Last Updated February 2024

Parties

This Data Processing Addendum (DPA) is between Assurestor and the other party to the Principal Services Agreement.

Background

(A)      Assurestor provides the Services and Support to Resellers and End Users pursuant to Principal Services Agreements.

(B)      The provision and use of the Services and Support involves the processing of Relevant Data by Assurestor, Resellers and End Users.

(C)      This DPA sets out the responsibilities of Assurestor, Resellers and End Users with respect to the processing of Relevant Data in connection with the provision and use of the Services and Support.

1. Status and effect of this DPA
1.1. This DPA supplements and forms a binding part of the Principal Services Agreement.
1.2. Except as amended or varied by this DPA, the provisions of the Principal Services Agreement shall continue in full force and effect in accordance with its terms.
1.3. In the event of any conflict or inconsistency between the provisions of this DPA and the Principal Services Agreement, the provisions of this DPA shall prevail with regard to the parties’ obligations, rights and liability in connection with the processing of Relevant Data.

2. Definitions

2.1 The following definitions apply in this DPA:

2.2. Terms relating to the processing of Personal Data such as processing, controller, processor, data subject and supervisory authority have the meanings given to them in the applicable Data Protection Law.

3. Purposes for processing Relevant Personal Data

3.1. Assurestor, End Users and Resellers may process Relevant Personal Data as reasonably necessary for the Permitted Purposes set out in Schedule 2.

4. Roles of the parties
4.1. Schedule 2 sets out the roles of the parties as controllers, processors or sub-processors in respect of the processing of Relevant Personal Data.

5. Application of Processor Terms
5.1. The Processor Terms shall apply to the processing of Service Data, which is processed by Assurestor and Resellers only for Processor Purposes.
5.2. The Processor Terms shall not apply to the processing of Account Data, which is processed by the parties only for Controller Purposes, User Data, which is processed by Assurestor only for Controller Purposes or Usage Data, which does not contain Personal Data.

6. Data security
6.1. Assurestor shall apply the Data Security Measures to Relevant Data.
6.2. End User and Reseller shall take reasonable steps to ensure that:
6.2.1. no unauthorised person gains access to the Platform or Services via a User account; and
6.2.2. persons it authorises to use the Platform and Services as Users have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, are adequately trained in data security and are reliable and aware of the confidential nature of Service Data and Account Data.

7. Data sharing
7.1. Assurestor may share :
7.1.1. Relevant Data with Vendors, to the extent necessary for the provision of the Services or Third Party Services;
7.1.2. Service Data and Account Data with any subcontractor appointed by Assurestor to provide Support, to the extent necessary for the provision of the Support requested;
7.1.3. User Data with any providers of services used by Assurestor in connection with the Services, such as web analytics , to the extent necessary for the provision of those services to Assurestor;
7.1.4. Relevant Data with other third parties if Assurestor is under a duty to disclose data in order to comply with any legal obligation, in connection with a merger or sale of Assurestor’s business or to protect the rights, property, or safety of Assurestor, Distributors, Resellers, End Users, Users or others, provided that Assurestor must only share Relevant Data with such recipients if and to the extent necessary for the relevant processing purpose and in accordance with the Data Protection Laws.
7.2. Assurestor shall comply with its obligations as a processor under the Processor Terms when sharing Service Data.

8. Data retention and deletion
8.1. Assurestor shall retain Relevant Data in accordance with the retention and deletion provisions set out in Schedule 1.

9. Assurestor’s obligations
9.1. Assurestor shall comply with its obligations as a controller under the Data Protection Laws when processing Account Data or User Data for the Controller Purposes. Further information about Assurestor’s processing for the Controller Purposes is set out in Assurestor's Privacy Notice.
9.2. Assurestor shall comply with its obligations as a processor under the Data Protection Laws and the Processor Terms when processing Service Data for the Processor Purposes.

