Data Processing Agreement

This version applies when supplied with and accepted as part of the Terms and Conditions. Publication alone does not replace an existing separately agreed DPA.

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between Built With Plot Limited, trading as Plot ("Plot"), and the Customer, and applies whenever Plot processes personal data on the Customer's behalf through the Services. Capitalised terms not defined here have the meaning given in the Terms and Conditions. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR, each as amended.

1. Roles and scope

1.1 For personal data that the Customer collects or handles through its Customer Site and the Services (such as fan sign-ups, form submissions, favourites, contact capture, audience records and data synced from connected ticketing or marketing platforms), the Customer is the controller and Plot is the processor. This DPA governs that processing.

1.2 For personal data relating to the Customer's own account, users, billing and support, Plot is the controller and the Privacy Policy applies instead.

1.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2. Customer obligations

2.1 The Customer determines the purposes and means of the processing and is responsible for: giving lawful, documented instructions; deciding which information to collect and which integrations to enable; publishing an accurate privacy notice on its Customer Site; obtaining any consents or other lawful basis required; and responding to data subjects who contact it.

2.2 The Customer warrants that it has the right to transfer the personal data to Plot for processing under this DPA.

2.3 The Customer shall not use the Services to process special category data, criminal offence data or children's data without a separate written agreement with Plot.

3. Plot's obligations

3.1 Plot shall:

(a) process the personal data only on the Customer's documented instructions, which include the Terms and Conditions, this DPA and the Customer's use of the Services' settings and features, unless required to do otherwise by law, in which case Plot will tell the Customer before processing unless the law prevents it;

(b) tell the Customer without delay if, in Plot's opinion, an instruction infringes Data Protection Law;

(c) ensure that people authorised to process the personal data are bound by confidentiality obligations;

(d) implement the technical and organisational measures set out in Annex 3 and keep them under review;

(e) engage subprocessors only in accordance with clause 4;

(f) taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights;

(g) assist the Customer in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to Plot;

(h) notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s personal data, and provide available information and cooperation as the investigation progresses;

(i) on the ending of the Services, delete or return the personal data as set out in clause 6; and

(j) make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits as set out in clause 7.

4. Subprocessors

4.1 The Customer gives Plot general authorisation to engage the subprocessors listed in Annex 2, and to engage further subprocessors in accordance with this clause.

4.2 Plot will notify the Customer by email of intended additions or replacements of subprocessors before they begin processing the Customer's personal data, providing information about their function, location and applicable safeguards and a reasonable opportunity to object on data protection grounds. Plot will give at least 30 days' notice where reasonably practicable. Where an existing supplier gives Plot a shorter notice period, Plot will pass the notice on promptly and explain the available objection period; this does not remove the Customer's opportunity to object before the change takes effect. Plot will consider timely objections in good faith and seek a reasonable alternative. If no reasonable alternative resolves the objection, the Customer may terminate the affected Subscription without penalty for the remaining term and receive a refund of prepaid fees for the period after termination. Plot will not use the change to bypass the Customer's authorisation or applicable data protection requirements.

4.3 Plot will impose on each subprocessor data protection obligations materially equivalent to those in this DPA and remains responsible to the Customer for the subprocessor's performance.

5. International transfers

5.1 Plot may transfer personal data outside the UK only where a lawful transfer mechanism is in place: the UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required. Plot will document the mechanism applicable to each restricted transfer and make relevant information available to the Customer on request. Listing a supplier in Annex 2 does not itself establish a lawful transfer mechanism.

5.2 Where the EU GDPR applies, the parties must identify and document the appropriate transfer mechanism for the actual transfer. Any required transfer instrument must be completed for the applicable parties, roles and transfer before it is relied upon; this DPA does not automatically execute an unspecified SCC module.

6. Return and deletion

On ending the Services, Plot shall, at the Customer's choice, return or delete the personal data processed on its behalf and delete existing copies unless applicable law requires retention. The archive periods below are the default instructions for continuity and export; they do not override a lawful instruction to delete sooner. Recovery copies awaiting expiry must be put beyond ordinary use, remain protected, and be deleted as soon as practicable under the applicable deletion cycle. Restoring a backup must not reinstate data contrary to an outstanding deletion instruction.

