Data processing agreement
These terms were last updated on August 2026
Scope and application
This Data Processing Agreement (the “DPA“) applies between WP Feedback Limited (trading as Atarim), a company registered in England and Wales with company number 12010526, whose registered office is at 28 Kipling Way, Borehamwood, Hertfordshire WD6 2FS (“Atarim“, “we“, “us“), and you, the customer using the Atarim platform (the “Customer“, “you“).
This DPA forms part of, and is incorporated into, the Atarim Terms and Conditions. It takes effect on the date you accepted those Terms and continues for as long as we process personal data on your behalf. No signature is required.
It governs our processing of personal data that you and your users submit to or generate within the Atarim platform, for which you are the controller and we are your processor.
If you require a countersigned copy, or if your organisation needs bespoke variations, contact us at operations@atarim.io. Reseller partners and enterprise customers enter into a separate executed version of this DPA which additionally covers the independent controller relationship between the parties.
1. Definitions and Interpretation
1.1 In this DPA:
Data Protection Laws: the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), and any other data protection or privacy law applicable to a party.
EU SCCs: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
Platform: the Atarim V5 platform.
Platform Data: personal data that you, or a user acting on your behalf or invited by you, submit to or generate within the Platform, including the categories set out in Annex 1.
Sub-processor: a third party we engage to process Platform Data.
Terms: the Atarim Terms and Conditions published at atarim.io/terms-and-conditions.
UK Addendum: the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner under section 119A of the Data Protection Act 2018.
UK Extension: the UK Extension to the EU-US Data Privacy Framework.
1.2 The terms controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the UK GDPR.
1.3 Headings do not affect interpretation. The Annexes form part of this DPA.
2. Roles
2.1 In respect of Platform Data, you are the controller and we are your processor.
2.2 You are responsible for: (a) establishing and maintaining a lawful basis for the processing; (b) providing the information required by Data Protection Laws to the individuals concerned, including individuals whose personal data is captured incidentally as described in Annex 1; and (c) the accuracy and lawfulness of the personal data you submit to the Platform.
2.3 We act as controller in our own right, and not as your processor, in respect of the limited processing described in clause 12. That processing falls outside this DPA except where clause 12 states otherwise.
2.4 The details of processing required by Article 28(3) UK GDPR are set out in Annex 1.
3. Processing on Documented Instructions
3.1 We will process Platform Data only on your documented instructions, including in relation to international transfers, unless required to do otherwise by law to which we are subject. Where we are required to process for such a legal reason, we will inform you of that requirement before processing, unless the law prohibits us from doing so.
3.2 Your documented instructions comprise: (a) this DPA; (b) the Terms; and (c) your configuration and use of the Platform’s features, including whether you enable optional features that transmit data to Sub-processors.
3.3 We will inform you if, in our opinion, an instruction infringes Data Protection Laws.
4. Confidentiality of Personnel
4.1 We will ensure that persons authorised to process Platform Data are subject to a duty of confidence, whether by contract or by statutory obligation.
4.2 We will ensure that access to Platform Data is limited to those personnel who require access in order to perform our obligations.
5. Security
5.1 We will implement and maintain the technical and organisational measures set out in Annex 2, which are appropriate to the risk taking into account the matters set out in Article 32 UK GDPR.
5.2 We may update the measures in Annex 2 from time to time, provided that no update will materially reduce the overall level of protection.
5.3 We hold a SOC 2 Type 2 report in respect of the Security trust services category, as described in Annex 2.
6. Sub-processors
6.1 You give us general written authorisation to engage the Sub-processors listed in Annex 3.
6.2 We will impose on each Sub-processor data protection obligations that are no less protective than those set out in this DPA, including an obligation to impose equivalent obligations on any further sub-processor it engages, and we remain fully liable to you for the acts and omissions of our Sub-processors.
6.3 Change notification. We will give at least 30 days’ notice before adding or replacing a Sub-processor. Notice is given by updating Annex 3 and by email or a subscribable update mechanism we make available. You can subscribe to those notifications at operations@atarim.io.
