Introduction

Under each Contract, the Customer engages the Supplier to provide the Services and in providing the Services, the Supplier will or may be required to Process Personal Data on behalf of the Customer. To the extent of that Processing of Personal Data and for the purposes of these terms and conditions, the Customer is a ‘Controller’, and the Supplier is a ‘Processor’ for the purposes of the GDPR. As such, Article 28 of the GDPR requires that the details in this attachment are included in the contract between the Customer and the Supplier.  

The parties must set out the subject matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and categories of data subjects – see appendix 1 to this attachment. If the Supplier determines the purposes and means of Processing, the Supplier is considered a ‘Controller’ in respect of that Processing in which case the Supplier needs to consider and address the different and additional provisions of the GDPR that apply.  

The terms used in this attachment have the meanings given to them in the main definition section of these terms and conditions or in clause 13 of this attachment, or in the GDPR if not defined in these terms and conditions or in this attachment.

1. Processing of Personal Data

1.1 The Supplier will: 

(a) Instructions from Customer: in providing Services under a Contract, Process Personal Data only on the Customer’s documented instructions (as provided in clause 2 and in appendix 1 to this attachment or otherwise in writing) unless required to do so by the Data Protection Laws in which case the Supplier will inform the Customer of that legal requirement before Processing unless the Supplier is prohibited from informing the Customer by that law; 

(b) Confidentiality: ensure that the Supplier’s personnel who are authorised to Process the Personal Data have obligations of confidentiality to the Supplier (including as required in clause 3 below) in respect of the Personal Data or are under an appropriate statutory obligation of confidentiality; 

(c) Security: comply with the security obligations in clause 4 below; 

(d) Subprocessors: comply with the provisions relating to Subprocessors in clause 5 below; 

(e) Data subjects’ rights: provide assistance to the Customer with responding to data subjects’ rights in accordance with clause 6 below; 

(f) Assist Customer: comply with its obligations to assist the Customer in relation to security of Personal Data and data protection impact assessments and prior consultation in accordance with clause 7 below; 

(g) Deleting and returning data: after the provision of Services related to Processing of Personal Data has ended, at the choice of the Customer either delete or return to the Customer all of that Personal Data and delete existing copies unless the Data Protection Laws require storage of Personal Data in accordance with clause 8 below; and 

(h) Compliance and audits: make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits including inspections conducted by the Customer or another auditor mandated from time to time, in accordance with clause 9 below. The Supplier will immediately inform the Customer if, in its opinion, an instruction received from the Customer in relation to an audit under this clause 1.1(h) infringes the Data Protection Laws.

2. Instructions From Customer

2.1. The Customer instructs the Supplier (and authorises the Supplier to instruct each Subprocessor) to: 

(a) Process Personal Data; and 

(b) in particular, transfer Personal Data to any country or territory, 

as reasonably necessary for the provision of the Services and consistent with and in compliance with the relevant Contract. 

2.2. The Customer warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in clause 2.1 on behalf of the Customer.

3. Confidentiality

The Supplier will take reasonable steps to ensure the reliability of its employees, agents or contractors who may have access to Personal Data, ensuring in each case that access is limited to those individuals who need to know or need to access the relevant Personal Data, as necessary for the purposes of the relevant Contract, and to comply with applicable laws in the context of that individual’s duties to the Supplier, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

4. Security

4.1. Subject to clause 4.2 below, the Supplier will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including amongst other things as appropriate: 

(a) the pseudonymisation and encryption of Personal Data; 

(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; 

(c) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; 

(d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing.  

4.2. In assessing the appropriate level of security for clause 4.1 above, the Supplier will take account in particular of the risks of a Personal Data Breach that are presented by the Processing to be undertaken under the relevant Contract. 

4.3. The Supplier will in relation to Personal Data:  

(a) implement and maintain appropriate information security to protect Personal Data against:  

i. a Personal Data Breach;  

ii. all other unauthorised or unlawful forms of Processing; and  

iii. any breach of the Supplier’s information security obligations in this attachment. The Supplier will (and will ensure that its Sub-processors) provide full cooperation and assistance to the Customer in ensuring that the individuals´ rights under the Data Protection Laws are timely and appropriately addressed for the fulfilment of the Customer’s obligation to respond without undue delay to requests by such individuals as required by Data Privacy Laws, including the rights of subject access, rectification, erasure, and portability, and the right to restrict or object to certain Processing;  

(b) take reasonable steps to inform its staff, and any other person acting under its supervision, of the responsibilities of any Data Privacy Laws due to the incidental access to Personal Data, and ensure the reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to and Process, such Personal Data.