6.1 During the Subscription Term, the Customer may request a copy of personal data processed on its behalf, or instruct Plot to delete that data, by contacting support in writing. Plot handles these requests manually. The Services do not provide a self-service site export or a downloadable website package for hosting elsewhere. This does not limit the Customer's return or deletion rights under this DPA.

6.2 On cancellation or non-renewal, the standard site archive period is 90 days after the paid period ends. During that period the Customer may request a copy of personal data or discuss reactivation. The subsequent deletion process includes the recovery-copy arrangements in clause 6.4; the archive period is not a guarantee that every copy has been erased at its end.

6.3 For termination under clause 13.2 or 8.7 of the Terms, the Customer may request a copy within 30 days after termination. The return and deletion arrangements, including the treatment of recovery copies, must be applied consistently with documented instructions and legal obligations.

6.4 Automated database backups use a 35-day retention window. Previous media-file versions have 180-day expiry rules. Tenant backup packages have separate 90-day lifecycle rules for current and previous versions; these are not a single maximum period after deletion. Manual database snapshots are retained separately for recovery and require explicit review and deletion. These periods do not mean every copy is erased within 35 days. Retained recovery copies are access-restricted; any recovery must respect previously received deletion instructions. Plot may retain personal data where required by law, only for as long as required.

6.5 Routine activity cleanup within the Services does not delete fan profiles, contact details, stored consent or custom fields solely because a profile has not been updated. The Customer must define and periodically review the retention criteria for those records and instruct deletion when retention is no longer justified. Browsing activity, favourites activity and form submissions have their own retention settings, so keeping a fan profile does not preserve every underlying activity record. Where a data subject withdraws marketing consent, the Customer must respect it, and any continued retention of consent evidence or suppression information requires its own purpose and lawful basis.

7. Audits

7.1 Plot will respond to reasonable written requests for information about its compliance with this DPA, including completing a reasonable security questionnaire, no more than once in any 12-month period unless required by a regulator or following a personal data breach.

7.2 Where written information is not sufficient to demonstrate compliance, the Customer (or an independent auditor bound by confidentiality) may audit Plot's relevant processing on at least 30 days' written notice, during Business Hours, no more than once in any 12-month period, in a way that does not disrupt Plot's business or compromise other customers' data. The Customer bears the reasonable costs of an ordinary audit. The frequency, notice and cost arrangements in clauses 7.1 and 7.2 do not restrict information, audits or inspections required by Data Protection Law or a competent supervisory authority, or prevent a necessary investigation following a personal data breach.

8. Liability

8.1 Each party's liability under this DPA is subject to the exclusions and the cap in clause 12 of the Terms and Conditions, except that nothing limits either party's liability to data subjects or regulators under Data Protection Law.

9. General

9.1 If there is a conflict between this DPA and the Terms and Conditions on a matter of data protection, this DPA prevails. On any other matter, the Terms and Conditions prevail.

9.2 This DPA is governed by the law of England and Wales. Nothing in it removes either party's direct obligations under Data Protection Law.

Annex 1: Details of processing

Subject matter: hosting and operating the Customer's website on Plot, including forms, audience tools, favourites, contact capture and authorised integrations, and providing support.

Duration: the Subscription Term, plus the archive and deletion periods in clause 6.

Nature and purpose: collecting, storing, organising, displaying, transmitting, syncing to and from connected services, exporting and deleting personal data as needed to run the features the Customer has enabled, and to provide support.

Categories of data subjects: the Customer's staff and authorised users; website visitors; fans, subscribers and ticket buyers; event participants, artists, performers, speakers and vendors; and other contacts whose details the Customer supplies or collects.

Types of personal data: names, email addresses, phone numbers, submitted form content, preferences and favourites, marketing consent records, custom fields the Customer defines, interaction and browsing records on the Customer Site, and technical identifiers such as IP address and device information.

