Data Processing Agreement (DPA)

Version 1.0 · Published 15 October 2026 · Next review October 2027 · Changelog

This Data Processing Agreement (the DPA) sets the terms on which we, Dacros, process personal data on your behalf when we support or administer your business's systems: under a monthly plan, a project, or a one-off remote session. It is the UK GDPR Article 28 contract between you as controller and us as processor. It applies to every engagement from the moment it starts, alongside your written Order, our plan terms and our privacy notice. The sub-processors it refers to are listed at /sub-processors.

1. Parties and roles

The processor is TicketWave HQ Ltd, trading as Dacros, registered in England and Wales under company number 17143167, registered office Radley House, Richardshaw Road, Pudsey, LS28 6LE. Contact for anything under this DPA: hello@dacros.com.

The controller is you, the business named on the Order. The personal data in your mailboxes, files, devices and systems is yours, and you decide why and how it is used. We act on your instructions. Where you are a regulated business (a clinic, a firm of solicitors or accountants, a school, a care provider), you remain the controller and your regulatory duties stay with you; this DPA helps you meet them, it does not take them over.

For a small amount of data we are the controller rather than your processor: our own record of the engagement (your contact details, quotes, invoices, and the note we keep of each session) and the connection records of our remote-support relay. The privacy notice covers those.

2. Subject matter, duration, nature and purpose

Subject matter: personal data held in the systems we support or administer for you, and anything we see, move or copy while doing that work.

Duration: for as long as the engagement runs, plus the return and deletion periods in section 12.

Nature and purpose: the work listed in your Order, which may include:

helpdesk and remote support for your staff;
device setup, monitoring and patching;
administration of your Microsoft 365 or Google Workspace tenant: licences, mailboxes, sharing permissions, security settings and the audit log;
business email: mailboxes on your domain, migration from a previous provider, and the DNS records (SPF, DKIM and DMARC) that protect your sending;
backups of the systems named in your Order, and the restore tests that prove them;
joiners and leavers: accounts created, access granted, and access removed;
security reviews, Cyber Essentials readiness, incident response planning, and UK GDPR and DPIA support;
network, telecoms and cabling projects, where the systems involved hold personal data;
attended remote sessions through our own relay.

3. Data subjects and categories of data

Whose data: your staff and contractors; your customers, suppliers and contacts; and anyone else who appears in your mailboxes, files, calendars, tickets, phone system or devices.

What data: names and contact details; account and sign-in identifiers; device names, identifiers and inventories; the content of mailboxes, files and messages to the extent a task requires sight of it; helpdesk requests and their attachments; call records, where we administer your phone system; and anything else your business keeps in the systems in scope.

Special-category data (UK GDPR Article 9: health, religion, trade union membership, sexual orientation, and data about criminal offences): we do not ask for it and no service we offer is designed around it. It will be present incidentally in a business's mailboxes and files (an HR matter, a sick note, a solicitor's letter), and that is covered by the confidentiality, no-copying and incident terms in this DPA. Where a service would involve special-category data by design, for example administering a system whose purpose is to hold patient, pupil or case records, we take on that processing only after a data protection impact assessment has been completed, yours or one we help you write, and its measures are written into your Order.

4. Your tenant, our access

Your Microsoft 365 or Google Workspace tenant is yours: your contract with Microsoft or Google, your licences, your data. Microsoft or Google is your processor under that contract, not a sub-processor of ours. We do not supply licences; if that ever changes we will say so in your Order and on the sub-processor list, because it changes the chain of responsibility.

We administer the tenant on these terms:

Named accounts. Each person at Dacros who works in your tenant uses an account in their own name. We do not share accounts or passwords.
Least privilege. We use the most limited role the task allows (for example a helpdesk, Exchange or device-management role rather than Global Administrator or Super Admin). The global role is used only for the tasks that need it.
Multi-factor authentication on every account of ours, phishing-resistant where the platform supports it.
Audit logging. The tenant's audit log is switched on and retained for the longest period your edition allows, so that what we did, and when, can be checked by you or your auditor.
A break-glass account held by you. An emergency administrator account whose credentials you keep, not us, so you are never locked out of your own tenant and never dependent on us to get back in.
No access to content except on instruction. We do not open mailboxes, read files or search messages except on your documented instruction, or where a fault you have reported cannot be fixed without it, and then only to the extent the fix needs.
Nothing copied out. No data leaves your tenant except a backup you have asked us to run or an export you have instructed, to a destination you have approved.
Access removed on exit. Our accounts, any application we registered and any delegated administration relationship are removed when the engagement ends (section 12).