6.4 Emergency replacement. Where a Sub-processor becomes unavailable, insecure, or otherwise unable to perform, and immediate replacement is necessary to maintain the security or continuity of the Platform, we may engage a replacement without the notice period in clause 6.3. We will notify you as soon as reasonably practicable and in any event within 5 business days, and clause 6.5 then applies from the date of that notice.
6.5 Objection. You may object to a Sub-processor on reasonable data protection grounds by written notice within 14 days of our notice. We will discuss your objection in good faith. If we cannot resolve it within 30 days, you may terminate your subscription on written notice without penalty, with access continuing to the end of the period for which fees have been paid.
6.6 Artificial intelligence models. Our AI features other than embeddings route through a single gateway provider, which is the Sub-processor listed in Annex 3 for that purpose. The gateway determines which underlying model serves a given request. We have no direct contractual relationship with those underlying models; they are engaged by the gateway provider and are its sub-processors, and clause 6.2 applies to them accordingly.
6.7 We configure the gateway so that requests are routed only to endpoints operating on a zero data retention basis, meaning the endpoint does not retain the prompt or the response. A change in the underlying model serving a request is not a change of Sub-processor for the purposes of clause 6.3, and does not require notice, provided the routing configuration in this clause 6.7 is maintained.
7. Data Subject Rights
7.1 Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests to exercise data subject rights under Chapter III UK GDPR.
7.2 Where we receive a request directly from a data subject in respect of Platform Data, we will not respond substantively and will forward the request to you without undue delay.
7.3 Where a reseller partner provisioned your account and a request reaches that partner, the partner is required to forward it to us within three business days without responding substantively, and we will then assist you under clause 7.1.
7.4 The scope and limits of erasure described in clause 11 apply to our assistance under this clause.
8. Impact Assessments and Prior Consultation
8.1 Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments under Article 35 UK GDPR and prior consultation with a supervisory authority under Article 36 UK GDPR.
8.2 Assistance under this clause is limited to information relating to the Platform and our processing, and does not extend to your own processing or purposes.
9. Personal Data Breach
9.1 We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Platform Data.
9.2 The notification will describe, to the extent known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where the information is not all available at once, we will provide it in phases without undue further delay.
9.3 We will provide reasonable assistance in connection with your obligations under Articles 33 and 34 UK GDPR.
9.4 We will not notify any supervisory authority or data subject on your behalf unless required to do so by law or instructed by you in writing.
10. Audit and Information Rights
10.1 We will make available to you the information necessary to demonstrate compliance with Article 28 UK GDPR.
10.2 We will satisfy that obligation by providing, on request and no more than once in any 12 month period:
(a) our then current SOC 2 Type 2 report, subject to the restricted use provisions of that report and to a confidentiality undertaking;
(b) a completed security questionnaire in a reasonable industry-standard format; and
(c) written responses to reasonable questions relating to our processing of Platform Data.
10.3 Where the information provided under clause 10.2 is not sufficient to demonstrate compliance, or following a personal data breach affecting you, you may request an audit. Any such audit will be: (a) on at least 30 days’ written notice; (b) during normal business hours; (c) conducted so as to minimise disruption; (d) subject to confidentiality obligations; (e) no more than once in any 12 month period unless required by a supervisory authority; and (f) at your cost, save where the audit reveals a material breach by us.
10.4 An audit does not extend to other customers’ data, to our internal pricing or commercial information, or to the premises or systems of a Sub-processor.
11. Deletion and Return
11.1 This clause describes what we do with Platform Data on deletion, and the limits of what deletion reaches.
11.2 Account records. On deletion of a user account, the identifying fields in the account record, including name, username and email address, are replaced with a non-identifying placeholder.
11.3 Workspace records. Workspaces are deleted from our database.
11.4 Triggers and timetable. We will complete the steps in clauses 11.2 and 11.3:
(a) within 30 days of a deletion request made by you or by a user;
(b) within 90 days of the expiry or termination of your subscription, including where a reseller partner revokes a licence through the partner dashboard; and
(c) within 90 days where deletion is triggered by account inactivity rather than by a request.
11.5 What deletion does not reach. The following are not deleted by the operations described in clauses 11.2 and 11.3, and are retained:
(a) image objects and file attachments held in object storage;
(b) derived data held in the recall store;
(c) cached artificial-intelligence responses held at the edge, until they expire in the ordinary course;
(d) activity log records, which are retained as described in Annex 1; and
(e) any data previously synchronised, at your instruction, to a third-party tool you connected, which is thereafter governed by your own arrangements with that tool.
