Last updated 4 August 2026. When you put your customers' details into Result Studio, you are the data controller and we are the processor. This sets out what that means in practice, and lists every third party involved.
You are the controller of the personal data you put into Result Studio: your customers, their contact details, your correspondence with them. You decide what to collect and why.
Heppleston Ltd is the processor. We hold and process that data only to provide the service to you, and only on your instructions. Using the product is the instruction.
This agreement forms part of our terms of service and takes effect when you create a workspace. It is written to satisfy Article 28 of the UK GDPR.
| Subject matter | Providing the Result Studio CRM, helpdesk, project, chat and invoicing service. |
|---|---|
| Duration | For as long as your workspace is open, plus up to 90 days afterwards. |
| Nature and purpose | Storing, organising, retrieving, transmitting and deleting data so that you can run your business. |
| Categories of data subject | Your customers and prospects, your staff, and anyone who contacts you through a form or live chat on your website. |
| Categories of personal data | Names, contact details, correspondence, notes, files you upload, activity and appointment records, invoice and payment records, and IP addresses of chat visitors. |
| Special category data | Not intended. Result Studio is not designed for health records or other special category data, and you should not use it as a clinical or safeguarding system. If you choose to record such data anyway, you remain responsible for the lawful basis and any additional safeguards. |
We will:
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours, with what we know at that point: what happened, which categories of data and roughly how many records are involved, the likely consequences, and what we are doing about it. We will keep you updated as we learn more.
Reporting to the ICO is your responsibility as controller, since it is your relationship with the individuals concerned. We will give you what you need to do it within the statutory 72 hours.
We keep this list short deliberately. These are the only third parties who may handle personal data on our behalf.
| Provider | Purpose | Location |
|---|---|---|
| 20i Ltd | Hosting and infrastructure for the application and databases | United Kingdom |
| Postmark (ActiveCampaign) | Sending transactional email such as invites, password resets and invoice reminders | United States, under standard contractual clauses |
| Google LLC | Calendar and mailbox synchronisation, only where you connect your own Google account | United States, under standard contractual clauses |
| Apple Inc | Push notification delivery to iPhones, only where you enable notifications | United States, under standard contractual clauses |
We will update this page before adding a sub-processor. If you object to a new one on reasonable data protection grounds, tell us and we will either find an alternative or let you leave without penalty.
Your workspace data is stored in the United Kingdom. The transfers that do occur are limited to the sub-processors listed above, and are covered by the UK International Data Transfer Addendum or standard contractual clauses.
We do not currently hold ISO 27001 or SOC 2 certification, and we say so plainly on our security page. In place of an audit report, we will answer security questionnaires properly and in writing, and we will tell you honestly where a control does not exist rather than describing an aspiration.
Data protection questions go to our contact page, or Heppleston Ltd, Floor 1, Lindpet House, Grantham, Lincolnshire, NG31 6LJ.
