Legal · Connected pilots
Data-processing terms
A connected pilot needs a signed, scope-specific DPA. This page states the required contents without pretending a generic public page is an executed agreement.
Last updated 28 August 2026
When a DPA is needed
Before WhoActs processes personal data on a customer’s instructions, the parties must identify their controller and processor roles and sign data-processing terms. The public website privacy notice covers only website and enquiry processing.
Required schedule
- Subject matter, duration, nature and purpose of the processing.
- Categories of personal data and data subjects.
- Customer instructions, confidentiality and authorised access.
- Security measures, incident notification and assistance obligations.
- Sub-processors, hosting regions and international-transfer mechanism.
- Return, deletion, audit and end-of-service arrangements.
Current boundary
No production hosting region, sub-processor list, retention schedule or key-custody model is promised on this page. Those details depend on the connected architecture and must be agreed before customer personal data enters a pilot.
How to obtain terms
A suitable organisation can request the DPA schedule during pilot scoping. Robert Prime will map the data flow with the customer’s legal and security stakeholders before terms are signed.
Contact Robert Prime before sending sensitive information.
Email rob@mrprime.com