10. End User obligations
10.1. End User shall comply with its obligations as a controller under the Data Protection Laws when processing Relevant Personal Data, including, without limitation, ensuring that it:
10.1.1. has a legal basis for that processing; and
10.1.2. provides data subjects with information about that processing.
10.2. End User shall comply with its obligations as a controller under the Processor Terms when processing Service Data via the Services.

11. Reseller obligations
11.1. Reseller shall comply with its obligations as a controller under the Data Protection Laws when processing Account Data for the Controller Purposes.
11.2. Reseller shall comply with its obligations as a processor under the Data Protection Laws when processing Service Data for the Processor Purposes on behalf of End Users and:
11.2.1. Reseller shall comply with all Reseller obligations set out in the Processor Terms;
11.2.2. Reseller shall enter into binding data processing terms with its End Users that comply with the Data Protection Laws and are consistent with the Processor Terms;
11.2.3. Reseller shall be responsible for obtaining and providing Assurestor with the End User’s processing instructions and authorisation for international transfers of Service Data and engagement of sub-processors by Assurestor to process Service Data (Instructions and Authorisations);
11.2.4. Reseller shall ensure that all Instructions and Authorisations it provides to Assurestor are in accordance with the End User’s processing instructions, the data processing terms between Reseller and the End User and the Data Protection Laws;
11.2.5. Reseller warrants that all Instructions and Authorisations set out in the Processor Terms and any document agreed between Assurestor and Reseller in writing in respect of the Processor Purposes are in accordance with the End User’s processing instructions, the data processing terms between Reseller and the End User and the Data Protection Laws;
11.2.6. Assurestor may treat all Instructions and Authorisations contained in the Processor Terms and any document agreed between Assurestor and Reseller in writing in respect of the Processor Purposes as the End User’s processing instructions;
11.2.7. Reseller shall indemnify Assurestor in respect of any losses, damages, claims, penalties or other liabilities incurred by Assurestor arising out of a breach of the warranty in Clause 11.2.5.

12. Co-operation between the parties
12.1. Each party shall co-operate with the other, to the extent reasonably requested, in relation to:
12.1.1. any request by a data subject to exercise any of their rights as a data subject under the Data Protection Laws in respect of Relevant Personal Data;
12.1.2. any other communication from a data subject concerning the processing of their Personal Data comprised in Relevant Data; and
12.1.3. any communication from a supervisory authority concerning the processing of Relevant Personal Data.

13. Liability in respect of data processing
13.1. Each party’s liability to the other in respect of any breach of this DPA shall be governed by the liability provisions of the Principal Services Agreement.

14. Notices under this DPA
14.1. Any notice or other communication required under this DPA, including under the Processor Terms, shall be given in accordance with the notice provisions of the Principal Services Agreement and this Clause 14.
14.2. Notices between the parties to the Principal Services Agreement shall be sent directly to each other using the notice address details in the Principal Services Agreement.
14.3. For notices to be given to End User as a controller of Service Data if the Services are provided to End User under an End User Agreement:
14.3.1. Assurestor shall send notices directly to End User using the notice address details in the applicable End User Agreement; and
14.3.2. End User shall send notices directly to Assurestor using the notice address details in the applicable End User Agreement.
14.4. For notices to be given to End Users as controllers of Service Data if the Services are provided to End Users under a Reseller Agreement:
14.4.1. Assurestor shall send notices to Reseller using the notice address details in the applicable Reseller Agreement;
14.4.2. Reseller shall forward Assurestor’s notices to its End Users who are affected by the notice; and
14.4.3. Reseller shall receive and respond to all responses to the notices from its End Users in accordance with the services agreement and data processing terms between Reseller and each End User.
14.5. If the Services are provided to End Users under a Reseller Agreement, provided that Assurestor has complied with this Clause 14, Assurestor shall have no liability to Resellers or End Users in respect of the delivery of notices under this DPA to End Users or the outcome of the notices, including the use of new sub-processors and international transfers of Service Data pursuant to the Processor Terms.

15. Effect of termination of the Principal Services Agreement
15.1. Upon termination of the Principal Services Agreement, the obligations in this DPA shall survive and continue to have effect in respect of any Relevant Data retained by Assurestor after termination.

