Data processing
Data Processing Agreement
This agreement applies where Lorenwick Systems processes personal data on behalf of a client business as processor.
1. Parties and roles
The client business identified in the applicable onboarding/order record is the Controller. Mateusz Ryszard Drozd, sole trader trading as Lorenwick Systems, is the Processor for processing carried out on the Controller's behalf.
2. Subject matter, duration, nature and purpose
Processing is limited to what is necessary to provide the managed enquiry service, onboarding, messaging automation, enquiry organisation, operator handoff, support and deletion/offboarding.
Operations may include receiving, transmitting, structuring, classifying, storing, retrieving, responding to, securing, deleting and returning personal data. Processing lasts for the service/trial relationship plus the controlled return/deletion period.
3. Data subjects and data categories
Data subjects may include the Controller's customers/prospects who send enquiries and the Controller's owners, employees or contractors using operational service features.
Personal data may include names/contact details, messaging/platform identifiers, message/enquiry content, vehicle/job/service details, preferred date/time, delivery/status information, business/operator contact details and necessary technical/security metadata.
Special-category/criminal data is not intentionally requested.
4. Controller obligations, rights and documented instructions
The Controller retains overall control of the purposes of processing and is responsible for ensuring its instructions and service use comply with applicable law, selecting and documenting its lawful basis, providing required customer privacy information, and issuing documented instructions when processing purposes or settings change.
Lorenwick will process Controller personal data only on documented instructions, including this agreement, the Service Terms, the approved Business Blueprint and authorised support instructions, unless UK law requires otherwise. This restriction also applies to international transfers of Controller personal data.
If Lorenwick believes an instruction infringes applicable data-protection law, Lorenwick will inform the Controller unless prohibited by law.
5. Confidentiality and security
Lorenwick will ensure authorised persons are subject to appropriate confidentiality obligations and will maintain appropriate technical and organisational measures proportionate to the risk.
6. Sub-processors
The Controller gives general written authorisation for Lorenwick to use sub-processors necessary to provide the service. Lorenwick will impose appropriate data-protection obligations, remain responsible for its processor obligations, and provide reasonable notice of material additions or replacements where required.
Where an unresolved legitimate objection materially prevents service delivery, either party may terminate the affected service.
7. International transfers
Lorenwick will not make a restricted transfer without a lawful UK transfer mechanism where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful safeguard.
8. Data-subject rights
Taking into account the nature of processing, Lorenwick will provide reasonable assistance so the Controller can respond to rights requests. If Lorenwick receives a request relating to Controller-controlled data directly, Lorenwick will forward it to the Controller without undue delay and will not independently decide the Controller's legal response unless required by law.
9. Personal-data breaches
Lorenwick will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller personal data and provide available information reasonably needed for the Controller's assessment and response.
10. Security, DPIAs and regulator assistance
Taking into account the nature of processing and information available to Lorenwick, Lorenwick will provide reasonable assistance with the Controller's obligations concerning appropriate security of processing, personal-data breach assessment and notification, data protection impact assessments, and prior consultation with the ICO where required.
11. Return and deletion
At termination, at the Controller's choice where reasonably practicable, Lorenwick will return/export or delete Controller personal data.
The V1 working policy is deletion of live client-controlled customer data within 30 days after termination and any agreed export window. Unavoidable provider backup/history copies may expire on the provider's documented cycle. Data that Lorenwick independently must retain as controller, such as contractual/accounting/security records with a separate lawful basis, is outside this processor deletion obligation.
12. Retention instructions
The default V1 configuration is 90 days for live end-customer enquiry content. The Controller may request a shorter period. A longer period requires a documented Controller instruction and purpose and must be technically supported by the service.
13. Compliance information and audit
Lorenwick will make available information reasonably necessary to demonstrate compliance with applicable processor obligations and permit proportionate audits subject to confidentiality, security, reasonable notice, minimising disruption and protecting other customers' information.
14. Order of precedence
For processor obligations, this Data Processing Agreement prevails over conflicting general commercial terms concerning processing of Controller personal data.
15. Contact
Privacy/data-processing contact: [email protected].