Data Processing Agreement
How we handle your data as a processor
Effective Date: December 2025. This Data Processing Agreement (DPA) forms part of the agreement between Perfect Rebel Ltd (Processor) and you (Controller) for the processing of personal data.
Understanding the Terms
Data Controller
You — the entity that determines the purposes and means of processing personal data through our services.
Data Processor
Perfect Rebel Ltd — we process personal data on your behalf according to your instructions.
Data Subject
An identified or identifiable natural person whose personal data is processed.
Personal Data
Any information relating to a data subject: names, emails, IP addresses, usage data, etc.
Categories of Personal Data
Identity Data
Names, usernames, job titles, company names provided during registration or membership.
Contact Data
Email addresses, phone numbers, business addresses used for communication.
Usage Data
Information about how you use our platform: pages visited, features used, session duration.
Technical Data
IP addresses, browser type, device information, cookies, and similar technologies.
How We Protect Your Data
As your data processor, Perfect Rebel Ltd commits to:
• Process data only on your documented instructions
• Ensure personnel are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Assist with data subject rights requests
• Delete or return data upon termination
• Make available information to demonstrate compliance
Technical & Organisational Measures
Encryption
Data encrypted in transit (TLS 1.2+) and at rest. Secure key management practices.
Access Control
Role-based access, multi-factor authentication, principle of least privilege.
Monitoring
Continuous security monitoring, intrusion detection, audit logging of data access.
Incident Response
Documented breach procedures, 72-hour notification commitment, impact assessments.
Authorised Sub-Processors
Cloud Hosting
Infrastructure providers for secure data storage and application hosting. UK/EU data centres.
Analytics
Google Analytics for usage insights. Data anonymisation and IP masking applied.
Email Services
Transactional email providers for notifications and communications.
Payment Processing
PCI-DSS compliant payment processors. We do not store card details.
Supporting Data Requests
We assist you in responding to data subject requests:
• Access — Provide copies of personal data
• Rectification — Correct inaccurate data
• Erasure — Delete data (right to be forgotten)
• Portability — Export data in machine-readable format
• Restriction — Limit processing in certain circumstances
• Objection — Stop processing for direct marketing
Cross-Border Data Transfers
Adequacy Decisions
We transfer to countries with UK/EU adequacy decisions where possible.
Standard Clauses
UK International Data Transfer Agreement or EU SCCs for other transfers.
Transfer Impact
We conduct transfer impact assessments for high-risk jurisdictions.
Supplementary Measures
Additional safeguards including encryption and access controls.
Contact Us
Perfect Rebel Ltd
Email: dpo@perfectrebel.co.uk
Location: United Kingdom
Upon Termination
At your choice, we will delete or return all personal data and certify destruction, unless retention is required by law.
Governing Law
This DPA is governed by the laws of England and Wales.