Data processing agreement
Roles of the parties
For customer personal data processed through the Managed platform, the customer is generally the controller and Managed is the processor, except where Managed determines its own purposes for limited operational, security, legal, or billing processing.
Subject matter and duration
The processing covers the services provided under the customer contract and continues for the period in which Managed is providing services and any limited post-termination period needed for return, deletion, backup expiry, or legal obligations.
Nature and purpose of processing
Processing may include collecting, storing, organising, transmitting, securing, reporting on, and otherwise handling personal data as needed to provide bookings, forms, communication, payments, reporting, support, and related Managed functionality.
Types of personal data and data subjects
Depending on customer configuration, data may include contact details, appointment data, staff data, notes, communications, form responses, payment-linked information, and treatment-related information concerning customers, prospects, staff, contractors, and other authorised users.
Managed’s processor obligations
Managed’s processing obligations are designed to reflect the minimum processor terms required under UK GDPR Article 28 and associated accountability guidance.
Documented instructions only
Managed will process customer personal data only on the customer’s documented instructions unless required to do otherwise by applicable law.
Confidentiality
Managed ensures that personnel and authorised subprocessors with access to customer personal data are subject to confidentiality duties and appropriate access control.
Security measures
Managed applies appropriate technical and organisational measures designed to protect customer personal data, including measures for confidentiality, integrity, resilience, restricted access, and incident handling.
Subprocessors
Managed may use subprocessors to help deliver the service. Where we do so, we remain responsible for ensuring they are bound by data protection obligations materially consistent with our own processor obligations.
Assistance with data subject rights
Taking into account the nature of processing, Managed will provide reasonable assistance so customers can respond to requests relating to access, correction, deletion, restriction, objection, or portability where applicable.
Assistance with compliance
Where appropriate and reasonably requested, Managed will provide information or support relevant to customer obligations relating to security, breach handling, impact assessments, and regulator cooperation.
Security, subprocessors, and international transfers
Managed operates with the expectation that customer data must be protected not only within our own environment but also across suppliers, infrastructure, and international service delivery chains.
Technical and organisational measures
Our security controls may include authentication and access restrictions, environment separation, encrypted transport, audit logging, supplier controls, backup protections, and internal operational safeguards proportionate to the service.
Security incidents and breach notification
If Managed becomes aware of a personal data breach affecting customer personal data, we will notify the customer without undue delay and provide information reasonably available to us to support the customer’s response obligations.
Subprocessor management
Managed may engage hosting, analytics, payments, communications, infrastructure, and support providers as subprocessors. We aim to maintain a controlled supplier set appropriate for service delivery and security.
Transfers outside the UK
Where customer personal data is transferred outside the UK, Managed will use an appropriate transfer mechanism, such as adequacy regulations, data transfer clauses, or equivalent safeguards suitable for the transfer.
Deletion, audit, and order of precedence
A workable DPA must address what happens at the end of the relationship and how customers obtain assurance that processor obligations are being met.
Return or deletion at the end of the service
At the end of the service, Managed will delete or return customer personal data in line with the applicable contract, customer instructions, retention constraints, and legal obligations, unless law requires continued storage.
Audit and information rights
Managed will make available information reasonably necessary to demonstrate compliance with this DPA and may support reasonable audit or assurance requests in a manner that protects service security, confidentiality, and the rights of other customers.
Customer responsibilities
Customers remain responsible for deciding what personal data to collect, the lawful basis for doing so, the content of forms and communications, and the instructions given to Managed through service configuration and use.
Questions and contract priority
If you need a signed DPA or supplier review information, contact support@withmanaged.com. Where there is a conflict between this summary and a signed customer agreement, the signed agreement will generally take precedence.