Data Processing Agreement

In this DPA, the following terms have the meanings set out below. Terms not defined here have the meanings given in the UK GDPR.

Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. The Controller's use of the Services constitutes documented instructions for the purposes of this clause.

Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Implement and maintain the technical and organisational security measures described in Schedule C, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

Not engage a Sub-processor without the prior written authorisation of the Controller. The Controller provides general written authorisation for the Processor to engage the Sub-processors listed in Schedule B. The Processor shall notify the Controller of any intended changes to that list at least 30 days in advance, giving the Controller the opportunity to object. Where the Controller objects on reasonable data protection grounds, the parties shall work in good faith to resolve the objection.

Assist the Controller, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling the Controller's obligations to respond to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR (including access, rectification, erasure, restriction, portability, and objection).

Assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of processing and the information available to the Processor.

At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Services relating to processing, and delete existing copies unless applicable law requires storage of the Personal Data. The Processor shall confirm deletion in writing within 30 days of the request.

Make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 UK GDPR, and allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to the terms of Section 10.

It has, and will maintain throughout the term, a valid lawful basis under the UK GDPR for each processing activity it instructs the Processor to carry out, including obtaining any necessary consents from Data Subjects.

All Personal Data provided to the Processor is accurate and up to date to the best of the Controller's knowledge, and the Controller will promptly update or correct any inaccurate Personal Data.

Where the Controller uploads or enters special category data (as defined in Article 9 UK GDPR) — including health information, religious beliefs, or biometric data — it has identified and documented an appropriate condition under Article 9(2) UK GDPR for that processing.

Its instructions to the Processor will at all times comply with applicable data protection law, and it will not instruct the Processor to process Personal Data in a way that would cause the Processor to breach applicable law.

Where the Processor receives a request directly from a Data Subject exercising their rights under the UK GDPR, the Processor shall promptly forward that request to the Controller and shall not respond to the Data Subject directly unless instructed to do so by the Controller or required by applicable law.

The Processor shall provide reasonable assistance to the Controller in responding to Data Subject requests within the timescales required by the UK GDPR (generally one calendar month). This includes providing data exports, confirming what data is held, and carrying out erasure or restriction as instructed.

The Processor makes available within the Kinvoy portal a self-service account deletion function that permanently erases all Personal Data held by the Processor on behalf of the Controller. Use of this function constitutes a documented instruction from the Controller to delete all associated Personal Data.

The Processor shall notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Security Incident affecting Personal Data processed under this DPA. The notification shall include, to the extent available at the time:

• A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and Personal Data records concerned.
• The name and contact details of the Processor's data protection contact.
• A description of the likely consequences of the Security Incident.
• A description of the measures taken or proposed to address the Security Incident, including measures to mitigate its possible adverse effects.

Where all required information is not available within 72 hours, the Processor may provide the information in phases, provided that the initial notification is made within the 72-hour window and subsequent information is provided without further undue delay.

The Controller is solely responsible for determining whether to notify the Information Commissioner's Office (ICO) and/or affected Data Subjects, and for making any such notifications. The Processor shall provide reasonable assistance to the Controller in preparing those notifications.

The transfer is to a country or territory that has received an adequacy decision from the UK Secretary of State under Article 45 UK GDPR, or from the European Commission under Article 45 EU GDPR where that decision has been incorporated into UK law.

The transfer is subject to appropriate safeguards under Article 46 UK GDPR, including the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, as applicable.

At the Controller's written election, either (a) return all Personal Data to the Controller in a portable, machine-readable format (CSV or JSON) within 30 days, or (b) securely delete all Personal Data and confirm deletion in writing within 30 days.

The Processor may retain encrypted backup copies of Personal Data for up to 90 days after the deletion date, solely for disaster recovery purposes. Those copies shall be deleted at the end of the 90-day period and shall not be used for any other purpose.

Notwithstanding clauses 11.1 and 11.2, the Processor may retain Personal Data to the extent required by applicable law (for example, financial records required by HMRC), and shall notify the Controller of any such retention obligation.