Little Moo Limited

Data Processing Agreement

The processor terms that apply where we handle personal data on your behalf.

Version: 2.0
Published: 29 August 2026
Effective: 1 September 2026. This version takes effect on that date.

Material amendments in this version. processing scope restricted to hosting and associated technical services.

Processor: Little Moo Limited, company number 16986790, Radcliffe House, Blenheim Court, Warwick Road, Solihull B91 2AA, United Kingdom. Information Commissioner's Office registration number ZC168766.

Controller: the customer identified in the Order.

Data protection contact: privacy@littlemoogroup.co.uk. General enquiries: contact@littlemoogroup.co.uk. Telephone: 0300 124 6935.

Legal Centre: https://www.littlemoohosting.com/legal/

This Data Processing Agreement forms part of the contract between Little Moo Limited and the Customer for the supply of services, and applies wherever Little Moo Limited processes personal data on the Customer's behalf. It is intended to satisfy the requirements of Article 28(3) of the UK GDPR.

Where Little Moo Limited processes personal data for its own purposes, it does so as a controller and its Privacy Policy applies instead of this agreement.

1. Definitions

1.1: In this agreement:

(a): Data Protection Legislation means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case as amended from time to time, including by the Data (Use and Access) Act 2025, together with any legislation which replaces or supplements them. Guidance and codes of practice issued by the Commissioner are not legislation, but the parties will take them into account where appropriate.
(b): UK GDPR means Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended.
(c): Commissioner means the Information Commissioner.
(d): Controller, processor, sub-processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the UK GDPR.
(e): Customer Personal Data means personal data which the Processor processes on behalf of the Customer under the Principal Agreement.
(f): Principal Agreement means the Master Terms and Conditions of Supply and any Order, Service Schedule or other agreement under which the Processor supplies services to the Customer.
(g): Restricted Transfer means a transfer of Customer Personal Data to a country or territory outside the United Kingdom which is subject to Chapter V of the UK GDPR.
(h): Transfer Mechanism means the International Data Transfer Agreement issued by the Commissioner, the UK Addendum to the European Commission's standard contractual clauses, adequacy regulations made under section 17A of the Data Protection Act 2018, or another lawful transfer mechanism recognised under Chapter V of the UK GDPR. Which mechanism applies depends on the individual supplier, the location of processing and the circumstances of the transfer.
(i): Sub-processor Register means the current list of the Processor's authorised sub-processors, maintained by the Processor and available on request from privacy@littlemoogroup.co.uk.

1.2: Terms defined in the Principal Agreement have the same meaning in this agreement unless otherwise stated. In the event of conflict between this agreement and the Principal Agreement in relation to the processing of personal data, this agreement prevails.

2. Roles of the Parties

2.1: The parties acknowledge that, in relation to Customer Personal Data, the Customer is the controller and the Processor is a processor.
2.2: The Customer is responsible for determining the purposes and means of the processing, for the lawfulness of its instructions, for having a lawful basis for the processing, for providing the information required by Articles 13 and 14 of the UK GDPR to data subjects, and for obtaining any consent required under the Privacy and Electronic Communications (EC Directive) Regulations 2003.
2.3: The Processor acts as a controller in respect of personal data it processes for its own business purposes, including account administration, billing and payment, support records and correspondence, security monitoring, abuse prevention and fraud detection, complaints handling, legal and regulatory compliance, and marketing to the Customer's business contacts. That processing is governed by the Processor's Privacy Policy and not by this agreement.
2.4: A single record may contain both categories of personal data. A support ticket, for example, may contain information the Processor holds in order to administer the account, respond to the Customer, keep a record of the matter and protect its systems, in respect of which it is a controller, and Customer Personal Data which it accesses only in order to carry out an instructed task, in respect of which it is a processor. The Processor's role depends on why and how the particular information is being processed rather than on where it is stored, and the parties will apply this agreement to the processor element and the Processor's Privacy Policy to the controller element.
2.5: Not every recipient of personal data is a sub-processor. The parties record the following roles:

(a): authorised sub-processors and software suppliers, being third parties engaged by the Processor to process Customer Personal Data on the Processor's behalf and on the Customer's instructions, listed in Annex 3 and in the Sub-processor Register, and subject to clause 7;
(b): independent controllers, being the Processor's payment providers Stripe and PayPal, which determine their own purposes and means in respect of payment data and are not sub-processors;
(c): domain registries and registrars, which receive registration data under their own registry policies and act as controllers of that data in their own right and not on the Processor's instructions;
(d): certification authorities issuing SSL certificates, which likewise act under their own policies and are not sub-processors;
(e): freelance associates and subcontractors engaged by the Processor to carry out instructed work, which are sub-processors and are engaged under written agreements imposing obligations no less protective than those in this agreement; and
(f): other recipients, being persons to whom disclosure is made because the law requires it, including courts, regulators and law enforcement authorities, which are not sub-processors.

