Whereas, the Processor provides software and technology services to the Controller, involving the processing of personal data as defined under applicable data protection laws. In consideration of the mutual covenants contained herein, the parties agree as follows.
1.Definitions
1.1 “Personal Data” means any information relating to an identified or identifiable natural person, as defined in applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR).
1.2 “Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
1.3 “Data Protection Laws” means all applicable laws and regulations related to the processing of personal data, including but not limited to the GDPR.
2.Data Processing
2.1 Scope of Processing. The Processor shall process personal data on behalf of the Controller for the purposes described in Annex A.
2.2 Compliance with Laws. The Processor shall comply with all applicable Data Protection Laws in the processing of personal data, and the Controller shall comply with the same laws in relation to its use of the Processor's services.
3.Sub-processing
3.1 Authorised Sub-processors. The Controller hereby authorises the Processor to engage sub-processors to assist in the provision of the services, provided that the Processor maintains an up-to-date list of its sub-processors, which shall be available to the Controller upon request.
3.2 Responsibility for Sub-processors. The Processor shall remain responsible for its sub-processors' compliance with the Agreement and shall ensure that sub-processors are bound by data processing terms no less protective than those in this Agreement.
4.Data Transfers
4.1 International Data Transfers. The Processor may transfer personal data to countries outside of the European Economic Area (EEA) or the United Kingdom, as necessary for the provision of the services, provided that such transfers comply with applicable data protection laws.
4.2 International Locations. The Processor shall take all necessary steps to ensure compliance with local data protection laws and regulations.
5.Data Security
5.1 Security Measures. The Processor shall implement appropriate technical and organisational measures to ensure the security and confidentiality of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage. See the Security page for detail on encryption, access, backups, testing and incident response.
6.Data Subject Rights
6.1 Assistance to Controller. The Processor shall assist the Controller in responding to data subject requests to exercise their rights under applicable data protection laws. This assistance is chargeable at the agreed hourly rate.
7.Data Breach Notification
7.1 Notification. The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach. The customer T&Cs specify a notification window (default 72 hours, or shorter if agreed on the Sales Order).
8.Data Protection Impact Assessments and Consultation
8.1 Assistance. The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultation with supervisory authorities, as required by applicable data protection laws.
9.Term and Termination
9.1 Term. This Agreement shall remain in effect until the termination of the Sales Order or until both parties agree to terminate it.
9.2 Return or Deletion of Data. Upon termination, the Processor shall return all personal data to the Controller or delete it, as directed by the Controller.
10.General Provisions
10.1 Governing Law and Jurisdiction. This Agreement shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising under or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of the United Kingdom.
10.2 Entire Agreement. This Agreement constitutes the entire agreement between the parties in relation to its subject matter and supersedes all prior agreements, representations and understandings.
A.Annex A — Data Categories & Purpose
- Subject matter of the processing
- Personal data of employees, contractors and other related persons of the Data Controller.
- Nature and purpose of the processing
- Demographic data, location data and misconduct data for reporting and BI; misconduct data to enable governance, case management and compliance of the Controller.
- Type of Personal Data
- May include but is not limited to: name, gender, email address, phone number, ethnicity, religion, sexual orientation, location, details of employment.
- Categories of Data Subject
- Personal data of employees, contractors and other related persons of the Data Controller.
B.Annex B — Processing and Retention
This annex outlines the data retention practices followed by Safe Space Technology (the Processor) in accordance with applicable data protection laws and regulations. It specifies the duration for which personal data is retained and the criteria for data deletion, as well as the technical procedures for erasure.
Retention. Retention duration is determined by the Controller, with the Controller responsible for legislative compliance.
Deletion. Secure erasure upon retention period expiration or earlier upon Controller's written request.
Legal Exceptions. Extended retention when mandated by law, with Controller notification.