16. Changes in laws
16.1. If any changes or prospective changes to the Data Protection Laws or other applicable laws result or will result in one or both parties not complying with those laws in relation to their processing of data pursuant to the Principal Services Agreement, the parties shall use their best endeavours to promptly agree such variations to this DPA and/or the Principal Services Agreement as may be necessary to remedy such non-compliance.

Schedule 1 to the Data Processing Addendum
Data descriptions and retention periods

Schedule 2 to the Data Processing Addendum
Permitted Purposes for processing Relevant Personal Data

Schedule 3 to the Data Processing Addendum
Processor Terms

1. Detail of the processing of Service Data in connection with the Principal Services Agreement

2. Processing Instructions
2.1. Assurestor shall only process Service Data on the documented instructions of End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement), including with regard to transfers of Service Data outside the UK or EU, as set out in these Processor Terms or any other document agreed by the parties in writing (Processing Instructions).
2.2. End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement) instructs Assurestor to process Service Data as reasonably necessary for the purpose of providing the Services in accordance with the Principal Services Agreement and to transfer Service Data outside the UK or EU in the circumstances, and subject to the Transfer Mechanisms, set out in Schedule 4 of this DPA.
2.3. Assurestor shall promptly inform End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement), if, in Assurestor’s opinion, any Processing Instruction infringes the Data Protection Laws. Once Assurestor has informed End User or Reseller under this Paragraph 2.3, Assurestor shall have no further liability to End User or Reseller in respect of the relevant processing being found to infringe the Data Protection Laws.
2.4. Notwithstanding any other provision of these Processor Terms, Assurestor may process Service Data otherwise than in accordance with the Processing Instructions if and to the extent that Assurestor is required to do so by applicable law. In such a case, Assurestor shall inform End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement) of the legal requirement before processing, unless that law prohibits such information .

3. Security
3.1. Assurestor shall ensure that persons it authorises to process Service Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and shall take reasonable steps to ensure that such persons are reliable and aware of the confidential nature of Service Data.
3.2. Assurestor, End User and Reseller shall each implement appropriate technical and organisational measures to ensure an appropriate level of security for Service Data, including but not limited to:
3.2.1. in Assurestor’s case, applying the Data Security Measures to Service Data; and
3.2.2. in End User’s and Reseller’s case, taking reasonable steps to ensure that: (i) no unauthorised person gains access to the Platform or Services via a User account; and (ii) persons it authorises to use the Platform and Services as Users have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, are adequately trained in data security and are reliable and aware of the confidential nature of Service Data.

4. Sub-processors
4.1. Assurestor must not engage any third party sub-processor to process Service Data without the prior specific or general written authorisation of End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement).
4.2. Assurestor is authorised by End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement) to engage, as sub-processors with respect to Service Data, the Vendors identified in Schedule 4 of this DPA ("Authorised Sub-Processors").
4.3. Assurestor shall inform End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) at least 14 days in advance of any intended changes concerning the addition or replacement of any Authorised Sub-Processor (the date of this notice being the “Notification Date”). Assurestor shall have no obligation to notify End Users directly if the Services are provided to them under a Reseller Agreement. If the Services are provided to End User under an End User Agreement and End User objects to a new sub-processor, End User may terminate the Order Form for the Service(s) affected by the change in sub-processor by giving written notice to Assurestor within 14 days of the Notification Date (“the Notice Period”). Such termination shall take effect at the end of the Notice Period or 7 days after the date of End User’s termination notice, whichever is later, and shall be subject to the provisions of the End User Agreement relating to consequences of termination of an Order Form. This termination right is End User’s sole and exclusive remedy if End User objects to any new or replacement Authorised Sub-Processor. If no termination notice is received by Assurestor, End User shall be deemed to have authorised the new sub-processor. Any addition to or replacement of an Authorised Sub-Processor under this Paragraph 4.3 shall be deemed to be an Authorised Sub-Processor. If the Service is provided to End User under a Reseller Agreement and End User objects to a new sub-processor, Reseller shall respond to the objection in accordance with the data processing terms between Reseller and End User, and Assurestor shall have no liability to Reseller or End User in respect of such new sub-processor.
4.4. Assurestor shall ensure that each Authorised Sub-Processor it engages to process Service Data is engaged pursuant to a written agreement containing equivalent legal obligations to those imposed on Assurestor by these Processor Terms and where an Authorised Sub-Processor fails to fulfil such obligations Assurestor shall remain fully liable to End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) for the performance of that Authorised Sub-Processor’s obligations.