Where the tenant's data sits. A Microsoft 365 tenant keeps its core customer data at rest in the geography it was created in (the United Kingdom, for a tenant created here). Google Workspace lets an organisation choose a data region for data at rest on some editions and not on others. We record your tenant's region in the documentation we keep for you. Both companies are US-incorporated, and their support and some services operate globally under the transfer terms in your contract with them.

5. Our obligations as your processor

We will:

process personal data only on your documented instructions: this DPA, your Order, the plan terms, and any reasonable written instruction from you. If we think an instruction would break data protection law, we will tell you before acting on it;
make sure everyone who works on your systems is bound by confidentiality, in their contract with us;
apply the security measures in section 6;
engage sub-processors only as section 7 allows;
help you respond to requests from individuals about their data (section 11);
help you meet your own duties on security, breach notification and impact assessments (sections 10 and 11);
tell you about any personal data breach affecting your data within the time in section 10;
at the end of the engagement, return or delete the personal data we hold for you, as you choose (section 12);
give you the information you need to show that these terms are met, and allow audits (section 13).

6. Security measures

These are the measures we apply, stated as they run. They are commitments, and you can hold us to them.

Our own systems. This website is served over TLS with HSTS and a content security policy. Enquiries are delivered by Scaleway and held in our Proton Mail mailbox. Our business system (quotes, invoices and client records) runs on our own server at OVHcloud in Gravelines, France, reachable only over TLS, with two-factor sign-in for every user and encrypted backups held off-site at Scaleway in Paris.
Our devices. The computers we work from are full-disk encrypted, kept current with security updates, and locked when unattended.
Credentials. Any credential we hold for you is kept in an encrypted password manager behind multi-factor authentication, never in email, chat or documents.
Working in your systems. Named accounts, least privilege, multi-factor authentication and audit logging, as section 4 sets out.
Remote sessions. Attended only: the person at the computer gives us a one-time code, watches throughout and can end the session at any moment. Sessions run through our own relay on OVHcloud and are encrypted end to end, so the relay cannot read them. Nothing is recorded, files are moved only at your request, and nothing stays installed unless you ask for it.
Backups we run for you. Encrypted in transit and at rest, kept in a location named on the sub-processor list, and restore-tested as the plan terms describe.
Monitoring. Of devices and software, never of people (section 8).
People. Everyone who works on your systems is briefed on UK GDPR, phishing and how to report a breach, and is bound by confidentiality.

We do not yet hold Cyber Essentials certification, and we claim no certification we do not hold; our credentials page says what is held and what is not.

7. Sub-processors

You authorise us to use the sub-processors listed at /sub-processors, which is the canonical list and the one this section refers to. In summary: Vercel (this website), Scaleway (email delivery and encrypted backups), Proton (our mailbox, and the quotes and invoices we send), Cloudflare (DNS and security for this website) and OVHcloud (the hardware for our remote-support relay, our analytics server and our business system). The tools we use to run managed IT plans (monitoring and patching, helpdesk, backup, documentation and telephony) are named on that page before any of them handles your data, with their residency and transfer safeguard.

Before we add a sub-processor that will process your data, we will give you at least 30 days' written notice by email to the address on your Order. You may object on reasonable data protection grounds within that period; if we cannot meet your objection, you may end the engagement, and we refund any fee paid for the period after it ends.

Where we use a subcontractor for part of a project (a cabling or network installer, for example), we tell you first and remain fully responsible for their work. Subcontractors are given site contact details and nothing more.

8. Monitoring is of devices, not people

The monitoring and patching that come with a plan report the state of a device: what software it runs, whether it is up to date, whether its protection is on, whether it is healthy. They do not report what the person using it is doing. We do not provide staff surveillance of any kind: no keystroke, screen, location or productivity monitoring, and no reading of mailboxes to check on staff. We will decline an instruction to use our access for that purpose. During a remote session the person at the computer watches throughout, and we never use a session to watch staff.