11.6 Backups. Platform Data may persist in our routine backups after deletion, and is deleted when those backups cycle out in the ordinary course. Backup retention is 7 days.
11.7 We will provide written confirmation of the steps taken under this clause on reasonable request.
11.8 Where you require the return of Platform Data before deletion, we will make it available through the export functionality of the Platform, or by another reasonable means agreed between us, before the deletion steps in this clause are carried out.
11.9 Nothing in this clause requires us to delete personal data that we are required by law to retain.
12. Processing Where We Act as Controller
12.1 We act as a controller in our own right, and not as your processor, in respect of:
(a) product analytics and feature usage data, collected to operate, secure and improve the Platform;
(b) error and diagnostic data, collected to detect and resolve faults;
(c) account, billing and subscription records; and
(d) lifecycle communications and customer relationship records relating to our own account holders.
12.2 We are responsible for our own lawful basis, privacy information and data subject rights handling in respect of that processing. Our Platform Privacy Notice explains it.
12.3 The recipients we use for that processing are listed separately in Annex 3, Part 2. Retention is set out in Annex 1, section 8.2.
12.4 We do not use Platform Data for the processing described in clause 12.1 beyond what is described in Annex 1.
13. International Transfers
13.1 Platform Data is stored in the primary locations set out in Annex 2. We transfer Platform Data to the Sub-processors listed in Annex 3, in the locations stated there.
13.2 Where a transfer of Platform Data is a restricted transfer under Data Protection Laws, we will ensure an appropriate transfer mechanism is in place, being one of:
(a) a finding of adequacy applicable to the destination;
(b) the UK Extension, where the recipient is certified under the EU-US Data Privacy Framework and the transfer is subject to UK law;
(c) the EU SCCs (Module Two, controller to processor, or Module Three, processor to processor, as applicable), together with the UK Addendum where the transfer is subject to UK law; or
(d) another mechanism recognised under Data Protection Laws.
13.3 The mechanism relied on for each Sub-processor is stated in Annex 3.
13.4 Where we rely on the EU SCCs or the UK Addendum, we carry out and maintain a transfer risk assessment in respect of the relevant recipient, and will make a summary available to you on reasonable request.
13.5 Where a Sub-processor’s certification under the EU-US Data Privacy Framework lapses or is withdrawn, we will put in place an alternative mechanism under clause 13.2 without undue delay.
13.6 Where the EU SCCs apply, they are incorporated into this DPA by reference and Annexes 1, 2 and 3 populate the corresponding annexes of the EU SCCs. The governing law and forum for the EU SCCs are as set out in clause 16.
14. Liability
14.1 Our liability under or in connection with this DPA is subject to the limitations and exclusions set out in the Terms.
14.2 Nothing in this DPA limits or excludes any liability that cannot be limited or excluded under Data Protection Laws, including a data subject’s rights under Article 82 UK GDPR.
15. Order of Precedence and Term
15.1 In the event of a conflict between this DPA and the Terms in relation to the processing of personal data, this DPA prevails.
15.2 In the event of a conflict between this DPA and the EU SCCs or the UK Addendum where they apply, those clauses prevail.
15.3 This DPA continues for as long as we process personal data to which it applies. Clauses 11, 14, 15 and 16 survive termination.
15.4 We may update this DPA from time to time. Where an update materially reduces the protections it provides, we will give reasonable notice before it takes effect.
16. Governing Law and Jurisdiction
16.1 This DPA is governed by the laws of England and Wales.
16.2 The courts of England and Wales have exclusive jurisdiction.
16.3 Where the EU SCCs apply, the governing law is the law of England and Wales as modified by the UK Addendum for UK transfers, and the law of Ireland for transfers subject solely to the EU GDPR.
Annex 1. Details of Processing
1. Subject matter
Provision of the Atarim V5 platform, a website collaboration and review service.
2. Duration
For the duration of your subscription, and thereafter as set out in clause 11.
