GDPR & Data Processing Addendum

1. Who we are and when this applies

Valome Media Ltd is a private limited company registered in England and Wales (company number 17539032).

Registered office: 34 Benbow Avenue, Eastbourne, England, BN23 6EB Email: hello@valomemedia.com ICO registration number: ZC172791

This Data Processing Addendum (“DPA”) applies where Valome Media processes personal data on behalf of the client identified in an accepted proposal or service agreement (“Client”).

For that processing, the Client is the controller and Valome Media is the processor.

If the Client is itself a processor, it must tell us before processing begins and establish that it has the necessary authority to appoint us as a sub-processor.

This DPA does not govern information we process as an independent controller for our own enquiries, relationship management, billing, security or business communications. Our Privacy Policy explains those activities.

2. How this DPA forms part of the agreement

The dated version of this DPA identified in the proposal forms part of the agreement when the parties accept it by email, signature or another express, recorded acceptance process.

The processing arrangements comprise:

• This DPA.
• The applicable standard service descriptions in section 15.
• The services, functionality and duration identified in the accepted proposal.
• Any additional documented instructions agreed between the parties.
• The applicable authorised sub-processor information.

A separate client-specific schedule is not required where these documents adequately describe the actual processing.

If the proposed work involves processing not adequately covered, the parties must record the additional details before that processing starts. This can be done by email or an amendment to the proposal.

This DPA takes priority over conflicting commercial terms concerning the protection and processing of personal data.

Publishing an updated version does not automatically change an existing agreement.

3. Definitions and scope

“Data Protection Law” means applicable UK data-protection legislation, including the UK GDPR and Data Protection Act 2018, as amended.

“Client Personal Data” means personal data we process on the Client’s behalf under the agreement.

Other data-protection terms have their meanings under Data Protection Law.

The “Processing Schedule” means the applicable descriptions in section 15, read with the accepted proposal and additional agreed instructions.

Only processing necessary for the purchased services and within the agreed instructions is authorised. Selecting a service does not authorise every possible use of its data.

4. Client rights and responsibilities

The Client determines the purposes of processing and retains control of Client Personal Data.

The Client may issue lawful documented instructions, request relevant compliance information, exercise the audit rights below and choose return or deletion at the end of processing.

The Client must:

• Have the authority and lawful basis needed to provide the data and instruct its processing.
• Give individuals appropriate privacy information.
• Supply only information necessary for the agreed services.
• Give clear instructions and identify relevant restrictions.
• Tell us before supplying sensitive information or proposing higher-risk processing.
• Maintain the accounts, permissions and security measures within its responsibility.

These responsibilities do not remove our own obligations.

5. Processing instructions

We will process Client Personal Data only on documented instructions, including instructions concerning international transfers, unless UK law requires otherwise.

Where the law requires other processing, we will inform the Client beforehand unless notification is legally prohibited.

We will immediately inform the Client if, in our opinion, an instruction infringes applicable data-protection law. We may suspend the affected processing while the issue is resolved.

We will not use Client Personal Data for our own unrelated marketing, independent general-purpose AI training or other incompatible purposes.

6. Confidentiality and security

We will ensure that people authorised to process Client Personal Data are bound by appropriate confidentiality obligations.

We will maintain technical and organisational measures appropriate to the processing and its risks, as required by Article 32.

These measures will address, as applicable:

• Restricting access to authorised people and systems.
• Appropriate authentication and privilege management.
• Secure transmission and protection of stored information.
• Separation of client information and controlled sharing.
• Secure management of credentials.
• Protection against accidental loss, unauthorised disclosure and unlawful access.
• Appropriate backup and recovery arrangements.
• Security monitoring, incident handling and secure disposal.
• Periodic testing and review.

Measures must reflect the actual services and systems used. We will provide relevant information about them on request, subject to proportionate security and confidentiality protections.

Where a project requires additional measures, these must be agreed before the affected processing begins.

The Client’s responsibility for its own backups does not remove our applicable security obligations.

7. Sub-processors

We may use providers to process Client Personal Data on our behalf only with the Client’s prior specific or general written authorisation.

Before acceptance, we will make the applicable named sub-processor list available to the Client through a linked register or private disclosure. It identifies providers, their functions and relevant processing locations.

By accepting this DPA together with that list, the Client gives general written authorisation for the listed providers relevant to the purchased services.

We will give at least 14 calendar days’ advance written notice of an intended addition or replacement, allowing an objection on reasonable data-protection grounds.

We will work to resolve an objection and will not send affected data to the proposed provider while the objection remains unresolved. If no suitable solution is available, either party may end the affected service, with an appropriate refund of prepaid unused fees.

