Data processing agreement

1. Roles

1.1 You are the controller of the personal data we process for you, and we are your processor. Details of the processing are in Schedule 1.

1.2 You are responsible for having a lawful basis for the processing, for the accuracy of the data, and for your instructions to us complying with Data Protection Law.

1.3 Where we process personal data for our own purposes, such as managing our relationship with you, we do so as a controller in line with our privacy notice.

2. Your instructions

2.1 We will process personal data only on your documented instructions, which are set out in the Agreement, your Order and any further written instructions you give us, unless the law requires otherwise. If it does, we will tell you before processing unless the law prevents us.

2.2 We will tell you straight away if we think an instruction breaks Data Protection Law.

3. Our people

3.1 Only staff and subcontractors who need access to deliver the services will have it. They are bound by confidentiality obligations and trained in handling data securely.

4. Security

4.1 We will take appropriate technical and organisational measures to protect personal data, taking account of the risks, including the measures in Schedule 2. We may update these measures as long as the overall level of protection does not fall.

5. Sub-processors

5.1 You give general authorisation for us to use sub-processors to deliver the services. Schedule 3 describes the providers we use.

5.2 We will tell you before adding or replacing a sub-processor that will process your personal data, giving you a reasonable chance to object. If you object on reasonable data protection grounds and we cannot resolve it, you may end the affected service.

5.3 We will put a written contract in place with each sub-processor that gives at least the same protection as this agreement, and we remain responsible to you for their performance.

6. Helping you

6.1 Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures where possible, to respond to requests from data subjects exercising their rights. If we receive such a request directly, we will pass it to you promptly and not respond except on your instructions.

6.2 We will give you reasonable help with your obligations on security, personal data breaches, data protection impact assessments and consultation with the Information Commissioner, taking into account the information available to us.

6.3 Help that goes beyond the services may be charged at our current rates.

7. Personal data breaches

7.1 We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your personal data.

7.2 We will give you the information you reasonably need to meet your own obligations, including what happened, the data and people likely to be affected, the likely consequences and the steps taken or proposed, providing it in stages if it is not all available at once.

7.3 We will take reasonable steps to contain the breach and limit its effects, and will not notify anyone else about it on your behalf unless you ask us to or the law requires it.

8. Transfers outside the UK

8.1 We will not transfer your personal data outside the UK, or allow a sub-processor to, unless the transfer is covered by UK adequacy regulations or appropriate safeguards under Data Protection Law, such as the UK International Data Transfer Agreement or Addendum.

9. When the services end

9.1 When the services end, we will, at your choice, return your personal data to you or delete it, and delete existing copies unless the law requires us to keep them. If you do not tell us your choice within 30 days, we will delete it.

9.2 Copies in backups that cannot reasonably be deleted straight away will be kept secure and deleted in the normal backup cycle.

10. Audits and information

10.1 We will make available the information reasonably needed to show that we meet this agreement, including our Cyber Essentials certification and policies.

10.2 We will allow and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice, during normal working hours, no more than once a year unless a breach or regulator requires otherwise, and subject to confidentiality. You will meet your own costs and our reasonable costs of supporting an audit.

11. General

11.1 Each party’s liability under this agreement is subject to the limits in the Agreement, except where the law does not allow it to be limited.

11.2 If this agreement conflicts with the rest of the Agreement on data protection, this agreement wins.

11.3 This agreement lasts as long as we process personal data on your behalf. It is governed by the law of England and Wales.

Schedule 1: Details of the processing

Schedule 2: Security measures

• PC1 holds Cyber Essentials certification across the whole organisation and applies the same controls to its own systems.
• Multi-factor authentication on all PC1 staff and administrator accounts, with named individual accounts and least-privilege access.
• Encryption of data in transit, and of data at rest on PC1 laptops and in the services we use.
• Managed security updates, anti-malware and endpoint protection on PC1 devices and on managed client devices.
• Access to client systems is logged, used only to deliver the services, and removed when no longer needed.
• Staff confidentiality obligations and regular security awareness training.
• Backups, where included in the services, are encrypted and tested.
• An incident response process covering detection, escalation, containment and notification under clause 7.

Schedule 3: Sub-processors

Which providers process your data depends on the services in your Order. Typically these include:

• Microsoft (Microsoft 365 and Azure): email, files, collaboration and cloud services we manage or use to support you.
• Kaseya and Datto: remote monitoring, management and patching of managed devices.
• Splashtop: remote support sessions you approve.
• Email security and backup providers included in your services.
• CyberSmart: when we carry out Cyber Essentials certification for you.

We will give you a current list of the sub-processors used for your services on request.