Data Processing Agreement

This Data Processing Agreement governs Client Personal Data that THISISITUK LTD, trading as “this is IT” (the Supplier and Processor), processes on behalf of the customer identified in the signed DPA Execution Sheet (the Client and Controller) when providing the agreed Services. It sets out the parties’ data-processing terms under Article 28(3) of the UK GDPR.

1. When This DPA Applies

• a) This Data Processing Agreement applies when the Supplier handles personal data on behalf of a Client while providing the agreed Services.
• b) For this processing, the Client is the controller and the Supplier is the processor. Each party is responsible for the data-protection duties that apply to it.
• c) This DPA applies together with:
  • a signed DPA Execution Sheet agreed by the Supplier and the Client;
  • the proposal, agreement or service schedule named in that execution sheet; and
  • the Supplier’s Terms and Conditions applicable to those Services.
• d) The proposal, agreement or service schedule describes the Services the Supplier provides. This DPA sets out the data-protection rules that apply when the Supplier provides those Services.
• e) The execution sheet records the details for the individual Client, including:
  • the version of this DPA that applies;
  • the relevant proposal, agreement or service schedule;
  • the Services and systems covered;
  • the personal data and people involved;
  • the providers used to support the Services;
  • relevant contact details; and
  • any additional requirements agreed with the Client.
• f) If the Supplier and the Client expressly agree to and sign a separate client-specific DPA, that separate DPA takes priority.
• g) Otherwise:
  • the execution sheet governs the details recorded for the individual Client;
  • this DPA governs the processing of Client Personal Data; and
  • the proposal, agreement or service schedule governs the Services and commercial arrangements.
• h) When the Supplier uses personal data for its own business purposes, such as billing, account administration, marketing or operating its website, the Supplier acts as a controller. This use of personal data is explained in the Supplier’s Privacy Policy and is not covered by this DPA.
• i) This DPA does not reduce anyone’s rights under data-protection law.

2. Definitions

• Client means the organisation receiving the Services from the Supplier.
• Client Personal Data means personal data that the Supplier processes on behalf of the Client when providing the Services.
• Controller means the organisation that decides why and how personal data will be processed. For Client Personal Data covered by this DPA, the Client is the controller.
• Data Subject means the person whom the personal data is about. This may include the Client’s staff, contractors, customers, suppliers or other contacts.
• DPA Execution Sheet means the document signed by the Supplier and the Client that connects this DPA to the relevant Services and records the processing details for that Client.
• Personal Data means information relating to an identified or identifiable person.
• Personal Data Breach means a security breach that results in personal data being accidentally or unlawfully lost, destroyed, changed, disclosed or accessed.
• Processing includes collecting, accessing, using, storing, changing, sharing, transferring, retrieving or deleting personal data.
• Processor means an organisation that processes personal data on behalf of a controller. The Supplier is the processor when it handles Client Personal Data under this DPA.
• Services means the services the Supplier provides to the Client as described in the applicable Service Documents.
• Service Documents means the proposal, agreement, service schedule or other written document named in the DPA Execution Sheet that describes the Services.
• Sub-processor means another provider appointed by the Supplier to process Client Personal Data when helping the Supplier provide the Services.
• UK Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, including any amendments or replacement legislation.

3. Subject Matter, Duration, Nature and Purpose

The DPA Execution Sheet records the processing details that apply to each Client. Unless it states otherwise, the following applies.

Subject Matter

The Supplier processes Client Personal Data only as needed to provide the agreed Services. Depending on what the Client buys, this may include managed IT support, Microsoft 365 administration, identity and device management, endpoint protection and monitoring, service documentation and backup and recovery. The Client’s specific systems are recorded in the DPA Execution Sheet.

Duration

The Supplier processes Client Personal Data during the term of the relevant Services and while completing agreed offboarding.

After offboarding ends, the Supplier may retain service documentation (including support ticket records) containing Client Personal Data for up to 90 days, or less if the Client instructs earlier deletion, unless UK law requires longer retention.

Backup copies remaining after Client Personal Data is removed from active systems will be deleted within 30 days. Until deletion, the documentation and backups remain protected under this DPA and will not be used for another purpose.

Nature of the Processing

When providing the Services, the Supplier may need to access and view Client Personal Data; organise or update information; administer accounts, devices and systems; store, copy or transfer information; review logs; monitor systems; manage backups; retrieve or restore information; and return or delete it. The Supplier will carry out only the processing reasonably required for the agreed Services.

Purpose

The Supplier processes Client Personal Data to provide, maintain, manage, secure, support and recover the Services agreed with the Client. It will not use Client Personal Data for its own unrelated purposes.

4. Personal Data and People Covered

The DPA Execution Sheet records the personal data and categories of people that apply to each Client.

