Version 1.0 · Effective 1 November 2026
1. Parties and scope
This Data Processing Agreement (“DPA“) is entered into between:
PCQ Solutions Ltd, a company registered in England and Wales under company number
04019429, whose registered office is at Cambrian House, Cambrian Place, Llanidloes, Powys, SY18 6BX (“PCQ“,
“we“, “us“); and
the customer identified in the Order Form or Services Agreement to which this DPA is
attached (“Customer“, “you“).
This DPA forms part of, and is subject to, the Services Agreement between the parties
(the “Agreement“). Where this DPA conflicts with the Agreement on matters of personal
data processing, this DPA prevails.
1.1 Roles
For the purposes of UK data protection law:
- You are the Controller. You determine the purposes and means of processing personal
data within the services. - PCQ is the Processor. We process personal data on your documented instructions.
Where we process personal data about you as a business contact — for billing, account
management, service notifications and our own business records — we act as a Controller in
our own right. That processing is described in our Privacy Notice and is outside the scope
of this DPA.
1.2 Definitions
“UK Data Protection Law” means the UK General Data Protection Regulation, the Data
Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, each
as amended.
“Personal Data“, “Data Subject“, “Processing“, “Controller“, “Processor“,
“Supervisory Authority” and “Personal Data Breach” have the meanings given in UK
Data Protection Law.
“Customer Personal Data” means personal data that PCQ processes on your behalf under
the Agreement, as described in Annex A.
“Subprocessor” means any third party engaged by PCQ to process Customer Personal Data.
2. Processing of Customer Personal Data
2.1 Our instructions
We will process Customer Personal Data only:
a. on your documented instructions, including with regard to transfers outside the UK, unless
required to do otherwise by law — in which case we will inform you of that legal
requirement before processing, unless the law prohibits us from doing so on important
grounds of public interest;
b. as necessary to provide the services described in the Agreement;
c. as described in this DPA and its Annexes.
The Agreement, the Order Form, this DPA and your use of the services through the interfaces
we provide constitute your documented instructions. Any additional instruction must be agreed
in writing, and we may charge for work needed to comply with instructions that fall outside
the agreed services.
2.2 Our obligations
We will:
a. inform you immediately if we consider that an instruction infringes UK Data Protection Law,
although we are not obliged to carry out a legal review of your instructions;
b. ensure that any person authorised to process Customer Personal Data is subject to an
appropriate duty of confidentiality, whether contractual or statutory, and that this duty
survives the end of their engagement;
c. limit access to Customer Personal Data to those personnel who need it to deliver the
services, and only to the extent needed;
d. not sell Customer Personal Data, and not use it for our own purposes, including the
training of machine learning or artificial intelligence models.
2.3 Your obligations
You warrant that:
a. you have a lawful basis for the processing you instruct us to carry out;
b. you have provided any notices and obtained any consents required under UK Data Protection
Law in relation to the Customer Personal Data;
c. the instructions you give us comply with UK Data Protection Law;
d. you will not instruct us to process special category personal data, or personal data
relating to criminal convictions and offences, without telling us in advance so that we
can agree appropriate additional measures.
3. Security
3.1 Technical and organisational measures
We will implement and maintain appropriate technical and organisational measures to protect
Customer Personal Data against accidental or unlawful destruction, loss, alteration,
unauthorised disclosure or access, taking into account the state of the art, the costs of
implementation, the nature, scope, context and purposes of processing, and the risks to
data subjects.
The measures in place at the date of this DPA are set out in Annex C.
We may update these measures from time to time provided the overall level of protection is
not reduced.
3.2 Your responsibilities
You are responsible for:
a. configuring the services appropriately for the sensitivity of your data, including the
access controls, sharing settings and retention policies available to you;
b. the security of credentials issued to you and your personnel, and for promptly notifying
us of any suspected compromise;
c. telling us if your processing requires measures beyond those in Annex C.
3.3 Higher-risk data
Where the services involve special category personal data, personal data relating to criminal
convictions and offences, or the personal data of children, we will agree with you in writing
any additional technical and organisational measures appropriate to that data before the
processing begins, or as soon as reasonably practicable after we become aware of it. Those
measures will be recorded in the Order or in Annex A and form part of Annex C for that
Customer.
