Skip to main content

🇪🇺 🇬🇧 Designating an EU + UK Representative

GDPR Art. 27 + UK DPA 2018 s. 7 require a representative for any controller outside the EEA / UK that offers goods or services to, or monitors the behaviour of, EEA / UK residents — regardless of business size or revenue.

AceSense has an EU user base. We do not have an EU establishment. Therefore we need a designated representative in an EU member state and in the UK.

Why this is not optional​

  • Missing-representative is one of the easiest items for a supervisory authority to notice + fine. Enforcement has been seen against mobile apps and US SaaS.
  • The representative is the first-contact point for DPAs and data subjects — if there is none, subjects escalate directly to the DPA.
  • No grace period for non-EU / non-UK controllers.

These firms specialise in acting as an Art. 27 representative. Typical cost: €30–120 / month.

ProviderCoversPricingNotes
PrighterEU + UK + Switzerland + Turkey + more~€30/mo entryWidely used by mobile app + SaaS startups. Includes a data-subject request portal.
EDPOEU + UK~€45/moLegal-focused; good for heavy regulated industries.
DP-DockEU (GDPR) + UK~€35/moSimple portal; used by indie / mid-sized SaaS.
DataRepUK only£10–15/moUK-only; combine with an EU rep.
Bird & Bird + Taylor Wessing + DLA PiperBoth£££Law-firm variant — only if you want legal advisory bundled.

Pick one for EU + UK (Prighter is the pragmatic default). You can always switch later.

What to publish once designated​

Both are required in writing, accessible to data subjects and supervisory authorities.

  1. Name + address of the representative.
  2. Contact email (usually something like privacy@<rep-provider>.com that forwards to you).
  3. Where to publish:
    • acesense-frontend/lib/screens/privacy_policy_screen.dart — add to § "Contact Us" / § "Regional Rights".
    • acesense-landing/public/privacy.html — same.
    • acesense-docs/compliance/overview.md — Contacts section.

Template wording:

European Representative (GDPR Art. 27):
  <Provider Name> on behalf of AceSense Technologies
  <Address>
  <Email>

UK Representative (UK GDPR Art. 27):
  <Provider Name (UK entity)> on behalf of AceSense Technologies
  <Address>
  <Email>

Onboarding checklist with the provider​

  1. Sign the rep agreement (they give you a PDF).
  2. Provide them with:
    • Company name, address, countries of operation.
    • Description of processing (summary of DPIA).
    • DPO name + email.
    • List of sub-processors.
    • Retention policy.
  3. They publish your company on their public registry (required by most providers).
  4. They issue the contact address to use in your privacy policy.
  5. You deploy the updated privacy pages (see file list above).
  6. Log the rep in compliance/overview.md § Contacts.

Data-subject request workflow once designated​

Most providers pass requests through to you via email / a dashboard. You remain responsible for the substantive answer within the 1-month (GDPR) / 1-month (UK-GDPR) window. The representative can extend that by 2 months if the request is complex — but the clock is still on you.

Keep a log of inbound requests + your response time. Regulators will ask for it during investigations.

One-time setup timeline​

DayAction
1Pick provider, sign up, pay first invoice.
2–3Provide them with the onboarding info above.
4Receive contact address + agreement countersigned.
5Update privacy policy (Flutter app + landing), redeploy.
6Commit compliance/overview.md update. Ship.

Total: ~1 week of elapsed time, ~2 hours of focused effort.

Status​

  • EU representative: not yet designated — owner: Ops
  • UK representative: not yet designated — owner: Ops
  • Target date: before first paid subscription is processed, or end of 2026-Q2 — whichever comes first.