Data Processing Agreement
Version 1, last updated 20 October 2026
The terms under which we process personal data on your organisation's behalf, as GDPR Article 28 requires: part of our Terms of Use.
1. About this agreement
1.1 This Data Processing Agreement (“DPA”) forms part of the Terms of Use between ProCo-STS Limited, trading as ProCo IT, a company registered in England and Wales (company number 05054551), of Higher Buckland Farm, Farm Lane, Buckland St Mary, Chard, Somerset TA20 3QZ, United Kingdom (“we”, “us”), and the organisation using Browser Rules (“you”). You accept it when you accept the Terms of Use.
1.2 “Data Protection Law” means the UK GDPR and the Data Protection Act 2018 and, where they apply to you, the EU General Data Protection Regulation (EU) 2016/679 and the laws implementing it. “Controller”, “processor”, “personal data”, “data subject”, “processing” and “personal data breach” have the meanings Data Protection Law gives them.
1.3 “Customer Personal Data” means the personal data we process on your behalf: the information your organisation’s browsers send to the admin console, and the people, groups and policies you set up in it. It also includes what your admin console members do in your organisation, as its audit log records. It doesn’t include admin console accounts themselves (their sign-in details and email choices) or billing details, for which we are the controller under our Privacy Policy.
1.4 If this DPA and the Terms of Use conflict on the processing of Customer Personal Data, this DPA applies.
1.5 If you’re an IT provider (such as a managed service provider) managing Browser Rules for a client (Terms of Use, clauses 1.3 to 1.6), then for that client’s organisation the client is the controller, you are its processor, and we are your sub-processor. This DPA applies between you and us for that organisation; where it calls you the controller, read it as you acting as your client’s processor. You confirm that you have a written agreement with the client that meets Data Protection Law and allows you to use us as your sub-processor, and that your instructions to us, including how you set up the client’s organisation, are within your client’s instructions. You pass on to the client our notices under this DPA, such as a change to our sub-processors or a personal data breach, as your agreement with it requires, and you handle its requests. We may also send notices to anyone with an account in the client’s organisation. When a client takes over its organisation, it accepts this DPA itself and becomes “you” for that organisation.
1.6 Nothing in this DPA limits either party’s obligations under Data Protection Law, or the rights it gives data subjects and supervisory authorities.
2. Roles and instructions
2.1 You are the controller of Customer Personal Data and we are your processor.
2.2 We process Customer Personal Data only on your documented instructions, including on transfers outside the UK. Your instructions are the Terms of Use, this DPA, and how you set up and use Browser Rules, including your policies and Privacy settings. If the law requires us to process it otherwise, we’ll tell you first, unless the law forbids it.
2.3 We’ll tell you straight away if we believe an instruction breaks Data Protection Law.
2.4 You’re responsible for having a lawful basis for the processing, for telling the people using your browsers about it, and for consulting their representatives (such as a works council) where the law requires.
2.5 We use Customer Personal Data only to provide Browser Rules to you. We never sell it, use it for advertising, or use it to train AI models.
3. Confidentiality and security
3.1 Everyone we authorise to process Customer Personal Data is bound by confidentiality.
3.2 We take the technical and organisational measures in Annex 2, and keep them appropriate to the risk, as Data Protection Law requires.
4. Sub-processors
4.1 You authorise us to use the sub-processors listed on our Trust and GDPR page.
4.2 Before adding or replacing a sub-processor, we’ll email everyone with an account in your organisation’s admin console, at least 30 days before it starts, and update the list on our Trust and GDPR page. These are service emails, which account holders can’t turn off. You may object on reasonable grounds about data protection, by replying to that email or writing to [email protected]. If we can’t resolve it, you may end your use of Browser Rules, and we’ll refund any fees you’ve paid in advance for the time left.
4.3 We put data protection obligations on each sub-processor equivalent to those in this DPA, and remain responsible to you for their work.
5. International transfers
5.1 Customer Personal Data is stored in the United Kingdom (Microsoft Azure, UK South). Microsoft may access it from elsewhere to provide the service, such as for support, under its standard contractual clauses and the Data Privacy Framework.
5.2 If you’re in the European Economic Area, Customer Personal Data comes to the UK under the European Commission’s adequacy decision for the United Kingdom (renewed in December 2025, until December 2031).
5.3 Where a sub-processor processes Customer Personal Data outside the UK and the European Economic Area, the transfer is covered:
- for transfers subject to the UK GDPR: by the UK Extension to the EU-US Data Privacy Framework, where the sub-processor is certified under it; otherwise by the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses;
- for transfers subject to the EU GDPR: by the EU-US Data Privacy Framework, where the sub-processor is certified under it; otherwise by the EU standard contractual clauses (Module 3, processor to processor).
Where both apply to a transfer, we meet the requirements of both. We use standard contractual clauses or the International Data Transfer Agreement only after a transfer risk assessment, with any supplementary measures it shows are needed. Annex 3 lists each sub-processor and where it processes data.
5.4 If a transfer safeguard we rely on is invalidated, we move to another lawful safeguard without undue delay and tell you. If none is available, we stop the transfer, even if that means suspending part of Browser Rules. You may then end your use of Browser Rules, and we’ll refund any fees you’ve paid in advance for the time left.