4. Subprocessors
4.1 General authorisation
You give us general written authorisation to engage subprocessors to process Customer
Personal Data, subject to this clause 4.
4.2 Current subprocessors
Our current subprocessors are published at https://pc-q.co.uk/subprocessors and listed, as at the
date of this DPA, in Annex B. The published list is the authoritative version.
4.3 Changes
Before engaging a new subprocessor, or replacing an existing one, we will give you at least
thirty (30) days’ notice, by updating the published list and notifying the contact you
have given us for this purpose.
You may object to a new subprocessor on reasonable data protection grounds within that notice
period, by writing to us at dataprotection@pc-q.co.uk. If you do, we will work with you
in good faith to find a resolution — which may include offering an alternative arrangement or,
where that is not reasonably possible, giving you the right to terminate the affected service
without penalty, with a pro-rata refund of fees paid in advance.
Where a change is required urgently to preserve the security or continuity of the services, we
may engage a subprocessor sooner and will notify you as promptly as possible.
4.4 Our responsibility
We will impose on each subprocessor, by written contract, data protection obligations no less
protective than those in this DPA. We remain fully liable to you for the performance of each
subprocessor’s obligations.
5. Assistance to you
5.1 Data subject rights
Taking into account the nature of the processing, we will assist you by appropriate technical
and organisational measures, insofar as is reasonably possible, in fulfilling your obligation
to respond to requests from data subjects exercising their rights under UK Data Protection Law.
We will respond to a request for assistance under this clause within five working days,
or sooner where you tell us the request is urgent or a statutory deadline requires it.
If we receive a request directly from a data subject relating to Customer Personal Data, we
will not respond to it other than to acknowledge receipt and direct them to you. We will
notify you, and pass on the content of the request, within two working days of receiving
it.
5.2 Security, breach notification and assessments
Taking into account the nature of processing and the information available to us, we will
assist you in ensuring compliance with your obligations under Articles 32 to 36 of the UK
GDPR — security of processing, breach notification, data protection impact assessments and
prior consultation.
5.3 Cooperation with the supervisory authority
We will cooperate, on request, with the Information Commissioner’s Office in the performance of
its tasks, as required by Article 31 of the UK GDPR. Where the ICO contacts us about processing
we carry out on your behalf, we will tell you without undue delay unless we are prohibited from
doing so by law.
5.4 Charges
Assistance under this clause is provided at no charge where the request is of a routine nature
and proportionate to the services. Where the assistance required is substantial or repeated, we
may charge at our standard rates, having first told you and given you the opportunity to agree
the scope.
6. Personal data breaches
6.1 Notification
We will notify you without undue delay, and in any event within 48 hours, after becoming
aware of a Personal Data Breach affecting Customer Personal Data.
We are “aware” for this purpose once we have a reasonable degree of certainty that a security
incident has occurred that led to the compromise of Customer Personal Data. We will not delay
notification in order to complete our investigation.
We will also tell you, without undue delay, about a security incident affecting systems holding
your personal data where we suspect but have not yet confirmed that a Personal Data Breach has
occurred, so that you are not learning of it only once it is established.
Our notification will include, to the extent known at the time:
- the nature of the breach, including the categories and approximate number of data subjects
and records concerned; - the likely consequences of the breach;
- the measures taken or proposed to address it, including to mitigate its effects;
- a contact point for further information.
Where we cannot provide all of this at once, we will provide information in phases without
undue further delay.
6.2 Cooperation
We will cooperate with you and take reasonable steps as directed by you to assist in the
investigation, mitigation and remediation of the breach.
We will preserve the logs, records and other evidence relevant to the breach that are within
our control, and will not delete them while the breach remains under investigation by either
party or by a supervisory authority.
6.3 No admission
Our notification of a breach is not and will not be construed as an acknowledgement of fault
or liability.
6.4 Reporting to authorities
You are responsible for determining whether a breach must be reported to the Information
Commissioner’s Office or to affected data subjects, and for making any such report. We will
not report a breach affecting Customer Personal Data to a supervisory authority on your behalf
unless required by law or agreed with you in writing.
