Snapshot 25566
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Version 1.2 March 2026
ADDITIONAL SERVICES
Data Processing Agreement
DEFINITIONS
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, processing and
appropriate technical and organisational measures: as defined in the Data Protection Legislation.
Data Protection Legislation means all applicable data protection and privacy legislation in force from
time to time in the UK including the UK GDPR (as defined by the meaning given to it in section 3(10)
(as supplemented by section 205(4)) of the Data Protection Act 2018); the Data Protection Act 2018
(DPA 2018) (and regulations made thereunder) and the Privacy and Electronic Communications
Regulations 2003 (SI 2003/2426) as amended and the guidance and codes of practice issued by the
Information Commissioner or other relevant regulatory authority and applicable to a party.
1.DATA PROTECTION
1.1 Both parties will comply with all applicable requirements of the Data Protection Legislation. This
clause 1 of the Data Processing Agreement is in addition to, and does not relieve, remove or replace, a
party's obligations or rights under the Data Protection Legislation.
1.2 Both you and us acknowledge that for the purposes of the Data Protection Legislation in
relation to the relevant Additional Services (as defined in the Business Account General Terms), you
(as Data Controller) appoint us as your Processor and you instruct (and consent to) us to process the
Personal Data to deliver the Additional Service(s). At the end of this Data Processing Agreement at
Table 1, we have set out the scope, nature and purpose of processing by us, the duration of the
processing and the types of Personal Data and categories of Data Subject.
1.3 Without prejudice to the generality of clause 1.1 of this Data Processing Agreement, you will
ensure that you have all necessary appropriate consents and notices in place to enable lawful transfer
of the Personal Data to us for the duration and purposes of the relevant business Account Schedule.
Unless we ask you expressly in writing, you must not transfer to us any special category personal data
for processing.
1.4 Without prejudice to the generality of clause 1.1 of this Data Processing Agreement, we
shall, in relation to any Personal Data processed in connection with the performance by us of our
obligations under the relevant Additional Service:
a) process that Personal Data only on your documented written instructions (and as per the terms
of this Data Processing Agreement) for the purposes described in the relevant Account
Schedule, Additional Conditions or part of the agreement or as otherwise agreed in writing by
you and us unless we are required by applicable law to otherwise process that Personal Data.
Where we are relying on applicable law as the basis for processing Personal Data, we will
promptly notify you of this before performing the processing required by the applicable law
unless those applicable law prohibit us from so notifying you;
b) ensure that we have in place appropriate technical and organisational measures to protect
against unauthorised or unlawful processing of Personal Data and against accidental loss or
destruction of, or damage to, Personal Data, appropriate to the harm that might result from the
unauthorised or unlawful processing or accidental loss, destruction or damage and the nature
of the data to be protected, having regard to the state of technological development and the
cost of implementing any measures (those measures may include, where appropriate,
pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability
and resilience of its systems and services, ensuring that availability of and access to Personal
Data can be restored in a timely manner after an incident, and regularly assessing and
evaluating the effectiveness of the technical and organisational measures adopted by it);
c) ensure that all personnel who have access to and/or process Personal Data are obliged to
keep the Personal Data confidential;
d) not transfer any Personal Data outside of the UK or the European Economic Area unless the
following have been fulfilled: (i) we have provided appropriate safeguards in relation to the
transfer; (ii) the Data Subject has enforceable rights and effective legal remedies (iii) we
comply with the Data Protection Legislation; and (iv) we will comply with your reasonable
instructions (at your cost) notified to us in advance with respect of the processing of the
Personal Data;
e) assist you, subject to you paying our reasonable costs in advance, in responding to any
request from a Data Subject and in ensuring compliance with your obligations under the Data
Protection Legislation with respect to security, breach notifications, impact assessments and
consultations with supervisory authorities or regulators;
f) notify you without undue delay on becoming aware of a Personal Data Breach involving your
Personal Data;
g) at the written direction of you, delete, return or make inaccessible your Personal Data and
copies of such to you on termination of the Additional Service unless required by applicable
law or regulatory requirement to store the Personal Data; and
h) maintain complete and accurate records and information to demonstrate our compliance
with this clause 1 and immediately inform you if, in our opinion, an instruction infringes the
Data Protection Legislation.
1.5 You consent to us appointing third-party processors of Personal Data as required by us under
this Data Processing Agreement to deliver the relevant Additional Service but always subject to us
having entered with the third-party processor into a written agreement incorporating terms which are
substantially similar to those set out in this clause 1 of this Data Processing Agreement and such
written agreement reflecting and will continue to reflect the requirements of the Data Protection
Legislation. As between you and us, we will remain fully liable for all acts or omissions of any third-party
processor appointed by us pursuant to this clause 1.5.
1.6 We may revise this Data Processing Agreement by replacing it with any applicable
controller to processor standard clauses or similar terms forming part of an applicable certification
scheme (which shall apply when replaced by attachment to this Agreement).
Table 1: Processing, Personal Data and Data Subjects
1.
Processing
by Us
1.1 Scope We will process the personal data of your Data Subjects (such as your
clients/ suppliers) as entered by you into our systems for the relevant
Additional Service.
1.2 Nature The nature of the processing will be to enable us to deliver the relevant
Additional Service to you as set out in the Agreement.
1.3 Purpose The purpose of the processing will be to enable us to deliver the
of Additional Service(s) to you as set out in the Agreement.
processing
1.4 Duration We will process this data for as long as we have a relationship with
of the you. At termination of the relevant Additional Service we will, subject to
processing our legal or regulatory requirements, delete or return the Personal
Data as set out above.
2. Types of The types of Personal Data are:
Personal
Data -Names;
-Addresses;
-Tax data; and
-Other data used for the Additional Service(s).
3. Categories Categories of Data Subjects include you and your:
of Data Subject
-Suppliers;
-Customers;
-Workforce; and
-Any other contacts.