Data Processing Agreement

Version 1.3 · Effective 10 November 2026

---

---

1. Parties and scope

This Data Processing Agreement (“DPA“) is entered into between:

PCQ Solutions Ltd, a company registered in England and Wales under company number 04019429, whose registered office is at Cambrian House, Cambrian Place, Llanidloes, Powys, SY18 6BX (“PCQ“, “we“, “us“); and

the customer receiving services from PCQ under PCQ’s Terms of Service, as identified in the Order (“Customer“, “you“).

This DPA forms part of, and is subject to, the agreement between the parties made up of PCQ’s Terms of Service and the Order, or any signed services agreement that replaces them (the “Agreement“). Where this DPA conflicts with the Agreement on matters of personal data processing, this DPA prevails.

Signed or tailored copies. This DPA applies automatically through our Terms of Service; you do not need to sign anything. If you need a signed copy, a version tailored to your organisation’s requirements, or to use your own data processing terms, ask us at [email protected]. A signed or tailored version we agree with you replaces this published version for you.

1.1 Roles

For the purposes of UK data protection law:

• You are the Controller. You determine the purposes and means of processing personal data within the services.
• PCQ is the Processor. We process personal data on your documented instructions.

Where we process personal data about you as a business contact — for billing, account management, service notifications and our own business records — we act as a Controller in our own right. That processing is described in our Privacy Notice and is outside the scope of this DPA.

Home customers. This DPA applies where you use our services for a business or organisation. If you use them as a private individual, for your home, you are not a controller under UK data protection law. We are the controller of the personal data involved, and our Privacy Notice explains how we handle it.

1.2 Definitions

“UK Data Protection Law” means the UK General Data Protection Regulation, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, each as amended.

“Personal Data“, “Data Subject“, “Processing“, “Controller“, “Processor“, “Supervisory Authority” and “Personal Data Breach” have the meanings given in UK Data Protection Law.

“Customer Personal Data” means personal data that PCQ processes on your behalf under the Agreement, as described in Annex A.

“Subprocessor” means any third party engaged by PCQ to process Customer Personal Data.

---

2. Processing of Customer Personal Data

2.1 Our instructions

We will process Customer Personal Data only:

a. on your documented instructions, including with regard to transfers outside the UK, unless required to do otherwise by law — in which case we will inform you of that legal requirement before processing, unless the law prohibits us from doing so on important grounds of public interest;

b. as necessary to provide the services described in the Agreement;

c. as described in this DPA and its Annexes.

The Agreement, the Order Form, this DPA and your use of the services through the interfaces we provide constitute your documented instructions. Any additional instruction must be agreed in writing, and we may charge for work needed to comply with instructions that fall outside the agreed services.

2.2 Our obligations

We will:

a. inform you immediately if we consider that an instruction infringes UK Data Protection Law, although we are not obliged to carry out a legal review of your instructions;

b. ensure that any person authorised to process Customer Personal Data is subject to an appropriate duty of confidentiality, whether contractual or statutory, and that this duty survives the end of their engagement;

c. limit access to Customer Personal Data to those personnel who need it to deliver the services, and only to the extent needed;

d. not sell Customer Personal Data, and not use it for our own purposes, including the training of machine learning or artificial intelligence models.

2.3 Your obligations

You warrant that:

a. you have a lawful basis for the processing you instruct us to carry out;

b. you have provided any notices and obtained any consents required under UK Data Protection Law in relation to the Customer Personal Data;

c. the instructions you give us comply with UK Data Protection Law;

d. you will not instruct us to process special category personal data, or personal data relating to criminal convictions and offences, without telling us in advance so that we can agree appropriate additional measures.

---

3. Security

3.1 Technical and organisational measures

We will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to data subjects.

The measures in place at the date of this DPA are set out in Annex C.

We may update these measures from time to time provided the overall level of protection is not reduced.

3.2 Your responsibilities

You are responsible for:

a. configuring the services appropriately for the sensitivity of your data, including the access controls, sharing settings and retention policies available to you;

b. the security of credentials issued to you and your personnel, and for promptly notifying us of any suspected compromise;

c. telling us if your processing requires measures beyond those in Annex C.

