Data processing agreement

Version 2 November 2026. Part of the terms between the council (controller) and NIMBOSOFT LTD (processor), under Article 28 of the UK GDPR.

What we process

Subject matter: running Nimbo Minutes for the council. Data subjects: councillors, officers, and anyone named in council records. Data: names, contact details, attendance, interests, and what is recorded in agendas, minutes and registers. Duration: while the council uses the service, and afterwards as set out in the privacy notice.

Our promises

• We act only on the council’s documented instructions (using the service is that instruction).
• Everyone who can reach the data is bound by confidentiality.
• We keep it secure: encrypted connections, separated council data, daily-checked backups, access only by named Nimbosoft staff when needed for support.
• We use these sub-processors: Hostinger (hosting and email, UK), Stripe (billing), and, only if the council allows AI help, Anthropic (United States, under the UK International Data Transfer Addendum). We’ll give 30 days’ notice of any new one, and the council may object.
• We help the council answer requests from data subjects and meet its security, breach and impact assessment duties.
• We tell the council without undue delay, and within 48 hours, of any personal data breach affecting its data.
• At the end, we delete or return the data as the council chooses, unless the law requires us to keep it.
• We give the council the information it needs to show these promises are kept, and allow reasonable audits.