Data Processing Agreement

In this DPA the following terms have the meanings below. Other capitalised terms have the meaning given in the Agreement.

Headings are for convenience only. A reference to a clause or Schedule is to a clause of or Schedule to this DPA. The Schedules form part of this DPA.

This DPA applies to the Processing of Customer Personal Data by Carionex in providing the Services and forms part of the Agreement.

In respect of Customer Personal Data, the Customer is the Controller and Carionex is the Processor. The Customer decides why and how Customer Personal Data is collected and used, including the purposes, the lawful basis, the conditions for Special Category Data and how long records are kept.

Carionex is a Controller, and not a Processor, for personal data that it uses for its own purposes. This includes account administration, billing, security and fraud prevention, service improvement, support records, and data collected through its own website and marketing. That processing is described in the Carionex Privacy Policy and is outside this DPA.

The Customer is responsible for:

1. (a)having a lawful basis, and where required a condition for Special Category Data, for each use of Customer Personal Data in the Services;
2. (b)giving Data Subjects the information required by Applicable Data Protection Law;
3. (c)the accuracy and lawfulness of the Customer Personal Data it and its users enter;
4. (d)the users it authorises, the roles and permissions it gives them, and the settings it chooses in the Services; and
5. (e)the decisions it makes about retention, disclosure and sharing of its records.

If there is a conflict between this DPA and the rest of the Agreement about the Processing of Customer Personal Data, this DPA prevails.

This DPA takes effect when it is incorporated into the Agreement or signed by both parties. The published version of this DPA is a template. Viewing or downloading it does not by itself create a contract, and does not amount to acceptance of its terms by either party.

The subject matter, nature and purpose of the Processing, the types of Customer Personal Data and the categories of Data Subjects are set out in Schedule 1.

Carionex will Process Customer Personal Data for the duration of the Agreement and afterwards only as required by clause 12.

Carionex will Process Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by law. In that case Carionex will tell the Customer of the legal requirement before Processing, unless the law prohibits it.

The Customer's documented instructions are:

1. (a)the Agreement and this DPA;
2. (b)the Customer's use and configuration of the Services, including the settings, permissions and features it enables; and
3. (c)any further reasonable written instruction from the Customer that is consistent with the Agreement and that Carionex has agreed to follow.

Carionex will tell the Customer without delay if, in its opinion, an instruction infringes Applicable Data Protection Law. Carionex may suspend the affected Processing until the Customer confirms or amends the instruction.

Carionex will not sell Customer Personal Data, use it to build profiles for advertising, or use it for its own purposes except as permitted by law and described in clause 2.3.

Carionex will ensure that every person it authorises to Process Customer Personal Data is bound by a duty of confidentiality, and that access is limited to those who need it to provide the Services, support the Customer or maintain the security of the Services.

Access by Carionex personnel to Customer Personal Data is controlled by role and recorded as described in Schedule 2.

Carionex will implement and maintain the Security Measures, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing, including that it includes Special Category Data and records about children and adults who may be vulnerable.

Carionex may update the Security Measures from time to time, provided that the update does not materially reduce the overall level of protection.

The Customer is responsible for the security of its own devices, accounts and credentials, for choosing appropriate roles and permissions for its users, and for using the security features that the Services make available, such as two-factor authentication.

The Customer gives Carionex general authorisation to engage Subprocessors to Process Customer Personal Data. The Subprocessors engaged at the date of this version are summarised in Schedule 3.

Carionex will give the Customer at least 30 days' written notice before it adds or replaces a Subprocessor that Processes Customer Personal Data. Notice may be given by email to the Customer's account administrator or by notice within the Services.

The Customer may object on reasonable grounds relating to data protection within 14 days of the notice. Carionex will then work with the Customer in good faith to resolve the objection, for example by offering a reasonable alternative. If the objection cannot be resolved, the Customer may terminate the part of the Services that cannot be provided without the Subprocessor, and Carionex will refund any fees paid in advance for the period after termination.

Where a Subprocessor must be replaced urgently to protect the security or availability of the Services, Carionex may replace it without prior notice, and will notify the Customer as soon as reasonably practicable. The Customer's right to object then applies from the date of that notice.

Carionex will have a written contract with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, as required by Article 28(4) of the UK GDPR. Carionex remains responsible to the Customer for the performance of each Subprocessor's obligations.

Carionex will keep the Subprocessor Register up to date and make the full register available to the Customer on request.

Taking into account the nature of the Processing, Carionex will assist the Customer, through appropriate technical and organisational measures, in responding to requests from Data Subjects to exercise their rights. The Services include features that allow the Customer to search, correct, export and delete records.

If Carionex receives a request directly from a Data Subject about Customer Personal Data, it will pass the request to the Customer without undue delay and will not respond to the Data Subject, except to direct them to the Customer, unless the Customer instructs otherwise.

Carionex will give the Customer reasonable assistance with its obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and prior consultation with the ICO, taking into account the information available to Carionex.

Carionex will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will be sent by email to the Customer's account administrator and, where the breach is serious, by telephone or other direct contact where available.