3.3 Sensitive data

Our services do not require us to collect or hold sensitive personal data, such as special category data, data about criminal convictions and offences, or data about children. However, because we hold administrative access to your systems, host and back up your data, and access your devices to provide support, such data may pass through our systems or be visible to us where you hold it in the systems we look after.

Where that happens, we treat it as Customer Personal Data under this DPA. We do not copy, extract or keep it beyond what the service itself requires (for example, it may sit within a mailbox or website database that we host or back up), and we do not look at it unless a support task you have asked for requires it.

If your organisation works with sensitive data as a matter of course, tell us. We will agree in writing any additional measures appropriate to it and record them in your Order.

---

4. Subprocessors

4.1 General authorisation

You give us general written authorisation to engage subprocessors to process Customer Personal Data, subject to this clause 4.

4.2 Current subprocessors

Our current subprocessors are published at https://pc-q.co.uk/subprocessors and listed, as at the date of this DPA, in Annex B. The published list is the authoritative version.

4.3 Changes

Before engaging a new subprocessor, or replacing an existing one, we will give you at least thirty (30) days’ notice, by updating the published list and notifying the contact you have given us for this purpose.

You may object to a new subprocessor on reasonable data protection grounds within that notice period, by writing to us at [email protected]. If you do, we will work with you in good faith to find a resolution — which may include offering an alternative arrangement or, where that is not reasonably possible, giving you the right to terminate the affected service without penalty, with a pro-rata refund of fees paid in advance.

Where a change is required urgently to preserve the security or continuity of the services, we may engage a subprocessor sooner and will notify you as promptly as possible.

4.4 Our responsibility

We will impose on each subprocessor, by written contract, data protection obligations that meet the requirements of Article 28(3) and (4) of the UK GDPR. We remain fully liable to you for the performance of each subprocessor’s obligations.

---

5. Assistance to you

5.1 Data subject rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as is reasonably possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under UK Data Protection Law.

We will respond to a request for assistance under this clause within five working days, or sooner where you tell us the request is urgent or a statutory deadline requires it.

If we receive a request directly from a data subject relating to Customer Personal Data, we will not respond to it other than to acknowledge receipt and direct them to you. We will notify you, and pass on the content of the request, within two working days of receiving it.

5.2 Security, breach notification and assessments

Taking into account the nature of processing and the information available to us, we will assist you in ensuring compliance with your obligations under Articles 32 to 36 of the UK GDPR — security of processing, breach notification, data protection impact assessments and prior consultation.

5.3 Cooperation with the supervisory authority

We will cooperate, on request, with the Information Commissioner’s Office in the performance of its tasks, as required by Article 31 of the UK GDPR. Where the ICO contacts us about processing we carry out on your behalf, we will tell you without undue delay unless we are prohibited from doing so by law.

5.4 Charges

Assistance under this clause is provided at no charge where the request is of a routine nature and proportionate to the services. Where the assistance required is substantial or repeated, we may charge at our standard rates, having first told you and given you the opportunity to agree the scope.

---

6. Personal data breaches

6.1 Notification

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

We are “aware” for this purpose once we have a reasonable degree of certainty that a security incident has occurred that led to the compromise of Customer Personal Data. We will not delay notification in order to complete our investigation.

We will also tell you, without undue delay, about a security incident affecting systems holding your personal data where we suspect but have not yet confirmed that a Personal Data Breach has occurred, so that you are not learning of it only once it is established.

Our notification will include, to the extent known at the time:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences of the breach;
• the measures taken or proposed to address it, including to mitigate its effects;
• a contact point for further information.

Where we cannot provide all of this at once, we will provide information in phases without undue further delay.

6.2 Cooperation

We will cooperate with you and take reasonable steps as directed by you to assist in the investigation, mitigation and remediation of the breach.

We will preserve the logs, records and other evidence relevant to the breach that are within our control, and will not delete them while the breach remains under investigation by either party or by a supervisory authority.

6.3 No admission

Our notification of a breach is not and will not be construed as an acknowledgement of fault or liability.

6.4 Reporting to authorities

You are responsible for determining whether a breach must be reported to the Information Commissioner’s Office or to affected data subjects, and for making any such report. We will not report a breach affecting Customer Personal Data to a supervisory authority on your behalf unless required by law or agreed with you in writing.