We will impose equivalent applicable data-protection obligations on sub-processors through binding agreements and remain responsible to the Client for their performance of those obligations.

A provider contracted directly by the Client is not automatically our sub-processor. The relevant relationships must be identified.

7.1 Supplier register

The following providers support our services. A provider is a sub-processor under this DPA only to the extent that it processes Client Personal Data on our behalf. Providers used solely for our own business administration are addressed in our Privacy Policy.

Register version: 17 October 2026

Only services necessary for the agreed processing are authorised. Listing AI functionality does not independently authorise its use outside section 8 and the agreed instructions.

These providers may use their own authorised sub-processors under their contractual arrangements. We assess the relevant onward-processing chain, safeguards and changes in accordance with our obligations under this DPA.

Supporting provider documentation:

• Lovable DPA: https://lovable.dev/data-processing-agreement
• Lovable sub-processors: https://lovable.dev/subprocessors
• IONOS DPA information: https://www.ionos.co.uk/help/index.php?id=3212

These links provide supporting information. They do not replace this DPA, our responsibility for authorised sub-processors, or the change-notification process in section 7.

Payment provider

We use Stripe to invoice and collect payment for our services. For those activities, relevant billing and transaction information is handled under the applicable Stripe arrangements and our Privacy Policy. Stripe may act as an independent controller or processor depending on the activity.

Stripe is not automatically an authorised sub-processor for Client Personal Data under this DPA merely because the Client pays us through Stripe.

Stripe DPA: https://stripe.com/gb/legal/dpa

8. AI-assisted processing

AI-assisted processing may be used only within the agreed purposes, documented instructions and authorised supplier arrangements.

The service descriptions do not provide blanket permission to send all Client Personal Data to AI providers.

Where external AI will receive Client Personal Data, the agreed documents must identify the relevant activity, information involved and applicable safeguards sufficiently clearly before processing begins.

Staff decide when to use internal AI features within those boundaries. There is no general self-service exclusion setting for individual records.

We will limit transmitted information to what is necessary. Special-category or criminal-offence data must not be used with external AI without express agreement and the required legal safeguards.

This DPA does not promise that every AI provider offers zero retention. Any required training, retention or other provider restrictions must be established before the processing.

9. International transfers

We will make restricted international transfers only within documented instructions and in compliance with Data Protection Law.

An applicable lawful transfer mechanism and any required assessment or supplementary measures must be in place before transfer.

We will provide relevant information about locations and safeguards so that the Client can understand the arrangements.

Acceptance of this DPA does not waive international-transfer requirements.

10. Assistance with rights and compliance

Taking account of the processing, we will assist the Client through appropriate measures in responding to individuals’ data-protection requests.

We will promptly forward relevant requests received directly. We will not respond substantively on the Client’s behalf unless instructed or legally required.

Taking account of the information available to us, we will assist the Client with security obligations, breach assessment and notification, data-protection impact assessments and prior consultation with the regulator.

11. Personal data breaches

We will notify the Client without undue delay after becoming aware of a personal data breach affecting Client Personal Data.

As information becomes available, we will explain the incident, affected information and individuals, likely consequences, measures taken or proposed, and a contact for follow-up.

Initial notification will not be delayed solely because the investigation is incomplete.

We will cooperate in investigation, containment and remediation. Each party remains responsible for its own legal notification obligations.

12. Compliance information and audits

We will provide information necessary to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by the Client or its appointed independent auditor.

Routine audits should use reasonable notice and proportionate arrangements protecting security, confidentiality and other clients’ information.

Those arrangements must not obstruct urgent investigations, required regulatory access or meaningful exercise of the Client’s audit rights.

We will cooperate with competent supervisory authorities as required.

13. Duration, return and deletion

Processing continues for the agreed services and any applicable handover or post-service access period.

Ongoing support extends processing only to the extent necessary for the support actually agreed.

At the end of the processing, we will, at the Client’s choice, return or securely delete Client Personal Data and delete remaining copies unless UK law requires retention.

Unless otherwise instructed or agreed, return/export and deletion of unnecessary working copies will be completed within 30 days after the relevant processing or agreed handover period ends.

Where applicable, Client Portal access normally continues for 90 days after the last relevant project and ongoing service end, with notice before closure. This permits agreed access and handover; it does not authorise unrelated processing or prevent earlier return/deletion instructions.

Where immediate backup deletion is not technically feasible, retained copies must be protected, unavailable for ordinary use and deleted through the documented backup cycle. Relevant deletions must be reapplied following restoration before ordinary use resumes.

Any legally required retention will be limited to the information and purpose concerned. Retaining our own accounting records does not justify retaining the Client’s entire customer dataset.

We will confirm return or deletion on request.

