Data processing terms
These terms form part of the Traades terms of service between Little Bird Solutions Limited (Traades) and the business using the service (you). They apply where we process personal information in website content on your behalf. They do not turn our own account, security or billing administration into processing on your instructions; our privacy notice covers those activities.
The processing we carry out
Roles. You are the controller of the personal information you choose to include in your website. We are your processor when storing, preparing and hosting that content. If you are acting for another controller, you must have authority to give us instructions and enter into these terms.
Purpose and operations. We receive, store, organise, resize images, retrieve, display, publish, restrict, return and delete information to provide the builder, private previews, hosting, publication changes and support you request.
People and information. Content can identify you, your staff, customers, reviewers and people shown in photos. It may include names, business contact details, testimonial text, photos, image descriptions and links. The service is not designed for special-category data, criminal-offence data, children's information, identity documents, financial credentials or confidential case records. Do not upload them.
Duration. Processing continues while we provide the relevant account and content-hosting service, including a retained private draft after a subscription ends, and during an agreed return or deletion process. Guest content has the separate expiry described in the privacy notice.
Your instructions and responsibilities
These terms, your builder actions and verified support requests are your documented instructions. Publishing is an instruction to make the reviewed content public on the internet; editing a draft alone is not. We will process content only on your documented instructions, including for international transfers, unless law requires otherwise. If the law requires other processing, we will tell you before it happens unless the law prohibits that notice. We will tell you if we believe an instruction infringes applicable data protection law.
You must establish an appropriate lawful basis, give people the information they need and meet their rights when choosing what to upload or publish. Obtain appropriate permissions for photos and testimonials, keep information accurate and avoid unnecessary personal details. Do not treat our hosting service as permission to republish someone else's information.
Confidentiality and security
We will ensure that people authorised to process your content are under confidentiality obligations and have access only as needed for their work. We will use technical and organisational measures appropriate to the risks, taking account of the nature of the information and the service. Our measures include:
- encrypted connections, email-code authentication and session controls;
- checks that private drafts and media belong to the requesting account, and separation of draft and published versions;
- private underlying image storage, with public delivery limited to content referenced by an available published website;
- bounded uploads, image processing and removal of embedded image metadata;
- rate limits and restricted administrative access, with security and recovery procedures.
No internet service can promise perfect security. We will maintain appropriate measures and will not deliberately reduce the overall level of protection during the service. Publicly instructed publication is not confidential hosting. You remain responsible for securing your email account and the devices you use.
Subprocessors
You give general authorisation for us to use subprocessors to supply the service. We remain responsible for their performance of the applicable processing obligations and will require equivalent data protection obligations in writing. Our current content-hosting subprocessor is Cloudflare, Inc., for hosting, database storage, private image storage, image processing and security, using its international infrastructure. Its subprocessor information describes its own suppliers.
Resend (Plus Five Five, Inc.) provides service email delivery, with primary processing in the United States. It is used for recipient addresses and service messages; we do not routinely send your website's testimonial or photo content in email. If helping with a content-related request requires personal information to be included in a service message, these subprocessor obligations apply to that information too. See Resend's subprocessor list.
Stripe/Link's independent payment processing and optional Umami marketing measurement are described in the privacy notice; neither is used to host your photo gallery or private website draft.
We will give account holders at least 30 days' email notice before adding or replacing a subprocessor that will process their website personal information. Tell us within that period if you have reasonable data protection grounds to object. We will discuss a reasonable alternative. If we cannot resolve the objection, you can end the affected service before the change and receive a refund for unused prepaid service. We will not send your affected content to the new subprocessor while that objection remains unresolved unless you agree to the arrangement or law requires it.
International transfers
The service uses international suppliers and does not promise UK-only storage or access. For restricted transfers we make on your behalf, we will use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK Addendum to the European Commission's standard contractual clauses or the UK International Data Transfer Agreement, with the assessments required by law. We will make information about the applicable safeguards available on request, subject to proportionate confidentiality protections. We will not rely on your publication instruction to justify unrelated private-data transfers.
Requests, incidents and compliance assistance
If someone contacts us about their rights in content you control, we will pass the request to you without undue delay unless prohibited by law, and will not answer on your behalf unless authorised or legally required. We will provide reasonable assistance, taking account of the processing and information available to us, so you can respond to requests, assess risks and comply with your obligations on security, breaches, impact assessments and consultation with regulators.
We will notify you without undue delay after becoming aware of a personal data breach affecting content we process for you. We will provide the information reasonably available about its nature, affected data and people, likely consequences, contact point and mitigation, and provide further information as the investigation progresses. We will cooperate with your response. You remain responsible for deciding and making any notifications required of you as controller.
We will make available the information reasonably necessary to demonstrate compliance with these terms and Article 28 of the UK GDPR. We will allow and contribute to proportionate audits or inspections by you or an independent auditor you appoint. We can agree reasonable confidentiality, security, scope and scheduling arrangements, without using them to prevent a necessary audit, regulatory access or urgent incident response. Any charge for unusual additional work must be reasonable and agreed in advance; ordinary rights assistance is not conditional on buying an extra plan.
Return and deletion
You can request return or deletion of your content by emailing contact@traades.co. We will verify the request, agree the scope and help return the stored content in a commonly usable form where available. There is no self-service export or account-deletion button. Cancelling renewal alone does not instruct deletion: a private draft remains available in the account.
When the content-hosting relationship ends, we will, at your choice, return or delete the personal information we process on your behalf and delete remaining copies unless law requires retention. Tell us if you want a return before deletion. We will restrict retained recovery copies until their normal recovery cycle ends, and reapply deletions if a backup is restored. We will explain any legal retention requirement and continue to protect the retained information.
Deletion from Traades cannot remove copies a visitor or search service has already made of a public website. Our separate controller records, such as a necessary billing or complaint record, are governed by the privacy notice rather than your website-content instructions.
Contact and precedence
Send processing instructions and data protection questions to contact@traades.co, identifying your account and website. These terms take precedence over a conflicting general service term concerning our processing of your website personal information. Mandatory data protection law and the rights of data subjects continue to apply.