Data Processing Agreement
This Data Processing Agreement forms part of the Contract for Services between the Practice and SurgeryWeb, as identified in that contract. It applies where SurgeryWeb processes personal data on behalf of the Practice in providing the contracted website services.
For that processing, the Practice acts as Data Controller and SurgeryWeb acts as Data Processor. Applicable Data Protection Laws include the UK GDPR and the Data Protection Act 2018, as amended from time to time.
Scope and Purpose of Processing
The processing concerns the operation, hosting, maintenance and support of the Practice website, including the collection and transmission of website form submissions, storage in the website administration dashboard, and backup, restoration and deletion of website data.
Depending on the forms and services enabled by the Practice, personal data may include names, dates of birth, sex, gender, racial or ethnic origin, addresses, postcodes, telephone numbers, email addresses, NHS numbers, health information, documents, photographs and other information submitted through the website. Data subjects may include patients, their representatives, Practice staff and other website users.
Processing continues for the duration of the contracted services and for the limited period needed to complete the agreed return or deletion of data. Individual form submissions and backups remain subject to the shorter retention arrangements below.
Responsibilities and Instructions
The Practice shall determine the purposes of processing, the information requested through its forms, the authorised recipients, and appropriate retention settings. It is responsible for the applicable lawful bases, conditions for processing special category data, and information supplied to individuals about that processing.
SurgeryWeb shall act only on documented instructions from the Practice, including the Contract for Services, this agreement and agreed configuration settings. If UK law requires other processing, SurgeryWeb shall inform the Practice before that processing unless the law prohibits this. SurgeryWeb shall promptly inform the Practice if it considers an instruction infringes applicable Data Protection Laws.
Email Transmission Through NHSmail
Email notifications containing form submissions are sent through NHSmail to the designated recipients configured for the Practice. These notifications are not routed through or stored on SurgeryWeb’s own mail server.
The website-to-NHSmail connection shall use the appropriate authenticated, encrypted connection supported by the integration. Sensitive information sent to recipients outside an accredited secure email service shall use the applicable NHSmail encryption arrangements. The Practice shall ensure that configured recipients are appropriate and authorised.
NHSmail transmission is separate from website storage: submitted data is also processed by the website hosting environment and may be retained in WordPress and included in backups as described below. Copies delivered to the Practice are subject to its own retention arrangements.
Confidentiality and Security
SurgeryWeb shall restrict access to authorised people who require it to provide the services and are subject to confidentiality obligations. It shall implement technical and organisational measures appropriate to the sensitivity of the data and the risks of processing, including controls over access, authentication, transmission, storage and recovery.
The agreed security measures, including encryption in transit and at rest, backup protection, access controls and restoration procedures, shall be documented and reviewed. NHSmail security does not, by itself, establish the protection applied to the website database or backup files.
Sub-processors and Third-party Services
SurgeryWeb shall obtain the prior written authorisation of the Practice before appointing a sub-processor. Where general written authorisation is given, SurgeryWeb shall notify the Practice in advance of proposed additions or replacements so that the Practice has an opportunity to object. SurgeryWeb shall impose equivalent applicable data protection obligations on its sub-processors and remain responsible for their performance.
The following services are identified for transparency. A service contracted directly by the Practice is not automatically a sub-processor appointed by SurgeryWeb. Provider identities, contractual roles and applicable processing agreements shall be confirmed in the service schedule. Links to privacy information do not replace those agreements.
| Provider or service | Personal data | Purpose | Arrangements and further information |
|---|---|---|---|
| NHSmail | Information included in form notification emails, including patient identifiers, contact details, health information and attachments where supplied. | Transmission and mailbox delivery of form submissions to the configured recipients. | NHS secure email guidance. |
| Catalyst2 | Website content, stored form submissions and associated files, which may contain the categories of personal data described above. | Website hosting, storage and transmission. | Catalyst2 privacy information. |
| Dropbox | Personal data contained in website backup files, including stored form submissions and associated files where included in a backup. | Off-site storage of weekly website backups. | Active backup files are rotated after 14 days. Dropbox retention information. |
Other providers used to process personal data on behalf of the Practice, including additional integrations where enabled, must also be recorded and authorised where required.
International Transfers
SurgeryWeb shall make international transfers only on the documented instructions of the Practice and in accordance with applicable transfer requirements. Relevant processing locations, overseas access and any required transfer safeguards shall be documented in the service schedule. Use of NHSmail does not establish that all website or backup processing takes place in the United Kingdom.
Data Retention and Deletion
Website form submissions
Form submissions stored in the WordPress administration dashboard are subject to a default retention period of 30 days from submission. A different period may apply where the Practice changes the available personal data settings or provides other documented instructions.
SurgeryWeb shall apply the agreed retention and deletion settings to submissions and associated copies within its control, including uploaded files where applicable. The Practice shall select a period appropriate to its purposes. A submission must not be treated as permanently deleted merely because it has been hidden from the dashboard or moved to Trash.
Weekly website backups
Website backups are created weekly and stored using Dropbox. The active backup set is configured for a retention period of 14 days from backup creation, after which files are removed through the backup rotation process. Backups may therefore contain submissions already deleted from the live website.
Removal from the active backup set does not necessarily mean immediate permanent deletion from Dropbox. The 14-day period is not a promise that every recoverable copy is permanently erased within 14 days.
Data already deleted from the live website shall be put beyond routine use in retained backups. If a backup is restored, SurgeryWeb shall reapply required deletions and retention settings before restored submissions become available for routine use. Backups shall not be used to extend the operational retention period for form submissions.
Copies held by the Practice and other data
Deleting a submission from the website does not delete notifications already delivered through NHSmail, downloaded files or information transferred into other Practice systems. The Practice is responsible for the retention of copies within those systems.
The 30-day default applies to website form submissions, not to all data stored on the server. Other personal data processed for the Practice shall have separately documented purposes and retention periods. This agreement does not establish a general three-year retention period.
Data Subject Requests and Assistance
SurgeryWeb shall notify the Practice without undue delay, and within two working days, of requests received from individuals concerning personal data processed on its behalf. It shall refer such requests to the Practice and respond only on its instructions, unless otherwise required by law.
Taking account of the nature of processing and the information available, SurgeryWeb shall assist the Practice with individuals’ rights, security obligations, breach notifications, data protection impact assessments and consultation with the regulator where required.
Personal Data Breaches
SurgeryWeb shall notify the Practice without undue delay after becoming aware of a personal data breach affecting data processed on its behalf. It shall provide available information about the incident, affected data, likely consequences, response measures and a contact for further information. Information may be supplied in stages as it becomes available.
SurgeryWeb shall cooperate with the Practice in investigating, containing and addressing the breach and in providing information needed for the Practice to meet its reporting and notification obligations.
Return or Deletion at the End of Services
At the end of the relevant services, SurgeryWeb shall, at the choice of the Practice, return or securely delete personal data processed on its behalf and delete existing copies, unless UK law requires retention. The parties shall document the practical return and deletion arrangements.
Where backup copies cannot immediately be erased, they shall be put beyond routine use and deleted through the documented deletion cycle. Any continued retention required by law shall be limited to that requirement.
Information, Audits and Inspections
SurgeryWeb shall make available information needed to demonstrate its compliance with the applicable processor obligations and shall allow and contribute to audits and inspections by the Practice or an auditor appointed by it. Arrangements shall protect confidentiality and the personal data of other customers without preventing those obligations from being met.