2.6: Nothing in this agreement relieves either party of its own direct obligations under the Data Protection Legislation.

3. Scope and Details of Processing

3.1: The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex 1, which forms part of this agreement.
3.2: The Customer may update Annex 1 where the scope of the services changes, by written notice to the Processor, provided that any change which materially alters the nature of the processing is agreed in writing between the parties.
3.3: The Processor's role is to provide the services described in the Principal Agreement. The Processor does not determine the content of, or the purpose for which the Customer collects, Customer Personal Data.

4. Processing on Documented Instructions

4.1: The Processor will process Customer Personal Data only on the Customer's documented instructions, including in relation to a Restricted Transfer, unless required to process by law, in which case the Processor will inform the Customer of that legal requirement before processing unless the law prohibits it on important grounds of public interest.
4.2: The Principal Agreement, this agreement and the Customer's use of the services through the client portal, support tickets and other agreed channels constitute the Customer's documented instructions.
4.3: The Processor will inform the Customer if, in its opinion, an instruction infringes the Data Protection Legislation. The Processor is not obliged to give legal advice and the Customer remains responsible for the lawfulness of its instructions.
4.4: The Processor may refuse to carry out an instruction which it reasonably believes would put it in breach of the Data Protection Legislation or which falls outside the scope of the services.

5. Confidentiality

5.1: The Processor will ensure that every person authorised to process Customer Personal Data is subject to a binding obligation of confidentiality, whether contractual or statutory.
5.2: The Processor will limit access to Customer Personal Data to those personnel and subcontractors who need access in order to perform the services, applying the principle of least privilege.
5.3: The Processor will ensure that persons authorised to process Customer Personal Data receive appropriate guidance on their data protection responsibilities.

6. Security Measures

6.1: The Processor will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to data subjects, as required by Article 32 of the UK GDPR.
6.2: The measures in place at the Effective Date are described in Annex 2. The Processor may update those measures provided the level of security is not reduced.
6.3: The Customer is responsible for assessing whether the measures in Annex 2 are appropriate to the risk presented by its own processing, and for the security of any application, code, theme, plugin or configuration under its own control.
6.4: Encryption is applied in different ways at different layers, and the parties record the position as follows:

(a): encryption in transit is applied to data transmitted to and from the Services using transport layer security, and to administrative access and file transfer;
(b): passwords stored by the Processor in its own systems are stored in hashed form and not in plain text;
(c): server or disk level encryption, database encryption and backup encryption are provided at the infrastructure layer to the extent made available by the Processor's infrastructure supplier, and the position for a particular plan will be confirmed by the Processor on written request; and
(d): the Processor does not undertake to apply application level encryption to Customer Personal Data stored within a Customer's own website, database or mailbox, and does not control encryption applied by the Customer's own applications.

Where the Customer requires a specific encryption control which is not confirmed as being in place, this must be agreed in writing before the Service is provisioned, and may attract an additional charge and may not be available on every plan.

6.5: Where the Customer or its personnel need to supply credentials to the Processor, those credentials must be submitted through the designated secure credentials area. Access is restricted to authorised personnel and the credentials are removed when the relevant task is completed, subject to any short technical deletion or backup cycle. Passwords, payment card information and other sensitive information must not be sent in ordinary emails or in the main body of a support ticket.
6.6W: here the Order or current product description expressly includes automated backups, the Processor will arrange them in accordance with the stated cycle. Automated mailbox backup applies only where expressly included. Backups are an additional recovery measure and are not a substitute for the Customer maintaining independent backups. The Processor cannot guarantee the completeness, currency, integrity or recoverability of an individual snapshot. A reasonable charge may apply for assisted restoration work, notified to the Customer in advance.

