GDPR and Data Processing
Effective date: 24 August 2026
This page explains how JD Web Services Ltd trading as The Voice Concierge approaches data protection and how customers can obtain the contractual information needed when we process personal data for them.
Read this page with our:
Contents
- Our roles
- Data Processing Agreements
- Customer responsibilities
- Our processor commitments
- Subprocessors
- International transfers
- Security measures
- Data-subject rights
- Personal-data breaches
- Retention and deletion
- Audits and compliance information
- Contact
1. Our roles
When we are controller
We act as controller for personal data where we decide the purpose and means of processing, including information about:
- Website visitors and enquiries
- Prospective and current customers
- Authorised account users
- Contracts, subscriptions and billing
- Support, service security and fraud prevention
- Our own legal and business records
When we are processor
We normally act as processor when a customer uses our Services to handle personal data about the customer’s contacts, callers, leads, website visitors, shoppers or customers.
In that relationship:
- The customer is normally the controller
- The customer decides the purpose and lawful basis
- We process personal data to provide the configured Service and follow documented instructions
- The relevant Data Processing Agreement applies
Some activities can involve separate roles. For example, we may process an end customer’s order information as processor while separately retaining a limited usage or security record as controller where necessary for billing, fraud prevention or legal compliance.
2. Data Processing Agreements
Whenever we act as processor, processing is governed by a binding Data Processing Agreement that meets the requirements of Article 28 of the UK GDPR.
For Store Sync, the published Store Sync Data Processing Agreement is incorporated into the Store Sync Terms Schedule and accepted when an authorised customer installs, subscribes to or uses Store Sync.
For another Service, the applicable Order may incorporate a service-specific DPA. If the Order does not identify one, customers can request the appropriate DPA from [email protected] before supplying personal data.
3. Customer responsibilities
As controller, the customer is responsible for:
- Identifying and documenting a lawful basis
- Giving individuals appropriate privacy information
- Obtaining consent where consent is required
- Ensuring instructions are lawful
- Limiting data to what is necessary
- Handling individual-rights requests
- Assessing high-risk processing and completing DPIAs where required
- Configuring retention, access and communications appropriately
- Informing us promptly where an instruction may create a security or legal risk
Customers must not instruct us to process personal data in breach of applicable law.
4. Our processor commitments
Where we act as processor, we will:
- Process personal data only on documented customer instructions, unless UK law requires otherwise
- Ensure authorised personnel are subject to confidentiality obligations
- Apply appropriate technical and organisational security measures
- Use subprocessors only under the applicable authorisation mechanism
- Assist with data-subject requests where reasonably possible
- Assist with security, breach, DPIA and regulatory obligations as required by law
- Delete or return personal data at the end of processing, subject to the agreement and legal retention
- Provide information reasonably needed to demonstrate Article 28 compliance
- Inform the customer if we believe an instruction infringes applicable data-protection law
5. Subprocessors
We use subprocessors for infrastructure and specialist functions. Depending on the Service, these can include:
| Provider or category | Typical purpose |
|---|---|
| HighLevel and LeadConnector | CRM, Marketplace, workflow, messaging and account functions |
| WooCommerce and customer-selected WordPress hosting | Store catalogue, order and webhook functions |
| Supabase | Database, authentication and server-side infrastructure for Store Sync |
| Lovable | Frontend application hosting and development services for Store Sync |
| Twilio and communications providers | Telephone, SMS or message delivery where enabled |
| AI and transcription providers | Language processing, voice transcription and response generation where enabled |
| Payment and Marketplace providers | Subscription and usage billing |
| Hosting, monitoring, email and support providers | Service operation, security and customer support |
The precise providers used depend on the customer’s configuration.
Where general written authorisation applies, we may appoint or replace a subprocessor after giving reasonable notice of a material change. The customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, either party may terminate the affected Service in accordance with its terms.
We require subprocessors to provide protections appropriate to their processing and impose data-protection obligations equivalent in substance to those that apply to us.
6. International transfers
Some subprocessors may process personal data outside the United Kingdom.
Where a restricted transfer occurs, we use a lawful mechanism such as:
- UK adequacy regulations
- The UK International Data Transfer Agreement
- The UK Addendum to the EU Standard Contractual Clauses
- Another mechanism permitted by UK data-protection law
We assess relevant contractual, technical and organisational safeguards where required.
7. Security measures
Our measures are selected according to processing risk and can include:
- Role-based and least-privilege access
- Authentication and secure credential management
- Encryption in transit and appropriate encryption at rest
- Tenant and account separation
- Secret, token and key protection
- Webhook authentication and replay controls
- Rate limits and abuse prevention
- Logging, audit trails and monitoring
- Data minimisation and redaction
- Backup, resilience and recovery controls
- Vulnerability management and security testing
- Incident-response procedures
- Supplier due diligence and contracts
No security programme removes all risk. Customers remain responsible for their own accounts, devices, staff access and connected platforms.
8. Data-subject rights
Requests concerning data processed for a customer should normally be sent to that customer as controller.
On receiving a documented request from the customer, we will provide reasonable assistance through available technical measures and support processes. Assistance that requires substantial custom work may be chargeable where permitted by the DPA and law.
Requests concerning data for which we are controller can be sent to [email protected].
9. Personal-data breaches
We maintain procedures to identify, investigate, contain and recover from personal-data breaches.
Where we become aware of a breach affecting personal data processed for a customer, we will notify that customer without undue delay and provide information reasonably available to support the customer’s legal obligations.
The customer remains responsible for deciding whether notification to individuals or a regulator is required where the customer is controller.
10. Retention and deletion
Personal data is retained according to the contract, Customer configuration, operational need and applicable legal obligations.
When a managed HighLevel service ends, we normally provide the Customer with a 30-day period in which to instruct us to:
- Provide an available export of Customer Personal Data
- Transfer the HighLevel account to an authorised receiving agency
- Transfer the account to an agency account controlled by the Customer
- Delete the account and Customer Personal Data
A transfer will be completed only where we are satisfied that the request is authorised and the transfer is permitted by HighLevel.
Unless the Customer requests earlier deletion, the account may remain paused or restricted during the offboarding period. Active workflows, AI agents, messaging, integrations and other processing may be disabled to prevent new processing and charges.
If the Customer does not provide an instruction within the 30-day period, we may delete the account and its contents. The Customer acknowledges that deletion of the HighLevel account may permanently remove contacts, conversations, workflows, calendars, funnels, websites, campaigns, settings and other account data.
At the end of processor services, we will delete or return personal data as required by the applicable Data Processing Agreement, unless UK law requires continued retention.
Personal data in protected backups may remain beyond ordinary use until the applicable deletion or overwrite cycle completes.
Records that we hold separately as controller, including billing, tax, fraud-prevention, security, contractual and legal records, may be retained independently under our Privacy Policy.
Store Sync operational retention periods are published in the Store Sync Privacy Notice and Documentation.
11. Audits and compliance information
We will provide information reasonably necessary to demonstrate compliance with applicable processor obligations.
Audits must:
- Be proportionate to the processing and risk
- Protect other customers and confidential security information
- Use available reports and documentation before requesting an inspection
- Be arranged on reasonable notice, except after a material incident or where a regulator requires otherwise
- Avoid unreasonable disruption
The requesting customer is responsible for reasonable audit costs unless an audit identifies our material non-compliance.
12. Contact
For privacy, DPA or data-protection enquiries:
JD Web Services Ltd trading as The Voice Concierge
104 High Street, Mold, Flintshire, CH7 1BH
Email: [email protected]