Capitan Systems Limited
Best viewed on a device with a larger screen...
Version 2.0 — November 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between Capitan Systems Limited (“Capitan”, “we”, “us”, the “Processor”) and the customer identified in the accepted order or Service Schedule (“you”, the “Controller”).
It applies where Capitan processes personal data on your behalf when providing the subscribed services.
Where this DPA conflicts with another provision of the agreement on the processing of personal data, this DPA takes priority.
Data Protection Law means the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection legislation, in each case as amended or replaced. Where applicable to the processing, it also includes the EU General Data Protection Regulation.
Customer Personal Data means personal data processed by Capitan on your behalf in providing the services.
Subprocessor means a provider engaged by Capitan to process Customer Personal Data on your behalf.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
The terms “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in applicable Data Protection Law.
You determine the purposes for which and the essential means by which Customer Personal Data is processed. Capitan processes that information on your behalf to provide the services.
The subject matter, duration, nature and purposes of processing, categories of data subjects and types of personal data are described in the Processing Schedule below, supplemented by your Service Schedule and documented instructions.
Where you act as a processor for another controller, you confirm that you are authorised to appoint Capitan as a subprocessor. References to your instructions include the lawful instructions you are authorised to give on that controller’s behalf.
This DPA does not govern information for which Capitan independently acts as controller, such as its own customer administration, billing and business correspondence. Those activities are explained in our Privacy Notice.
We will process Customer Personal Data only on your documented instructions, including instructions concerning international transfers, unless processing is required by applicable law.
Your instructions include the agreement, the configuration and use of your subscribed services, and authorised requests made through the platform or agreed support channels.
Where law requires processing outside your instructions, we will inform you of that requirement before processing unless the law prohibits us from doing so.
We will inform you immediately if, in our opinion, an instruction infringes applicable Data Protection Law. We may pause the affected processing while the instruction is clarified or corrected.
We will not sell Customer Personal Data or use it for our own marketing or another organisation’s independent marketing.
You are responsible for:
You must not introduce processing that materially changes the agreed risk or service requirements without discussing it with us first.
Processing involving special-category data, criminal-offence data, children’s data or other unusually sensitive information must be identified and expressly agreed before that information is introduced into the services.
We will ensure that people authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality.
Access will be limited to what is necessary to provide, maintain, secure or support the services, or to comply with applicable law.
Authorised personnel must receive appropriate instructions about their data protection and confidentiality responsibilities.
We may access Customer Personal Data when reasonably necessary to investigate faults, provide authorised assistance, maintain the platform or address a security incident, subject to this DPA.
We will implement appropriate technical and organisational measures to protect Customer Personal Data, taking account of the nature, scope, context and purposes of processing, the risks to individuals, the state of the art and the cost of implementation.
As appropriate to the processing and risks, these measures will address:
The applicable measures are described in our Security Statement and any additional arrangements recorded in your Service Schedule.
We may update individual measures as technology and risks change, provided that the overall protection remains appropriate and we continue to meet our contractual and legal obligations.
Customer Personal Data may be included in scheduled backups used to support service recovery and business continuity.
Backup arrangements may include local hosting backups and copies transferred to cloud storage through Plesk’s backup functionality.
The cloud storage provider, relevant processing locations and any associated international transfer arrangements must be identified in the Subprocessor Register before that provider processes Customer Personal Data.
Backup frequency and retention are specified in the applicable backup schedule or Service Schedule. Backups must be protected against unauthorised access and retained only for the documented periods.
Backup copies are used for recovery and related security purposes, not as a separate source for ordinary business processing.
You provide general written authorisation for Capitan to use the subprocessors identified in the Subprocessor Register made available with the agreement.
The register will identify each provider, its processing function, relevant processing locations and any applicable international transfer arrangements.
We will notify you of an intended addition or replacement at least 30 days before the new provider begins processing Customer Personal Data.
You may object during that notice period on reasonable grounds relating to the protection of Customer Personal Data. We will discuss the concern and seek a practical resolution.
If a reasonable objection cannot be resolved and the affected service cannot be provided without the proposed subprocessor, either party may end that affected service by written notice. We will refund prepaid subscription charges for the unused period of that affected service.
Before allowing a subprocessor to process Customer Personal Data, we will put in place a written agreement imposing data protection obligations that provide the protection required by applicable Data Protection Law.
Capitan remains responsible to you for the performance of its subprocessors’ data protection obligations.
We will not make a restricted international transfer of Customer Personal Data unless it is covered by your documented instructions and a lawful transfer mechanism.
Where required, this may include applicable adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another valid safeguard permitted by applicable law.
Where EU data protection law applies, we will also meet the corresponding EU transfer requirements.
We will carry out any assessment and implement any additional measures required for the applicable transfer.