7. Sub-processors

7.1: The Customer gives the Processor general written authorisation to appoint sub-processors, subject to this clause.
7.2: The authorised sub-processors and software suppliers at the Effective Date are listed in Annex 3. Annex 3 records the position at the date of this version. The Processor maintains the Sub-processor Register as the current and authoritative list, and will provide it on written request to privacy@littlemoogroup.co.uk. Where Annex 3 and the Sub-processor Register differ, the Sub-processor Register is the current list and the Customer's rights under clause 7.3 apply to any addition or replacement recorded in it.
7.3: The Processor will give the Customer at least 14 days' written notice of the intended addition or replacement of a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service on written notice without penalty, and the Processor will refund charges paid for any unused period.
7.4: The Processor will impose on each sub-processor, by written contract, data protection obligations that are no less protective than those in this agreement.
7.5: The Processor remains fully liable to the Customer for the performance of each sub-processor's obligations.

8. International Transfers

8.1: Customer Personal Data is primarily stored within the United Kingdom. The Processor's hosting infrastructure supplier is based in the United Kingdom.
8.2: The Processor will not carry out a Restricted Transfer of Customer Personal Data without the Customer's authorisation and without ensuring that an appropriate Transfer Mechanism is in place, together with any supplementary measures identified as necessary by a transfer risk assessment.
8.3: Annex 4 identifies any Restricted Transfer applicable to the services and the Transfer Mechanism relied on. The Transfer Mechanism is determined supplier by supplier. No single mechanism applies automatically to every recipient, and in particular the United Kingdom extension of the EU-US Data Privacy Framework applies only to a recipient which is itself certified under it and only in respect of transfers falling within the scope of that certification.
8.4: Where the Processor is required to enter into the International Data Transfer Agreement or the UK Addendum on behalf of the Customer in order to deliver the services, the Customer authorises it to do so as the Customer's agent, and the Processor will provide a copy on request.

9. Assistance with Data Subject Rights

9.1: Taking into account the nature of the processing, the Processor will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, to fulfil the Customer's obligation to respond to requests to exercise data subject rights under Chapter III of the UK GDPR.
9.2: The Processor will notify the Customer without undue delay if it receives a request from a data subject relating to Customer Personal Data, and will not respond to the request itself except on the Customer's documented instructions or where required by law.
9.3: Where the assistance requested goes materially beyond making the services and their standard functionality available, the Processor may charge a reasonable fee, notified in advance, based on the time spent.

10. Personal Data Breaches

10.1: The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours of becoming aware.
10.2: The notification will include, to the extent known at the time and updated as further information becomes available:

(a): a description of the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
(b): the likely consequences of the breach;
(c): the measures taken or proposed to address the breach and to mitigate its adverse effects; and
(d): a contact point from whom further information can be obtained.

10.3: The Processor will assist the Customer in ensuring compliance with the Customer's obligations under Articles 33 and 34 of the UK GDPR, taking into account the nature of the processing and the information available to the Processor.
10.4: The Processor will not notify the Commissioner or any data subject on the Customer's behalf unless instructed to do so in writing by the Customer, and will not make any public statement identifying the Customer in connection with a breach without the Customer's prior written consent unless required by law.
10.5: The Processor will document all personal data breaches affecting Customer Personal Data, including the facts, effects and remedial action taken.

11. Data Protection Impact Assessments

11.1: The Processor will provide reasonable assistance to the Customer with any data protection impact assessment and any prior consultation with the Commissioner which the Customer is required to carry out under Articles 35 and 36 of the UK GDPR, in each case solely in relation to the processing carried out by the Processor and taking into account the information available to it.
11.2: The Processor may charge a reasonable fee for assistance under this clause where it goes materially beyond providing information about the services, notified to the Customer in advance.

12. Audit and Information

12.1: The Processor will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR and with this agreement.
12.2: The Processor will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to the conditions in this clause.
12.3: An audit may be carried out:

(a): normally no more than once in any 12 month period, unless required by the Commissioner, following a personal data breach affecting Customer Personal Data, or where the Customer has reasonable grounds to suspect material non-compliance;
(b): on reasonable written notice, normally at least 30 days, except where urgency makes that period inappropriate;
(c): during Working Hours and in a manner that does not disrupt the Processor's business or compromise the confidentiality or security of other customers' data; and
(d): subject to the auditor entering into a reasonable confidentiality undertaking.

12.4: The Processor may satisfy an audit request by providing a completed information security questionnaire, documentation of its measures, or any third party certification or audit report held by it or by its infrastructure supplier.
12.5E: ach party bears its own ordinary costs of demonstrating compliance. Where a Customer audit requires material work beyond providing existing information and assurance records, the Processor may charge a reasonable fee agreed in advance, unless the audit reveals a material breach by the Processor.

