Action Spaces — Data Processing Agreement
Updated: 6 October 2026
Scope and roles
This DPA forms part of a written customer agreement or order that incorporates it. Publishing this page alone does not create an agreement. It applies between Normtech Ltd, trading as Action Spaces (company 17105378, Castle House, Silver Street, Wethersfield, Essex, CM7 4BP), and the customer named in that agreement. Contact: [email protected].
“Customer data” means personal data in workspace content, inputs, outputs and related records, including copies used for authorised support. The customer is the controller and Normtech its processor, or the customer is a processor and Normtech its subprocessor acting with the controller's authority. Each party complies with applicable UK and EU GDPR and the UK Data Protection Act 2018. This DPA takes precedence over conflicting agreement provisions concerning this processing.
Normtech's independent processing of relationship, account and security information is described in the Privacy Notice.
Processing particulars
| Item | Details |
|---|---|
| Subject and purpose | Providing the business AI workspace service and authorised support |
| Duration | The customer agreement and the limited return/deletion period below |
| Operations | Collection, storage, organisation, retrieval, embeddings, search reranking, inference, generation of outputs, export and deletion |
| Data subjects | Customer personnel, clients, contacts and other individuals included in customer data |
| Data types | Customer-selected identifiers, contact and business information; messages, documents, project context, saved memories, repository code, ticket records and artifacts; temporary audio for transcription |
| Excluded data | Special-category data and personal data relating to criminal convictions or offences |
Instructions and customer responsibilities
Normtech processes customer data only on documented instructions, including the agreement, authorised service configuration and user actions, and written support requests. We do not use it for model training, unrelated evaluation or product improvement, and require AI providers processing customer data to do so on a no-training basis. Staff content access is limited to service delivery and authorised support.
The customer is responsible for lawful instructions, appropriate notices and lawful bases, and for ensuring it may supply the data. A customer acting as processor must have its controller's authority. Customers must not submit the excluded data above.
Normtech will immediately inform the customer if an instruction appears to infringe applicable data protection law. Processing outside instructions is permitted only where required by UK law under the UK GDPR or by EU or Member State law under the EU GDPR, as applicable. We will notify the customer before that processing unless the relevant law prohibits notice.
Confidentiality and security
Personnel authorised to process customer data must be bound by confidentiality obligations. Access is limited to what is necessary. Normtech implements appropriate technical and organisational measures under Article 32, taking account of risks, the nature of processing, available technology and implementation costs. The measures include:
| Area | Measures |
|---|---|
| Account and workspace access | Clerk authentication, role-based access and tenant-scoped database access |
| Agent execution | Isolated execution environments; provider credentials kept outside agent pods |
| Integrations | Protection of integration tokens and scoped access to authorised repositories |
| Diagnostics | Configuration and scrubbers to reduce sensitive information in error reports and traces |
| Operational handling | Controlled support access, secure return, deletion and recovery procedures |
These measures are maintained and adapted to the risks; this schedule does not assert a certification.
Assistance and incidents
Taking account of the nature of processing, Normtech assists with requests to exercise data-subject rights. We promptly pass customer-data requests to the customer and do not respond substantively without instructions unless legally required.
Taking account of available information, we assist the customer with security obligations, breach reporting, data protection impact assessments and prior regulatory consultation under Articles 32–36.
We notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data. We provide available information about its nature, affected data and individuals, likely consequences, mitigation and a contact point. Missing information is supplied in phases as it becomes available, and we cooperate with the customer's response.
Suppliers and subprocessors
The customer gives general written authorisation for the suppliers below to process personal data on its instructions. Normtech imposes equivalent applicable data protection obligations by written contract and remains responsible for subprocessors' performance.
| Supplier | Role | Processing location |
|---|---|---|
| DigitalOcean | Hosting, database and object storage for customer content; self-hosted Umami analytics | Frankfurt hosting; wider provider support may involve other locations |
| Baseten | AI inference for task context and outputs, on a no-training basis | US |
| Voyage AI | Knowledge-base embeddings and search reranking of document excerpts, queries and candidate document text | Provider-operated services, which may involve US processing |
| Clerk | Authentication, accounts and invitations | Provider-operated services, which may involve US processing |
| Sentry | Scrubbed error and performance diagnostics, which may still contain personal data | Provider-operated services, which may involve US processing |
DigitalOcean, Baseten and Voyage AI process workspace content. Clerk and Sentry principally support account and operational processing; this authorisation covers them to the extent they process customer personal data on instructions. Umami is self-hosted software, not a separate external recipient. Customer-selected GitHub integrations operate under the customer's authorisation and arrangements with GitHub.
We give reasonable advance written notice of a new or replacement subprocessor before it processes customer data, allowing time for an objection on reasonable data protection grounds. We work with the customer to resolve an objection before that processing starts and keep this list current.
International transfers
Before making a restricted transfer outside the UK or EEA, Normtech must ensure applicable Chapter V safeguards, including an adequacy decision or EU Standard Contractual Clauses with a UK Addendum or International Data Transfer Agreement where required. We provide information about the relevant arrangements on request. This DPA does not itself execute or complete those separate transfer instruments.
Return and deletion
The customer can request a secure export during the agreement without erasure. On an authorised deletion request or termination, the customer chooses return followed by deletion, or deletion without return. We arrange requested return in a commonly used machine-readable format before erasure, and delete live customer data and copies within 30 days of an authorised deletion request or the agreement ending, except where law requires retention. We explain any legally required retention and protect the retained information.
Return and deletion may be performed manually. Workspace archive or delete controls do not by themselves establish complete erasure. On request we confirm completion in writing.
Protected backup copies expire on the documented provider backup cycle. Normtech must disclose and agree that cycle with the customer before accepting customer content. Pending expiry, backups are isolated from ordinary use, remain protected under this DPA and are accessed only for recovery or legally required purposes. If restored, outstanding erasure instructions are reapplied before ordinary processing resumes.
Accountability and audits
Normtech makes available information necessary to demonstrate compliance with this DPA and Article 28, and allows and contributes to audits, including inspections, by the customer or its mandated auditor. The parties coordinate reasonable timing, confidentiality and protection of other customers' information without preventing statutory audit rights.
Processing questions, instructions and requests should be sent to [email protected].