission of fault.

The customer is responsible for notifications it must make as controller. Both parties will preserve relevant evidence and avoid public statements that compromise investigation or security.

12Compliance assistance and audit

Ident.ink will provide information reasonably necessary to demonstrate Article 28 compliance and assist, in proportion to the service and risk, with impact assessments and regulator consultation. Customers should first use current security, privacy and audit documentation.

A further audit must be legally justified, proportionate, confidential, avoid other tenants and normally use an independent qualified auditor. The customer bears unreasonable or repeated audit costs unless the audit identifies a material Ident.ink breach.

13Return and deletion

During active access the customer may use available exports. On termination, Ident.ink deletes or anonymises processor data according to the disclosed schedule unless law requires retention. Disaster-recovery copies age out under backup rotation and remain protected and unavailable for ordinary use.

14Continuity, recovery and deletion evidence

Ident.ink maintains restart, backup and restoration controls proportionate to the service and periodically verifies recovery. The customer must keep independent copies of legally or operationally critical records unless a signed service level expressly allocates that responsibility differently.

On reasonable request after deletion completes, Ident.ink may provide available system evidence or a deletion confirmation appropriate to the service. It need not expose another tenant, confidential security detail or immutable records retained under law, fraud prevention, backup rotation or legal hold.

15International transfers

Where processor data is transferred outside the United Kingdom or another protected jurisdiction, Ident.ink will use an applicable adequacy regulation, the UK International Data Transfer Agreement or Addendum, Standard Contractual Clauses, or another lawful safeguard, with supplementary measures where required.

16Liability, changes and priority

The liability provisions of the Terms of Service apply to these terms except where data-protection law requires otherwise. A change needed for law or security may take effect on notice; a materially adverse discretionary change normally applies at renewal. These terms prevail over inconsistent general processor wording, while mandatory law prevails over all contract terms.