Legal Stuff.

Data Processing Schedule

Last updated: 26 October 2026

← Back to Legal Stuff home

1. Scope and roles

1.1 This schedule forms part of the Agreement between Cogent Connective Limited ("Cogent", "we", "us") and the client named on the Quote ("you") under our Terms of Business. It applies whenever we process Protected Data on your behalf.

1.2 You are the controller and we are the processor of Protected Data. Where we process personal data about your staff as our business contacts (for example to send invoices), we do so as a controller under our Privacy Policy, not under this schedule.

1.3 If this schedule conflicts with the rest of the Agreement on the processing of Protected Data, this schedule takes priority.

2. Definitions

2.1 Words defined in the Terms of Business have the same meaning here. In addition:

• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any law that amends, replaces or supplements them, as they apply to either of us or to the Services.
• UK GDPR means Regulation (EU) 2016/679 as it forms part of UK law under the European Union (Withdrawal) Act 2018, as amended.
• Controller, Processor, Data Subject, Personal Data, Personal Data Breach and processing have the meanings given in the Data Protection Laws.
• Protected Data means Personal Data in Client Data that we process on your behalf to provide the Services.
• Sub-processor means any processor we engage to process Protected Data.
• ICO means the UK Information Commissioner's Office.

3. Your obligations as controller

3.1 You will comply with the Data Protection Laws, including having a lawful basis for the Protected Data, giving the privacy information Data Subjects need, and holding valid consents for electronic marketing.

3.2 Your instructions to us must comply with the Data Protection Laws. The Agreement, the SOW and the configuration you approve are your documented instructions.

3.3 You will tell us before sending us special category data (such as health data) or criminal offence data. The Services are not designed for it unless the SOW says so.

3.4 You will indemnify us against losses, fines, claims and reasonable costs arising from your breach of this clause 3.

4. Our obligations as processor

4.1 We will process Protected Data only on your documented instructions, as described in Annex A, unless the law requires otherwise. If it does, we will tell you before processing unless the law forbids it.

4.2 If we believe an instruction breaks the Data Protection Laws, we will tell you. We may pause the affected Services until we agree a lawful instruction, and fees are not reduced for that pause.

4.3 We will make sure everyone we authorise to process Protected Data is bound by a duty of confidentiality and has had data protection training.

4.4 We will not sell Protected Data, use it for our own purposes, or combine it with other clients' data.

5. Security

5.1 We will put in place and maintain the technical and organisational measures in Annex B, appropriate to the risk, to protect Protected Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

5.2 We may update these measures as technology and risks change, provided the overall level of protection does not fall.

5.3 Security inside your own systems (including HubSpot user access, permissions and two-factor authentication for your users) is your responsibility, although we will advise on good practice during the Services.

6. Sub-processors

6.1 You authorise us to use the sub-processors listed in Annex C.

6.2 We will appoint each sub-processor under a written contract that gives at least the same protection as this schedule, and we remain responsible to you for their work.

6.3 We will give you at least 14 days' notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot address the objection, either of us may end the affected Services without penalty.

6.4 Your own suppliers, such as HubSpot and your ERP provider, are your processors under your own contracts with them, not our sub-processors.

7. International transfers

7.1 We will not transfer Protected Data outside the UK except to the sub-processors and locations in Annex C, or with your written approval.

7.2 Each transfer will rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US suppliers) or on the UK International Data Transfer Agreement or Addendum, with any supplementary measures needed.

8. AI features

8.1 We will only use Protected Data with AI features where the SOW or your written instruction covers it.

8.2 We will use AI services on business terms under which the provider does not use your data to train its models, and we will list each provider in Annex C.

8.3 You remain responsible for deciding whether using Protected Data with an AI feature is lawful, including any data protection impact assessment and transparency to Data Subjects. We will give you the information you reasonably need to do this.

8.4 AI features we configure inside your own HubSpot portal (such as Breeze) are provided by HubSpot under your contract with them.

9. Assistance and data subject requests

9.1 We will pass to you, within 5 Working Days, any request we receive from a Data Subject about Protected Data. We will not respond to it except on your instruction.

9.2 Taking into account the nature of the processing, we will help you respond to Data Subject requests and meet your duties on security, breach notification, data protection impact assessments and prior consultation with the ICO.

9.3 Help beyond what is reasonable within the Services is charged at our standard rates.

10. Personal data breaches

10.1 We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Protected Data.

10.2 Our notice will describe, as far as we know at the time, what happened, the data and approximate number of Data Subjects affected, the likely consequences, and what we have done or propose to do. We will add details as they become available.

10.3 We will take reasonable steps to contain the breach and will not notify the ICO or Data Subjects on your behalf unless you ask us to or the law requires it.

11. Audits and information

11.1 On request, we will give you the information reasonably needed to show we meet this schedule, such as our policies, this schedule's annexes and answers to a reasonable security questionnaire.

11.2 If that is not enough, you (or an independent auditor bound by confidentiality) may audit our compliance once in any 12 months, on at least 30 days' notice, during business hours and without disrupting our business. More frequent audits are allowed after a Personal Data Breach or at a regulator's request.

11.3 Each of us bears our own audit costs. We may charge for time beyond 1 Working Day at our standard rates. We may withhold information that is confidential to other clients or commercially sensitive.

12. Return, deletion and survival

12.1 When the Services involving Protected Data end, we will, at your choice, return the Protected Data we hold in a standard format or delete it. If you have not told us within 30 days, we will delete it.

12.2 Deletion from backups happens as those backups expire, within 90 days. We may keep data the law requires us to keep, protected under this schedule.

12.3 Data held in your own systems (such as your HubSpot portal) stays under your control and is not deleted by us.

12.4 This schedule continues for as long as we hold any Protected Data.

Annex A: Processing details

Annex B: Technical and organisational security measures

These measures are set out in Cogent's information security policies (IS 01 to IS 26), data protection policy (DP 01), data retention policy (DP 02) and personal data breach policy, available on request.

Annex C: Approved sub-processors

We also use GitHub (US) for source code and Amazon Web Services (EU) for testing and development. Neither holds client personal data: test data is anonymised and randomly generated.

Data Privacy Framework status checked on the Data Privacy Framework List on 26 October 2026.