This DPA applies where MOTION 3D MEDIA LTD (processor) handles personal data on behalf of a business customer (controller) to provide RealFlo or AutoFlo. For RealFlo's own account administration and billing we act as an independent controller.
1. Processing
Processing concerns supplied property images, project details, associated contacts and resulting content as required to provide the service. It lasts for the service term and necessary wind-down/retention. Data subjects may include customer staff and individuals appearing in submitted material. Operations include receiving, hosting, processing, delivering and deleting data.
2. Instructions
We process on documented customer instructions, unless law requires otherwise, and inform the customer of apparently unlawful instructions where legally permitted.
3. Confidentiality and security
Personnel with access are bound by confidentiality; we maintain proportionate access controls, authentication, secure transmission, monitoring and security practices.
4. Subprocessors
The customer grants general authorisation to necessary service subprocessors. We remain responsible for their contracted obligations and provide information about current subprocessors and material changes through a business contact channel, allowing reasonable objections. A current confidential subprocessor annex can be supplied to business customers on request; this public summary deliberately does not detail our technology architecture.
5. Assistance
We provide reasonable assistance with rights requests, security incidents, impact assessments and supervisory authority enquiries, taking account of the processing and information available to us. We notify customers of personal data breaches without undue delay after becoming aware.
6. Transfers
We apply legally required UK international transfer safeguards when personal data is transferred outside the UK.
7. End of service
On termination, at the customer's choice and subject to legal retention requirements, we return or delete processor personal data; operational deletion arrangements are described in our Retention Policy.
8. Evidence
We make compliance information reasonably available and permit audits as legally required, subject to proportionate confidentiality and security conditions. This document must be read with the customer's service agreement and any customer-specific processing or transfer annex required under UK GDPR Article 28.