GDPR and your data when we work on your system
Most business systems hold personal data: customers, staff, patients, students. When we maintain or develop one, data protection law treats us as your processor. This page explains what that means and what we commit to.
Last reviewed: 16 October 2026. This page is about personal data in the systems we work on for clients. For information about you that we collect through this website, see our privacy policy.
Who is responsible for what
You are the controller of the personal data in your system: you decide why it is held and how it is used, and the lawful basis for holding it is yours. We are your processor: we handle that data only to do the work you have asked for, and only on your documented instructions.
We work under the UK GDPR and the Data Protection Act 2018, and for clients in the European Union and Switzerland under the EU GDPR and Swiss data protection law as they apply to processors. Our standard data processing agreement sets out the terms Article 28 requires. If you have your own, we will review and sign it instead.
What we commit to
- We use your data only for the work you have instructed, never for our own purposes.
- Everyone who can access it is bound by confidentiality.
- We protect it with the measures described on our security page.
- We help you answer requests from data subjects (access, correction, erasure and the rest) by finding, exporting or changing their records in the system, usually as part of normal support.
- We help you with data protection impact assessments and with consultation with a regulator where the work calls for it.
- We tell you about a personal data breach within 24 hours of becoming aware of it, with the information you need to decide whether to notify the regulator and the people affected.
- We tell you if we believe an instruction would break data protection law.
Where the data is
Your system's data normally stays where it already is: on your servers or in your cloud account. We work on it there rather than moving it. On the occasions when we hold a copy ourselves, for example a database backup taken during a takeover, it is stored in the UK or the European Economic Area.
The European Commission recognises the UK as providing adequate protection, so clients in the EU can share data with us without extra transfer arrangements. Where one of our subprocessors handles data outside the UK, the transfer is covered by a UK adequacy regulation (including the UK extension to the EU-US Data Privacy Framework where the provider is certified) or by the International Data Transfer Agreement or Addendum issued by the Information Commissioner.
When the work ends
At the end of an engagement we return any of your data we hold, in a format you can use, and then delete our copies within 30 days, unless the law requires us to keep something. We confirm the deletion in writing on request. Access you gave us should also be removed, and we tell you which accounts to close.
Subprocessors
These are the services that may process your data while we work on your system. Hosting you choose and contract for yourself, such as your own Microsoft Azure or Amazon Web Services account, is not included. We give at least 30 days' notice before adding or replacing one, so that you can object.
| Provider | What it is used for | Where |
|---|---|---|
| Microsoft (Microsoft 365) | Email, documents and file sharing, including anything a client sends us | UK and EU data centres |
| Microsoft (Azure DevOps) | Source code, work tracking and build pipelines, where the client does not host these itself | EU data centres |
| GitHub | Source code hosting, where the client does not host the code itself | United States |
| Anthropic | AI coding assistant (Claude) used to read, review and change code | United States |
| Amazon Web Services | Encrypted backups of our working files, and the automated code review service | EU (Ireland) and UK regions |
| Sentry | Error monitoring of applications we support, where the client agrees | United States or EU, as the client chooses |
| New Relic | Performance and availability monitoring of applications we support, where the client agrees | United States or EU, as the client chooses |
Anthropic (Claude) is used as an AI coding assistant. Material sent to it is processed under commercial terms that do not allow the provider to train its models on the material sent. If you would rather we did not use it on your system, we will not.
Questions
Email contact@codefirst.co.uk with any data protection question, or to ask for a signed copy of our data processing agreement.