Data processing addendum
Version 2026-09-25
This Data processing addendum (the "Addendum") forms part of the Terms of Service between Nonstop Branding Limited, a company registered in England and Wales, company number 16634111, registered office 29 Doodstone Nook, Lostock Hall, Preston, England, PR5 5AQ ("Nonstop") and you (the "Customer"). It applies where Nonstop processes personal data on your behalf in the course of providing Designer HQ (the "Services") and the UK GDPR, the EU GDPR or similar law applies to that data.
1. Roles
For the personal data you and your clients enter into the Services ("Customer Data"), you are the controller and Nonstop is the processor. For your own account information, Nonstop is the controller, as described in the Privacy Policy.
2. Subject matter and duration
Nonstop processes Customer Data to provide the Services under the Terms of Service, for as long as you have an account and until the data is deleted under section 11.
3. Nature and purpose
Processing consists of storing, displaying, transmitting, backing up and, where you use a feature that offers it, producing AI drafts from Customer Data, for the purpose of providing the Services to you and the people you give access to.
4. Types of personal data and data subjects
The types of personal data and the categories of data subjects are set out in the Annex.
5. Your obligations
You are responsible for the lawfulness of the Customer Data you enter and of your instructions, for having the rights and permissions needed to share it with Nonstop, and for informing the people it concerns as the law requires.
6. Nonstop's obligations
Nonstop will:
- process Customer Data only on your documented instructions, which are the Terms of Service, this Addendum and your use of the Services' features, unless required to do otherwise by law, in which case we will tell you before processing unless the law prevents it;
- ensure that the people authorised to process Customer Data are bound by confidentiality;
- implement appropriate technical and organisational security measures, described in the Annex;
- not access the content of Customer Data except to provide the Services, to respond to a support request you have made, or as required by law;
- limit administrative access to named people set in our configuration, which cannot be granted from inside the Services, and record every administrative change made to your account;
- not sell Customer Data or use it to train AI models.
7. Sub-processors
You authorise Nonstop to engage the sub-processors listed in section 4 of the Privacy Policy. Nonstop will bind each sub-processor to data protection obligations no less protective than this Addendum and remains responsible for their performance. When we add or replace a sub-processor we update that list and change the version date at the top of the Privacy Policy. Write to hello@designerhq.app to be told by email when it changes. If you object on reasonable data protection grounds and we cannot offer a solution, you may terminate the affected Services and request deletion under section 11.
8. International transfers
Customer Data is hosted in the European Union: the servers and the database are in Frankfurt, Germany. Files are held by Cloudflare, which may store them in more than one region. Where a sub-processor processes Customer Data in the United States or another country outside the United Kingdom or the European Economic Area, Nonstop relies on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, or another transfer mechanism recognised under applicable law.
9. Data subject rights
Taking into account the nature of the processing, Nonstop will assist you in responding to requests from data subjects to exercise their rights. The Services let you edit and delete client records and download files, documents and brand hubs. For anything the Services cannot do, contact hello@designerhq.app. If a data subject contacts Nonstop directly about Customer Data, we will refer them to you.
10. Security incidents
Nonstop will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, provide the information reasonably available to help you meet your own notification obligations, and cooperate with your investigation.
11. Deletion or return
When your account ends, Customer Data remains available for you to download until you request deletion. On your request, Nonstop will delete Customer Data within thirty days. Deleted data persists in our database provider's rolling backups until those backups pass out of their retention window, which is never longer than ninety days, and it is not restored. This does not apply where applicable law requires retention.
12. Audit
On written request, Nonstop will make available the information reasonably necessary to demonstrate compliance with this Addendum and will allow an audit by you or an independent auditor you appoint, at reasonable notice, during business hours, no more than once in any twelve months unless required by a supervisory authority or following a security incident.
13. Liability
Each party's liability under this Addendum is subject to the limitations and exclusions in the Terms of Service.
14. Governing law
This Addendum is governed by the laws of England and Wales. Where the EU GDPR applies to Customer Data, the parties agree that the terms of this Addendum are intended to satisfy Article 28 of that regulation.
Annex: details of processing
Categories of data subjects. Your clients' representatives and employees; other people named in the files, documents and messages you keep in the Services.
Types of personal data. Names, job titles, email addresses, phone numbers and company details; the content of workshop answers, strategy documents, brand hubs, proposals, contracts, invoices, files and messages; the network address, browser and time recorded when a client signs in or signs a contract.
Security measures. Encrypted connections; encryption at rest by hosting providers; separation of each customer's data at the database level; access limited to named administrators set in our configuration, with every administrative change recorded; regular backups by the database provider.
Contact. Nonstop Branding Limited (registered in England and Wales, company number 16634111), 29 Doodstone Nook, Lostock Hall, Preston, England, PR5 5AQ, hello@designerhq.app.