Engine Data Processing Agreement

1. What this is

This Data Processing Agreement (“DPA”) applies whenever Product of Experience LTD (company no. 13443773, “we”, “us”) runs Engine for a business (“you”). It forms part of your Engine agreement: our Terms together with your proposal or order. It is how we meet Article 28 of the UK GDPR.

If this DPA and the Terms disagree about personal data, this DPA wins.

2. Who does what

• You are the controller of your customers’ personal data: you decide why it is collected and what happens with it.
• We are your processor. We only handle that data to run Engine for you, as described in this DPA and Annex A.
• We never use your customers’ data for our own purposes, never sell it, never use it for marketing, and never use it to train AI. Engine does not send it to any AI service.
• We are the controller of our own account details about you, such as the owner’s name and email. Our Privacy Policy covers those.

3. Your instructions

We process your customers’ data only on your documented instructions. Your instructions are:

• this DPA and your Engine agreement;
• the set-up you approve with us: your form fields, the wording under your form, the messages Engine sends and when, and any tools you connect (such as an email inbox or booking calendar);
• anything else you ask us in writing (email is fine).

If we think an instruction breaks data protection law, we will tell you and will not act on it until we have agreed what to do. If the law requires us to process data in another way, we will tell you first unless the law forbids it.

4. Your responsibilities

• Have a lawful basis for collecting the data, and a privacy notice that tells your customers about it and about Engine. Your form shows your own wording and links to your privacy notice.
• Approve every message Engine sends to your customers before it goes live. Engine’s messages are service messages about the customer’s own enquiry. Do not ask us to add offers or marketing to them: under PECR that would need consent we do not collect.
• Do not use Engine to collect special category data (such as health information) or criminal records data. Engine is not designed for it.
• Tell us promptly if one of your customers asks to see, correct or delete their data, or objects to how it is used.

5. Confidentiality and who can see the data

• Only Scott Byrne-Fraser, who runs Product of Experience, can access the data. If anyone else ever needs access (for example a contractor), they will be bound by confidentiality and we will tell you first.
• We look at your customers’ data only when we need to: to set Engine up, fix a problem, or act on your instructions.

6. Security

We keep the data secure with the measures in Annex B, and review them when Engine changes. We may improve them, but will not weaken them.

7. Sub-processors

• You give us general permission to use the sub-processors listed in Annex C.
• We will give you at least 30 days’ notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you can end Engine without penalty before the change takes effect.
• Each sub-processor is bound by a written contract with data protection terms no less protective than this DPA. We remain responsible to you for them.
• Tools you connect from your own account, such as your booking calendar or your website’s form, are your providers, not ours. Their terms are between you and them.

8. International transfers

Engine stores and processes your customers’ data in the UK (London) and the EU (Ireland). The UK recognises the EU as giving adequate protection, so no further safeguard is needed for that.

Our providers are US companies and may occasionally access data from the United States, for example to give support. Where that happens, they rely on a lawful safeguard: the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum. Cloudflare’s bot check runs on its global network and sees only the visitor’s IP address and browser details.

9. Helping you with your customers’ rights

• If one of your customers contacts us directly, we will pass the request to you the same working day and will not answer it ourselves unless you ask us to.
• When you ask, we will export everything Engine holds about a person, or delete it, normally within 5 working days. We will confirm in writing when it is done.
• We will give you reasonable help with data protection impact assessments and questions from the ICO about Engine.

10. If something goes wrong (personal data breaches)

• We will tell you without undue delay, and in any case within 48 hours, after we become aware of a breach affecting your customers’ data.
• We will tell you what happened, what data and roughly how many people are affected, the likely consequences, and what we have done and will do about it. If we do not know everything yet, we will tell you what we know and follow up.
• You decide whether to report it to the ICO (which must normally be within 72 hours of you becoming aware) and whether to tell the people affected. We will help.

11. How long we keep data, and when you leave

• While you use Engine, we keep enquiries so Engine can work and you can see your history. Some data is deleted sooner automatically: see Annex A.
• When Engine ends, we will send you a full export of your data on request, and delete it from Engine within 30 days of the end date, unless the law requires us to keep it. We will confirm in writing when it is deleted.
• Copies in our providers’ backups are overwritten on their normal cycle, normally within 7 days after that.
• Emails already sent stay in your and your customers’ inboxes. We cannot recall them.

12. Checking we comply

• We will give you the information you reasonably need to show we comply with this DPA, including answers to a security questionnaire.
• If that is not enough, or the ICO requires it, you (or an auditor bound by confidentiality) can carry out an audit, once a year, with at least 30 days’ notice, during working hours. Each side pays its own costs, unless the audit finds a material breach of this DPA by us.

13. Liability, changes and law

• The limits of liability in our Terms apply to this DPA, except where the law does not allow them to.
• We may update this DPA to reflect changes in the law or in Engine. We will give you 30 days’ notice of any change that affects you. Changes will never reduce the protection your customers’ data gets.
• This DPA is governed by the laws of England and Wales.

Annex A. What data Engine processes

Annex B. Security measures

• Encryption in transit (HTTPS/TLS) for every connection, and encryption at rest by our database provider.
• Each client’s data is kept separate: Engine refuses any database request that is not limited to one client, and records in the database cannot be linked across clients.
• The database is not reachable from browsers. Only Engine’s server code can read it, using a secret key held in our hosting provider’s encrypted settings, never in code.
• Status buttons in emails use signed links that expire after 60 days and cannot be guessed. Opening a link does not change anything until it is confirmed, so email security scanners cannot trigger it.
• Bot protection and rate limits on forms.
• Every message Engine sends is recorded, with a unique key so it cannot be sent twice.
• Access to the providers in Annex C is limited to Scott Byrne-Fraser, with two-step sign-in on every account.
• Daily backups by our database provider, kept for 7 days.
• Automatic deletion of raw emails and IP codes after 30 days.
• Written procedures for exports, deletions, clients leaving and breaches.

Annex C. Sub-processors

Last updated: 13 October 2026. We will email you before this list changes (section 7).

Contact

Questions about this DPA or your customers’ data: privacy@productofexperience.com.