Data processing position
Draft for solicitor review. This page was drafted by Datum Forge from its own record, in plain English, for a solicitor to review before publication. It has not been reviewed by anyone legally qualified and it is not legal advice.
Last updated 19 October 2026.
Not a data processing agreement; the DPA for an engagement is agreed before any processing starts.
The short version
Your finished system keeps your data on your own accounts. Datum Forge does not keep a shared database of client data, does not pass your traffic or your AI calls through its own accounts, and its access is reduced to what care needs, or removed, when the work ends. The one exception is the prototype in the first move of a build, described below.
Roles
For the ordinary business contact details we exchange (names, work email addresses, the details of the people we talk to), each side is its own controller. Where an engagement requires us to handle personal data on your behalf, for example because the system we are designing or building holds your customers’ records, we act as your processor, on your instructions, under a written data processing agreement signed before that handling starts. The design stage does not normally require it; a build usually does.
Where the data lives
In your finished system: your hosting account, your database, your email sending and your AI provider account, all in your name. We build there, we do not copy it out, and we do not pool it with anyone else’s. Where we need access to your data during the work, to build or to fix something, that access is bounded to the work and is reduced to what care needs, or removed, when the work ends. While you use the prototype in the first move of a build, it runs in Datum Forge’s accounts and your working data sits there for that period, under the engagement’s data processing agreement; it moves to your accounts with the finished system.
AI providers
The finished system runs on your own account with whichever provider it uses. You choose the provider, we configure the system to use it, and the provider’s terms apply to you directly. We do not proxy calls, so nothing of yours passes through a Datum Forge account on the way to the provider. The one exception is the prototype: while it runs in Datum Forge’s accounts it uses our account with the provider, which the data processing agreement names as a sub-processor. The design document names the provider and says what it does with data under its own terms.
Sub-processors
Named per engagement in the data processing agreement. Our own tooling (hosting, email, the tools we use to build) is listed there too, and you can object to a change.
Security, honestly
Datum Forge holds no security certification today: no ISO 27001, no Cyber Essentials. What we do instead is structural: your accounts, not ours; access limited to what the work needs and removed at handover; no pooled data; no shared credentials. If a certification matters to your procurement, say so on the first call and we will tell you where we are with it.
If something goes wrong
We tell you about a personal-data breach affecting your data without undue delay after we become aware of it, with what we know, so you can meet your own obligations.
UK and EU
We work to UK data protection law. If your business has people in the EU in scope, the engagement’s DPA carries EU GDPR terms as well, and we design to the stricter position where the two differ. One difference matters to websites in particular: the UK allows a site’s own usage statistics without consent on conditions we describe in our privacy notice; the EU does not have that exception, so a site with EU visitors is designed and documented differently.
Measurement on a site we build for you
The right to run consent-free statistics on your site is yours, as its provider. We assist only with improving that site. We do not pool, benchmark or reuse your site’s measurement data across clients, and the notice and the objection control live on your domain, in your name.