Snapshot 222545
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Annex
1. Introduction
1.1 This Data Processing Annex forms part of the Contract entered into between
Supplier and the Client and is subject to its terms and conditions.
1.2 Definitions for capitalised terms used in this Data Processing Annex are set out in
paragraph 5.
2. Compliance with Data Privacy Legislation
2.1 The Client and Supplier acknowledge that this Data Protection Annex will apply if
the Supplier is deemed to perform processing activities on behalf of Client.
2.2 This clause is in addition to, and does not relieve, remove or replace, a party’s
obligations under the Data Privacy Legislation.
3. Data Processing
3.1 If data processing is deemed to exist, in respect of such processing activities,
Supplier is the processor, and the Client is the controller (as such terms are
defined in the Data Privacy Legislation).
3.2 The Client shall be responsible for establishing and maintaining the lawful basis
for the processing of personal data under the Contract and shall notify the
Supplier in writing on request, of the applicable lawful basis for processing.
3.3 In respect of the personal data processed by Supplier as a data processor acting
on behalf of the Client under the Contract, the Supplier shall:
(a) only process the personal data in accordance with the Client’s written
instructions from time to time, unless such processing is required by any
law to which Supplier is subject, in which case, Supplier shall (to the
extent permitted by law) inform the Client of that legal requirement
before carrying out the processing;
(b) process the personal data only to the extent, and in such a manner, as is
necessary for the purposes of carrying out its obligations under the
Contract;
(c) ensure that persons engaged in the processing of personal data are
bound by appropriate confidentiality obligations;
(d) keep a written record of all processing activities which it carries out;
(e) implement and have in place appropriate technical and organisational
measures to protect against unauthorised, unlawful or accidental
processing, including accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to personal data, such measures in
each case to be appropriate to the likelihood and severity of harm to data
subjects that might result from the unauthorised, unlawful or accidental
Version 2.0 - December 2025
processing, having regard to the state of technological development and
the cost of implementing any measures;
(f) comply promptly with any lawful request from the Client requesting
access to, copies of, or the amendment, transfer or deletion of the
personal data to the extent the same is necessary to allow the Client to
fulfil its own obligations under the Data Privacy Legislation, including the
Client’s obligations arising in respect of a request from a data subject;
(g) notify the Client within two (2) Business Days if it receives any complaint,
notice or communication (whether from a data subject, competent
supervisory authority or otherwise) relating to the processing, the
personal data or either party’s compliance with the Data Privacy
Legislation as it relates to the Contract and provide the Client with
reasonable co-operation, information and other assistance in relation to
any such complaint, notice or communication;
(h) notify the Client promptly and at least within two (2) Business Days if, in
its opinion, an instruction from the Client infringes any Data Privacy
Legislation (provided always that the Client acknowledges that it remains
solely responsible for obtaining independent legal advice regarding the
legality of its instructions);
(i) inform the Client within 24 hours after becoming aware that any personal
data processed under this Agreement has been lost or destroyed or has
become damaged, corrupted, or unusable or has otherwise been subject
to unauthorised or unlawful processing including unauthorised or unlawful
access or disclosure;
(j) inform the Client promptly (and in any event within two (2) Business
Days) if it receives a request from a data subject for access to that
person’s personal data and shall:
(i) promptly provide the Client with reasonable co-operation and assistance
in relation to such request; and
(ii) not disclose the personal data to any data subject (or to any third party)
other than at the request of the Client or as otherwise required under the
Contract.
(k) provide reasonable assistance to the Client in responding to requests
from data subjects and in assisting the Client to comply with its
obligations under Data Privacy Legislation with respect to security, breach
notifications, and consultations with supervisory authorities or regulators;
(l) provide assistance to the Client with any data privacy impact
assessments for which Supplier reserves the right to charge any
reasonable costs incurred; and
(m) if ANDigital Limited is the Supplier, only transfer personal data outside
the United Kingdom if such transfer is carried out in accordance with
paragraph 4.
3.4 Subject to the limitation on liability in the Contract, each party agrees to
indemnify and keep indemnified and defend at its own expense the other party
against all costs, claims, damages or expenses (including reasonable legal fees)
incurred by the other party or for which the other Party may become liable due to
Version 2.0 - December 2025
any failure by the indemnifying party of its directors, employees or agents to
comply with any of its obligations under this Data Processing Annex.
4. International transfers – where ANDigital Limited is the Supplier:
4.1 Supplier and Client agree that personal data will be processed within the United
Kingdom. If it is processed outside of the United Kingdom, the following
conditions must be met:
(a) transferred by secure transfer to a country within the EU or the EEA with
the prior written permission of the Client to such transfer;
(b) the processing of the personal data is compliant with this Data Processing
Annex;
(c) the relevant transfer takes place without breach of applicable Data
Privacy Legislation; and
(d) transferred to a recipient in circumstances where Supplier is entitled to
rely on a permitted derogation under Data Privacy Legislation, which may
include circumstances where (among other things) the transfer is
necessary for the establishment, exercise or defence of legal claims.
4.2 Where Supplier uses a sub-processor located in a third country outside of the
United Kingdom that is not an Adequate Territory, Supplier shall have the right to
enter into Standard Contractual Clauses with the sub-processor for and on behalf
of the Client, whether on a named or an undisclosed basis.
4.3 Where the Client or its users are located in a third country outside of the United
Kingdom that is not an Adequate Territory and requires Supplier to transfer
personal data to it or them, the Client acknowledges that Supplier may not be
able to ensure that such transfer is subject to appropriate safeguards. The Client
nevertheless instructs Supplier to undertake such transfers as required for the
proper delivery of the Services pursuant to the Contract.
5. Definitions
5.1 In this Data Processing Annex the following terms have the meanings given to
them below, unless a contrary intention appears: The terms controller, processor,
process and data subject have the meanings given to them under Data Privacy
Legislation.
(a) Adequate Territory means: (i) with respect to transfers from the EEA to
a third country that is outside of the EEA, a territory outside of the EEA
that has been designated by the European Commission as ensuring an
adequate level of protection pursuant to Data Privacy Legislation and (ii)
with respect to transfers from the United Kingdom to a third country, a
territory that has been recognised by the United Kingdom as ensuring an
adequate level of protection pursuant to Data Privacy Legislation.
European Economic Area or EEA means those member states that are
subject to the Agreement on the European Economic Area dated 1
January 1994 including the member states of the European Union and
Iceland, Liechtenstein and Norway.
(b) Business Days means any day in the processor’s jurisdiction where
banks are open for business.
Version 2.0 - December 2025
(c) Data Privacy Legislation means UK Data Privacy Legislation and any
other applicable legislation relating to personal data and other regulations
and legislation in force from time to time that apply to a party’s use of
personal data (including, without limitation, the privacy of electronic
communications).
(d) Data subject, data privacy impact assessment, personal data,
processor, controller, has the meaning given to it in the Data Privacy
Legislation.
(e) UK Data Privacy Legislation means all applicable data protection and
privacy legislation in force from time to time in the UK, including the UK
General Data Protection Regulation (UK GDPR, the Data Protection Act
2018, the Privacy and Electronic Communications Directive 2002/58/EC
(as updated by Directive 2009/136/EC) and the Privacy and Electronic
Communications Regulations 2003 (SI 2003/2426) as amended.
(f) Standard Contractual Clauses means the Standard Contractual
Clauses for the transfer of personal data to processors, adopted by the
European Commission.
Version 2.0 - December 2025