6.5 Requests from third parties and law enforcement

If we receive a request from a law enforcement agency, government body or other third party for disclosure of Customer Personal Data, we will:

a. not disclose it unless we are legally compelled to do so;

b. tell you about the request without undue delay, so that you can seek to challenge it, unless we are prohibited from telling you by law — in which case we will use reasonable efforts to obtain a waiver of that prohibition;

c. where we are compelled to disclose, limit the disclosure to the minimum required and tell you what was disclosed as soon as we are lawfully able to.

We will require the same of our subprocessors.

---

7. International transfers

We will not transfer Customer Personal Data outside the United Kingdom except:

a. to a country or territory covered by UK adequacy regulations; or

b. under an International Data Transfer Agreement, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or another transfer mechanism recognised under UK Data Protection Law.

Where we rely on (b), we will carry out a transfer risk assessment where one is required, and will make it available to you on request.

Transfers that take place as at the date of this DPA, and the safeguards applying to each, are identified in Annex B.

---

8. Audit and information

8.1 Information

We will make available to you the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR. This will ordinarily take the form of:

• this DPA and its Annexes;
• our published subprocessor list;
• our security overview; and
• written responses to reasonable, proportionate questions in a security questionnaire.

8.2 Audits

Where the information in clause 8.1 does not reasonably satisfy you, we will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to the following:

a. you give us at least 30 days’ written notice, except where an audit follows a Personal Data Breach, in which case we will agree a reasonable shorter period;

b. audits take place during normal business hours, no more than once in any 12-month period unless required by a supervisory authority or following a Personal Data Breach;

c. the auditor is not a direct competitor of PCQ in the supply of managed IT services, and enters into appropriate confidentiality undertakings. We will not withhold agreement to an auditor unreasonably;

d. the audit does not require us to disclose information relating to other customers, or to breach any duty of confidence owed to a third party;

e. you bear your own costs, and reimburse our reasonable costs where an audit exceeds one working day.

Where our infrastructure is operated by a third party, our ability to grant physical access is limited to what that third party permits, and we will instead provide the assurance documentation available to us.

---

9. Deletion and return

9.1 On termination

On termination or expiry of the services, we will, at your election, delete or return all Customer Personal Data, and delete existing copies, unless we are required by law to retain it.

You must tell us which you require within 30 days of termination. If you do not, we will delete the data in accordance with clause 9.2.

9.2 Deletion timescales

Live systems. We will delete Customer Personal Data from live systems within 30 days of your instruction, or within 60 days of termination where you have given no instruction.

Backups. Personal data held in backup copies cannot be selectively deleted while the backup set exists. On termination we will delete your backup set in full within 90 days, which removes the personal data within it. Until that point it remains subject to the security measures in Annex C and will not be processed for any other purpose.

Where your Order specifies a backup retention period, that period applies during the life of the service. It does not extend the 90-day deletion period on termination.

Workshop data. Copies taken from a device for repair, transfer or recovery are deleted within 30 days of the device being returned, independently of this clause and whether or not the services have terminated.

Records we must keep. We may retain Customer Personal Data where required by law or for the establishment, exercise or defence of legal claims. This includes invoices and supporting records, retained for six years under the Companies Act 2006 and HMRC requirements. Data retained on this basis is retained only for that purpose.

9.3 Certification

We will confirm deletion to you in writing within ten working days of it being completed, without you needing to ask.

---

10. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

Nothing in this DPA limits or excludes either party’s liability where it cannot lawfully be limited or excluded, including for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or for any liability under UK Data Protection Law that cannot lawfully be limited.

---

11. General

11.1 Duration

This DPA takes effect on the date the Agreement takes effect, or on the date of signature if later, and continues until we have ceased all processing of Customer Personal Data in accordance with clause 9.

11.2 Changes

We may update this DPA where necessary to reflect a change in law or guidance from a supervisory authority. Any other change requires your written agreement.

We will give you at least 30 days’ notice of any change that materially reduces your rights or our obligations. If you do not accept it, you may terminate the affected service without penalty, and where the change goes to the basis on which we hold your data you may terminate the Agreement as a whole on the same basis.

