Data Processing Agreement – May 2018

Data Protection Legislation: the UK Data Protection Legislation and (for so long as and to the extent that the law of the European Union has legal effect in the UK) the General Data Protection Regulation ((EU) 2016/679) and any other directly applicable European Union regulation relating to privacy.

UK Data Protection Legislation: any data protection legislation from time to time in force in the UK including the Data Protection Act 1998 or 2018 or any successor legislation.

1. DATA PROTECTION 1.1 Both parties will comply with all applicable requirements of the Data Protection Legislation. This agreement is in addition to, and does not relieve, remove or replace, a party’s obligations under the Data Protection Legislation. In this clause 1, Applicable Laws means (for so long as and to the extent that they apply to the Provider) the law of the European Union, the law of any member state of the European Union and/or Domestic UK Law; and Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK.

1.2 The parties acknowledge that for the purposes of the Data Protection Legislation, the Customer is the Data Controller and the Provider is the Data Processor (where Data Controller and Data Processor have the meanings as defined in the Data Protection Legislation). The Data Processor agrees that data will only be processed for legitimate business reasons in order to service the agreement between our two parties. Data received from the Data Controller will be limited to HR, Employment Law, Health and Safety matters and any other data necessary to service the contract between the Data Controller and the Data Processor. Data will processed for the duration of the contract and six years thereafter (except where required by law to process for longer periods). Data will be permanently and securely deleted six years after the end of the contract (except where required by law to store for longer periods).

1.3 Without prejudice to the generality of clause 1.1, the Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Personal Data to the Provider for the duration and purposes of this agreement.

1.4 Without prejudice to the generality of clause 1.1, the Provider shall, in relation to any Personal Data processed in connection with the performance by the Provider of its obligations under this agreement:

(a) process that Personal Data only on the written instructions of the Customer unless the Provider is required by Applicable Laws to otherwise process that Personal Data. Where the Provider is relying on laws of a member of the European Union or European Union law as the basis for processing Personal Data, the Provider shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Provider from so notifying the Customer;

(b) ensure that it has in place appropriate technical and organisational measures, reviewed and approved by the Customer, to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);

(c) ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential; and

(d) not transfer any Personal Data outside of the European Economic Area unless the prior written consent of the Customer has been obtained and the following conditions are fulfilled:

(i) the Customer or the Provider has provided appropriate safeguards in relation to the transfer;

(ii) the data subject has enforceable rights and effective legal remedies;

(iii) the Provider complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred; and

(iv) the Provider complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the Personal Data;

(e) assist the Customer, at the Customer’s cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(f) notify the Customer without undue delay on becoming aware of a Personal Data breach;

(g) at the written direction of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the agreement unless required by Applicable Law to store the Personal Data; and

(h) maintain complete and accurate records and information to demonstrate its compliance with this agreement.

1.5 The Customer consents to the Provider appointing third-party processors of Personal Data under this agreement. The Provider confirms that it has entered or (as the case may be) will enter with the third-party processor into a written agreement substantially on that third party’s standard terms of business.

1.6 The provider may, at any time, revise any clause in this agreement by replacing it with any applicable standard clauses or similar terms forming party of an applicable certification scheme (which shall apply when replaced by attachment to this agreement).

Privacy policy

What we collect

We may collect the following information:

name and job title contact information including email address demographic information such as postcode, preferences and interests other information relevant to customer surveys and/or offers

What we do with the information we gather

We require this information to understand your needs and provide you with a better service, and in particular for the following reasons: Internal record keeping. We may use the information to improve our products and services. We may periodically send promotional emails about new products, special offers or other information which we think you may find interesting using the email address which you have provided. From time to time, we may also use your information to contact you for market research purposes. We may contact you by email, phone, fax or mail. We may use the information to customise the website according to your interests.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Cookies

Our website uses cookies, as almost all websites do, to help provide you with the best experience we can. Cookies are small text files that are placed on your computer or mobile phone when you browse websites

Our cookies help us:

Make our website work as you'd expect
Remember your settings during and between visits
Offer you free services/content (thanks to advertising)
Improve the speed/security of the site
Allow you to share pages with social networks like Facebook
Continuously improve our website for you
Make our marketing more efficient (ultimately helping us to offer the service we do at the price we do)

We do not use cookies to:

Collect any personally identifiable information (without your express permission)
Collect any sensitive information (without your express permission)
Pass personally identifiable data to third parties
Pay sales commissions
You can learn more about all the cookies we use below

How we use cookies

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website. Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. Controlling your personal information

You may choose to restrict the collection or use of your personal information in the following ways:

whenever you are asked to fill in a form on the website, look for the box that you can click to indicate that you do not want the information to be used by anybody for direct marketing purposes if you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to or emailing us at [email address]

We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. We may use your personal information to send you promotional information about third parties which we think you may find interesting if you tell us that you wish this to happen.

You may request details of personal information which we hold about you under the Data Protection Act 1998. A small fee will be payable. If you would like a copy of the information held on you please write to [address].

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address. We will promptly correct any information found to be incorrect.

GoodAveragePoor How do you rate this information?

Subjects covered in this guide

Introduction Sample website usage terms and conditions Sample privacy policy Sample website disclaimer Sample internet copyright notice & guidelines Sample business email disclaimer Sample acceptable internet use policy Sample acceptable email use policy

Print options - What are my print options - Opens in a new window Print guide now - Opens in a new window Add guide to my print portfolio (print later as PDF)

Email options - What are my email options - Opens in a new window Tell a friend about this page Send me an email alert when this guide changes

Actions

Assess and minimise the IT risks facing your business with our IT risk assessment tool Also on this site

Comply with data protection legislation Privacy and data protection in direct marketing E-commerce and the law Develop an e-marketing plan

Developed with: