Data processing terms

01Scope and roles

These data processing terms form part of the terms of service between you (the customer) and Administrative Burden Ltd (company number 17363389). They apply when we process personal data on your behalf to provide LookupDock. You are the controller and we are the processor. Annex 1 describes the processing.

02Instructions

We process the personal data only on your documented instructions, which are the terms of service, your use of the workspace and API, and any written instructions you send us, unless the law requires otherwise. If we believe an instruction breaks data protection law, we will tell you.

03Confidentiality

Anyone we authorise to process the personal data is bound by confidentiality.

04Security

We apply the technical and organisational measures in Annex 2 and keep them appropriate to the risk.

05Subprocessors

You authorise the subprocessors in Annex 3. We will tell you at least 14 days before adding or replacing a subprocessor, by updating this page and emailing the account owner. If you object on reasonable data protection grounds and we cannot address the objection, you may end the service. We impose data protection obligations on each subprocessor that are equivalent to these terms, and we remain responsible for them.

06Transfers

We transfer personal data outside the UK or EEA only with a valid safeguard, such as adequacy regulations, the UK International Data Transfer Addendum with the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework for certified subprocessors.

07Assistance

Taking into account the nature of the processing, we will help you respond to requests from data subjects, and with security, breach notification, data protection impact assessments and consultation with supervisory authorities. If a data subject contacts us directly about data you submitted, we will pass the request to you.

08Personal data breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own obligations.

09Deletion and return

Lookup inputs and results are deleted automatically after seven days, and uploaded files are not kept after processing. When the service ends we will delete remaining personal data, unless the law requires us to keep it. Encrypted backups are overwritten on their seven-day cycle. You can download batch results before they expire.

10Information and audits

We will make available the information reasonably needed to show compliance with Article 28, and allow for and contribute to audits by you or an auditor you appoint, on reasonable notice, at your cost and subject to confidentiality. We will first try to answer through written information.

11Annex 1: Processing details

Subject matter

Validating phone numbers, email addresses and IP addresses that the customer submits.

Duration

For the term of the service. Lookup details are kept for seven days.

Nature and purpose

Receiving values through the workspace, API or CSV upload, sending them to our validation supplier when live checks are enabled, and returning and briefly storing the results.

Categories of data subjects

• People whose phone numbers, email addresses or IP addresses the customer submits for checking
• The customer's own users of the workspace

Categories of personal data

• Phone numbers, email addresses and IP addresses
• Results returned for those values (for example validity, line type, deliverability, network and location signals)
• Other columns in an uploaded CSV, which are parsed transiently to find the chosen column

Special category data

None. You must not submit it.

12Annex 2: Security measures

• Application-level encryption of lookup inputs, results and batch contents in the database.
• HTTPS for all traffic, with TLS between the network edge and the server.
• API keys stored only as SHA-256 digests, individually revocable.
• Workspace-scoped queries, so one customer cannot read another's data.
• No-store caching headers on responses with personal data.
• Passwords, tokens and keys filtered from logs; verification and reset tokens kept out of URLs sent to the server.
• Automatic deletion of lookup details after seven days; uploaded files not retained.
• Rate limits on checks, uploads and sign-in.
• Daily database backups kept for seven days, with encryption keys stored separately.
• Access to production limited to the operator.

13Annex 3: Subprocessors