3. Nature and purpose of processing
Hosting, storage, organisation, retrieval, transmission, display, analysis and deletion of Platform Data, for the purpose of enabling you and your team members, stakeholders and clients to review websites, capture and discuss feedback, manage tasks, and use the Platform’s artificial-intelligence features.
4. Categories of data subject
| Category | Description |
|---|---|
| Account users | Individuals who hold an account on the Platform, including your own staff and any agency, brand, stakeholder or client personnel you invite |
| Guest participants | Individuals given access through a public collaboration link without holding an account. Access can be restricted through project permission settings |
| Individuals captured incidentally | Individuals whose personal data appears on a web page at the moment a screenshot is taken, in an uploaded attachment, or in inbound email addressed to a workspace address. These individuals may have no relationship with Atarim or with your use of the Platform. You are the controller of this data and are responsible for the notice and lawful basis obligations relating to it. |
5. Categories of personal data
| Category | Detail |
|---|---|
| Account identity | Name, first and last name, email address, username, avatar, hashed password, role, time zone offset, onboarding and trial state |
| Guest identity | Display name and email address, held against the guest’s comments |
| Comment and task content | Free text authored by users, including any personal data those users choose to include |
| Page and element metadata | Page URL, page title, element CSS path and coordinates. A page URL may itself identify an individual, depending on the reviewed site’s URL design |
| Environment data | Browser family and related technical information shown in the task’s technical information panel |
| Screenshots | Images of a reviewed page as rendered in the reviewer’s browser, which may include any personal data displayed on that page at the time of capture |
| Attachments and uploads | Files uploaded by users, which may contain personal data |
| Inbound email | Full message content and sender address, where mail is sent to a workspace’s shared address and becomes a task |
| Connected tool credentials | Access tokens and webhook URLs for third-party tools you choose to connect |
| Derived data | Data derived from workspace content, used for artificial-intelligence recall |
| Search terms | Text passed to a stock imagery provider where a user or the artificial-intelligence features request an image, which may contain a name where the request includes one |
| Activity log references | References identifying the user, record and action associated with an event. The log records references to information rather than the information itself |
| Billing identifiers | Plan, subscription status and external billing customer reference |
6. Special categories of personal data
The Platform is not intended for special category data within the meaning of Article 9 UK GDPR, criminal offence data within the meaning of Article 10 UK GDPR, payment card numbers, or government identification numbers. You undertake not to submit such data to the artificial-intelligence features of the Platform.
7. Frequency of processing
Continuous, for the duration of your subscription.
8. Retention
8.1 Platform Data
| Data | Retention |
|---|---|
| Account records | For the duration of the subscription. On deletion, the steps in clause 11.2 are completed within the timetable in clause 11.4 |
| Workspace records | For the duration of the subscription, then deleted within the timetable in clause 11.4 |
| Inbound email content | Held as part of the task it creates, and subject to the same timetable |
| Guest records | Held against the guest’s comments within the relevant workspace, and subject to the same timetable |
| Platform activity log | Retained indefinitely, for security monitoring, audit and dispute resolution purposes. The log records references to users, records and actions rather than the content of those records |
| Backups | 7 days |
| Screenshots, attachments and uploads | Retained. See clause 11.5(a) |
| Derived data | Retained. See clause 11.5(b) |
| Cached artificial-intelligence responses at the edge | 24 hours |
| Files sent for format conversion | 24 hours, held by the conversion provider |
| Rate-limiting records, including the password reset IP key | Maximum 10 minutes, held transiently in the in-memory store |
| Connected tool credentials | Deleted on disconnection of the relevant integration |
8.2 Data processed by Atarim as controller (clause 12)
| Data | Retention |
|---|---|
| Error and diagnostic data | 90 days |
| Product analytics events | 24 months |
| Billing and subscription records | Six years, to meet applicable tax and accounting requirements |
| Lifecycle communications and customer relationship records | For the duration of the account relationship and thereafter as required for our own legitimate interests |
Annex 2. Technical and Organisational Measures
Except where stated otherwise, the measures below were tested by an independent service auditor as part of our SOC 2 Type 2 examination, or verified directly against our production infrastructure.
