Data Processing & Security
Information for organisations reviewing data protection responsibilities before contracting.
Last updated: 6 November 2026 · i360 DigiTech Limited · Contact: hello@i360digitech.uk
Controller and processor roles
For customer-managed workspace content, the customer will generally determine purposes and means of processing and i360 DigiTech Limited will generally process data on documented instructions. A signed Article 28-compliant DPA must be executed where required before production customer data is processed.
DPA commitments to agree
The DPA should specify subject matter, duration, nature and purposes of processing, data-subject categories, data types, confidentiality, security measures, subprocessor authorisation, international transfers, assistance with rights requests and DPIAs, breach notification, audits and deletion or return of data.
Technical and organisational measures
Security controls to verify and document include encryption in transit and at rest, tenant isolation, role-based access, MFA options, secure development and patching, access logging, backups and restore testing, incident response and vulnerability management. No unverified certification or data-residency promise is made here.
International customers
UK GDPR and the Data Protection Act 2018 may apply, alongside EU GDPR and other local privacy laws depending on customer location and processing. Customers should confirm their regulatory and sector-specific requirements before deployment.
Request contractual documents
Contact hello@i360digitech.uk to request the customer DPA, security schedule, subprocessor list and international-transfer details. These documents require completion and approval before paid onboarding.