5. Subprocessors

5.1. The Customer authorises the Supplier to appoint Subprocessors (and permits each Subprocessor appointed in accordance with this clause 5 to appoint Subprocessors) in accordance with this clause 5 and any restrictions in these terms and conditions. 

5.2. The Supplier will give the Customer prior written notice of the appointment of any new Subprocessor, including full details of the Processing to be undertaken by the Subprocessor. If, within two weeks of receipt of that notice, the Customer notifies the Supplier in writing of any objections (on reasonable grounds) to the proposed appointment, the Supplier will not appoint (nor disclose any Personal Data to) the proposed Subprocessor unless and until it obtains the prior written consent of the Customer. 

5.3. With respect to each Subprocessor, the Supplier will: 

(a) enter into an agreement with the Subprocessor which includes the same data protection obligations as set out in this attachment (and Appendix 1) and in particular includes sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. If the Subprocessor fails to fulfil its data protection obligations, the Supplier will remain fully liable to the Customer for the performance of that Subprocessor’s obligations;  

(b) if the Processing by the Subprocessor will involve a Restricted Transfer, ensure that the IDTA is at all relevant times incorporated into the agreement between the Supplier and the Subprocessor; and 

(c) provide to the Customer for review, copies of the Supplier’s agreements with Subprocessors (confidential commercial information that is not relevant to the requirements of this attachment may be blacked out) as the Customer may request from time to time. 

5.4. Appendix 1 to this attachment sets out certain information regarding the Supplier’s Processing of Personal Data, as required by article 28(3) of the GDPR. The Customer may make reasonable amendments to Appendix 1 by written notice to the Supplier from time to time as the Customer reasonably considers necessary to meet those requirements.

6. Data Subjects’ Rights

6.1. Taking into account the nature of the Processing, the Supplier will, by implementing appropriate technical and organisational measures to the extent described in clause 4, assist the Customer to respond to requests to exercise Data Subject rights under the Data Protection Laws. 

6.2. The Supplier will:

(a) promptly notify the Customer if the Supplier or any Subprocessor receives a request from a Data Subject under any Data Protection Law in respect of Personal Data; and 

(b) ensure that the Supplier or relevant Subprocessor does not respond to that request except on the documented instructions of the Customer or as required by applicable laws to which they are subject, in which case the Supplier will to the extent permitted by applicable laws inform the Customer of that legal requirement before the Supplier or relevant Subprocessor responds to the request.

7. Assist Customer

7.1. Assist Customer with Security of Processing:

(a) The Supplier will assist the Customer in respect of the Customer’s obligations to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, by complying with the Supplier’s obligations under clause 4 of this attachment.  

7.2. Assist Customer with notifications of Personal Data Breach 

(a) The Supplier will notify the Customer without undue delay if the Supplier or any Subprocessor becomes aware of a Personal Data Breach, providing the Customer with sufficient information to allow the Customer to meet any obligations to report the Personal Data Breach to the relevant Supervisory Authority under the Data Protection Laws (noting that the Customer is required, where feasible, to notify applicable Personal Data breaches to the relevant Supervisory Authority within 72 hours after having become aware of the breach).  

(b) The Supplier will co-operate with the Customer and take such reasonable commercial steps as are directed by the Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach. 

7.3. Assist Customer with communication of Personal Data breach to Data Subject

(a) Where a Personal Data Breach is likely to result in a high risk to the rights and freedoms of natural persons: 

i. such that the Customer is required to communicate the Personal Data Breach to the Data Subject (including where, despite the conditions referenced in clause 7.3(a)(ii) below being met, the Supervisory Authority has required the Customer to communicate the Personal Data Breach to the Data Subject), the Supplier will assist the Customer in doing so by providing all relevant information as may be reasonably required by the Customer; 

ii. but despite that high risk, the Customer is not required to communicate the Personal Data Breach to the Data Subject due to certain conditions being met (such as that the Personal Data is encrypted and so unintelligible to any person not authorised to access it), the Supplier will assist the Customer by providing all relevant information as may be reasonably required by the Customer.  

7.4. Assist Customer with Data Protection Impact Assessments

(a) The Supplier will provide reasonable assistance to the Customer with any data protection impact assessments which the Customer reasonably considers to be required of the Customer by Article 35 of the GDPR or equivalent provisions of related Data Protection Laws. The Supplier’s obligations under this clause 7.4(a) are solely in relation to Processing of Personal Data by the Supplier and taking into account the nature of the Processing and information available to the Supplier. 