13. Deletion and Return of Data

13.1O: n termination or expiry of the processing services, the Processor will, at the Customer’s written choice, return or securely delete all Customer Personal Data and delete existing copies, unless applicable law requires storage. The Customer should communicate its choice and complete any available export before the underlying hosting package is terminated because termination may cause immediate deletion by the infrastructure platform.
13.2T: he export functionality or assistance in clause 13.3 is subject to the following exceptions, which mirror clause 15.6 of the Principal Agreement. Where an exception applies, the Processor will tell the Customer what it can and cannot do, and why, so far as it is lawfully able. The exceptions are:

(a): where retaining or releasing the data would be unlawful;
(b): where the service was used for fraud, malware distribution or serious abuse;
(c): where providing access would create a security risk to the Customer, to the Processor or to a third party;
(d): where a court, regulator, domain registry or infrastructure supplier requires the data to remain restricted; or
(e): where the Customer has lawfully requested earlier deletion and deletion is technically possible.

13.3T: he Processor will provide reasonable export functionality or assistance before the effective termination date. No fixed post-termination access period is promised unless stated in the Order, and recovery after the underlying package has been terminated cannot be guaranteed.
13.4: Residual copies of Customer Personal Data may remain temporarily within backup systems until they are removed through the normal backup rotation cycle. Until removal, that data remains subject to this agreement and to the same access controls.
13.5: The Processor will certify deletion in writing on the Customer's written request.

14. Liability and General

14.1: The limitations and exclusions of liability in the Principal Agreement apply to this agreement. Claims arising from a breach of this agreement or of the data protection provisions of the Principal Agreement are not subject to the ordinary liability cap. They fall within the higher aggregate cap in clause 23.5 of the Principal Agreement, which applies to breaches of confidentiality, breaches of the data protection provisions, intellectual property infringement claims and loss of data resulting from a failure to perform an accepted backup obligation.
14.2: Where a personal data breach or other data protection failure results from the acts or omissions of both parties, liability between them will be allocated in proportion to each party's responsibility for the failure and for the resulting loss. Where either party is required by a regulator or a court to pay compensation, a fine or costs which are attributable in whole or in part to the other party's breach, that other party will bear the attributable proportion, subject to the caps described in clause 14.1.
14.3: Nothing in this agreement or in the Principal Agreement limits or excludes any liability which cannot lawfully be limited or excluded, including liability to a data subject under the Data Protection Legislation, liability for death or personal injury caused by negligence, liability for fraud, and liability for deliberate misconduct or wilful default.
14.4: This agreement takes effect on the Effective Date and continues for as long as the Processor processes Customer Personal Data. Clauses which by their nature should survive termination will do so.
14.5: If the Data Protection Legislation changes in a way that requires amendment of this agreement, the parties will negotiate in good faith to make the necessary amendments, and the Processor may implement changes required by law on written notice.
14.6: This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

ANNEX 1: DETAILS OF PROCESSING

Subject matter

The provision by the Processor of hosting, managed hosting, managed WordPress, business email, domain, migration, website-care, unmanaged VPS and associated technical-support services under the Little Moo Hosting brand.

Duration

For the duration of the Principal Agreement, plus the retention periods described in clause 13.

Nature of the processing

Collection, recording, organisation, structuring, storage, hosting, adaptation, retrieval, consultation, use, transmission, backup, restoration, erasure and destruction, in each case as necessary to deliver the services.

Purpose of the processing

To provide, support, secure, maintain and administer the services requested by the Customer.

Types of personal data

Depending on the services taken and the content the Customer places on them, the personal data may include: names; job titles; business and personal contact details including email address, postal address and telephone number; account credentials in hashed form; enquiry, contact form and support ticket content; customer relationship and order data held within a website or database operated by the Customer; email content and mailbox data; marketing preferences and subscriber lists; website user account data; internet protocol addresses, device and browser information and server log data; images and other content published by the Customer; and domain registrant contact details.

The Customer must not place special category data or criminal offence data on the services without first notifying the Processor in writing.

Notification alone does not mean that the service is suitable for special category data or criminal offence data. On receiving a notification the Processor will consider whether the service is suitable and what additional safeguards would be required. Additional safeguards may be needed, may attract an additional charge, and may not be available on every plan. The Processor may decline to process such data where it considers the service unsuitable, and may require the data to be removed.

The Customer remains responsible for identifying a lawful basis under Article 6 of the UK GDPR and, in addition, a condition under Article 9 of the UK GDPR or under Schedule 1 to the Data Protection Act 2018, as applicable, before placing such data on the services.

Categories of data subject

The Customer's own customers and prospective customers; visitors to and registered users of the Customer's website; the Customer's employees, officers, contractors and suppliers; enquirers and correspondents; newsletter and mailing list subscribers; and domain registrant and technical contacts.