6.5 Requests from third parties and law enforcement
If we receive a request from a law enforcement agency, government body or other third party for
disclosure of Customer Personal Data, we will:
a. not disclose it unless we are legally compelled to do so;
b. tell you about the request without undue delay, so that you can seek to challenge it, unless
we are prohibited from telling you by law — in which case we will use reasonable efforts to
obtain a waiver of that prohibition;
c. where we are compelled to disclose, limit the disclosure to the minimum required and tell
you what was disclosed as soon as we are lawfully able to.
We will require the same of our subprocessors.
7. International transfers
We will not transfer Customer Personal Data outside the United Kingdom except:
a. to a country or territory covered by UK adequacy regulations; or
b. under an International Data Transfer Agreement, the International Data Transfer Addendum to
the EU Standard Contractual Clauses, or another transfer mechanism recognised under UK Data
Protection Law.
Where we rely on (b), we will carry out a transfer risk assessment where one is required, and
will make it available to you on request.
Transfers that take place as at the date of this DPA, and the safeguards applying to each, are
identified in Annex B.
8. Audit and information
8.1 Information
We will make available to you the information reasonably necessary to demonstrate compliance
with Article 28 of the UK GDPR. This will ordinarily take the form of:
- this DPA and its Annexes;
- our published subprocessor list;
- our security overview; and
- written responses to reasonable, proportionate questions in a security questionnaire.
8.2 Audits
Where the information in clause 8.1 does not reasonably satisfy you, we will allow for and
contribute to audits, including inspections, conducted by you or an auditor you mandate,
subject to the following:
a. you give us at least 30 days’ written notice, except where an audit follows a Personal
Data Breach, in which case we will agree a reasonable shorter period;
b. audits take place during normal business hours, no more than once in any 12-month period
unless required by a supervisory authority or following a Personal Data Breach;
c. the auditor is not a direct competitor of PCQ in the supply of managed IT services, and
enters into appropriate confidentiality undertakings. We will not withhold agreement to an
auditor unreasonably;
d. the audit does not require us to disclose information relating to other customers, or to
breach any duty of confidence owed to a third party;
e. you bear your own costs, and reimburse our reasonable costs where an audit exceeds one
working day.
Where our infrastructure is operated by a third party, our ability to grant physical access
is limited to what that third party permits, and we will instead provide the assurance
documentation available to us.
9. Deletion and return
9.1 On termination
On termination or expiry of the services, we will, at your election, delete or return all
Customer Personal Data, and delete existing copies, unless we are required by law to retain
it.
You must tell us which you require within 30 days of termination. If you do not, we will
delete the data in accordance with clause 9.2.
9.2 Deletion timescales
Live systems. We will delete Customer Personal Data from live systems within 30 days of
your instruction, or within 60 days of termination where you have given no instruction.
Backups. Personal data held in backup copies cannot be selectively deleted while the backup
set exists. On termination we will delete your backup set in full within 90 days, which
removes the personal data within it. Until that point it remains subject to the security
measures in Annex C and will not be processed for any other purpose.
Where your Order specifies a backup retention period, that period applies during the life of
the service. It does not extend the 90-day deletion period on termination.
Workshop data. Copies taken from a device for repair, transfer or recovery are deleted within 7 days of the device being returned, independently of this clause and whether or not the services have terminated.
Records we must keep. We may retain Customer Personal Data where required by law or for
the establishment, exercise or defence of legal claims. This includes invoices and supporting
records, retained for six years under the Companies Act 2006 and HMRC requirements. Data
retained on this basis is retained only for that purpose.
9.3 Certification
We will confirm deletion to you in writing within ten working days of it being completed,
without you needing to ask.
10. Liability
The liability of each party under this DPA is subject to the limitations and exclusions of
liability set out in the Agreement.
Nothing in this DPA limits or excludes either party’s liability where it cannot lawfully be
limited or excluded, including for death or personal injury caused by negligence, fraud or
fraudulent misrepresentation, or for any liability under UK Data Protection Law that cannot
lawfully be limited.
11. General
11.1 Duration
This DPA takes effect on the date the Agreement takes effect, or on the date of signature if
later, and continues until we have ceased all processing of Customer Personal Data in
accordance with clause 9.
11.2 Changes
We may update this DPA where necessary to reflect a change in law or guidance from a supervisory
authority. Any other change requires your written agreement.
We will give you at least 30 days’ notice of any change that materially reduces your rights or
our obligations. If you do not accept it, you may terminate the affected service without
penalty, and where the change goes to the basis on which we hold your data you may terminate
the Agreement as a whole on the same basis.