7.4. Assist Customer with Prior Consultation with Supervisory Authority

(a) The Supplier will provide reasonable assistance to the Customer with prior consultations with Supervising Authorities or other competent data privacy authorities, which the Customer reasonably considers to be required of the Customer by Article 36 of the GDPR or equivalent provisions of related Data Protection Laws. The Supplier’s obligations under this clause 7.5(a) are solely in relation to Processing of Personal Data by the Supplier and taking into account the nature of the Processing and information available to the Supplier.

8. Deletion or Return of Personal Data

8.1. Subject to clauses 8.2 and 8.3, the Supplier will, within three weeks of the date of expiration or termination of Services involving the Processing of Personal Data (the “End of Processing Date”), delete and procure the deletion of all copies of the Personal Data.

8.2. Subject to clause 8.3, the Customer may in its absolute discretion by written notice to the Supplier within two weeks of the End of Processing Date require the Supplier to:

(a) return a complete copy of all Personal Data to the Customer by secure file transfer in such format as is reasonably notified by the Customer to the Supplier; and 

(b) delete and procure the deletion of all other copies of Personal Data Processed by the Supplier. The Supplier will comply with any such written request within four weeks of the End of Processing Date. 

8.3. The Supplier may retain Personal Data to the extent required by applicable Laws and only to the extent and for such period as required by applicable Laws and always provided that the Supplier will:

(a) ensure the confidentiality of all such Personal Data; 

(b) ensure that such Personal Data is only processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.

8.4. The Supplier will provide written certification to the Customer that it has fully complied with this clause 8 within four weeks following the End of Processing Date.

8. Deletion or Return of Personal Data

8.1. Subject to clauses 8.2 and 8.3, the Supplier will, within three weeks of the date of expiration or termination of Services involving the Processing of Personal Data (the “End of Processing Date”), delete and procure the deletion of all copies of the Personal Data.

8.2. Subject to clause 8.3, the Customer may in its absolute discretion by written notice to the Supplier within two weeks of the End of Processing Date require the Supplier to:

(a) return a complete copy of all Personal Data to the Customer by secure file transfer in such format as is reasonably notified by the Customer to the Supplier; and 

(b) delete and procure the deletion of all other copies of Personal Data Processed by the Supplier. The Supplier will comply with any such written request within four weeks of the End of Processing Date. 

8.3. The Supplier may retain Personal Data to the extent required by applicable Laws and only to the extent and for such period as required by applicable Laws and always provided that the Supplier will:

(a) ensure the confidentiality of all such Personal Data; 

(b) ensure that such Personal Data is only processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.

8.4. The Supplier will provide written certification to the Customer that it has fully complied with this clause 8 within four weeks following the End of Processing Date.

9. Audit Rights

9.1. Subject to clauses 9.2 to 9.4, the Supplier will make available to the Customer on request all information necessary to demonstrate compliance with this attachment, and will allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer in relation to the Processing of Personal Data by the Supplier. 

9.2. Information and audit rights of the Customer only arise under clause 9.1 to the extent that a Contract does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Laws (including, where applicable, article 28(3)(h) of the GDPR). 

 9.3. The Supplier may, on reasonable grounds, object to the proposed auditor in which case the Customer will propose an alternate auditor. 

(a) The Customer will give the Supplier reasonable notice of any audit or inspection to be conducted under clause 9.1 and will make (and ensure that its auditor makes) reasonable endeavours to avoid causing any damage, injury or disruption to the Supplier’s premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection. The Supplier need not give access to its premises for the purposes of such an audit or inspection for the purposes of more than one audit or inspection in any calendar year, except for any additional audits or inspections which: 

i. the Customer reasonably considers necessary because of genuine concerns as to the Supplier’s compliance with this attachment; or  

ii. the Customer is required or requested to carry out by Data Protection Law, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Data Protection Laws in any country or territory,  

where the Customer has identified its concerns or the relevant requirement or request in its notice to the Supplier of the audit or inspection.

10. Restricted Transfers

10.1 Subject to clause 10.3, where the Services involve a ‘Restricted Transfer’ as between the Customer and the Supplier, the Customer (as “data exporter”) and the Supplier (as “data importer”) each agrees to the IDTA in respect of that Restricted Transfer.  

10.2. The IDTA will come into effect under clause 10.1 on the later of:  

(a) the data exporter becoming a party to them;  

(b) the data importer becoming a party to them; and  

(c) commencement of the relevant Restricted Transfer. 

10.3. There is no requirement for the Supplier and Customer to agree to the IDTA (or to include the IDTA in these terms and conditions) where the transfer of Personal Data is to a country within the EEA or to an Approved Jurisdiction.

