I am one person, so the paperwork is where the rigour shows. Below is how I handle personal data, every processor that touches it, the contract I work under, and the clauses I will not sign. Read it now instead of during week three of onboarding.
Six things, in the order a security reviewer asks them.
Project files, deliverables and decision logs live in your Microsoft 365 or Google tenant, under your retention rules. Anything sent by email is moved there within five business days and deleted from my mailbox. I do not keep a working copy in personal cloud storage.
This website and its database are hosted by Contabo in Karlsruhe, Germany — covered by the UK’s adequacy regulation, so no transfer instrument is needed. The GitLab server is in Portsmouth, UK: no transfer arises at all. Client engagement data is governed by the register below, which is a different list.
Only paid, API or enterprise tiers. No use of your inputs for model training, retention set to the minimum the provider offers, and zero data retention enabled where it is available. I send extracts rather than complete records wherever the task allows, and no output reaches you without my review.
Access control is not a policy here, it is a fact of the business. Devices and storage are encrypted, authentication is passkey or hardware-backed, and there is no support team, no offshore subcontractor and no shared drive.
From the moment I become aware, not from the moment it happened. Where a hosting provider is the source of the incident I also run independent monitoring on both servers, because a provider’s contractual notice period is not a channel you can rely on.
Complete UK residency of all processing is not achievable with the AI tooling this work requires, and I will not write a clause that says otherwise. What I can show is control: named providers, named locations, named transfer mechanisms, and your files outside all of it.
The article 32 measures in force today. Written as controls rather than as assurances, because that is the form a security questionnaire asks for.
Listed so that a reviewer does not have to discover them by asking.
Two separate registers, because these are two different processing operations and conflating them is how most vendor registers go wrong.
This is Annex 1 to Schedule 4 of the master agreement. It carries a general written authorisation, 30 days’ notice of any change, and a right to object on data protection grounds. Providers marked as available are listed so they can be switched on for UK-region processing without a fresh notice period — they are not in use today.
Client files: Project deliverables, working files and decision logs live in your own Microsoft 365 or Google Workspace tenant under your retention rules. The data never leaves your environment. Your tenant is your own infrastructure as controller, not a sub-processor.
| Provider | Purpose | Data handling | Location | Transfer mechanism |
|---|---|---|---|---|
Google Workspace Google Cloud EMEA Limited | Email, calendar and meetings. Mailbox copies are deleted within five business days | — | EU (Ireland), US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Google Cloud (Gemini, Vertex AI) Google Cloud EMEA Limited | Drafting and review. Paid tier only; no training on inputs | — | EU, US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
OpenAI OpenAI OpCo, LLC | Drafting and summarising | No training on inputs. Retained only for abuse monitoring | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Anthropic Anthropic, PBC | Drafting and review | No training on inputs | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
OpenRouter OpenRouter, Inc. | Model routing. European endpoint, Google models excluded for client data | Zero Data Retention (ZDR) enabled; no training on inputs | EU (European endpoint), US | UK Addendum to the EU SCCs |
Notion Notion Labs, Inc. | Meeting notes, discovery logs, deliverable drafts | — | US | UK extension to the EU–US Data Privacy Framework |
GitHub GitHub, Inc. (Microsoft) | Repository access for technical review | — | US | UK extension to the EU–US Data Privacy Framework |
Xero Xero (UK) Limited | Invoices, expenses and financial records | — | UK | No transfer outside the UK |
Azure OpenAIAvailable, not active Microsoft Ireland Operations Limited | UK-region inference, available if you require it | — | UK South, EU | None where processing stays in UK South; otherwise UK IDTA |
Amazon BedrockAvailable, not active Amazon Web Services EMEA SARL | Claude in the London region, available if you require it | — | UK (London), EU, US | None where processing stays in London; otherwise UK IDTA |
A materially different list, for a different role. The master agreement’s Schedule 4 does not cover this processing, and should not be read as though it does.
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
Contabo GmbH Contabo GmbH | Application hosting and database. The GitLab server is separately in the UK | Karlsruhe, Germany — UK adequacy applies | Adequacy: no transfer instrument needed |
Stripe Stripe Payments Europe, Limited (Stripe Payments UK Ltd as additional party) | Card payments and checkout. Card details never reach this server | EU (Ireland), US | UK extension to the EU–US Data Privacy Framework; UK IDTA as fallback |
Google Analytics 4 Google Ireland Limited | Consent-gated usage analytics. Consent Mode v2 defaults to denied | EU, US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Gmail SMTP Google Cloud EMEA Limited | Transactional email: enquiries, invoices, bookings, newsletter | EU (Ireland), US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Sanity Sanity.io, Inc. | Blog and case-study content. Editor accounts only; no visitor data | US, EU | UK IDTA; UK extension to the EU–US Data Privacy Framework |
OpenAI OpenAI OpCo, LLC | Chat assistant, content embeddings and article narration | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Anthropic Anthropic, PBC | Chat assistant inference | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Pinecone Pinecone Systems, Inc. | Vector index used to retrieve published content for the assistant | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Sentry Functional Software, Inc. | Error monitoring in production only | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
ElevenLabs ElevenLabs Inc. | Text-to-speech narration of published articles | US | UK IDTA; UK extension to the EU–US Data Privacy Framework |
Telegram Telegram Messenger Inc. | Operational notifications: new enquiries and payment events | Various | UK IDTA; transfer risk assessed |
Provider-level evidence — the accepted DPA, the date of acceptance and the saved copy — is kept on file and available on request. A link to a provider’s current terms is not evidence, because providers revise them without notice.
Commercial boundaries stated clearly in advance to save both sides weeks of redlining.
If you have your own paper, use it. I will work under your master agreement and your NDA. I keep three things through the redlines: the liability cap tied to fees, the disclosure of conflicts and commissions, and the position that the appointment decision is yours and the advice is mine. Everything else is negotiable.
Published in full, as printable PDFs. No form, no gate, no sales call first. The rate card is the only thing redacted, and the copy says so where it happens.
The Article 28 terms that apply when I process personal data on your behalf, with the authorised sub-processor list annexed.
It is the document your DPO will ask for. Ask for it on day one and read it before the second procurement review, not after.
Identical to Schedule 4 of the master agreement, so the two cannot drift.
The framework contract: scope, fees, intellectual property, liability, conflicts of interest, confidentiality and data protection.
Each piece of work is commissioned by a signed statement of work under this agreement. Nothing is provided on a handshake.
Schedule 2 (rates) is redacted: rates are quoted per statement of work.
A symmetric confidentiality agreement, three-year term for ordinary confidential information and indefinite for identified trade secrets.
Sign it before the conversation gets specific. Mutual, non-exclusive, with a permitted-disclosure carve-out for vendors in a procurement exercise.
The terms that attach to work bought through an invoice: scope, payment, warranty, intellectual property and the liability cap.
This is the contract for small pieces of work bought without a full master agreement. Its liability cap is the same as the master agreement, so the two cannot contradict each other.
How this website handles personal data as a controller: enquiries, bookings, invoices, the newsletter and analytics.
This is the notice that covers the website. It is deliberately separate from the DPA, which only covers client work.
The rules for using this site, and the intellectual property position on its content.
Standard, and short. It does not govern paid work.
All engagements contracted directly through this site are with Ihor Chyshkala as a sole trader.
All engagements contracted directly through this site are with Ihor Chyshkala as a sole trader. Outside the off-payroll working rules (IR35) that apply to personal service companies, though a client is still entitled to run its own status check.
These documents are commercial templates, not legal advice, and reading this page does not create a contract or an engagement. Work is commissioned only by a signed statement of work under a signed master agreement.