Data processing terms

1. Parties and roles

The client is the controller. Jigomit LLP, A-902, Kesar Alenta, Gota, Ahmedabad 382481, India ("we", "the processor") processes personal data only on the client's behalf and only to deliver the services in the engagement letter.

These terms implement Article 28(3) of the UK GDPR. Where the client is established in the European Union, every reference to the UK GDPR reads as a reference to Regulation (EU) 2016/679 as well, and nothing here gives the client less than Article 28 of that Regulation requires.

2. Subject matter, duration, nature and purpose

Schedule 1 to each engagement letter states, for that engagement, the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subjects. For a Laravel upgrade, rescue or care plan the processing is normally incidental: we see personal data because it lives in the application we are asked to keep running, not because we are asked to do anything with it.

Processing lasts for the engagement and ends when the data is returned or deleted under clause 9.

3. Documented instructions

We process personal data only on the client's documented instructions, which are the engagement letter, Schedule 1 and written instructions given afterwards, including on transfers of personal data outside the United Kingdom or the European Economic Area, unless UK or EU law to which we are subject requires otherwise. Where it does, we tell the client before processing unless that law forbids it.

If we think an instruction infringes the UK GDPR or EU GDPR, we say so at once and may pause the processing concerned until the instruction is confirmed or changed.

4. Confidentiality of the people who do the work

Every person we authorise to process the client's personal data is bound by a written confidentiality obligation and has been told what the engagement letter and these terms allow. Access is limited to the named engineer or engineers on the account.

5. Security of processing (Article 32)

Taking account of the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we maintain the technical and organisational measures listed under "Security measures" below, and any further measures Schedule 1 names for the engagement. We review them at least annually and whenever the engagement changes materially.

6. Sub-processors

The client gives general written authorisation for the sub-processors listed under "Sub-processors" below. We give at least 30 days' written notice before any new sub-processor handles the client's personal data, so the client can object; if the client objects on reasonable data-protection grounds and we cannot resolve it, either party may end the affected part of the engagement.

Every sub-processor is bound by written terms that impose the same data-protection obligations as these, and we remain fully liable to the client for their performance.

7. Assistance with data-subject rights

Taking into account the nature of the processing, we assist the client with appropriate technical and organisational measures, so far as possible, in responding to requests to exercise data-subject rights under Chapter III (access, rectification, erasure, restriction, portability, objection). We forward any request we receive directly to the client within two working days and do not respond to the data subject ourselves unless instructed.

8. Assistance with Articles 32 to 36, and breach notice

We assist the client in meeting its obligations on security, personal-data-breach notification, data-protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us. We notify the client without undue delay, and in any case within 48 hours of becoming aware, of any personal-data breach affecting the client's data, with what we know at the time and updates as we learn more.

9. Return or deletion at the end

At the end of the engagement, and at the client's choice, we delete or return all personal data and delete existing copies within 30 days, unless UK or EU law requires storage. Access credentials issued to us are revoked within five working days of the end of the engagement.

10. Information and audit

We make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the client or an auditor the client mandates, on reasonable notice and no more than once a year unless a supervisory authority requires otherwise or a breach has occurred. We tell the client at once if, in our opinion, an instruction given during an audit infringes data-protection law.

11. International transfers

We work from Ahmedabad, India. Access to personal data from India is a restricted transfer under the UK GDPR and the EU GDPR. The engagement letter attaches the transfer mechanism the client chooses: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses for UK clients, or the EU Standard Contractual Clauses (module two, controller to processor) for EU clients, together with a transfer risk assessment where the client needs one. We do not rely on any other basis unless the client instructs it in writing.

12. UK and EU representative (Article 27)

Whether we must appoint a representative in the United Kingdom or the European Union under Article 27 depends on the nature, scale and frequency of the processing in each engagement. We assess it with the client at signing and appoint a representative where the obligation applies. We do not claim an exemption in advance.

13. Liability, law and precedence

These terms are governed by the law the engagement letter chooses; if it chooses none, by the law of England and Wales, with the courts of England and Wales having exclusive jurisdiction. If these terms conflict with the engagement letter on a data-protection point, these terms prevail. Liability is as stated in the engagement letter and our terms of service, except that nothing limits liability to data subjects that the law does not allow to be limited.

Security measures

• Named-person access to production and staging on least privilege; no shared logins, no credentials in chat or email.
• Multi-factor authentication on every account that reaches client systems, including GitHub, hosting consoles and Google Workspace.
• Encryption in transit everywhere (TLS); data at rest encrypted where the client's hosting provides it, and we recommend it where it does not.
• No client data copied to personal devices or removable media; work happens on full-disk-encrypted company machines.
• Production data is not used in development or test environments unless the client instructs it in writing; anonymised fixtures are the default.
• Credentials and API keys issued to us are rotated or revoked at hand-over, and within five working days of the end of the engagement.
• Changes reach production through the client's repository and deployment pipeline, so every change is attributable and reversible.

Sub-processors

Schedule 1 (filled in per engagement)

• Subject matter and duration of the processing
• Nature and purpose of the processing
• Types of personal data
• Categories of data subjects
• Transfer mechanism attached (UK IDTA, UK Addendum or EU SCCs) and any transfer risk assessment
• Additional security measures specific to the engagement

Questions, or a marked-up version to review: [email protected]. Our terms of service and privacy policy sit alongside this document.