The notice will describe, as far as it is known at the time:

1. (a)the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
2. (b)the likely consequences of the breach;
3. (c)the measures taken or proposed to contain and address the breach and to reduce its possible adverse effects; and
4. (d)a contact point from whom more information can be obtained.

Where all of this information is not available at once, Carionex may provide it in phases without further undue delay.

Carionex will investigate and contain the breach, record it in its incident register, keep the Customer informed, and provide the reasonable assistance the Customer needs to meet its own obligations. After the incident Carionex will review the cause and take steps to prevent a recurrence.

As Controller, the Customer decides whether a breach must be reported to the ICO, which for a reportable breach must be done within 72 hours of the Customer becoming aware of it, and whether Data Subjects must be told. Carionex will not notify the ICO or Data Subjects about Customer Personal Data on the Customer's behalf unless the Customer instructs it to or the law requires it.

Notification under this clause is not an admission of fault or liability by Carionex.

The primary production database for the Services is hosted in the United Kingdom, on Amazon Web Services in London. Other Subprocessors, including those that provide application delivery, file storage, email, SMS and payment services, may Process Customer Personal Data outside the United Kingdom or be accessed from outside the United Kingdom. Their locations, as confirmed, are recorded in the Subprocessor Register.

Carionex will make a Restricted Transfer only where one of the following applies:

1. (a)the recipient is in a country covered by UK adequacy regulations, including a recipient covered by the UK Extension to the EU-US Data Privacy Framework where it is certified;
2. (b)the transfer is covered by the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required; or
3. (c)another safeguard or exception permitted by Applicable Data Protection Law applies.

The Customer authorises the Restricted Transfers that Carionex makes in accordance with this clause to the Subprocessors listed in the Subprocessor Register.

Carionex will make available to the Customer the information needed to demonstrate compliance with this DPA and Article 28 of the UK GDPR. As a first step, Carionex will provide its Supplier Security and Compliance Assurance Pack on request. It describes the security controls, evidence and policies that are in place at the time it is generated, and the status of each.

If that information is not sufficient, the Customer, or an independent auditor bound by confidentiality that it appoints, may audit Carionex's compliance with this DPA, on at least 30 days' written notice, during normal business hours and without unreasonable disruption to Carionex or its other customers.

The Customer may audit more than once in any twelve months only where required by the ICO or another regulator, or following a Personal Data Breach affecting Customer Personal Data.

An audit does not extend to the data of other customers, to information that is legally privileged, or to the premises or systems of Subprocessors. For Subprocessors Carionex will provide the reports and certifications that it holds. Each party bears its own costs of an audit. Carionex may charge reasonable costs for assistance beyond the Assurance Pack and one audit in any twelve months.

The Customer decides how long its records are kept. Carionex does not apply a single retention period to all Customer Personal Data. Different categories of record, such as care records, safeguarding records, payroll records and employment records, are subject to different legal and professional retention requirements, and the Customer is responsible for deciding and applying the right period for each.

During the Agreement the Customer may export, correct and delete Customer Personal Data using the features of the Services. Carionex will delete or return Customer Personal Data on the Customer's documented instruction.

On expiry or termination of the Agreement, the Customer may export its Customer Personal Data for 30 days. Carionex will make the data available in a commonly used, machine-readable format. The formats available for each type of record are confirmed in writing when an export is requested, and Carionex does not promise a particular format for a record type that has not been confirmed in that way.

After the export period Carionex will delete the Customer Personal Data from its live production systems within 30 days, or earlier on the Customer's written request, unless the law requires it to be kept. Carionex will confirm the deletion in writing on request.

Copies held in backups are kept for a limited rolling period, currently 7 days. Backups are not accessed or restored except for disaster recovery, and are overwritten when that period ends. Customer Personal Data is therefore removed from backups on a delay and not immediately.

Where the law requires Carionex to keep any Customer Personal Data, Carionex will tell the Customer, will keep it securely, will use it only for that purpose, and will delete it when the requirement ends.

The liability of each party under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits liability that cannot be limited by law, or affects the rights of Data Subjects or the powers of the ICO.

Carionex may update this DPA to reflect a change in Applicable Data Protection Law, in guidance from the ICO, in the Services or in its Subprocessors. Each version has a version number, an effective date and a last-updated date. Earlier versions are kept and are available on request.

Where a change is material, Carionex will give the Customer at least 30 days' written notice before it takes effect. If the Customer reasonably objects, the parties will discuss the change in good faith, and the version already agreed continues to apply to the Customer until they agree otherwise or the Agreement ends.

This DPA starts when it takes effect under clause 2.6 and continues for as long as Carionex Processes Customer Personal Data, including during the periods in clause 12. Clauses that are intended to continue after termination continue to apply.

This DPA, and any dispute or claim arising out of or in connection with it, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, unless the Agreement provides otherwise.

Questions about this DPA, requests for the full Subprocessor Register or the Assurance Pack, and notices under this DPA should be sent to privacy@carionex.co.uk or by post to TradeAlgoSuite Technologies Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.