1.4 Commencement

This DPA takes effect on the earlier of:

1. the date you first access or use the Service;
2. the date your subscription begins; or 
3. the date you accept the Terms.

3.3 Your responsibilities

As controller, you are responsible for:

1. determining the purposes and lawful basis for the processing;
2. complying with your obligations under the Applicable Data Protection Laws;
3. providing any privacy notices required by law; and
4. obtaining any consents or other permissions required for the processing.

3.4 Our controller processing

Nothing in this DPA prevents us from processing personal data as controller where we do so for our own purposes, including those described in our Privacy and Cookie Policy.

4.1 Processing on your instructions

We will process Customer Personal Data only:

1. on your documented instructions;
2. as necessary to provide the Service in accordance with our Terms and Conditions and this DPA;
3. where required by Data Protection Legislation; or
4. as otherwise agreed in writing between us.

4.2 Documented instructions

Your use of the Service, including the way you configure it, the personal data you upload or connect to it, and the features you choose to use, constitutes your documented instructions for the purposes of this DPA.

4.3 Legally required processing

If we are required by Data Protection Legislation to process Customer Personal Data other than in accordance with your instructions, we will notify you before doing so unless we're prohibited by law from giving that notice.

4.4 Infringing instructions

If we reasonably believe that one of your instructions infringes the Data Protection Legislation, we'll notify you without undue delay. Unless required by law, we will not be obliged to comply with that instruction until the issue has been resolved.

5.1 Our obligations

We will

1. ensure that persons authorised to process Customer Personal Data are subject to a duty of confidentiality or an appropriate statutory obligation of confidentiality;
2. implement and maintain the technical and organisational measures described in clause 7 and Annex C;
3. comply with clause 6 when appointing sub-processors;
4. taking into account the nature of the processing and the information available to us, provide reasonable assistance to help you comply with your obligations under the Data Protection Legislation, including in relation to:
   
   • data subject requests;
   • personal data breaches;
   • data protection impact assessments; and
   • prior consultation with a supervisory authority;
5. make available to you all information reasonably necessary to demonstrate our compliance with this DPA and Article 28 of the UK GDPR; and
6. permit audits in accordance with clause 10.

7.3 Specific measures

Our current technical and organisational measures are described in Annex C. We may update those measures from time to time, provided that the overall level of security is not materially reduced.

1. encryption of Customer Personal Data in transit and at rest;
2. logical access controls restricting access to authorised personnel on a need-to-know basis;
3. password protection and authentication measures;
4. processes to ensure the ongoing confidentiality, integrity, availability and resilience of our systems and services;
5. procedures for regularly testing, assessing and evaluating the effectiveness of our security measures; and
6. appropriate backup and disaster recovery procedures.

7.4 Hosting and infrastructure

Details of our hosting providers and infrastructure are set out in Annexes B and C.

8.1 Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 Contents of notification

Our notification will, to the extent the information is available, include:

1. a description of the nature of the personal data breach;
2. the categories and approximate number of data subjects and personal data records affected;
3. the likely consequences of the personal data breach; and
4. the measures taken or proposed to address the personal data breach and mitigate its possible adverse effects.

9.4 Requests received by us

If we receive a request directly from a data subject relating to the Customer Personal Data, we will promptly notify you and won't respond to the request except:

1. on your written instructions; or
2. where we are required to do so by law.

10.3 Further audits

If the information provided under clause 10.2 is insufficient to demonstrate our compliance, you may request a further audit on reasonable written notice and no more than once per year, provided that:

1. the audit relates only to our processing of Customer Personal Data;
2. it takes place during normal business hours;
3. it does not unreasonably interfere with our business; and
4. it complies with our reasonable confidentiality and security requirements.

10.4 Audit costs

Each party will bear their own costs of any audit unless the audit identifies a material breach of this DPA by us.

11.2 Transfer safeguards

We will not transfer Customer Personal Data outside the United Kingdom or the European Economic Area (EEA) other than to the sub-processors identified in Annex B, or any replacement sub-processors appointed in accordance with clause 6, unless:

1. the transfer is subject to an appropriate safeguard recognised under the Data Protection Legislation, including an adequacy regulation, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful transfer mechanism;
2. data subjects benefit from enforceable rights and effective legal remedies, where required by the Data Protection Legislation;
3. we comply with our obligations under the Data Protection Legislation in relation to the transfer and ensure that Customer Personal Data continues to receive an appropriate level of protection; and
4. we continue to process Customer Personal Data in accordance with your documented instructions and this DPA.