14. Records, changes and liability

We will maintain processing records where required and the information necessary to perform this DPA.

Changes to purposes, data categories or activities outside the agreed scope must be documented and agreed before they begin. Sub-processor changes follow section 7.

The service agreement governs commercial matters and lawful allocation of liability, subject to mandatory law.

Nothing in this DPA removes individuals’ statutory rights, limits a regulator’s powers or excuses either party from its own legal obligations.

15. Standard processing descriptions

The descriptions below apply only to the services and functionality identified in the accepted proposal.

They define permitted processing categories, not a requirement to collect every category. We must use only the information necessary for the agreed work.

Unless separately agreed:

• Individuals are adults whose information the Client lawfully controls.
• Special-category and criminal-offence data are excluded.
• Real personal data should not be used for development or testing where synthetic or appropriately anonymised data would suffice.
• Full payment-card numbers and security codes are not to be supplied to Valome Media.
• Retention and end-of-service handling follow section 13.

15.1 Email Automation

Subject matter and purpose: Configuration, testing, implementation and agreed support of the Client’s email workflows.

Activities: Accessing and organising relevant records, configuring fields and segmentation, importing approved lists, testing workflows, setting up agreed communications, checking results and correcting issues.

Individuals: Customers, prospective customers, subscribers, business contacts and relevant Client personnel.

Data: Names, contact details, subscription preferences, consent or objection records, enquiry details, relevant purchase/order information and communication activity needed for the agreed workflows.

Duration: During implementation, testing and handover, and throughout any agreed ongoing operation or support.

The Client determines the lawful recipients and communication purposes. This description does not independently authorise new marketing campaigns or unrelated tracking.

15.2 Website Development

Subject matter and purpose: Building, configuring, testing, launching and supporting the website functionality identified in the proposal.

Activities: Accessing relevant systems; configuring forms and integrations; migrating agreed content or records; testing submissions; troubleshooting; and transferring the completed website.

Individuals: Website visitors, enquirers, customers, account holders, booking contacts and relevant Client personnel, only where the agreed functionality concerns them.

Data: Contact details, enquiry content, account/profile information, appointment details, relevant order references and technical records necessary for the agreed functionality.

Duration: During the build, migration, testing, launch and handover, plus any agreed support or hosting responsibilities.

This description does not authorise unrestricted access to all website records or collection of sensitive booking information.

15.3 Software Development

Subject matter and purpose: Building and supporting the specific business application and workflows described in the proposal.

Activities: Accessing agreed systems, configuring data structures and permissions, importing approved records, testing, troubleshooting, delivering agreed integrations and handing over the application.

Individuals: Authorised application users and relevant Client staff, business contacts or customers involved in the specified workflows.

Data: Basic identity/contact information, business profiles, user roles, task and project records, communications and relevant operational or transaction references.

Duration: During development, migration, testing, deployment and handover, and any agreed ongoing support.

The proposal must identify the application’s actual functions. This description alone does not cover sensitive records, monitoring, profiling or materially different data uses. Additional details must be agreed where necessary.

15.4 SEO & Google Business

Subject matter and purpose: Delivering the agreed search-visibility and business-listing work.

Activities: Accessing authorised business accounts, reviewing relevant analytics, checking and updating listings or website information, troubleshooting and reporting on the agreed work.

Individuals: Business contacts, authorised account users, website visitors represented in relevant analytics, and people whose public reviews are relevant to the work.

Data: Business-contact details, account identifiers, public review information and necessary technical or usage information available through authorised tools.

Duration: During the agreed optimisation work and any ongoing support, followed by handover and removal of access no longer needed.

This description does not authorise exporting identifiable visitor histories, contacting reviewers or repurposing information for unrelated marketing.

15.5 Ongoing support

Ongoing support continues only the relevant processing described above, limited to the scope of the accepted support proposal.

Activities may include investigating reported issues, making approved changes, maintaining agreed configurations and answering service-related questions.

A support subscription does not authorise new data categories, unrelated processing or unrestricted monitoring. Changes outside the existing descriptions must be agreed before implementation.

15.6 Additional instructions

If a service, data type, group of individuals, AI activity or processing purpose is not adequately described by this section and the accepted proposal, the parties must agree the missing details in writing before it begins.

Email instructions can be used, provided they are retained as part of the agreement. No separate signature document is required solely because an instruction is recorded this way.

16. Contact and governing law

Data-protection instructions, requests and incident communications should be sent to hello@valomemedia.com.

The Client’s contact is the person identified in the accepted proposal or subsequently nominated in writing.

This DPA is governed by the laws of England and Wales, subject to mandatory Data Protection Law and individuals’ statutory rights.