GDPR Compliance

Digizonics is committed to the highest standards of data protection under UK GDPR and the Data Protection Act 2018. This page summarises how we comply and how we help our clients comply.

1. Roles

For our website and marketing activities we act as data controller. When processing client data through our products and custom builds, we act as a data processor on behalf of the client (the controller).

2. Data Processing Agreement

Every client contract includes a UK GDPR-compliant Data Processing Agreement (DPA) covering purpose, duration, types of data, security measures, sub-processors and assistance with data subject requests.

3. Security Controls

• UK-hosted infrastructure with encryption at rest (AES-256) and in transit (TLS 1.3).
• Role-based access controls and audit logging.
• Quarterly penetration tests and continuous vulnerability scanning.
• Documented incident response with 72-hour breach notification commitment.

4. Sub-processors

We maintain a current list of sub-processors available on request. All sub-processors are bound by written agreements and located in the UK or EEA.

5. Data Subject Requests

We assist clients in responding to data subject access, rectification, erasure and portability requests within statutory timeframes.

6. International Transfers

Data remains in the UK/EEA by default. Any onward transfer relies on the UK IDTA, Standard Contractual Clauses, or an adequacy decision.

7. Contact our DPO

Email dpo@digizonics.co.uk for DPAs, sub-processor lists, security questionnaires or data subject requests.