Depending on the Services and systems involved, the Supplier may process personal data about:

• the Client’s current and former staff;
• workers and contractors;
• job applicants;
• authorised users of the Client’s systems;
• the Client’s customers and prospective customers;
• suppliers and business contacts; and
• other people whose information is held in systems the Supplier supports or backs up.

The personal data may include:

• names and contact details;
• company, department and job-role information;
• user-account and access information;
• device and asset identifiers;
• IP addresses and other technical information;
• system, security and diagnostic logs;
• support requests and service-desk records;
• emails, messages and calendar information;
• files and records held in supported systems;
• information included in backups;
• documentation about the Client’s systems and users; and
• other personal data held in systems covered by the Services.

Sensitive Personal Data

The Supplier does not normally ask the Client to provide special-category or criminal-offence data specifically to deliver the Services. Such data may nevertheless be present in systems, mailboxes, files or backups the Supplier supports and may be processed as part of that support even if the Supplier does not inspect it. Where present, it remains protected under this DPA.

The Client should identify in the DPA Execution Sheet any known sensitive data or higher-risk system that requires additional handling or agreed security arrangements.

Client Responsibilities

The Client is responsible for:

• ensuring that it has a lawful reason for collecting and using the personal data;
• giving appropriate privacy information to the people concerned;
• keeping only the personal data it reasonably needs;
• giving the Supplier lawful and appropriate instructions;
• telling the Supplier about known sensitive or higher-risk processing relevant to the Services; and
• identifying any special security, regulatory or contractual requirements that the Supplier has agreed to support.

5. Processing Only on Instructions

The Supplier will process Client Personal Data only in accordance with the Client’s documented instructions for the agreed Services, unless required to process it differently by law.

The Client’s documented instructions include:

• this DPA;
• the DPA Execution Sheet;
• the relevant proposal, agreement or service schedule;
• written service requests;
• support tickets;
• emails and written approvals; and
• any other instructions recorded and agreed by the parties.

A Client user may raise routine requests through the ticket system where the request falls within the Services and standing instructions already agreed. An instruction that changes the scope or nature of processing (such as giving a new party access, exporting a mailbox or moving data to a new system) must come from an authorised Client contact named in the DPA Execution Sheet.

The Client is responsible for ensuring that its instructions are lawful and sufficiently clear for the Supplier to carry out safely. The Client must keep the authorised contacts in the DPA Execution Sheet up to date and notify the Supplier in writing when they change.

If the Supplier reasonably believes that an instruction may breach data-protection law, it will tell the Client without undue delay. The Supplier may pause the affected processing while the parties clarify or resolve an unclear or potentially unlawful instruction.

If the law requires the Supplier to process Client Personal Data in another way, the Supplier will inform the Client before doing so unless the law prevents it from giving that information.

The Supplier will ensure that people authorised to process Client Personal Data do so only as required to provide the Services and follow the Client’s documented instructions.

The Supplier will not:

• sell or rent Client Personal Data;
• use it for the Supplier’s own marketing;
• use it to profile people for the Supplier’s own purposes;
• use it for unrelated product development; or
• use it to train, fine-tune or improve an AI model.

Further information about the Supplier’s use of AI is provided in its AI Policy.

6. Confidentiality of Client Personal Data

• a) The Supplier will treat Client Personal Data as confidential information.
• b) The Supplier will allow access only to people who:
  • need the information to provide the Services;
  • are authorised to access it; and
  • are subject to an appropriate contractual or legal duty of confidentiality.
• c) The Supplier will limit access according to each person’s role and responsibilities. Access will be reviewed when a person changes role and removed promptly when it is no longer needed.
• d) Anyone authorised to access Client Personal Data may use it only:
  • to provide the Services;
  • to follow the Client’s documented instructions; or
  • where required by law.
• e) The duty to protect Client Personal Data continues after a person’s employment, contract or other engagement ends.
• f) Before a contractor or continuity partner is given access to Client Personal Data, the Supplier will ensure they are bound by written confidentiality obligations. Any sub-processor with access must also be subject to the data-protection obligations described in the Sub-Processors section of this DPA.