11. Order of Precedence

11.1. Nothing in this attachment reduces the Supplier’s obligations under a Contract in relation to the protection of Personal Data or permits the Supplier to Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Contract. In the event of any conflict or inconsistency between this attachment and the IDTA, the IDTA will prevail.

11.2. Subject to clause 11.1, in the event of inconsistencies between the provisions of this attachment and the other parts of these terms and conditions or any Associated Agreement, the provisions of this attachment will prevail.

12. Changes in Data Protection Laws

12.1. The Customer may by at least 30 calendar days’ written notice to the Supplier: 

(a) vary the IDTA (only if applicable, and only in accordance with Section 5 of the IDTA), as they apply to Restricted Transfers which are subject to non-UK data protection laws, as required as a result of any change in, or decision of a competent authority under, that data protection law, to allow those Restricted Transfers to be made (or continue to be made) without breach of that data protection law; and 

(b) propose any other variations to this attachment which the Customer reasonably considers to be necessary to address the requirements of any data protection law. 

12.2. If the Customer gives notice under clause 12.1(a): 

(a) the Supplier will promptly co-operate (and require affected Subprocessors to promptly co-operate) to ensure that equivalent variations are made to the agreements made under clause 5.3; and 

(b) the Customer will not unreasonably withhold or delay agreement to any consequential variations to this attachment proposed by the Supplier to protect the Supplier against additional risks associated with the variations made under this clause 12.2. 

12.3. If the Customer gives notice under clause 12.1(b), the parties will promptly discuss the proposed variations and negotiate in good faith with a view to agreeing and implementing those or alternative variations designed to address the requirements identified in the Customer’s notice as soon as is reasonably practicable.

13. Definitions

“Adequacy Decision” means a country (or territory or specified sector within it) or an international organisation which the European Commission has decided, under Article 45(3) of the GDPR, ensures an adequate level of data protection;  

“Approved Jurisdiction” means the countries in the EEA and jurisdictions for which an Adequacy Decision has been made and any other countries or territories for which there are UK adequacy regulations; 

“Contracted Processor” means the Supplier or a Subprocessor; 

“Data Subject” means an identified or identifiable natural person, or any updated definition of this term from time to time in the GDPR; 

“EEA” means the European Economic Area; 

“Information Security Obligations” means commercially reasonable and appropriate physical, technical and organisational security measures (determined with regard to risks associated with the Processing of Personal Data as part of the Services), including the measures set out in this GDPR attachment and in particular in the IDTA (where applicable). 

“International Data Transfer Agreement” or “IDTA” means the international data transfer addendum to the European Commission’s Standard Contractual Clauses for international data transfers, as issued by the UK Information Commissioner’s Office’s (ICO) under section 119A(1) of the Data Protection Act 2018 and as applicable on and from 21 March 2022. 

“Restricted Transfer” means transferring Personal Data outside of the United Kingdom, whether this is: 

(a) a transfer of Personal Data from the Customer to the Supplier or to a Subprocessor; or 

(b) an onward transfer of Personal Data from one Contracted Processor to another Contracted Processor, or between two establishments of a Contracted Processor,

in each case, where such transfer means would be prohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws), in the absence of the IDTA; 

“Services” means, for the purposes of this GDPR Attachment, the products, services and/or deliverables (as applicable) and any related services supplied to or carried out by or on behalf of the Supplier for the Customer under a Contract; 

“Subprocessor” means any person (including any third party, but excluding an employee of the Supplier or any of its sub-contractors) appointed by or on behalf of the Supplier to Process Personal Data on behalf of the Customer in connection with a Contract;  

The term “Supervisory Authority” has the meaning given to that term in the GDPR.

Processing of Personal Data

This includes certain details of the Processing of Personal Data as required by Article 28(3) GDPR.

Subject matter and duration of the Processing of Personal Data
Contact information of Customer personnel for purposes of services to be provided to the Customer. The duration will be the term for which the Supplier provides Services to the Customer under any Associated Agreements and a reasonable period following that term to allow for handover.

The nature and purpose of the Processing of Personal Data
For the purposes of these Master Terms and Conditions and each Associated Agreement. To provide Services to the Customer and for related activities prior to or after Contracts are made as anticipated in these Master Terms and Conditions.

The types of Personal Data to be Processed
Details for Customer personnel or contractors: name, email address and telephone number, social networks, online identifiers, location, images, images with identifiers, disability details.

The categories of Data Subject to whom Personal Data relates
Customer management personnel, Customer staff, or contractors who are entitled to contact the Supplier for services.

The obligations and rights of the Customer
The obligations and rights of the Customer are set out in each Contract (including this attachment).