Data processing agreement
Last updated: 3 November 2026. This agreement forms part of the Inkbright terms of service and meets UK GDPR Article 28.
1. Parties and roles
The customer is the controller and Ironbit Ltd (NI729290) is the processor of personal data processed through Inkbright.
2. Details of processing
| Subject matter | Creating and maintaining email signatures in the customer's Google Workspace |
|---|---|
| Duration | For the term of the customer's use of Inkbright, plus the deletion periods in the privacy policy |
| Data subjects | The customer's Google Workspace users; recipients who click campaign banners (counts only) |
| Personal data | Directory profile fields (name, job title, department, phone, photo URL, org unit, manager, custom fields), group membership, self-service fields, administrator emails in audit logs |
| Special category data | None intended. Pronouns are optional and entered by the user |
3. Processor obligations
- Process personal data only on the customer's documented instructions, which are these terms and the customer's configuration of Inkbright.
- Ensure everyone with access is bound by confidentiality.
- Apply appropriate technical and organisational security measures, including encryption in transit and at rest, least-privilege access, and access to customer data restricted to staff who need it.
- Use only the sub-processors listed in the privacy policy, give 30 days' notice before adding one, and let the customer object. Each sub-processor is bound by equivalent terms.
- Help the customer respond to data subject requests and with data protection impact assessments, where reasonable.
- Notify the customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
- At the end of the service, delete customer personal data (the customer can do this immediately via Remove Inkbright), unless law requires retention.
- Make available information needed to demonstrate compliance and allow reasonable audits, normally by questionnaire, on 30 days' notice.
4. International transfers
Where personal data is transferred outside the UK, it is protected by UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.