Data processing agreement (DPA)

Processing takes place in the context of developing, maintaining and operating the client's systems, and for that purpose only.

The categories of data and of data subjects are listed in an annex to the order form for each engagement.

The processor processes personal data only on the controller's documented instructions.

If an instruction is considered to infringe applicable law, the controller is informed before the processing takes place.

Personnel with access to the data are bound by confidentiality undertakings, and access is granted only to the extent the role requires.

TLS in transit, encryption at rest, role-based authorisation, audit logging, daily backups and regular restore drills are applied.

The detail matches the protocols described on the Security page.

Hosting and email providers are used as sub-processors. The list of sub-processors is shared on request.

The controller is notified before a new sub-processor is added and may object.

Requests received from data subjects are directed to the controller, and the technical assistance needed to answer them is provided.

On becoming aware of a personal data breach, the controller is notified without undue delay and within twenty-four hours at the latest.

When the service ends, personal data is returned or deleted at the controller's choice; copies held in backups are destroyed when their retention period expires.

The controller may audit once a year on reasonable notice, or appoint an independent auditor.

Where a transfer outside the country is required, it does not take place until the conditions of the applicable legislation are met.