11.3 Governing law

This DPA is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

11.4 Order of precedence

On matters of personal data processing, this DPA prevails over the Agreement and over any other document. On all other matters the Agreement prevails over this DPA. Clause 10 is a matter for the Agreement.

---

Signature

PCQ Solutions Ltd

Signed: ……………………………………..

Name: ………………………………………..

Position: ……………………………………

Date: …………………………………………

Customer

Signed: ……………………………………..

Name: ………………………………………..

Position: ……………………………………

Organisation: ……………………………..

Date: …………………………………………

---

Annex A — Details of processing

A.1 Subject matter and duration

Subject matter. The provision of managed IT, connectivity, hosting, communications and security services as set out in the Agreement.

Duration. For the term of the Agreement, plus the deletion period described in clause 9.2 — up to 60 days for live systems and 90 days for backup copies. Billing records retained under the Companies Act 2006, as described in clause 9.2, are held by PCQ as a controller in its own right and are not processed on the Customer’s behalf.

A.2 Nature and purpose of processing

PCQ processes Customer Personal Data in order to deliver the services the Customer has purchased. Depending on which services apply, this includes:

Service	Nature and purpose of processing
Microsoft 365	Administering the Customer’s tenant: creating, amending and removing user accounts; configuring mailboxes, groups and sharing; applying security and compliance settings; licence assignment; mailbox and file migration; responding to support requests. PCQ holds administrative access to the Customer’s tenant. Where PCQ supplies Microsoft 365 and holds administrative rights, PCQ links the tenant to its service desk by default, so that user accounts are imported into the service desk and matched to devices, to improve support. The Customer may ask for this link to be switched off.
Email hosting	Operating mail services on PCQ infrastructure: mailbox provisioning, message transport, spam and malware filtering, storage and retrieval.
Website hosting	Hosting the Customer’s website and associated databases, including any personal data the Customer or its website visitors place there; server administration; backup; performance and security monitoring.
DNS and domain services	Operating or managing DNS for the Customer’s domains; domain registration and renewal, which involves registrant contact data.
Backup	Backing up Microsoft 365 data and website or server data; storage of backup copies; restoration on request.
Endpoint protection and monitoring	Deploying and managing endpoint security agents and remote monitoring and management software on Customer devices; applying software updates; collecting device, performance and threat telemetry; keeping an asset register of devices and their users (operating system, installed software, serial number and linked Microsoft 365 user), which the Customer can view in PCQ’s client portal; remote access for support purposes. Connections made through the remote management platform are logged; occasional one-off sessions started through PCQ’s website chat, on devices without the management software, are not.
IT support	Receiving, recording and resolving support requests; remote access to devices and systems, during which the technician can see and control the device and anything displayed on it; on-site attendance; retaining records of work carried out.
Connectivity	Placing, amending and ceasing broadband and telephony orders with suppliers; managing line and service records; fault diagnosis.
Telephony and VoIP	Provisioning and administering hosted telephony; call routing configuration; access to call records and voicemail held on the platform. Where voicemail transcription is enabled, the telephony platform transcribes and summarises voicemail messages and delivers them by email.
Security awareness training	Enrolling Customer personnel on training and simulated phishing; recording completion and results.
Compliance tooling	Operating endpoint compliance monitoring in support of Cyber Essentials and similar schemes; collecting device configuration data.
Password management	Provisioning and administering password management for Customer personnel. PCQ does not have visibility of vault contents.
Workshop repair and data services	Diagnosis, repair and data transfer or recovery on devices brought to PCQ’s premises. Where the work requires it, copying the contents of a device to encrypted storage at PCQ’s premises, and holding credentials supplied by the Customer for the duration of the job. The contents of a device may include any category of personal data the Customer or its personnel have placed on it.
Custody of devices	Holding Customer devices at PCQ’s premises before, during and after work, including devices awaiting parts or collection.
Managed networks and monitoring	Configuring and managing routers, firewalls, wireless links and site-to-site connections; collecting device logs, alerts and connection metadata for monitoring and fault diagnosis.
Managed WiFi and guest access	Installing and managing WiFi networks, including guest access systems. Where guests sign in, the login page runs on the Plasma Cloud platform, on PCQ’s systems or on the Customer’s own system, and holds guest login details and connection records.

