Data processing agreement

This agreement is part of the Terms of service between your business (the controller) and Aarya Technologies Ltd, company number 08845253 (the processor, “we”). It covers the personal data your business puts into Loudmill about other people, and meets the requirements of Article 28 of the UK GDPR. Your business accepts it when it accepts the Terms.

1. What we process

• Subject matter and purpose: running Loudmill for your business: drafting, storing and publishing your marketing, sending your emails, showing you your customers’ comments and messages so you can answer, and reporting results.
• Duration: while your business uses Loudmill, then as in section 8.
• People: your customers and contacts; people who comment on, message or review your business; people in photos you add (only with their agreement).
• Data: names, email addresses, the business they have with you (such as a last visit), their comments, messages and reviews, and photos. Loudmill is not designed for special category data (health, beliefs and so on): don’t put it in.

2. Your instructions

We process this data only on your documented instructions: these terms and your use of Loudmill (what you upload, connect, approve and send). We won’t use it for anything else, including our own marketing or training AI. If an instruction seems to break data protection law, we’ll tell you. If the law requires us to process it otherwise, we’ll tell you first unless the law forbids it.

3. Your responsibilities

You have a lawful basis for the data you put in, give people the information the law requires (your own privacy notice), and only email people you’re allowed to (see the Terms).

4. Confidentiality and security

Everyone at Aarya Technologies who can reach your data is bound by confidentiality. We protect it with measures suited to the risk, including:

• encryption in transit (HTTPS) and at rest; access tokens for your connected accounts are encrypted again on their own;
• each business’s data kept apart from every other’s, enforced twice: in the application, and by the database itself (row-level security);
• sign-in through Google or Microsoft only, roles for each team member, a fresh sign-in for sensitive actions, and two-step verification for our own staff access;
• hosting in Microsoft Azure UK South, daily backups, request logs without personal content, automated security scanning of every change, and regular security reviews of the code (including AI-assisted reviews).

5. Subprocessors

You authorise the subprocessors on our subprocessors page. We give you at least 30 days’ notice by email before adding or replacing one; if you object on reasonable data protection grounds and we can’t resolve it, you may end the service and we’ll refund any amount paid for the time after that. Each subprocessor is bound by data protection terms at least as protective as these, and we remain responsible for them.

6. International transfers

Where a subprocessor handles data outside the UK, the transfer is covered by UK adequacy regulations (such as the UK–US data bridge for certified companies) or the UK’s International Data Transfer Agreement or Addendum.

7. Helping you

Taking into account what we process and the information we have, we help you meet your own duties under UK GDPR Articles 32 to 36:

• People’s rights: Loudmill lets you see, export, correct and remove a person’s data yourself (Contacts; Settings → Download all your data). If a person writes to us instead, we pass it to you promptly and help you answer.
• Security: we keep the measures in section 4, and tell you anything you need to know to keep your own use of Loudmill secure.
• Breaches: we tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data, with what we know, its likely effects and what we’re doing, so you can meet your own 72-hour duty to report it. We help you tell the people affected where that’s required.
• Assessments and the regulator: we give you the information you reasonably need for a data protection impact assessment, for consulting the Information Commissioner beforehand where the law requires it, and for answering any question from them.

8. At the end: return or deletion, your choice

• If you end the service, download everything first if you want it back (Settings → Download all your data), then delete your business. Deleting stops everything at once: nothing more is posted, emailed or drafted, and nobody can open it. For 7 days you can restore it, in case it was a mistake; the night after those 7 days, your data is deleted from Loudmill for good.
• If we end the service, we tell you at least 30 days ahead, and you can download everything as above. If we end it at once (for a breach of the Terms or the law), you have 30 days to ask us at hello@loudmill.com for a full copy of your data, which we make available to you before deleting it (we reopen your business, with posting switched off, for you to download it); if you don’t ask, we delete it after those 30 days.
• Once deleted for good, your data leaves our backups within a further 7 days: about 15 days from pressing Delete in all. We keep nothing else unless the law requires it, and then only what it requires.

9. Showing we comply

We make available the information reasonably needed to show we meet this agreement, and allow audits by you or an auditor you appoint, on reasonable notice, at your cost, no more than once a year unless a breach or the regulator requires it. We’ll usually answer through written information first.

10. Everything else

The Terms of service apply to this agreement, including their limits on liability, and English law. If this agreement and the Terms disagree about personal data, this agreement wins.

Last updated 7 October 2026.

Back to Loudmill · Terms of service · Privacy notice · Subprocessors