Data processing agreement
Last updated 16 September 2026
This is the processor agreement Marchlight enters into with every client business. It forms part of the terms of service. A signed PDF of this text, with your business named as controller, is available on request before you load any data — email hello@marchlight.pro and it comes back the same working day.
Marchlight is a sole proprietor, not a law firm, and this document is not legal advice. If your organisation has a preferred DPA template or your own information governance lead, send it — signing your paper is usually faster than arguing about ours.
1. Roles
For personal data about your customers, you are the controller and Marchlight is the processor. You decide what is collected and why; Marchlight acts only on your documented instructions, which are these terms plus the settings you choose in the dashboard and anything you ask for in writing.
2. Subject matter and duration
Processing lasts for as long as you are a client, plus the 30-day deletion window in clause 9. The subject matter is the operation of an appointment booking system.
3. Nature and purpose of processing
Storing appointments and customer contact details; showing availability; sending confirmations, reminders, cancellation notices, review requests and no-show follow-ups; producing reports for you in your dashboard. Nothing else. Marchlight does not use your customers' data to train models, to market anything, or for any purpose of its own.
4. Categories of data and data subjects
| Data subjects | Your customers, and your staff whose names and working hours appear in the diary |
|---|---|
| Personal data | Name; email address; phone number; appointment history; the free-text note a customer chooses to leave; marketing opt-in status; staff names, staff email addresses and working hours |
| Special category data | Not requested and not required. The note field is free text, so a customer may volunteer health information. Where that is foreseeable in your sector, you remain the controller of it and should reflect it in your own privacy notice and record of processing. |
| Children's data | Only if you book appointments for children; the system has no separate handling for it, and you should consider that before using it in paediatric settings |
5. Marchlight's obligations
- Process only on your documented instructions, and tell you if an instruction appears to breach data protection law.
- Keep everyone with access bound by confidentiality. Today that is one person: Sahil Sidhu.
- Apply the technical and organisational measures described on the security page, which is incorporated into this agreement and kept current.
- Help you respond to data subject requests, and to your obligations on security, breach notification and impact assessments, within 5 working days.
- Make available the information needed to demonstrate compliance, and submit to audits — see clause 10.
6. Sub-processors
You give general authorisation for the sub-processors listed at marchlight.pro/subprocessors. Each is bound by terms no less protective than these.
Before adding or replacing one, Marchlight gives you 30 days' notice by email. If you object on reasonable data protection grounds within that period, and there is no workable alternative, you may terminate with no charge and take a full export.
7. International transfers
Marchlight operates from India, which does not benefit from a UK or EU adequacy decision. Where you transfer UK or EU personal data to Marchlight, the transfer is covered by:
- the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), incorporated into this agreement by reference; and
- for UK data, the UK International Data Transfer Addendum (version B1.0) to those clauses.
The relevant selections: clause 7 docking is permitted; clause 9 option 2 (general authorisation, 30 days' notice); clause 11 optional redress body not used; clause 17 governing law and clause 18 forum, Ireland; Annexes I to III are formed by clauses 3, 4 and 6 of this agreement and the security page.
A transfer risk assessment covering Indian government access powers is available on request. Hosting is planned to move to a UK or EU region, at which point these clauses stop being the primary transfer mechanism; clients will get at least 30 days' notice before any move.
8. Personal data breaches
Marchlight will notify you without undue delay and in any event within 24 hours of becoming aware of a breach affecting your data, by email and phone, with what is known at that point: what happened, which data and roughly how many people are affected, the likely consequences, and what is being done. Follow-up detail comes as it is established rather than being held back until the picture is complete. You, as controller, decide on any notification to a regulator or to individuals.
9. Deletion and return
You can export everything yourself at any time. On termination, or on your written request, live data is deleted within 30 days. Backup copies age out within 8 weeks on the rotation described in the privacy policy; they are not selectively edited, and they are not restored for any purpose other than recovering the service. Written confirmation of deletion is provided on request.
10. Audit
Marchlight will answer a written security questionnaire within 10 working days, and will join a call with your information governance lead. Given that the service is operated by one person, an on-site audit is not practical; a documented review of configuration, access and backup evidence is offered instead, once per year, at no charge.
11. Liability and precedence
Liability under this agreement is subject to the limits in the terms of service, except where data protection law does not permit that. If this agreement and the terms of service conflict on the handling of personal data, this agreement wins.
To have this signed with your business named as controller, email hello@marchlight.pro. If you need it before a trial rather than before going live, that is fine — ask.