Data Processing Agreement (DPA)

    MM Studios

    This Data Processing Agreement ("Agreement") forms part of the service agreement between:

    • Controller: The Client (the business using MM Studios services)
    • Processor: MM Studios

    Scope of Processing

    MM Studios will process personal data on behalf of the Client for the purpose of:

    • Website enquiries and lead capture
    • CRM management (including GoHighLevel)
    • Marketing automation (email, SMS, follow-ups)
    • Review and referral systems
    • Analytics and performance tracking

    Types of Personal Data

    Data processed may include:

    • Name
    • Email address
    • Phone number
    • Business details
    • Enquiry information
    • Communication history

    Categories of Data Subjects

    • Prospective customers
    • Existing customers
    • Website visitors

    Processor Obligations (MM Studios)

    MM Studios agrees to:

    • Process data only on documented instructions from the Client
    • Ensure appropriate technical and organisational security measures
    • Restrict access to authorised personnel only
    • Assist the Client in responding to data subject requests
    • Notify the Client of any data breach without undue delay

    Sub-processors

    The Client authorises MM Studios to use the following sub-processors:

    • GoHighLevel (CRM and automation platform)
    • Twilio / LeadConnector (SMS and communications)
    • Mailgun or equivalent (email delivery)
    • Google (Analytics and tracking tools)

    MM Studios will ensure these providers maintain appropriate GDPR safeguards.

    International Data Transfers

    Some data may be processed outside the UK/EEA. MM Studios ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs).

    Data Retention

    Data will be retained only as long as necessary for the purposes outlined, unless otherwise instructed by the Client.

    Data Subject Rights

    MM Studios will assist the Client in fulfilling obligations relating to:

    • Access requests
    • Rectification
    • Erasure
    • Data portability

    Security Measures

    MM Studios implements:

    • Secure platforms (SSL, encrypted systems)
    • Access controls and authentication
    • Regular system monitoring

    Termination

    Upon termination of services, MM Studios will, upon request:

    • Return or delete all personal data
    • Remove access to systems

    Liability

    Each party is responsible for compliance with applicable data protection laws. The Client remains the Data Controller and is responsible for lawful data collection.

    Acceptance

    By engaging MM Studios' services, the Client agrees to this Data Processing Agreement.

    MM Studios
    Bristol, United Kingdom