Data processing agreement
These are the terms that apply when we process personal data on your behalf while working on your software. They form part of our agreement with you unless you would rather we signed your own data processing agreement, which we are happy to do.
Version dated 16 October 2026. To have a signed copy, email contact@codefirst.co.uk.
1. Parties and scope
1.1 This agreement is between CodeFirst Limited, a company registered in England and Wales with number 08672649, whose registered office is at 11 Brindleyplace, Brunswick Square, Birmingham B1 2LP ("CodeFirst", the processor), and the client named in the order, statement of work or support agreement that refers to it (the "Client", the controller).
1.2 It applies whenever CodeFirst processes personal data on the Client's behalf in providing services under the main agreement between the parties (the "Services"). If this agreement conflicts with the main agreement on the protection of personal data, this agreement takes precedence.
1.3 "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where they apply to the processing, Regulation (EU) 2016/679 (the EU GDPR) and the Swiss Federal Act on Data Protection. Terms such as controller, processor, personal data, personal data breach, data subject and processing have the meanings given to them in Data Protection Law.
2. The processing
2.1 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.
2.2 The Client is responsible for having a lawful basis for the processing and for the instructions it gives.
3. CodeFirst's obligations
CodeFirst will:
- process personal data only on the Client's documented instructions, including on transfers outside the UK, unless the law requires otherwise, in which case it will tell the Client first unless the law forbids that;
- tell the Client immediately if, in its opinion, an instruction breaks Data Protection Law;
- ensure that everyone it authorises to process the personal data is bound by confidentiality;
- take the technical and organisational measures described in Annex 2;
- assist the Client, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights;
- assist the Client in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority;
- at the end of the Services, at the Client's choice, return or delete the personal data within 30 days and delete existing copies, unless the law requires them to be kept, and confirm this in writing on request;
- make available the information needed to show that it meets this agreement, and allow and contribute to audits and inspections under clause 7.
4. Subprocessors
4.1 The Client gives general authorisation for CodeFirst to use the subprocessors listed in Annex 3.
4.2 CodeFirst will tell the Client of any intended addition or replacement of a subprocessor at least 30 days in advance. The Client may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Client may end the affected Services without penalty.
4.3 CodeFirst will put data protection obligations on each subprocessor that are no less protective than those in this agreement, and remains responsible to the Client for the subprocessor's performance of them.
5. Personal data breaches
5.1 CodeFirst will notify the Client within 24 hours after becoming aware of a personal data breach affecting the Client's personal data.
5.2 The notice will describe, as far as is then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at first will be provided as it becomes available.
5.3 CodeFirst will take reasonable steps to contain the breach and will cooperate with the Client's investigation. Notifying the supervisory authority and data subjects remains the Client's decision.
6. International transfers
6.1 CodeFirst will not transfer personal data outside the United Kingdom, or for EU or Swiss data outside the European Economic Area or Switzerland, unless the transfer is covered by an adequacy decision or regulation or by appropriate safeguards under Data Protection Law.
6.2 Where safeguards are needed, the parties rely on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, and for EU data the Standard Contractual Clauses adopted by the European Commission (Module 2 or Module 3 as appropriate), which are incorporated by reference.
7. Audits
7.1 CodeFirst will answer the Client's reasonable written questions about its compliance, including security questionnaires.
7.2 Where the answers are not enough, the Client, or an independent auditor bound by confidentiality, may audit CodeFirst's compliance with this agreement on at least 30 days' written notice, no more than once in any 12 months unless a personal data breach or a regulator requires it, during business hours and at the Client's cost.
8. Duration and liability
8.1 This agreement lasts as long as CodeFirst processes personal data on the Client's behalf, and clauses 3(g) and 7 survive its end for as long as CodeFirst holds any of the Client's personal data.
8.2 Each party's liability under this agreement is subject to the limits in the main agreement, except where Data Protection Law does not allow liability to be limited.
8.3 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses require otherwise.
Annex 1: Details of the processing
| Subject matter | Maintenance, support, development, migration and review of the Client's software systems and their data. |
|---|---|
| Duration | The term of the Services, and afterwards until the personal data has been returned or deleted. |
| Nature of the processing | Access to and storage of data while diagnosing faults, testing, releasing changes, migrating data between systems or platforms, taking and restoring backups, and answering data subject requests on the Client's instruction. |
| Purpose | To provide the Services. |
| Types of personal data | The personal data held in the Client's systems, typically names, contact details, account and login details, records of transactions and use of the system, and any other data the Client's systems hold. Special category data only where the Client's system holds it and the Client has told CodeFirst. |
| Data subjects | The Client's staff, customers, suppliers, members, students, patients or other users whose data the Client's systems hold. |
Annex 2: Security measures
- Named individual accounts with the least access each task needs; access removed at the end of the Services.
- Multi-factor authentication wherever the Client's platform supports it, and on every CodeFirst account that can reach Client systems or data.
- Credentials kept in a password manager or the Client's own secret store, never in source code, documents or email.
- Source code kept in the Client's own repository, with every change recorded against the person who made it.
- Production data not copied to developer machines unless the Client agrees for a specific task; anonymised or generated data used for testing where possible.
- Full-disk encryption and automatic screen lock on every device used for Client work.
- Client data held by CodeFirst stored in the UK or the European Economic Area.
- Tested backups, supported software versions, dependency vulnerability checks and production monitoring for the systems CodeFirst supports, as agreed in the Services.
- Confidentiality obligations on everyone who processes the personal data.
The security page describes these measures in more detail.
Annex 3: Authorised subprocessors
| Provider | What it is used for | Where |
|---|---|---|
| Microsoft (Microsoft 365) | Email, documents and file sharing, including anything a client sends us | UK and EU data centres |
| Microsoft (Azure DevOps) | Source code, work tracking and build pipelines, where the client does not host these itself | EU data centres |
| GitHub | Source code hosting, where the client does not host the code itself | United States |
| Anthropic | AI coding assistant (Claude) used to read, review and change code | United States |
| Amazon Web Services | Encrypted backups of our working files, and the automated code review service | EU (Ireland) and UK regions |
| Sentry | Error monitoring of applications we support, where the client agrees | United States or EU, as the client chooses |
| New Relic | Performance and availability monitoring of applications we support, where the client agrees | United States or EU, as the client chooses |
Hosting and services that the Client chooses and contracts for directly are not CodeFirst's subprocessors.