Controller and processor roles
Our clients remain the controller of the personal data held in their stores, advertising accounts, marketing platforms and customer databases. When we act on their documented instructions to deliver services, we act as a processor and, where we engage others to assist, those parties act as sub-processors.
We enter into a written data processing agreement with each client where personal data is involved. It records the subject matter, duration, nature and purpose of the processing, the categories of data subject and personal data, and the obligations and rights of the controller, and it incorporates the clauses required by the applicable data protection law. A copy of our standard agreement is available on request from hello@veltradigital.com.
Our commitments as a processor
- We process personal data only on the client's documented instructions, including on international transfers, unless required otherwise by law.
- We ensure that personnel authorised to process personal data are bound by confidentiality obligations.
- We implement appropriate technical and organisational security measures, and keep them under review.
- We do not engage a new sub-processor without authorisation, and we give advance notice of intended changes so the client has an opportunity to object.
- We assist the client, taking into account the nature of the processing, in responding to data subject requests and in meeting their security, breach notification and impact assessment obligations.
- We notify the client without undue delay after becoming aware of a personal data breach affecting their data.
- At the end of the engagement we delete or return personal data at the client's choice, except where storage is required by law.
- We make available the information necessary to demonstrate compliance and allow for audits, subject to reasonable notice and confidentiality.
Sub-processors used for our own operations
The following providers support the operation of veltradigital.com and our internal business processes.
| Provider | Service | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery, DNS, security and email routing | Server logs, security signals, and the contents of enquiry and inbound email messages in transit |
| Google LLC (Google Fonts) | Delivery of web typefaces | IP address and browser information at the time of the font request |
| Google LLC (business email) | Receipt and storage of business correspondence | Email content and business contact details |
Providers typically involved in client engagements
The platforms used in a given engagement depend on the client's existing stack and are agreed with the client. They commonly include ecommerce platforms such as Shopify, advertising platforms such as Meta, Google and TikTok, marketing automation platforms such as Klaviyo, analytics and tag management tools, and project and communication tools used to run the work.
In most engagements these accounts are owned and contracted directly by the client, who is responsible for their own agreements with those providers. Where we contract with a provider on a client's behalf, that provider is treated as a sub-processor and is covered by our data processing agreement.
Technical and organisational measures
| Area | Measures |
|---|---|
| Access control | Least-privilege access, individual named accounts, multi-factor authentication on business-critical systems, delegated platform permissions instead of shared credentials, prompt revocation on role or engagement change |
| Encryption | TLS in transit across our website and administrative systems; encryption at rest as provided by our platform vendors |
| Secret management | Credentials, tokens and API keys stored in encrypted secret stores, never in source code, documents or messages |
| Segregation | Client environments, repositories and accounts kept separate; no cross-use of one client's data for another |
| Data minimisation | We request the narrowest access and the smallest dataset needed for the work; customer-level exports are avoided unless necessary |
| Resilience | Versioned deployments, the ability to roll back changes, and reliance on providers offering redundancy and backup |
| Personnel | Confidentiality obligations in contracts, security guidance, and access granted only for the duration of the engagement |
| Incident response | Defined process for triage, containment, client notification without undue delay, and post-incident review |
Data subject requests and transfers
If an end customer contacts us about data we hold on behalf of a client, we do not respond substantively. We forward the request to the client as controller and assist them in meeting their obligations.
Where personal data is transferred internationally, we rely on an adequacy decision where one applies, or on Standard Contractual Clauses together with the UK International Data Transfer Addendum, with additional safeguards where appropriate.
Contact
Data protection enquiries, requests for our data processing agreement, sub-processor notifications and audit requests: hello@veltradigital.com.