11.3 Governing law
This DPA is governed by the law of England and Wales, and the parties submit to the exclusive
jurisdiction of the courts of England and Wales.
11.4 Order of precedence
On matters of personal data processing, this DPA prevails over the Agreement and over any
other document. On all other matters the Agreement prevails over this DPA. Clause 10 is a
matter for the Agreement.
Signature
PCQ Solutions Ltd
Signed: ……………………………………..
Name: ………………………………………..
Position: ……………………………………
Date: …………………………………………
Customer
Signed: ……………………………………..
Name: ………………………………………..
Position: ……………………………………
Organisation: ……………………………..
Date: …………………………………………
Annex A — Details of processing
A.1 Subject matter and duration
Subject matter. The provision of managed IT, connectivity, hosting, communications and
security services as set out in the Agreement.
Duration. For the term of the Agreement, plus the deletion period described in clause 9.2 —
up to 60 days for live systems and 90 days for backup copies. Billing records retained under
the Companies Act 2006, as described in clause 9.2, are held by PCQ as a controller in its own
right and are not processed on the Customer’s behalf.
A.2 Nature and purpose of processing
PCQ processes Customer Personal Data in order to deliver the services the Customer has
purchased. Depending on which services apply, this includes:
| Service | Nature and purpose of processing |
|---|---|
| Microsoft 365 | Administering the Customer’s tenant: creating, amending and removing user accounts; configuring mailboxes, groups and sharing; applying security and compliance settings; licence assignment; mailbox and file migration; responding to support requests. PCQ holds administrative access to the Customer’s tenant. |
| Email hosting | Operating mail services on PCQ infrastructure: mailbox provisioning, message transport, spam and malware filtering, storage and retrieval. |
| Website hosting | Hosting the Customer’s website and associated databases, including any personal data the Customer or its website visitors place there; server administration; backup; performance and security monitoring. |
| DNS and domain services | Operating or managing DNS for the Customer’s domains; domain registration and renewal, which involves registrant contact data. |
| Backup | Backing up Microsoft 365 data and website or server data; storage of backup copies; restoration on request. |
| Endpoint protection and monitoring | Deploying and managing endpoint security agents and remote monitoring software on Customer devices; collecting device, performance and threat telemetry; remote access for support purposes. |
| IT support | Receiving, recording and resolving support requests; remote access to devices and systems, during which the technician can see and control the device and anything displayed on it; on-site attendance; retaining records of work carried out. |
| Connectivity | Placing, amending and ceasing broadband and telephony orders with suppliers; managing line and service records; fault diagnosis. |
| Telephony and VoIP | Provisioning and administering hosted telephony; call routing configuration; access to call records and voicemail held on the platform. |
| Security awareness training | Enrolling Customer personnel on training and simulated phishing; recording completion and results. |
| Compliance tooling | Operating endpoint compliance monitoring in support of Cyber Essentials and similar schemes; collecting device configuration data. |
| Password management | Provisioning and administering password management for Customer personnel. PCQ does not have visibility of vault contents. |
| Workshop repair and data services | Diagnosis, repair and data transfer or recovery on devices brought to PCQ’s premises. Where the work requires it, copying the contents of a device to encrypted storage at PCQ’s premises, and holding credentials supplied by the Customer for the duration of the job. The contents of a device may include any category of personal data the Customer or its personnel have placed on it. |
| Custody of devices | Holding Customer devices at PCQ’s premises before, during and after work, including devices awaiting parts or collection. |
AI assistance. Across the service lines above, PCQ uses an AI assistant to help triage and
draft support records, analyse systems, produce reports and automate routine work. This means
Customer Personal Data held in PCQ’s service desk is processed by the subprocessor identified in
Annex B. The scope and limits of that access are set out in the note to Annex B.
A.3 Types of personal data
The categories of personal data processed depend on the services taken and on what the
Customer places in them. They may include:
- Identity and contact data — names, job titles, business email addresses, business and
mobile telephone numbers, postal addresses. - Account and authentication data — usernames, account identifiers, security group
membership, multi-factor authentication registration details, password reset records.