AI assistance. Across the service lines above, PCQ uses an AI assistant to help triage and draft support records, analyse systems, produce reports and automate routine work. This means Customer Personal Data held in PCQ’s service desk is processed by the subprocessor identified in Annex B. The scope and limits of that access are set out in the note to Annex B.

A.3 Types of personal data

The categories of personal data processed depend on the services taken and on what the Customer places in them. They may include:

• Identity and contact data — names, job titles, business email addresses, business and mobile telephone numbers, postal addresses.
• Account and authentication data — usernames, account identifiers, security group membership, multi-factor authentication registration details, password reset records. PCQ does not hold Customer passwords in readable form.
• Communications content — the content of emails, attachments, calendar entries, contacts, files, documents and chat messages held in services PCQ administers or backs up.
• Device and technical data — device names, serial numbers, hardware and software inventory, IP addresses, operating system and patch status, security agent telemetry, system and access logs, and records of remote access sessions (who connected, to which device, and when).
• Support records — the content of support requests, correspondence, notes of work carried out, screenshots and diagnostic information.
• Website data — any personal data contained in the Customer’s website, its database, or submitted through its forms; web server access logs.
• Telephony data — call detail records, voicemail messages, telephone numbers.
• Training records — course enrolment, completion status, simulated phishing results.
• Service and billing data — service addresses, line identifiers, account references.
• Device contents — where a device is brought in for repair, data transfer or recovery, the entire contents of that device or disk, which may include any category of personal data.
• Access credentials supplied for workshop work — device passwords and PINs supplied by the Customer so that PCQ can carry out requested work. These are recorded on paper, held physically with the device, and destroyed on completion. They are not entered into PCQ’s systems.

Sensitive data. PCQ does not require sensitive personal data to deliver the services. Where the Customer holds it in a system PCQ administers, hosts, backs up or accesses for support, it is handled as described in clause 3.3.

A.4 Categories of data subjects

• The Customer’s employees, officers, contractors and volunteers
• The Customer’s own customers, clients, service users, members or patients
• The Customer’s suppliers and business contacts
• Visitors to the Customer’s website
• Members of the public using guest WiFi that PCQ manages for the Customer
• Any other individual whose personal data the Customer holds in a system PCQ administers, hosts, backs up or accesses for support

A.5 Controller contact for data protection matters

To be completed by the Customer:

Name: ………………………………………..

Role: …………………………………………

Email: ……………………………………….

This is the address to which PCQ will send subprocessor change notifications and breach notifications.

---

Annex B — Subprocessors

As at 10 November 2026. The current list is published at https://pc-q.co.uk/subprocessors.