1. Independent assurance
We hold a SOC 2 Type 2 report covering the Security trust services category, examined by Laika Compliance LLC for the period 1 November 2024 to 31 October 2025. Amazon Web Services is carved out as a subservice organisation for infrastructure and data hosting. The report is available under clause 10.2 subject to the restricted use provisions the report itself contains.
2. Data location
| Store | Contents | Location |
|---|---|---|
| Relational database | Accounts, workspaces, sites, pages, tasks, comments, connected-tool credentials | Ireland |
| Object storage | Screenshots, attachments, uploads, generated documents | Ireland |
| Recall store | Derived data | Ireland |
| Edge key-value store | Site mappings, prompt definitions, cached artificial-intelligence responses | European Union. Regional processing controls are enabled to constrain processing to the EU |
| Backups | Database backups | Ireland |
3. Encryption
- AES-256 encryption at rest on the relational database and on object storage.
- TLS 1.2 or higher for data in transit.
- AES-256 disk encryption on Atarim servers, workstations and laptops.
4. Access control
- Access to system components requires a documented access request with manager approval before provisioning.
- Unique user identifiers are assigned before access is granted. Credential sharing is prohibited.
- Access rights are granted on the principle of least privilege using role-based access control.
- Privileged access is restricted to authorised users with a business need.
- Access to production infrastructure requires valid multi-factor authentication.
- Access reviews are conducted annually and documented, with access modified or removed where applicable.
- Access is revoked within 24 hours of termination of employment or engagement.
- Password configuration is managed in accordance with our password policy.
5. Network and infrastructure
- The network is segmented to prevent unauthorised access to customer data.
- Cloud security groups are configured to prevent unauthorised access to the production environment.
- The production database is not reachable from the public internet.
6. Object storage
- Objects are encrypted at rest with AES-256 and served over TLS.
- Anonymous listing of the storage bucket is refused.
- Objects are addressed by a long, randomly generated object key.
7. Monitoring and logging
- A log management tool monitors and identifies security events and generates alerts.
- An intrusion detection system provides continuous monitoring and early detection of potential security breaches.
- A system monitoring tool monitors availability and performance and alerts on defined thresholds.
- Platform activity logging is enabled and retained as described in Annex 1.
8. Vulnerability and patch management
- Independent third-party penetration testing is performed at least annually, with a remediation plan developed and changes implemented for all critical and high vulnerabilities identified.
- Internal vulnerability scans are performed at least quarterly and container image scans at least annually.
- Infrastructure supporting the service is patched as part of routine maintenance.
9. Change management
- Changes are authorised, documented, tested, reviewed and approved before implementation in production.
- Development environments are segregated from production.
- Branch protection rules are configured in the development tooling.
- Access to migrate changes to production is restricted to authorised personnel.
- Hardening standards are documented for production systems before deployment.
- A configuration management tool is used to deploy system configurations consistently.
10. Personnel
- Employees and contractors are subject to a confidentiality agreement prohibiting disclosure of information to which they have been granted access.
- Reference checks are carried out before start date.
- Security awareness training is provided on hire and annually thereafter.
11. Incident response and continuity
- An incident response policy is documented, covering detection, response and recovery.
- The incident response plan is tested annually.
- A business continuity and disaster recovery plan is documented and tested annually.
- Backups are taken daily and retained for 7 days.
12. Vendor management
- A vendor management policy governs classification of third parties, assessment of risk arising from procurement, and annual review of critical third-party attestation reports.
- Formal agreements are in place with critical vendors.
- We maintain an inventory of third parties, which are contractually required to maintain relevant information security requirements and to report cybersecurity incidents in a timely manner.
13. Governance
- A risk assessment is performed at least annually, or in response to major changes to the product, client base or business plan.
- An Information Security Policy is documented, communicated to authorised users, and reviewed annually.
14. Customer-side controls
The Platform renders screenshots in the reviewer’s own browser. Any element on a reviewed page carrying the class no-screenshot is excluded from every capture, and we honour that class by default. You, or the operator of the reviewed website, may apply this class to regions displaying personal data to prevent it being captured.