5. International transfers of Service Data
5.1. End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement) authorises and instructs Assurestor to transfer Service Data outside the UK or EU in the circumstances, and subject to the Transfer Mechanisms, set out in Schedule 4 of this DPA.

6. Assistance with End User controller obligations
6.1. Assurestor shall, insofar as possible and taking into account the nature of the processing, take appropriate technical and organisational measures to assist End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement) with the fulfilment of End User’s controller obligation to respond to requests exercising a data subject's rights under the Data Protection Laws in respect of Service Data. Assurestor may charge End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) at its standard time-based charging rates for any work performed by Assurestor at the request of End User or Reseller in connection with responding to such requests where the End User or Reseller is able to respond to such requests itself using the functionality of the Services.
6.2. Assurestor shall assist End User (if the Services are provided to End User under an End User Agreement) or Reseller on behalf of End User (if the Services are provided to End User under a Reseller Agreement) in ensuring compliance with the obligations relating to security of the processing of Personal Data, the notification of Personal Data breaches to the supervisory authority, the communication of Personal Data breaches to the data subject, data protection impact assessments and prior consultation in relation to high-risk processing under the Data Protection Laws in respect of Service Data. Assurestor shall report any Personal Data breach relating to Service Data to End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) without undue delay following Assurestor becoming aware of the breach. Assurestor may charge End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) at its standard time-based charging rates for any work performed by Assurestor at the request of End User or Reseller pursuant to this Paragraph 6.2, except where such work is necessitated by a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws.

7. Information and audit
7.1. Assurestor shall make available to End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) on request Assurestor’s ISO 27001 Internal and External Audit Reports and Cyber Essentials Audit Report to demonstrate the compliance of Assurestor with its obligations under these Processor Terms and the Data Protection Laws.
7.2. Assurestor shall allow for and contribute to audits, including inspections, conducted by End User or Reseller on behalf of End User or another auditor mandated by End User or Reseller on behalf of End User in respect of the compliance of Assurestor's processing of Service Data with these Processor Terms and the Data Protection Laws. Reseller or End User must give Assurestor at least 14 days’ written notice of an audit unless the audit is required as a result of a Personal Data breach affecting Service Data or a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws, in which case Reseller or End User must give Assurestor reasonable written notice. The audit must take place within Business Hours (as defined in the Principal Services Agreement). Audits shall not be carried out more than once in any 12-month period unless an audit is required as a result of a Personal Data breach affecting Service Data or a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws. Assurestor may charge End User (if the Services are provided to End User under an End User Agreement) or Reseller (if the Services are provided to End User under a Reseller Agreement) at its standard time-based charging rates for any work performed by Assurestor at the request of End User or Reseller on behalf of End User pursuant to this Paragraph 7.2, except where such work is necessitated by a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws.

8. Return and deletion of Service Data
8.1. End User acknowledges (if the Services are provided to End User under an End User Agreement), and Reseller shall make End User aware (if the Services are provided to End User under a Reseller Agreement), that because the purpose of the Services is the backup and storage of Service Data on the Platform, after the end of the provision of a Service to End User, Assurestor shall delete all Service Data stored on the Platform in accordance with the data retention and deletion provisions set out in Schedule 1 and shall delete any copies of it in its possession or control save to the extent that applicable law requires storage of the relevant Personal Data.

Schedule 4 to the Data Processing Addendum
Vendors and international transfers