This Data Processing Agreement ("DPA") forms part of the Toolbelt Websites Terms & Conditions where Toolbelt processes personal information on behalf of a customer. Electronic acceptance of the Terms also accepts this DPA.
Last updated: 24 August 2026
1. Status and scope
This DPA is between Rikki Webster Ltd trading as Toolbelt Websites ("Toolbelt", "Processor") and the business or organisation purchasing Toolbelt services ("Customer", "Controller"). It applies only to personal information Toolbelt processes on behalf of Customer in providing the services ("Customer Personal Data").
Toolbelt remains a Data Controller for separate information it processes for its own business purposes, such as its own customer-account, billing, legal, fraud-prevention and business administration records. Those activities are addressed in the Toolbelt Privacy Policy.
This DPA is intended to satisfy the applicable controller-to-processor requirements of UK data protection law, including Article 28 of the UK GDPR, as amended or replaced from time to time.
2. Controller and Processor roles
Customer determines the purposes and essential means of processing Customer Personal Data, including what information its website collects, why it collects it, the lawful basis for collection, who should receive enquiries and how long Customer retains information after receipt. Customer is therefore the Data Controller for that processing.
Toolbelt processes Customer Personal Data to provide, operate, support and secure the agreed services and acts as Data Processor except where applicable law requires Toolbelt to process particular information for a separate purpose in its own right.
3. Details of the processing
Subject matter. Website hosting and operation where provided or managed by Toolbelt; website contact and enquiry forms; enquiry routing and transmission; technical support and troubleshooting; security and abuse prevention; and other processing reasonably necessary to deliver the agreed website service.
Duration. For the term of the services and for the limited period afterwards during which Customer Personal Data remains reasonably necessary for return, deletion, security, troubleshooting, legal compliance or the establishment, exercise or defence of legal claims.
Nature and purpose. Receiving, transmitting, routing, temporarily holding, accessing and otherwise processing Customer Personal Data as necessary to operate the website and deliver enquiries to Customer, provide support and maintain the security and integrity of the service. The Toolbelt Notifications Gateway is primarily a transmission service and is not intended to operate as a permanent customer enquiry CRM.
Types of personal data. Depending on Customer's website configuration, this may include names, email addresses, telephone numbers, enquiry or message content, service or request details, customer-supplied website content and files, and limited IP, timestamp, device, delivery, security or abuse-prevention metadata. Visitors may voluntarily include other personal information in free-text messages.
Categories of data subjects. Visitors, prospective customers and other end users of Customer websites, and Customer personnel or representatives whose information is included in material Toolbelt processes on Customer's behalf.
Higher-risk data. The standard Toolbelt website enquiry service is not designed for the deliberate routine collection of special category data, criminal-offence data, payment-card data, passwords or other similarly sensitive information. Customer must not configure the standard service to request such data without first agreeing appropriate arrangements with Toolbelt in writing.
4. Documented instructions
Toolbelt will process Customer Personal Data only on Customer's documented instructions, including instructions contained in the agreed service, onboarding information, support requests, configuration choices and other written communications, unless UK law requires otherwise. If law requires processing outside Customer's instructions, Toolbelt will inform Customer before processing unless the law prohibits that notice.
Toolbelt may make day-to-day technical and operational decisions about how to provide the service, provided those decisions remain consistent with Customer's instructions, this DPA and applicable law.
If Toolbelt believes an instruction infringes applicable data protection law, Toolbelt may suspend the affected instruction and notify Customer so the parties can resolve the issue.
5. Customer obligations and rights
Customer is responsible for ensuring that it has a lawful basis for its processing, provides appropriate privacy information to data subjects, configures forms to collect only information reasonably necessary for its purposes, and gives Toolbelt lawful instructions.
Customer is responsible for the security and retention of copies of enquiries after they reach Customer's nominated email account or other Customer-controlled system. Customer retains all rights and responsibilities of the Data Controller in relation to Customer Personal Data.
6. Confidentiality and authorised personnel
Toolbelt will limit access to Customer Personal Data to people who need access to provide, support or secure the service. Personnel and contractors authorised to process Customer Personal Data must be subject to appropriate confidentiality obligations.
7. Technical and organisational security measures
Taking account of the nature of the service and the risks involved, Toolbelt will maintain appropriate technical and organisational measures intended to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
For the central website enquiry notification service, current measures include CSRF protection, honeypot and submission-timing protections, rate limiting, per-site Site IDs and revocable authentication tokens, centrally registered and locked recipient addresses, protected central Resend credentials that are not stored on individual customer websites, SPF and DKIM authenticated sending, and TLS-protected email transport where supported by the receiving system.
Toolbelt also uses protected server-side configuration and access controls for relevant internal systems. Security measures may be updated where needed to maintain or improve protection, provided the overall level of protection is not materially reduced.
8. Authorised subprocessors
Customer gives Toolbelt general written authorisation to use the subprocessors listed below, and to appoint or replace subprocessors in accordance with this section. Toolbelt will ensure that a subprocessor processing Customer Personal Data is bound by written data protection obligations providing an equivalent level of protection for the relevant processing, and Toolbelt remains responsible to Customer for the subprocessor's performance of those obligations as required by applicable law.
