Skip to main content
ConsultOnline

Data Processing Agreement

Last updated: October 2026

1. Definitions

In this Data Processing Agreement ("DPA"), the following terms have the meanings set out below:

  • "Controller" means the Client, being the organisation that determines the purposes and means of processing Personal Data through the ConsultOnline platform.
  • "Processor" means PNPR Ltd (Company No. 08357874), registered at 14 Lannesbury Crescent, St. Neots, Cambridgeshire, PE19 6AF, operating the ConsultOnline platform.
  • "Personal Data" means any information relating to an identified or identifiable natural person, as defined in the UK GDPR.
  • "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
  • "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
  • "UK GDPR" means the UK General Data Protection Regulation, being the retained EU law version of the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018.
  • "DPA 2018" means the Data Protection Act 2018.

2. Scope and purpose

This DPA sets out the terms on which PNPR Ltd processes Personal Data on behalf of the Controller for the purpose of operating the ConsultOnline platform, including the collection, storage, analysis and reporting of public consultation data.

Types of Personal Data processed:

  • Consultation respondent names
  • Email addresses
  • Postal addresses
  • Postcodes
  • Demographic data (age, gender, ethnicity, disability status)
  • Survey responses
  • Map pin comments
  • IP addresses

Categories of Data Subjects:

  • Consultation respondents (residents, stakeholders, community members)
  • Consultation subscribers

Duration of processing:

Personal Data will be processed for the term of the service agreement between the Controller and PNPR Ltd, plus any applicable retention period as set out in section 10 of this DPA.

3. Processor obligations

PNPR Ltd shall:

  1. Process Personal Data only on documented instructions from the Controller, unless required to do so by law applicable to the Processor, in which case the Processor shall inform the Controller of that legal requirement before processing unless prohibited from doing so.
  2. Ensure that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations, whether contractual or statutory.
  3. Implement appropriate technical and organisational security measures to ensure a level of security appropriate to the risk, as set out in section 4 of this DPA.
  4. Not engage any Sub-processor without the prior specific or general written consent of the Controller, subject to the terms set out in section 5 of this DPA.
  5. Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights, including subject access requests, erasure, rectification and data portability.
  6. Assist the Controller in ensuring compliance with the obligations relating to data protection impact assessments and prior consultation with the Information Commissioner's Office (ICO), taking into account the nature of processing and the information available to the Processor.
  7. At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services, subject to a 90-day export window as described in section 10 and delete existing copies unless applicable law requires storage of the Personal Data.
  8. Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR.
  9. Allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, as set out in section 9 of this DPA.

4. Security measures

PNPR Ltd implements the following technical and organisational measures to protect Personal Data:

  • Encryption: all Personal Data is encrypted at rest and in transit using TLS 1.2 or higher.
  • Access controls: role-based access permissions ensure that only authorised personnel can access Personal Data, with access granted on a least-privilege basis.
  • Security updates: regular security updates and patching are applied to all platform infrastructure and software components.
  • Backups: automated backups are performed regularly, with tested restore procedures to ensure data can be recovered in the event of loss.
  • Monitoring: incident detection and monitoring systems are in place to identify and respond to potential security threats.
  • Data location: all Personal Data is stored in UK and EEA data centres only.

