GDPR & Data Processing Addendum

1. Our role

Valome Media is a UK-based studio and complies with the UK GDPR and the Data Protection Act 2018. Our ICO registration number is ZC172791.

For personal data we collect directly (e.g. quote requests, marketing), we act as a data controller- see our Privacy Policy. For personal data we process on behalf of a client during a paid engagement (e.g. customer lists, leads, CRM records), we act as a data processor. This page sets out our standard data processing terms.

2. Subject matter & duration

We process personal data only as needed to deliver the services described in the relevant quote or statement of work, and only for the duration of that engagement plus a short period afterwards required for handover, backups or legal record keeping.

3. Nature & purpose of processing

Typical processing activities include hosting websites and databases, sending and automating emails, setting up CRM and internal systems, configuring local SEO listings, and analysing performance. We process data only on the client's documented instructions, unless required by law to do otherwise.

4. Personal data & data subjects

• Categories of data: typically contact details, account data, transaction or enquiry records, marketing engagement, and basic technical data. We do not process special category data unless explicitly agreed in writing.
• Categories of data subjects: the client's customers, prospects, leads, employees and contractors.

5. Our obligations as processor

• Process personal data only on the client's documented instructions.
• Ensure people authorised to access the data are bound by confidentiality.
• Implement appropriate technical and organisational measures, including access controls, encryption in transit, role-based permissions and secure credential storage.
• Assist the client with data subject requests, security, data protection impact assessments and prior consultation, as required by UK GDPR.
• Notify the client without undue delay (and in any case within 72 hours of awareness) of any personal data breach affecting their data.
• On termination, delete or return personal data unless storage is required by law.
• Make available information needed to demonstrate compliance and allow for reasonable audits.

6. Sub-processors

We use a small number of trusted sub-processors to deliver our services. They typically include hosting and database providers, email delivery services, AI providers, and analytics tools. We require all sub-processors to provide at least the same level of data protection that we offer. A current list is available on request.

7. International transfers

Where personal data is transferred outside the UK we rely on appropriate safeguards such as adequacy decisions, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum.

8. Requesting a signed DPA

If you require a signed Data Processing Addendum for your records or compliance file, email hello@valomemedia.com and we'll send a counter-signed copy based on the terms above.