Subprocessor	Purpose	Entity location	Data location	Transfer safeguard
Microsoft Ireland Operations Ltd	Microsoft 365 services and licensing	Ireland	United Kingdom	UK adequacy (EU)
Acronis International GmbH	Microsoft 365 and server backup	Switzerland	UK (London)	UK adequacy (CH)
Syncro (Servably, Inc.)	Service desk, ticketing, remote monitoring and management, asset inventory, remote access, patch management and remote script execution on managed devices	United States	United States	UK IDTA / SCCs + Addendum
Splashtop Inc.	The remote access connector built into Syncro, used for remote support sessions on Customer devices. Each connection is logged; sessions are not recorded	United States	United States, with connections relayed through regional servers	Engaged through Syncro. Splashtop’s own terms use the UK Addendum to the Standard Contractual Clauses
ISL Online (ISL Remote d.o.o.)	Remote access to Customer devices for support purposes, and live chat on PCQ’s website	Slovenia (part of PDQ.com Corporation, United States)	European Union for account data. Session details may be routed through ISL’s servers worldwide; session content is end-to-end encrypted and ISL does not hold the keys	UK adequacy (EU); supplier’s SCCs for routing outside the EU
Cloudflare, Inc.	DNS, content delivery and web application firewall for Customer domains	United States	Global edge network	UK IDTA / SCCs + Addendum
HostPresto	Provision of the physical server infrastructure on which PCQ hosting services run	United Kingdom	United Kingdom	N/A — UK
WebPros International GmbH (Plesk)	Hosting control panel software operating on PCQ infrastructure	Switzerland	United Kingdom	Covered by UK adequacy
Cloud Linux Software, Inc. (Imunify360)	Server security, web application firewall and malware scanning	United States	Germany, Finland and Poland, and the United States (security analysis servers and databases)	EU Standard Contractual Clauses with the UK Addendum (CloudLinux data processing addendum); Data Privacy Framework certified
Bitdefender	Endpoint protection	Romania	EU	UK adequacy (EU)
CyberSmart Ltd	Endpoint compliance monitoring and Cyber Essentials certification support	United Kingdom	United Kingdom	N/A — UK
KnowBe4, Inc.	Security awareness training and simulated phishing	United States	European Union (KnowBe4’s EU instance, hosted on AWS in Ireland and Germany)	UK adequacy (EU); UK IDTA / SCCs + Addendum for access from the US
Keeper Security, Inc.	Password management supplied to customers, and used internally by PCQ	United States	European Union (keepersecurity.eu)	UK adequacy (EU); UK IDTA / SCCs + Addendum for access from the US; zero-knowledge encryption
AgileBits Inc. (1Password)	Password management used internally by PCQ, holding credentials for customer systems	Canada	European Union (1Password.eu)	UK adequacy (Canada and EU); zero-knowledge encryption
Zen Internet Ltd	Broadband and connectivity; hosted telephony and VoIP, including the Uboss telephony platform (call records, voicemail and voicemail transcription)	United Kingdom	United Kingdom	N/A — UK
Swiftnet Ltd (SCG)	Legacy telephony, broadband and hosted VoIP services	United Kingdom	United Kingdom	N/A — UK
EE Ltd	Mobile data services	United Kingdom	United Kingdom	N/A — UK
Unity World Ltd	Provisioning, billing and support for O2 mobile SIMs and tariffs	United Kingdom	United Kingdom	N/A — UK
Telefónica UK Ltd (O2)	Mobile network operator carrying those services	United Kingdom	United Kingdom	N/A — UK
Giacom / Cloud Market Ltd	Microsoft 365 licence provisioning	United Kingdom	United Kingdom	N/A — UK
Octiga Software Limited	Microsoft 365 security monitoring and policy management, integrated with Acronis. Holds administrative access to Customer Microsoft 365 tenants and reads activity and configuration data (sign-in events, user and mailbox settings), not email or file content	Ireland	Ireland (AWS, Dublin). Sign-in IP addresses and user email addresses are checked by security services in France and the United States	UK adequacy (EU). Onward checks in the US under the supplier’s Standard Contractual Clauses
Plasma Cloud Ltd	Cloud management of WiFi networks and guest access systems, including guest login details and connection records	Hong Kong	United States (confirmed by Plasma Cloud, November 2026)	Data processing terms with UK transfer clauses requested from the supplier (November 2026) and under review by its legal team. The data held is limited to device identifiers, connection records and any details entered on a guest login page
Livedrive Internet Ltd	Cloud backup of files on customer computers	United Kingdom	United Kingdom	N/A — UK
Anthropic PBC	AI assistance in service delivery and automation — see note below	United States	United States	UK IDTA / SCCs + Addendum

Note on Anthropic

PCQ uses Anthropic’s Claude to assist with service delivery, reporting and automation. Its access is limited to:

• PCQ’s service desk system (Syncro) — which contains Customer contact details, support request content and device inventory;
• PCQ’s accounting system — Customer billing contact details and invoice history, which PCQ holds as a controller in its own right rather than on the Customer’s behalf;
• PCQ’s hosting control panel and server management tools — configuration data, domain and site settings, and server logs;
• PCQ’s DNS management — domain and DNS record configuration;
• PCQ’s own Microsoft 365 tenant — PCQ’s own mail and files.

It does not have access to Customer Microsoft 365 tenants, Customer mailboxes, Customer files, or password vaults. It has no ability to initiate a remote session to a device or take control of a device. On PCQ’s hosting platform it can carry out actions that change Customer systems, such as updating website software or changing files, but only after a PCQ technician has reviewed and approved each action.