Special category data: none. The Services are not designed for it and clause 2.3 applies.

Annex 2: Suppliers and subprocessors

This register distinguishes subprocessors handling customer-controlled data from suppliers handling Plot’s own account and billing administration. The safeguards in clauses 4 and 5 apply to processing under this DPA.

Amazon Web Services EMEA SARL: customer-site hosting, database storage, media and backups; core production infrastructure is in US East (Northern Virginia). CloudFront provides global content delivery.

BunnyWay, informacijske storitve d.o.o. (Bunny CDN), Slovenia: media delivery for selected customer sites. Global delivery regions are enabled. Plot accepted DPA version 2 on 26 October 2026; Bunny confirmed on 27 October 2026 that its existing DPA covers Plot acting as processor for its customers and Bunny acting as Plot’s subprocessor.

OpenAI: AI-assisted generation from supplied inputs where the feature is used; processing is governed by the applicable API services agreement and incorporated DPA, including its UK transfer provisions. No UK/EU-only residency or Zero Data Retention commitment is made.

AC PM LLC (Postmark): service-email delivery, including message content, recipient details and delivery events; the role depends on whose personal data the message contains. Published service documentation describes US processing. The applicable new-customer DPA is incorporated through the service terms; it provides international-transfer provisions. Account retention settings are distinct from that contractual coverage.

Intercom: support and automated assistance. Plot acts as controller for its own customer-account support; customer-controlled data shared during support must be assessed under the processing agreement. The workspace is hosted in the United States. The standard processing agreement includes Standard Contractual Clauses and a UK Addendum for applicable transfers.

Stripe handles Plot subscription billing, invoicing and accounting records. Cal.com and connected Google Calendar/Meet services handle customer design-call scheduling where used. These are not automatically customer-audience subprocessors merely because they are Plot suppliers.

Customer-selected ticketing, CRM and marketing services depend on the customer’s integrations and agreements. These customer-selected relationships are separate from suppliers engaged by Plot.

Annex 3: Technical and organisational measures

Access control: named accounts, role-based permissions and hashed passwords. Plot administrator accounts require multi-factor authentication. Administrative access is restricted; this does not claim that every customer account or third-party service has mandatory MFA.

Encryption: HTTPS for public connections, encryption at rest for the production RDS database and primary S3 file-storage bucket. Other stores and internal connections must be assessed separately before making a universal encryption claim.

Network and application security: AWS web application firewall and edge protection, tenant-scoped access controls, and dependency maintenance processes. Third-party account separation is reviewed separately; this is not a claim that every service uses separate production and development accounts.

Backups and recovery: automated database backups retained for 35 days, with other recovery-copy arrangements described in clause 6.4. A database and media restore exercise was completed on 15 October 2026. This was not a complete application failover test and does not establish a recurring test frequency or guaranteed recovery time.

Monitoring and logging: application and infrastructure monitoring with alerting. Most production CloudWatch application and access logs retain 30 days; some operational logs retain 14 days. Some database and monitoring groups have no automatic expiry and require review.

Incident response: Michael Watson is the contact for privacy requests and incidents at support@builtwithplot.com. Plot must identify and contain incidents, preserve relevant evidence and notify the Customer under clause 3.1(h). This does not promise a staffed 24-hour incident desk or a fixed recovery time.

Confidentiality: access must be limited to authorised staff and contractors bound by confidentiality obligations. Plot must ensure that authorised personnel understand the data protection and security duties relevant to their access; this does not assert completion of a particular certification programme.

Data minimisation: Plot staff access Customer Sites and audience data only to provide support or design services the Customer has requested, and only for as long as needed.

Subprocessor management: written agreements with each subprocessor containing data protection obligations and security requirements.

Contact Plot

For questions about this page, contact support@builtwithplot.com.

Built With Plot Limited
12 Hilton Street, Manchester, England, M1 1JF
Registered in England and Wales. Company number 14313779.