Your staff need to know that their work devices are managed and monitored, and what that means. That notice is yours to give, as controller and employer; we can provide plain-English wording for you to adapt.

9. International transfers

By default your data stays in the United Kingdom or the European Economic Area. The exceptions are named, so you can see them:

Microsoft and Google, as your own processors, under your contract with them and their standard transfer terms (section 4).
Vercel (this website) and Cloudflare (DNS and security for it) are US-incorporated; the site is served from London and Cloudflare's network is global. Both are covered by a data processing agreement with the UK Addendum to the EU standard contractual clauses.
Proton is in Switzerland, which the UK recognises under adequacy regulations, so no further safeguard is needed.
WhatsApp (Meta), only if you choose to message us through it, under its own terms.

For the tools that run managed IT plans, we choose UK or EU residency where a suitable tool offers it, and we state the residency and the transfer safeguard on the sub-processor list before the tool handles your data.

10. Personal data breaches

If we become aware of a personal data breach affecting your data, whether in our systems or in yours, we will tell you without undue delay and in any event within 24 hours of becoming aware, so that you have time to meet your own 72-hour deadline to the Information Commissioner's Office. The first notice carries what we know: what happened, the systems and the categories and approximate number of people and records affected, the likely consequences, and what we have done or propose to do. We keep you updated as we learn more, help you decide whether the ICO and the people affected need to be told, help you with that if they do, and keep a record of the breach and what was done about it.

11. Assistance

Requests from individuals. If someone asks us directly for access to, correction or deletion of their data, we pass the request to you promptly and do not answer it ourselves: you, as controller, respond. We give you the technical help the request needs (searches, exports, deletion) as part of your plan.
Impact assessments and the ICO. We help you with a data protection impact assessment that involves the systems we run, and with any consultation with the ICO that follows from it.
Evidence for others. We give you the information you need for Cyber Essentials, for your insurer's questions and for your customers' supplier questionnaires, as far as it concerns the systems we run.

12. Return, deletion and exit

When the engagement ends, on the end date set under the plan terms or your Order:

On the end date, our administrative access is removed: our accounts, any application we registered and any delegated administration relationship. We recommend that you, or your next provider, change every credential we have held.
Within 10 working days of the end date, we hand over the documentation we keep for you and every credential we hold, and we return the data we hold on your behalf (backup copies, exports) in a usable format, or delete it, as you instruct.
Within 30 days of the end date, any copy of your data still in our systems or in a tool we use is deleted, unless you have asked us in writing to keep it longer for a stated reason, and we confirm the deletion to you in writing.
We keep our own record of the engagement (quotes, invoices and the note of each session) for six years after it ends, for accounting and in case of a dispute. We hold that as controller, not as your processor, and it contains no copy of your business's data.

13. Audits

We will give you the information you need to show that this DPA is being met. Once in any 12 months, on at least 30 days' written notice, you may audit our compliance through a written questionnaire, which we complete within 30 days of receiving it. More often than that only after a breach affecting your data, or at the request of your regulator or insurer, who may receive the same information through you. An on-site audit is available by arrangement, at cost for our time.

14. Liability and precedence

Each party's liability under this DPA is subject to the liability terms in your Order and in our terms of business. If this DPA and any other document between us conflict on a data protection matter, this DPA prevails on that matter.

15. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

16. How this DPA applies, and how to get a signed copy

This DPA applies by engagement: by starting or continuing a plan, a project or a remote session with Dacros, you accept it. For a one-off remote session the price and these terms are confirmed by email or message before we connect. If your organisation needs a signed copy, email hello@dacros.com and we will sign and return a PDF. We can also work from your own DPA by negotiation, which is usual for larger organisations with their own procurement terms.

17. Related documents

Sub-processors (the canonical list for section 7) · Plan terms · Privacy notice · Website terms of use

18. Changelog

Version 1.0, 15 October 2026. First publication. The Article 28 terms for remote sessions, published in the website terms on 10 October 2026, now live here (sections 2, 6, 7 and 8); the terms page keeps a summary and points to this document.