Annex 3. Sub-processors and Recipients
Part 1. Sub-processors of Platform Data
| Sub-processor | Processing purpose | Location | Transfer mechanism | Activation |
|---|---|---|---|---|
| Amazon Web Services | Infrastructure hosting, relational database, object storage | Ireland | No restricted transfer | Always |
| Cloudflare | Edge compute, key-value storage, response caching, page rendering | European Union, regional processing controls enabled | No restricted transfer | Always |
| Qdrant | Storage of derived data for artificial-intelligence recall | Ireland | No restricted transfer | Always |
| Chargebee | Subscription management. Receives account and billing identifiers | European Union | No restricted transfer | Always |
| Stripe | Payment processing. Receives account and billing identifiers | Ireland | No restricted transfer | Always |
| CloudConvert | File format conversion. Receives uploaded files and holds them for 24 hours | Germany | No restricted transfer | Feature-dependent |
| OpenRouter | Gateway for artificial-intelligence model calls. Receives comment and task content, page content, and screenshots where visual scoring is enabled. Routes requests to underlying models, which are its own sub-processors. See clauses 6.6 and 6.7 | United States | EU SCCs, with the UK Addendum for UK transfers. Transfer risk assessment maintained | Always |
| OpenAI | Conversion of workspace content for artificial-intelligence recall. Engaged directly rather than through the gateway | United States | UK Extension to the EU-US Data Privacy Framework | Always |
| Mailgun | Outbound transactional email and inbound email to workspace addresses. Receives recipient addresses and full message content | United States | UK Extension to the EU-US Data Privacy Framework | Always |
| Sentry | Error monitoring. Receives stack traces and surrounding context. Retained 90 days | United States | UK Extension to the EU-US Data Privacy Framework | Always |
| Urlbox | Screenshot rendering where browser capture fails. Receives the page URL, renders the page as an anonymous visitor, and writes the resulting image directly to our own object storage | United States | EU SCCs, with the UK Addendum for UK transfers. Transfer risk assessment maintained | Fallback only |
| Unsplash | Stock imagery search. Receives the search term submitted by a user or generated by the artificial-intelligence features, which may contain personal data where the request includes a name | United States | EU SCCs, with the UK Addendum for UK transfers | Feature-dependent |
| Slack, Jira, Asana, ClickUp, Monday, Trello, Teamwork, Basecamp | Two-way synchronisation of task and comment content and author names | As determined by your own account with that provider | Your own arrangements apply | Only where you connect your own account |
| Google, Figma | Authentication identifiers for sign-in and design-tool integration | As determined by the user’s own account | The user’s own arrangements apply | Only where the user chooses to use it |
Artificial-intelligence model routing. Model calls other than those used for recall route through OpenRouter, which dispatches to an underlying model. We configure the gateway to route only to endpoints operating on a zero data retention basis. We have no direct contractual relationship with the underlying models; they are engaged by OpenRouter and are its sub-processors. Clauses 6.6 and 6.7 apply.
Recall features. Workspace content is converted for artificial-intelligence recall using OpenAI’s API, engaged directly by us. OpenAI does not use data submitted through its API to train its models. By default OpenAI generates abuse monitoring logs which may contain submitted content and retains them for up to 30 days, after which they are deleted unless longer retention is required by law.
Reseller-originated accounts. Where your account originates through a reseller partner, additional recipients may apply under that partner’s own arrangements. Any such recipients are set out in the relevant partner agreement.
Part 2. Recipients used for Atarim’s own controller purposes
The recipients below are used for the processing described in clause 12, in respect of which we act as controller in our own right. They are listed for transparency and are not Sub-processors of Platform Data.
| Recipient | Purpose | Location |
|---|---|---|
| PostHog | Product analytics and feature flags. Session replay covers the Atarim application only and is explicitly disabled inside a reviewed website | United States |
| Customer.io | Lifecycle messaging to account holders | United States |
| HubSpot | Customer relationship management | European Union |
| FirstPromoter | Affiliate attribution | European Union |
Session replay. The layer we inject into a reviewed page has session recording, automatic click capture and page view tracking explicitly disabled. No behavioural data about visitors to a reviewed website is recorded.
Contact
Questions about this DPA, requests for a countersigned copy, and subscriptions to sub-processor change notifications:
WP Feedback Limited
28 Kipling Way, Borehamwood, Hertfordshire WD6 2FS, United Kingdom