PCQ does not hold Customer passwords in readable form. - Communications content — the content of emails, attachments, calendar entries, contacts,
files, documents and chat messages held in services PCQ administers or backs up. - Device and technical data — device names, serial numbers, hardware and software
inventory, IP addresses, operating system and patch status, security agent telemetry,
system and access logs. - Support records — the content of support requests, correspondence, notes of work
carried out, screenshots and diagnostic information. - Website data — any personal data contained in the Customer’s website, its database, or
submitted through its forms; web server access logs. - Telephony data — call detail records, voicemail messages, telephone numbers.
- Training records — course enrolment, completion status, simulated phishing results.
- Service and billing data — service addresses, line identifiers, account references.
- Device contents — where a device is brought in for repair, data transfer or recovery, the entire contents of that device or disk, which may include any category of personal data.
- Access credentials supplied for workshop work — device passwords and PINs supplied by the Customer so that PCQ can carry out requested work. These are recorded on paper, held physically with the device, and destroyed on completion. They are not entered into PCQ’s systems.
PCQ does not require special category personal data to deliver the services, but will process
it where the Customer places it in a system PCQ administers or backs up — for example within
mailbox or file content, or in a hosted website database.
For some Customers this is routine rather than incidental. Where the Customer’s activities
involve children, pupils, health, or other special category data as a matter of course, the
parties will record that in the Order or in Annex A.5 and agree any additional measures under
clause 3.3, rather than treating each instance as an exception under clause 2.3(d).
A.4 Categories of data subjects
- The Customer’s employees, officers, contractors and volunteers
- The Customer’s own customers, clients, service users, members or patients
- Children, pupils and students, where the Customer’s activities involve them
- Parents, guardians and carers
- The Customer’s suppliers and business contacts
- Visitors to the Customer’s website
- Any other individual whose personal data the Customer places in a service PCQ provides
A.5 Controller contact for data protection matters
To be completed by the Customer:
Name: ………………………………………..
Role: …………………………………………
Email: ……………………………………….
This is the address to which PCQ will send subprocessor change notifications and breach
notifications.
Annex B — Subprocessors
As at 1 November 2026. The current list is published at https://pc-q.co.uk/subprocessors.
| Subprocessor | Purpose | Entity location | Data location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd | Microsoft 365 services and licensing | Ireland | United Kingdom | UK adequacy (EU) |
| Acronis International GmbH | Microsoft 365 and server backup | Switzerland | UK (London) | UK adequacy (CH) |
| Syncro (Servably, Inc.) | Service desk, ticketing, remote monitoring and management, asset inventory, remote access, patch management and remote script execution on managed devices | United States | United States | UK IDTA / SCCs + Addendum |
| ISL Online (XLAB d.o.o.) | Remote access to Customer devices for support purposes | Slovenia Confirming | European Union Confirming | UK adequacy (EU) Confirming |
| Cloudflare, Inc. | DNS, content delivery and web application firewall for Customer domains | United States | Global edge network | UK IDTA / SCCs + Addendum |
| HostPresto | Provision of the physical server infrastructure on which PCQ hosting services run | United Kingdom | United Kingdom | N/A — UK |
| WebPros International GmbH (Plesk) | Hosting control panel software operating on PCQ infrastructure | Switzerland | United Kingdom | Covered by UK adequacy |
| CloudLinux Inc. (Imunify360) | Server security, web application firewall and malware scanning | United States | Confirming | Confirming |
| Bitdefender | Endpoint protection | Romania | EU | UK adequacy (EU) |
| CyberSmart Ltd | Endpoint compliance monitoring and Cyber Essentials certification support | United Kingdom | United Kingdom | N/A — UK |
| KnowBe4, Inc. | Security awareness training and simulated phishing | United States | Confirming | UK IDTA / SCCs + Addendum |
| Keeper Security, Inc. | Password management supplied to customers | United States | Confirming | UK IDTA / SCCs + Addendum |
| AgileBits Inc. (1Password) | Password management used internally by PCQ, holding credentials for customer systems | Canada Confirming | European Union | UK adequacy (Canada) Confirming |
| Zen Internet Ltd | Broadband and connectivity; hosted telephony and VoIP | United Kingdom | United Kingdom | N/A — UK |
| Swiftnet Ltd (SCG) | Legacy telephony, broadband and hosted VoIP services | United Kingdom | United Kingdom | N/A — UK |
| EE Ltd | Mobile data services | United Kingdom | United Kingdom | N/A — UK |
| Unity World Ltd | Provisioning, billing and support for O2 mobile SIMs and tariffs | United Kingdom | United Kingdom | N/A — UK |
| Telefónica UK Ltd (O2) | Mobile network operator carrying those services | United Kingdom | United Kingdom | N/A — UK |
| Giacom / Cloud Market Ltd | Microsoft 365 licence provisioning | United Kingdom | United Kingdom | N/A — UK |
| Anthropic PBC | AI assistance in service delivery and automation — see note below | United States | United States | UK IDTA / SCCs + Addendum |
Note on Anthropic
PCQ uses Anthropic’s Claude to assist with service delivery, reporting and automation. Its
access is limited to:
- PCQ’s service desk system (Syncro) — which contains Customer contact details, support
request content and device inventory; - PCQ’s accounting system — Customer billing contact details and invoice history, which PCQ
holds as a controller in its own right rather than on the Customer’s behalf; - PCQ’s hosting control panel and server management tools — configuration data, domain and
site settings, and server logs; - PCQ’s DNS management — domain and DNS record configuration;
- PCQ’s own Microsoft 365 tenant — PCQ’s own mail and files.