ANNEX 2: TECHNICAL AND ORGANISATIONAL MEASURES

Access control

Role based access control; the principle of least privilege; individual named accounts for administrative access; multi-factor authentication on administrative and client portal accounts where supported; prompt removal of access when a person leaves or changes role; secure password management using a password manager.

Transmission and network security

Transport layer security for data in transit; SSL certificates on hosted sites; secure protocols for file transfer and administrative access; firewalling and rate limiting at the infrastructure layer as provided by the infrastructure supplier.

System security

Regular application of operating system, control panel, application and plugin updates within the scope of the plan purchased; malware scanning on hosting infrastructure; hardening of server configuration by the infrastructure supplier.

Availability and resilience

Hosting on infrastructure operated by a United Kingdom based supplier; automated backups and restore procedures where expressly included in the relevant Order or Service Description; monitoring and alerting appropriate to the Service.

Logging and monitoring

Retention of server, access and error logs for the periods described in the Privacy Policy; alerting on unusual activity; investigation of abuse reports.

Organisational measures

Written confidentiality, intellectual property and data protection obligations in contracts with staff, freelance associates and subcontractors; guidance for personnel on handling personal data; a documented incident and breach response process; due diligence on new processors before appointment; data minimisation in support and project workflows.

Deletion

Deletion of data from live systems on termination in accordance with clause 13; removal of residual backup copies in accordance with the backup rotation cycle.

Limitations

Encryption controls vary according to the technical layer and the infrastructure available for the relevant Service. Encryption in transit is applied using transport layer security. Passwords stored in Little Moo Limited's own systems are stored in hashed form. Server or disk level encryption, database encryption and backup encryption are provided to the extent made available by the infrastructure supplier and applicable to the relevant plan. Little Moo Limited does not undertake to apply application level encryption to data stored within a Customer's own website, database or mailbox unless expressly agreed in writing. This annex is to be read consistently with clause 6.4.

The Processor does not carry out penetration testing of Customer applications as a standard service. The Customer is responsible for the security of code, themes, plugins and configuration under its own control, and for its own backups.

ANNEX 3: AUTHORISED SUB-PROCESSORS AND SOFTWARE SUPPLIERS

The Customer gives general written authorisation for the Processor to use the authorised sub-processors identified in the current Sub-processor Register. The register states each provider, its processing purpose, relevant processing location and applicable international transfer safeguard. It is available at the stable location published in the Legal Centre or on request from privacy@littlemoogroup.co.uk.

The Sub-processor Register is the current and authoritative list. The Processor will give the Customer at least 14 days written notice of an intended addition or replacement and the objection and termination rights in clause 7.3 apply.

Payment providers, domain registries, domain registrars and SSL certification authorities are not treated as sub-processors where they determine their own purposes and means and act as independent controllers. Courts, regulators and law-enforcement bodies are also not sub-processors.

ANNEX 4: INTERNATIONAL TRANSFERS

Customer Personal Data held within the hosting environment is stored in the United Kingdom.

Certain authorised sub-processors and software suppliers listed in Annex 3 may process limited personal data outside the United Kingdom in the course of providing software as a service platforms, including support, licensing, billing, email and accounting systems. The processing location and transfer mechanism applicable to each are set out in Annex 3 and are recorded in the current Sub-processor Register.

Where such a transfer is a Restricted Transfer, the Processor relies on the Transfer Mechanism made available by the relevant supplier. Which mechanism applies is determined supplier by supplier and depends on the location of processing and the circumstances of the transfer. It may be adequacy regulations made under section 17A of the Data Protection Act 2018, the International Data Transfer Agreement, the UK Addendum to the European Commission's standard contractual clauses, or, only where the recipient is itself certified and only in respect of transfers within the scope of that certification, the applicable United Kingdom extension of the EU-US Data Privacy Framework. No mechanism applies automatically by reason only of the recipient being located in a particular country.

The Processor will provide details of the Transfer Mechanism relied on for a particular authorised sub-processor or software supplier on written request to privacy@littlemoogroup.co.uk, and records that mechanism in the Sub-processor Register.

Where the Customer requires that no Restricted Transfer takes place in relation to a particular service, the Customer must notify the Processor in writing before the service is provisioned, and the parties will agree whether the service can be delivered on that basis.

EXECUTION

This Data Processing Agreement forms part of the Principal Agreement and takes effect without the need for signature. Where the Customer requires a signed counterpart, it may be executed as follows.