Data Processing Addendum

Each clause with the page it sits on. Pick one to see it highlighted in the document.

• p.1CoverData Processing Addendum between Pelham & Rowe Surveyors Ltd and Lantern Cloud Ltd Dated 9 June 2025 Reference MF-DPA-2025-023 Fictional document...
• p.3Parties and backgroundThis Addendum is made on 9 June 2025 between: (1) Pelham & Rowe Surveyors Ltd, a company incorporated in England and Wales with company number...
• p.3 §1.1Definitions and interpretationIn this Addendum the following words have the meanings set out below: “Business Day” means a day other than a Saturday, a Sunday or a public holiday...
• p.4 §1.2Definitions and interpretationThis Addendum forms part of the Agreement. Words that are defined in the Agreement have the same meaning in this Addendum unless it says otherwise....
• p.4 §2.1Scope and rolesThe parties acknowledge that, for the Controller Personal Data, the Controller is the controller and the Processor is the processor. 2.2 Annex 1...
• p.4 §3.1Processing instructionsThe Processor shall process the Controller Personal Data only on the Controller’s documented instructions, unless the law requires otherwise. In that...
• p.4 §3.3Processing instructionsThe Processor shall tell the Controller promptly if, in its opinion, an instruction infringes the Data Protection Legislation. The Processor is not...
• p.4-5 §4.1PersonnelThe Processor shall make sure that every person that it authorises to process the Controller Personal Data is bound by a written duty of confidence,...
• p.5 §5.1SecurityThe Processor shall implement and maintain the technical and organisational measures in Annex 2, and any other measures that are appropriate to the...
• p.5 §6.1Sub-processorsThe Controller gives the Processor a general authorisation to engage the Sub-processors that are listed in Annex 3 at the date of this Addendum. 6.2...
• p.5 §6.3Sub-processorsThe Controller may object to a new Sub-processor within 14 days of receiving a notice under clause 6.2, on reasonable grounds that relate to data...
• p.5 §6.4Sub-processorsThe Processor shall have a written contract with each Sub-processor that imposes on it obligations that are no less protective than those in this...
• p.6 §7.1International transfersThe Processor shall not make a Restricted Transfer without the Controller’s prior written consent. At the date of this Addendum, the Processor does...
• p.6 §8.1Data Subject requestsThe Processor shall pass to the Controller, within five Business Days of receiving it, any request that a Data Subject makes to the Processor to...
• p.6 §8.2Data Subject requestsTaking into account the nature of the processing, the Processor shall help the Controller, by appropriate technical and organisational measures, to...
• p.6 §9.1Personal data breachThe Processor shall notify the Controller of a personal data breach affecting Controller Personal Data without undue delay, and in any event within...
• p.7 §9.3Personal data breachThe Processor shall take all reasonable steps to contain the breach and to prevent a recurrence, and shall cooperate with the Controller’s...
• p.7 §10.1AssistanceThe Processor shall give the Controller reasonable assistance, taking into account the nature of the processing and the information available to it,...
• p.7 §11.1AuditThe Processor shall give the Controller all the information that is necessary to show that it is complying with this Addendum, and shall allow and...
• p.7 §11.3AuditThe Controller may carry out an audit once in any period of 12 months, and at any time after a personal data breach affecting the Controller Personal...
• p.7 §11.4AuditEach auditor must sign a confidentiality undertaking that the Processor reasonably requires. The Controller shall bear the costs of an audit, unless...
• p.8 §12.1Deletion and returnAt the Controller’s choice, made by written notice before the Export Period ends, the Processor shall return the Controller Personal Data or delete...
• p.8 §12.3Deletion and returnThe Processor shall confirm in writing, on request, that it has returned or deleted the Controller Personal Data, and shall give the Controller a...
• p.8 §13.1LiabilityEach party’s liability to the other that arises under or in connection with this Addendum is subject to the limits and exclusions of liability in the...
• p.8 §13.2LiabilityNothing in this Addendum limits the liability of either party to a Data Subject, or any liability that cannot be limited by law. 13.3 Each party...
• p.8-9 §14.1Term and generalThis Addendum starts on the date stated at its beginning and continues for as long as the Processor processes Controller Personal Data, including...
• p.9 §15.1Governing law and jurisdictionThis Addendum, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by the...
• p.10 §Annex1.1Details of the processingAnnex 1 — Details of the processing 1. The subject matter, duration, nature and purpose of the processing, and the types of personal data and...
• p.11 §Annex2.1Security measuresAnnex 2 — Security measures 1. The Processor shall implement the measures below as a minimum. 2. Access control. Access to production systems is...
• p.11 §Annex2.3Security measures3. Encryption. Controller Personal Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or later. Encryption keys are stored...
• p.11 §Annex2.5Security measures5. Logging and monitoring. Security-relevant events are logged, kept for 12 months and monitored, with alerts that are reviewed by on-call personnel...
• p.11 §Annex2.7Security measures7. Back-up and recovery. Controller Personal Data is backed up every day and each back-up is kept for 35 days. Restoration from back-up is tested...
• p.11 §Annex2.9Security measures9. Physical security. The Processor hosts Controller Personal Data only in data centres in the United Kingdom that hold ISO/IEC 27001 certification...
• p.12 §Annex3.1Authorised Sub-processorsAnnex 3 — Authorised Sub-processors 1. The Controller has authorised the Sub-processors in the table below at the date of this Addendum....
• p.13ExecutionThis Addendum has been entered into on the date stated at the beginning of it. Signed for and on behalf of Pelham & Rowe Surveyors Ltd: Signature |...