UK production hosting does not, by itself, establish the location of every support, backup or other processing activity. Relevant locations and safeguards must be recorded accurately.
Taking account of the nature of processing, we will assist you through appropriate technical and organisational measures, insofar as possible, to fulfil your obligations when individuals exercise their rights.
If we receive a request relating to Customer Personal Data, we will inform you promptly and will not respond on your behalf unless instructed or required by law.
We will not delete, disclose or materially alter Customer Personal Data in response to a request without appropriate authority, except where required by law.
Where assistance requires substantial additional work beyond the subscribed service, we may agree a reasonable charge in advance. A dispute about charges will not justify withholding assistance that we are legally required to provide.
We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. We will not wait for a complete investigation before providing an initial notification.
As information becomes available, we will provide:
We may supply information in stages and will correct or supplement it as the investigation develops.
We will take appropriate steps to contain and address the breach and provide reasonable assistance with your assessment, regulatory reporting and communication obligations.
You remain responsible for notifications required of you as controller. We remain responsible for any obligations that apply directly to us.
Taking account of the nature of processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and consultation with supervisory authorities where required.
We will make available information necessary to demonstrate compliance with our obligations under this DPA and applicable processor requirements.
We will allow and contribute to audits and inspections conducted by you or an auditor authorised by you.
Where appropriate, we may first provide relevant documentation, assurance information or existing reports. This does not prevent further inspection where reasonably necessary to establish compliance.
Audits should normally be arranged on reasonable notice during business hours, protect confidential information and avoid unnecessary disruption or access to other customers’ data. These arrangements must not obstruct a lawful audit or urgent regulatory requirement.
At the end of services involving Customer Personal Data, we will, at your choice, return that personal data to you or delete it, and delete existing copies unless applicable law requires their retention.
We will agree practical export and deletion instructions before the service ends where possible. We will not treat failure to make a request within a short administrative deadline as removing your rights under this clause.
Returned data will be provided in an agreed, reasonably usable format. Bespoke migration work, transformations or assistance with another platform may be separately quoted.
Where immediate removal from backup media is not reasonably practicable, the remaining data must be put beyond ordinary use, remain protected under this DPA and be deleted through the documented backup-retention cycle.
If a backup is restored before that deletion is complete, we will reapply relevant deletion instructions before returning the restored data to ordinary use.
Any legally required retention will be limited to the information, purpose and period required by that law.
On reasonable request, we will confirm completion of the agreed return or deletion process.
The liability provisions in the main agreement apply between the parties to the extent permitted by applicable law.
Nothing in this DPA limits the rights of individuals, the powers of a supervisory authority or any responsibility that cannot lawfully be excluded or limited.
This DPA applies while Capitan processes Customer Personal Data on your behalf, including any period of authorised retention following the end of the subscription.
Changes must follow the variation process applicable to the agreement. We will cooperate in making changes reasonably necessary to comply with applicable Data Protection Law.
The DPA is governed by the law of England and Wales, subject to any mandatory requirements of applicable Data Protection Law.
Hosting and operation of the customer’s subscribed Capitan website, business tools and associated support and recovery services.
For the duration of the subscribed processing services and any subsequent period necessary to complete the return, deletion or legally required retention of Customer Personal Data.
Receiving, recording, organising, storing, retrieving, displaying, updating, transmitting, exporting and deleting personal data as instructed through the subscribed services.
Processing may support customer management, enquiries, communications, quotations, invoicing, orders, payments, subscriptions, memberships, authorised access and customer or staff portals.
It also includes authorised technical support, fault investigation, security measures, backup and restoration where necessary to provide the agreed services.
This schedule does not authorise storage of complete payment-card credentials or unrestricted processing of sensitive information. Any additional or high-risk categories must be separately identified and expressly agreed.
The Subprocessor Register identifies the operational providers authorised to process Customer Personal Data, including the selected cloud backup storage provider.
The Service Schedule and applicable retention schedule specify the backup frequency, retention periods and any additional customer-specific processing arrangements.
These records must be provided with the agreement and kept consistent with the services actually supplied.
The following provider supports the standard Capitan hosting service. This information forms part of the subprocessor arrangements described in this agreement.
Provider: CompuWeb Communications Services Limited, trading as CWCS Managed Hosting.
Services: Hosting infrastructure, server management, infrastructure technical support and outbound platform email delivery. Capitan does not provide incoming email or mailbox hosting.
Hosting location: United Kingdom.
Processing: Storage of customer website files, databases and related service information; processing of recipient addresses, message content and delivery records for outbound platform email; and authorised infrastructure maintenance, troubleshooting and recovery activities.
Changes to providers processing customer personal data are subject to the notification and objection arrangements in this Data Processing Agreement.
bespoke website build, Capitan, CRM, e-marketing, e-billing, analytics, website, London, Kensington, Bayswater