It does not have access to Customer Microsoft 365 tenants, Customer mailboxes, Customer
files, or password vaults. It has no ability to initiate a remote session to a device, take
control of a device, or execute code on Customer systems.
PCQ does not direct AI assistance at the contents of Customer website databases. PCQ notes for
completeness that hosting control panel access carries the technical ability to reach them, so
this is a restriction of practice rather than one imposed by the access level itself.
Customer Personal Data processed through this route is not used to train Anthropic’s models.
PCQ has model training disabled on the account used to deliver its services.
Annex C — Technical and organisational measures
These are the measures in place as at 1 November 2026. PCQ’s current security overview is published at
https://pc-q.co.uk/security.
C.1 Organisational
- PCQ uses CyberSmart to monitor endpoint compliance on a continuous basis.
- Access to Customer systems is limited to PCQ personnel who require it to deliver the
services. - All PCQ personnel are subject to contractual confidentiality obligations that survive the
end of their engagement. - PCQ personnel complete security awareness training.
- Subprocessors are subject to written contracts imposing data protection obligations no less
protective than those in this DPA.
C.2 Access control
- Administrative access to PCQ systems requires individual named accounts. Shared logins are
not used. - Multi-factor authentication is enforced on PCQ’s Microsoft 365 tenant and on administrative
access to management platforms that support it. - Access is reviewed when personnel join, change role or leave.
C.3 Technical
- Encryption in transit. Services PCQ operates are served over TLS. Mail transport uses
opportunistic TLS. - Endpoint protection. Managed endpoint security software is deployed across PCQ systems
and on Customer devices where the Customer has purchased it. - Server security. PCQ’s hosting infrastructure runs a web application firewall, malware
scanning, intrusion detection and brute-force protection. - Patching. Operating system and application security updates are applied on a managed
basis. Where a vendor-supplied patch is not available, PCQ applies documented interim
mitigations and records them. - Monitoring. Server availability, performance and security events are monitored, with
automated daily reporting. - Backup. Microsoft 365 data and PCQ-hosted data are backed up to UK-based storage.
Retention is as stated in the Customer’s Order. Restoration is carried out on request. - Segregation. Customer data is logically separated between hosting accounts.
- Workshop storage. Where data is copied from a Customer device for repair, transfer or recovery, it is held on storage that is encrypted at rest at PCQ’s premises, accessible only to the technicians carrying out the work, and deleted within 7 days of the device being returned. Credentials supplied for the work are held on paper with the device and destroyed on
completion rather than being entered into PCQ’s systems. - Physical security. PCQ’s premises are protected by a monitored intruder alarm with
police response. Customer devices are held in a workshop area that is not accessible to
the public.
C.4 Resilience and recovery
- PCQ’s hosting infrastructure is provided by a UK data centre operator with resilient power
and connectivity. - Backups are held separately from the systems they protect.
- PCQ maintains an incident response procedure covering detection, containment, notification
and recovery.
C.5 Review
These measures are reviewed at least annually, and after any significant incident or material
change to the services.