5. Sub-processors

  1. PNPR Ltd shall maintain a current list of Sub-processors engaged to process Personal Data on behalf of the Controller.
  2. The Controller will be notified of any intended changes to the list of Sub-processors, including the addition or replacement of Sub-processors, at least 30 days before the new Sub-processor begins processing Personal Data.
  3. The Controller may object to the appointment of a new Sub-processor on reasonable grounds relating to data protection. Where the Controller objects, PNPR Ltd shall use reasonable efforts to make available an alternative solution that avoids the use of the objected-to Sub-processor. If no alternative is reasonably available, either party may terminate the affected services.
  4. PNPR Ltd shall ensure that each Sub-processor is bound by data protection obligations no less protective than those set out in this DPA.
  5. Current Sub-processors are listed below. PNPR Ltd will keep this list up to date and give notice of changes in line with this section.
  • Cloudflare, Inc. — hosting, content delivery, security and file storage (files stored in the EU)
  • PlanetScale, Inc. — managed database (hosted in London, United Kingdom)
  • Resend, Inc. — email delivery
  • Functional Software, Inc. (Sentry) — error monitoring (EU data region)
  • Hetzner Online GmbH — server hosting in the EU for website analytics (Plausible) and a temporary backup of the previous platform
  • Twilio Inc. — SMS verification codes, where enabled
  • Meta Platforms Ireland Limited — WhatsApp Business messaging, where enabled
  • Stannp Ltd — printing and posting letters, where direct mail is used
  • Ideal Postcodes Ltd — UK address lookup
  • MXroute — project email mailboxes, where enabled
  • AI service providers — optional AI-assisted features such as summaries, translation, moderation and narration, where enabled

6. International transfers

Personal Data is stored in the United Kingdom and the European Economic Area. Some Sub-processors, including those providing content delivery and security, email delivery, SMS and optional AI-assisted features, may process Personal Data outside the UK, including in the United States. Where this happens, PNPR Ltd relies on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

If it becomes necessary to transfer Personal Data outside the UK adequacy area, PNPR Ltd will ensure that appropriate safeguards are in place before any transfer takes place, including the use of the UK International Data Transfer Agreement (IDTA) or an equivalent mechanism approved by the ICO.

7. Data Subject rights

  1. PNPR Ltd shall assist the Controller in responding to requests from Data Subjects exercising their rights under UK GDPR, including rights of access, rectification, erasure, restriction, portability and objection.
  2. Where PNPR Ltd receives a request from a Data Subject directly, it shall forward the request to the Controller without undue delay and in any event within 5 working days of receipt.
  3. PNPR Ltd shall not respond to Data Subject requests directly unless instructed to do so by the Controller in writing.

8. Data breach notification

  1. PNPR Ltd shall notify the Controller without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting Personal Data processed under this DPA.
  2. The notification shall include, to the extent known at the time:
  • A description of the nature of the breach, including the categories of Personal Data affected.
  • The approximate number of Data Subjects affected.
  • The likely consequences of the breach.
  • The measures taken or proposed to address the breach and mitigate its effects.
  1. PNPR Ltd shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation and remediation of the breach.
  2. PNPR Ltd shall provide supplementary information as it becomes available and shall document all breaches, including the facts, effects and remedial action taken.

9. Audits

  1. The Controller may audit PNPR Ltd's compliance with this DPA upon reasonable written notice (not less than 30 days, except in the case of a suspected data breach).
  2. PNPR Ltd shall cooperate with and provide access to relevant systems, documentation and personnel as reasonably required for the purpose of the audit.
  3. Audits shall be conducted during normal business hours and shall not unreasonably interfere with PNPR Ltd's operations.
  4. The Controller shall bear the costs of any audit, except where the audit reveals a material breach of this DPA by PNPR Ltd.

10. Term and termination

  1. This DPA shall remain in effect for the duration of the service agreement between the Controller and PNPR Ltd.
  2. On termination of the service agreement, PNPR Ltd shall make all Personal Data available to the Controller for export for a period of 90 days from the date of termination.
  3. After the expiry of the 90-day export period, all Personal Data shall be securely deleted from PNPR Ltd's systems and infrastructure. Deletion shall be confirmed to the Controller in writing.
  4. The obligations of the Processor regarding confidentiality, security and Data Subject rights shall survive termination of this DPA.

11. Liability

  1. The liability of each party under this DPA is subject to the exclusions and limitations of liability set out in the ConsultOnline Terms of Service.
  2. Nothing in this DPA excludes or limits the liability of either party for breaches of UK GDPR obligations that cannot be limited by law, including obligations arising under Articles 82 and 83 of the UK GDPR.

12. Governing law

This DPA is governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction in relation to any dispute arising out of or in connection with this DPA.

This Data Processing Agreement forms part of the ConsultOnline Terms of Service. For questions, contact info@consultonline.uk.