Data Processing Agreement
Last updated: 19 July 2026 · v2026-07.2 · Version 2026-06
For business/Team customers — controller/processor terms under UK GDPR Art. 28.
Effective: 2026-07-19
This DPA applies where Stacklab X Ltd ("Processor") processes personal data on behalf of a business customer ("Controller") and forms part of the agreement between the parties. It reflects Article 28 UK GDPR.
1. Subject matter & duration
The Processor processes personal data solely to provide the JaguarVPN service for the duration of the customer agreement.
2. Nature & purpose
Provision of VPN and account services; the categories of data subjects are the Controller's authorised users, and the data is limited to account and service metadata (no browsing activity is logged).
3. Processor obligations
The Processor shall: (a) process personal data only on documented instructions; (b) ensure personnel are bound by confidentiality; (c) implement appropriate technical and organisational measures (TOMs — encryption, access control, integrity monitoring); (d) assist the Controller with data-subject requests and with security, DPIA and breach obligations; (e) delete or return personal data at the end of the service.
4. Sub-processors
The Controller authorises the use of vetted sub-processors (e.g. payment processors, cloud/hosting, email). The Processor imposes equivalent data-protection obligations on them and remains liable for their performance. A current list is available on request; we give notice of intended changes.
5. International transfers
Any transfer outside the UK relies on adequacy or appropriate safeguards (UK IDTA / SCC Addendum).
6. Personal data breach
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
7. Audit
The Processor makes available information necessary to demonstrate compliance and allows for reasonable audits.
8. Deletion & return
On termination, personal data is deleted or returned per the Controller's choice, save where retention is required by law.