PCQ does not direct AI assistance at the contents of Customer website databases. PCQ notes for completeness that hosting control panel access carries the technical ability to reach them, so this is a restriction of practice rather than one imposed by the access level itself.

Customer Personal Data processed through this route is not used to train Anthropic’s models. PCQ has model training disabled on the account used to deliver its services.

---

Annex C — Technical and organisational measures

These are the measures in place as at 10 November 2026. PCQ’s current security overview is published at https://pc-q.co.uk/security.

C.1 Organisational

• PCQ uses CyberSmart to monitor endpoint compliance on a continuous basis.
• Access to Customer systems is limited to PCQ personnel who require it to deliver the services.
• All PCQ personnel are subject to contractual confidentiality obligations that survive the end of their engagement.
• PCQ personnel complete security awareness training.
• Subprocessors are subject to written contracts imposing data protection obligations no less protective than those in this DPA.

C.2 Access control

• Administrative access to PCQ systems requires individual named accounts. Shared logins are not used.
• Multi-factor authentication is enforced on PCQ’s Microsoft 365 tenant and on administrative access to management platforms that support it.
• Access is reviewed when personnel join, change role or leave.

C.3 Technical

• Encryption in transit. Services PCQ operates are served over TLS. Mail transport uses opportunistic TLS.
• Endpoint protection. Managed endpoint security software is deployed across PCQ systems and on Customer devices where the Customer has purchased it.
• Customer device updates. On Windows computers covered by Care & Support, automatic updates are set to install critical Windows security updates within 14 days of release. This is an automated policy, not a guarantee: an update can fail or be held up, and except on Care & Support Premium such failures are not checked proactively. It does not apply to servers or Macs.
• Remote access. Remote sessions to Customer devices are normally made through PCQ’s remote management platform, and each of those connections is logged. Occasional one-off sessions started through PCQ’s website chat, on devices without the management software, are not logged.
• Wiping devices. When a Customer device is returned to PCQ to be wiped for reuse or disposal, PCQ erases it with the manufacturer’s built-in method, following NIST SP 800-88: on Macs with Apple silicon or a T2 chip, “Erase All Content and Settings”, which destroys the encryption keys (a NIST “Purge”); on Windows PCs, “Reset this PC” with the clean-data option, which overwrites the drive (a NIST “Clear”). Business Windows PCs PCQ manages have BitLocker drive encryption switched on as standard, monitored through PCQ’s Cyber Essentials tooling. Each wipe is recorded against the device in PCQ’s service desk, with the date, method and technician, and the record is sent to the Customer.
• Server security. PCQ’s hosting infrastructure runs a web application firewall, malware scanning, intrusion detection and brute-force protection.
• Patching. Operating system and application security updates are applied on a managed basis. Where a vendor-supplied patch is not available, PCQ applies documented interim mitigations and records them.
• Monitoring. Server availability, performance and security events are monitored, with automated daily reporting.
• Backup. Microsoft 365 data and PCQ-hosted data are backed up to UK-based storage. For Microsoft 365 backups the Customer chooses the retention period; unless the Customer tells us otherwise, backups are kept with no time limit. Retention for other backups is as stated in the Customer’s Order. Restoration is carried out on request.
• Segregation. Customer data is logically separated between hosting accounts.
• Workshop storage. Where data is copied from a Customer device for repair, transfer or recovery, it is held on storage that is encrypted at rest at PCQ’s premises, accessible only to the technicians carrying out the work, and deleted within 30 days of the device being returned. Credentials supplied for the work are held on paper with the device and destroyed on completion rather than being entered into PCQ’s systems.
• Physical security. PCQ’s premises are protected by a monitored intruder alarm with police response. Customer devices are held in a workshop area that is not accessible to the public.

C.4 Resilience and recovery

• PCQ’s hosting infrastructure is provided by a UK data centre operator with resilient power and connectivity.
• Backups are held separately from the systems they protect.
• PCQ maintains an incident response procedure covering detection, containment, notification and recovery.

C.5 Review

These measures are reviewed at least annually, and after any significant incident or material change to the services.

---