5.5 We’ll give you a copy of the safeguard for any sub-processor on request.
6. Helping you
6.1 We’ll help you answer requests from data subjects exercising their rights, with appropriate technical and organisational measures, as far as possible given the nature of the processing. Browser Rules lets you search the audit log by person and remove enrolled users yourself. If a request or complaint reaches us directly, we’ll pass it to you.
6.2 We’ll help you meet your obligations on security, personal data breaches, data protection impact assessments and consulting a supervisory authority, taking into account the nature of the processing and the information available to us.
6.3 If a public authority, such as a court or the police, asks us for Customer Personal Data, we’ll ask it to come to you where we can. Unless the law forbids it, we’ll tell you promptly, so you can respond or object. We’ll challenge a request we believe is unlawful, and disclose only the minimum the law requires.
7. Personal data breaches
7.1 We’ll tell you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours. We’ll give you the information you need to meet your obligations, as it becomes available, and take reasonable steps to contain the breach.
8. Return and deletion
8.1 Audit events are deleted automatically at the end of your plan’s retention period. You can remove enrolled browsers and users at any time.
8.2 You choose what happens at the end. Before deleting your organisation, its owners can download a copy of Customer Personal Data from the admin console (the audit log, browsers, users and members as CSV files, and the policies as JSON), or delete it without one. When your organisation is deleted, we delete Customer Personal Data, unless the law requires us to keep it. Backups expire within 35 days.
8.3 If your organisation’s use of Browser Rules ends another way, such as when we end it under clause 13 of the Terms of Use, its owners can have a copy for 30 days, from the admin console or on request, unless the law forbids it. We delete Customer Personal Data by the end of that 30-day period, unless the law requires us to keep it. Backups expire within 35 days after that.
8.4 Deleting a person’s admin console account doesn’t delete Customer Personal Data. It stays with your organisation until you remove it or delete the organisation.
9. Information and audits
9.1 We’ll make available all the information necessary to show compliance with Article 28, including answers to security questionnaires.
9.2 Where that isn’t enough, we’ll allow an audit, including an inspection, by you or an auditor you appoint, on reasonable notice, during working hours, no more than once a year unless a supervisory authority requires it or after a personal data breach, and at your cost. This does not affect any allocation of costs required by law or ordered by a court. Auditors must keep what they learn confidential, and mustn’t be our competitors. An audit never gives access to other customers’ data.
10. Liability and duration
10.1 Each party’s liability under this DPA is subject to the limits in the Terms of Use, except where Data Protection Law doesn’t allow it.
10.2 This DPA lasts as long as we process Customer Personal Data for you.
10.3 We may update this DPA, for example for changes in Data Protection Law. We’ll tell you about material changes before they take effect.
Annex 1: Details of the processing
| Subject and purpose | Providing Browser Rules: enforcing your organisation’s browser policies, and showing you in the admin console what was blocked, warned about or recorded. |
| Duration | As long as you use Browser Rules, then until deleted as in section 8. |
| Nature | Receiving, storing, organising, displaying and deleting data sent by your browsers and entered in the admin console. |
| Data subjects | The people using your organisation’s enrolled browsers, people you name in policies or groups, and your admin console members, in the changes your audit log records. |
| Types of personal data | Work email addresses; the browser, its version, the operating system and, if your device management sets it, the device’s name; audit events, with the detail your Privacy settings allow (time, file name, size and fingerprint, website and page addresses, including website visits an Audit policy records, the policy and the reason, up to 80 characters of copied text that matched a malicious command, and pause reasons); admin changes (who made them, when, and what changed); group membership; and technical data such as IP addresses in service logs. |
| Special category data | None is intended. File inspection happens locally; file contents are not sent to our servers, and Browser Rules doesn’t read what people type. File names, website and page addresses, and copied text that matched a malicious command (up to 80 characters) can still reveal sensitive information by chance. You limit these in your Privacy settings. |
Annex 2: Security measures
- Checks run inside the browser: files are never uploaded, and a browser that isn’t enrolled sends nothing.
- Hosting on Microsoft Azure, UK South (London), in certified data centres.
- Encryption in transit (TLS, HTTPS only) and at rest, backups included; point-in-time backups for 35 days.
- Access to each organisation’s data restricted through organisation-scoped authorisation and data queries, with every read and change checked against its organisation.
- Two-factor authentication or passkeys for every admin console account; passwords of at least 12 characters, breached passwords refused, and lockout after five wrong attempts.
- Roles (owners, admins and read-only members), and changes recorded in your audit log.
- Each enrolled browser has its own token, stored only in a form that can’t be used to sign in; enrolment attempts rate limited; any browser can be revoked.
- Our support team opens your admin console only when an owner allows it, for a set time, read only, and each opening is recorded in your audit log. Otherwise our staff see only the account details needed to run the service: the organisation’s name, plan and limits, how many users, browsers, members and policies it has, and the email address, role and sign-in settings of each member and person invited.
- Two-factor authentication on all our own accounts, and access to systems only for the people who need it.
Our Security page describes these in more detail.
Annex 3: Sub-processors
The current list, with what each does, where, and the safeguard for any transfer, is on our Trust and GDPR page.