Data Processing

Our role

For data collected through this website, we act as a data controller — see our privacy policy.

During a client engagement, we usually act as a data processor. Your customer records, form submissions, order history and analytics remain yours; we handle them only to the extent required to build, migrate, test or maintain the system you have engaged us to work on, and only on your instructions.

What we access

Development work routinely requires access to production or near-production systems. Depending on the engagement this can include:

• CMS and hosting administrator accounts
• Database exports used for migration or testing
• CRM and marketing platform records
• E-commerce order and customer data
• Analytics and advertising platform accounts

How we handle it

• Least privilege. We request the narrowest access that lets us do the work, and prefer scoped or temporary accounts over shared administrator credentials.
• Credential hygiene. Credentials are stored in an encrypted password manager, never in email, chat or plain-text files.
• Anonymised test data. Where a realistic dataset is needed for testing, we anonymise or synthesise it rather than copying live personal data into a development environment.
• Access revocation. At the end of an engagement we ask you to revoke our access, and we delete local copies of any exports within 30 days of final handover.
• No secondary use. We never use client data for our own analysis, marketing, model training or any purpose other than delivering the engagement.

Sub-processors

We may use the following providers in the course of delivering work. Which ones apply depends on your project.

• HighLevel Inc. — CRM, forms, scheduling and messaging (United States).
• Google LLC — tag management, analytics and workspace (United States).
• Vercel Inc. / Amazon Web Services — application hosting and preview environments.
• GitHub, Inc. — source control and code review.
• Shopify Inc. — where the engagement involves a Shopify store.

We will tell you before adding a sub-processor that will handle your data as part of an active engagement.

International transfers

Several sub-processors are based in the United States. Where you are subject to UK or EU data protection law and your engagement involves personal data, we will sign a data processing agreement incorporating the appropriate transfer mechanism before that data is shared.

Breach notification

If we become aware of a security incident affecting your data while it is in our care, we will notify you without undue delay and in any case within 72 hours, with what we know about the scope, cause and remediation.

Requesting a DPA

If your organisation requires a signed data processing agreement before work begins, email hello@netdeveloper.org and we will put one in place. We can also work to your own DPA template.