Hostinger (applicable Hostinger group contracting entity under Toolbelt's account)
Purpose: hosting and infrastructure used to operate Toolbelt systems and customer website services where applicable, including infrastructure supporting the Toolbelt service.
Resend / Plus Five Five, Inc.
Purpose: transactional email delivery and website enquiry notification delivery. Contact form information may pass through Resend so that an enquiry can be delivered to Customer's nominated recipient. Resend maintains its own current downstream subprocessor list at resend.com/legal/subprocessors.
Toolbelt will give Customer reasonable advance written notice of an intended material addition or replacement of a subprocessor that will process Customer Personal Data so Customer has a reasonable opportunity to object on legitimate data-protection grounds. If the parties cannot resolve a reasonable objection and no commercially reasonable alternative is available, either party may end the affected service in accordance with the Customer Agreement.
9. International transfers
Customer acknowledges that providing modern hosting and transactional email services can involve processing Customer Personal Data outside the United Kingdom. Toolbelt will not make a restricted transfer of Customer Personal Data unless the transfer is permitted by applicable UK data protection law.
Where required, Toolbelt will rely on an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful transfer mechanism, and will take reasonable steps to ensure relevant subprocessors provide appropriate safeguards.
Resend may process data in the United States and other locations used by its authorised subprocessors. Resend's current DPA provides contractual mechanisms for UK restricted transfers, including the UK Addendum to the EU Standard Contractual Clauses, and describes other transfer mechanisms it may rely upon. Hostinger's applicable data-processing terms similarly provide international transfer safeguards for covered services. Provider infrastructure and lawful transfer mechanisms can change, so Toolbelt does not promise that processing will always take place in a particular country.
10. Assistance with data subject rights
Taking account of the nature of the processing, Toolbelt will provide reasonable assistance to enable Customer to respond to requests to exercise data protection rights, including access, correction, deletion, restriction, objection and portability where applicable.
If Toolbelt receives a request relating to Customer Personal Data directly from a data subject, Toolbelt will normally direct the individual to Customer and notify Customer where appropriate, unless applicable law requires Toolbelt to act differently.
11. Personal data breaches and security assistance
Toolbelt will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and will provide information reasonably available to Toolbelt to help Customer meet its notification and communication duties. Toolbelt will take reasonable steps within its control to contain, investigate and remediate the incident.
Toolbelt will also provide reasonable assistance, taking account of the nature of processing and information available to Toolbelt, with Customer's obligations concerning security of processing.
12. DPIAs and regulatory consultation
Taking account of the nature of the processing and information available to Toolbelt, Toolbelt will provide reasonable assistance with a Customer data protection impact assessment or prior consultation with the Information Commissioner's Office where the processing performed by Toolbelt is relevant and such assistance is required by applicable law.
13. Enquiry retention, return and deletion
Toolbelt does not use the Toolbelt Notifications Gateway as a permanent Customer enquiry repository. Enquiry content is retained only for as long as reasonably necessary to provide the service, for delivery, security, abuse prevention, troubleshooting or legitimate operational requirements, where retention is required by law, or where reasonably necessary to establish, exercise or defend legal claims. Toolbelt does not promise an arbitrary fixed deletion period unless a particular service configuration expressly provides one.
Once an enquiry has been delivered to Customer's nominated email account, Customer controls and is responsible for the retention and deletion of that copy.
At the end of the services, and at Customer's choice where applicable and reasonably practicable, Toolbelt will return or delete Customer Personal Data then held on Customer's behalf, unless applicable law requires continued retention. Data contained in protected backups or archives may remain until the applicable backup cycle expires, provided it is kept protected and not restored for ordinary use except where necessary for recovery, legal compliance or security.
14. Information, audits and compliance
Toolbelt will make available information reasonably necessary to demonstrate compliance with the processor obligations in this DPA. Customer may carry out, or appoint an independent auditor to carry out, a reasonable audit relating to Customer Personal Data on reasonable prior written notice.
Where appropriate, the parties will first use current documentation, security information and remote review to minimise unnecessary disruption. Audits must be proportionate, protect confidential information, avoid access to other customers' data and not compromise the security of Toolbelt or third-party systems. This does not limit a legally required audit, investigation or regulatory inspection.
15. Changes, termination and contact
This DPA remains in effect for as long as Toolbelt processes Customer Personal Data on Customer's behalf. Material changes affecting active processing will be notified in accordance with the Customer Agreement and the subprocessor provisions above.
If the customer agreement ends, this DPA continues to apply for as long as Toolbelt retains Customer Personal Data in its capacity as Processor.
Data protection questions relating to this DPA can be sent to support@toolbeltwebsites.co.uk.
Rikki Webster Ltd trading as Toolbelt Websites
Company number: 13001015
Registered office: Greenacre House, The Street, Hinderclay, Diss, England, IP22 1HX