Data processing agreement
This data processing agreement (“DPA”) applies when we handle personal data for you while delivering your plan. It forms part of our terms and conditions and meets the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018.
Last updated: 24 October 2026
1. Who is who
- You (our client) are the controller. You decide why and how the personal data is used.
- We, The Powerful Group Limited trading as Powerful Digital Marketing (company number 09629669, 124 City Road, London EC1V 2NX), are the processor. We handle the data only to deliver your plan.
Our privacy policy covers the data we use for our own purposes, such as your account and billing details. In that case we are the controller, and this DPA does not apply.
2. What we process
| Details | |
|---|---|
| Subject matter | Delivering the plans and items you buy from us |
| How long | For as long as your plan runs, then until the data is deleted or returned under section 10 |
| What we do with it | Store, organise, use and publish it as needed to deliver your plan |
| Types of people | Your customers, website visitors, newsletter subscribers, people who leave reviews, people who chat with your Powerful Bot, people named or quoted in your press releases, and your staff |
| Types of data | Names, contact details, messages and chat conversations, review text, email list details, order and product details, and online identifiers |
| Special category data | None. You must not ask us to process it without a separate written agreement. |
Examples by service:
- Powerful Bots: conversations between your website visitors and your bot, and any contact details they choose to give.
- Email newsletters: your subscriber list, held in your own Mailchimp or Brevo account.
- Email automations: your contact list and segments, held in your own email platform.
- Powerful PR: names and quotes of the people in your press releases, sent to a press release distribution service and the media it reaches.
- Google reviews and social media: names and comments of people who review or comment on your business.
- Ads: audience data held in your Google or Meta ad account.
- Product listings and Powerful Pages: data in your eBay, Amazon, Etsy, WooCommerce or website account that we can see while working.
3. Your instructions
We only process personal data on your documented instructions. Your order, your plan’s description and your approvals are your instructions. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.
4. Your responsibilities
You confirm that you have a lawful basis for the personal data you give us or ask us to process, that you have told people how their data is used (for example in your own privacy policy and cookie notice), and that your instructions comply with the law.
5. Confidentiality and security
- We do not use subcontractors. Only people who need your personal data to deliver your plan handle it.
- We use appropriate technical and organisational measures to protect it, as required by Article 32 of the UK GDPR. These include access controls, secure connections and limiting access to the people who need it.
6. Sub-processors
You give us general permission to use sub-processors to help deliver your plan. Our current sub-processors are:
| Sub-processor | What they do for us |
|---|---|
| Hostinger | Website and data hosting, and our email (sending and storing emails) |
| Stripe and PayPal | Payments |
| Third-party AI providers, such as OpenAI, Anthropic, Google, Microsoft and xAI | Creating content and replies with AI, including AI voices for podcasts |
| Kuga, our chatbot platform provider | Running Powerful Bots chatbots and storing chat data |
| Our press release distribution service | Sending your press releases to the media |
| Google Workspace and X (formerly Twitter) | Tools we use to work with your project files and content |
| The platforms you ask us to work on, such as Google, Meta, Mailchimp, Brevo, eBay, Amazon and Etsy | Publishing and managing your content in your own accounts |
- Our sub-processors handle personal data under their own data protection terms, which apply when we use their services.
- We will tell you before we add or replace a sub-processor. You can object on reasonable data protection grounds. If we cannot resolve your objection, you can cancel the affected plan.
- We remain responsible to you for our sub-processors’ work.
7. Transfers outside the UK
We only transfer personal data outside the UK when there is an adequacy decision (“data bridge”), or under the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or another safeguard allowed by law. AI processing may happen in the USA. Our chatbot platform provider, Kuga, processes data in the UK, EU or USA under appropriate safeguards.
8. Helping you
Taking into account what we do and the information we have, we will help you:
- respond to people using their data protection rights (for example access or deletion requests). If someone contacts us directly, we will pass the request to you;
- keep personal data secure, and carry out data protection impact assessments or consult the ICO where needed.
9. Data breaches
If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 48 hours. We will give you the information you need to decide whether to report it to the ICO or tell the people affected, and help you contain it.
10. When your plan ends
When your plan ends, we will delete or return your personal data, at your choice, within 30 days, unless the law requires us to keep it.
For Powerful Bots, chatbot data is deleted within 14 days after your plan ends.
11. Audits and information
We will give you the information you reasonably need to show that we meet this DPA. We will allow and contribute to audits by you or an auditor you appoint, up to once a year with 30 days’ notice, at your cost, unless there has been a personal data breach or the ICO requires an audit.
12. Liability and law
Each party’s liability under this DPA is subject to the limits in our terms and conditions, except where the law does not allow that. This DPA is governed by the law of England and Wales.
Questions
Email info@powerfuldigitalmarketing.com. If your organisation needs a signed copy of this DPA, email us.