7. Security of Processing

• a) The Supplier will use appropriate technical and organisational measures to protect Client Personal Data. The measures will be designed to reduce the risk of:
  • accidental or unlawful loss or destruction;
  • unauthorised access or disclosure;
  • inappropriate alteration;
  • loss of availability; and
  • other unlawful processing.
• b) The Supplier will select its security measures according to:
  • the nature of the Client Personal Data;
  • the Services and systems involved;
  • the likelihood and possible effect of a security incident;
  • available technology; and
  • the cost and practicality of the measures.
• c) Where relevant to the Services, the Supplier’s measures include:
  • multi-factor authentication;
  • single sign-on where available;
  • role-based access controls;
  • prompt removal of unnecessary access;
  • secure storage of passwords, keys and other secrets;
  • encryption in transit;
  • encryption at rest where supported by the relevant platform;
  • patching and secure configuration;
  • endpoint protection;
  • logging and monitoring; and
  • backup and recovery arrangements where included in the Services.
• d) The Supplier will review its security measures periodically and when there is a material change to the Services, systems, risks or providers involved.
• e) The Supplier’s current security certification and its expiry date are identified in the proposal or the certificate provided with it. The Supplier will notify the Client if its certification status changes.
• f) Some security measures within the Client’s own systems depend on:
  • the Services agreed with the Client;
  • the licences and technology available;
  • the systems included in the agreed scope;
  • accurate information and access supplied by the Client; and
  • the Client acting on agreed security recommendations.
• g) The Client must tell the Supplier about any specific security, regulatory or contractual requirements that apply to Client Personal Data. Those requirements apply to the Supplier only where they have been agreed in writing.
• h) The Client’s responsibilities do not reduce the Supplier’s duty to protect Client Personal Data while it is processing that data.

8. Sub-Processors

• a) The Client gives the Supplier general written authorisation to use the sub-processors listed below for the Services identified in the Client’s DPA Execution Sheet, subject to this section.
• b) The Supplier will put written data-protection obligations on each sub-processor that offer no less protection for Client Personal Data than this DPA, including an obligation to notify the Supplier of a Personal Data Breach without undue delay. The Supplier remains responsible to the Client for the sub-processor’s performance of those obligations.
• c) The approved sub-processors are:

The DPA Execution Sheet identifies which of these providers apply to the Client’s Services. IT Select may access Client Personal Data only when continuity cover is needed and under the agreed access controls.

• d) If an AI provider is used to process Client Personal Data on the Supplier’s behalf, it must be added to the approved sub-processor list through the change process below. Its use is also subject to the Supplier’s AI Policy.
• e) The Supplier will give the Client at least 30 days’ written notice before adding or replacing a sub-processor. The Client may object within that period on reasonable data-protection grounds. The parties will discuss the objection in good faith. If they cannot resolve it, either party may terminate the affected Service on written notice. Fees already incurred and any agreed non-cancellable third-party commitments remain payable under the Terms.
• f) The Client may request restrictions on AI tooling or another category of sub-processing. The parties will record any agreed restriction in the DPA Execution Sheet and agree any resulting change to the Services, timing or fees.

9. International Transfers

• a) The Supplier will use UK processing and storage locations where these are available and suitable for the agreed Services. Server and file backup storage uses AWS UK regions. Cloud backups through AFI Backup are stored in the UK, currently on Google Cloud. The Supplier’s Microsoft 365 tenant is configured for UK data residency. Where the Supplier provisions a Microsoft 365 tenant for a Client, it will confirm the available data residency setting with the Client.
• b) Some sub-processors may store or access Client Personal Data outside the UK, including where data is stored in the UK.
• c) The Supplier will use established and reputable sub-processors with suitable data-protection and security arrangements, under the provider’s applicable business service and data-processing terms.
• d) Where a sub-processor may process Client Personal Data outside the UK, the Supplier will check that an appropriate legal transfer mechanism applies. This may be UK adequacy regulations or, where required, the UK Addendum to the EU standard contractual clauses included in the provider’s data-processing terms.
• e) The Supplier records the hosting region or principal processing location for a sub-processor where that information is available from the provider or the service configuration. The Supplier will provide relevant information to the Client on request and review the applicable transfer arrangements if a material location or access arrangement changes.
• f) The Supplier will not initiate a transfer of Client Personal Data to a new country unless an appropriate legal transfer mechanism is in place.
• g) If an international transfer changes because the Supplier adds or replaces a sub-processor, the Supplier will follow the notice process in the Sub-Processors section of this DPA.

10. Assisting with Data Subject Rights

• a) The Supplier will assist the Client, so far as reasonably possible, in responding to requests from individuals exercising their data-protection rights.
• b) If an individual contacts the Supplier directly about Client Personal Data, the Supplier will pass the request to the Client without undue delay.
• c) Routine assistance, including searching for and exporting information from systems the Supplier manages, is included in the Services. The Supplier will provide this assistance within 14 days of receiving the Client’s request and the instructions needed to carry it out.
• d) The Client is responsible for assessing the request, deciding what information to disclose, redact or withhold and responding to the individual. The Supplier will provide technical assistance but will not make those decisions for the Client.
• e) If a request requires substantial additional work, the Supplier will explain the work and agree any charge with the Client before starting it.

11. Personal Data Breaches

• a) The Supplier will notify the Client without undue delay and, in any event, within 72 hours of becoming aware of a Personal Data Breach affecting Client Personal Data.
• b) The Supplier becomes aware of a Personal Data Breach when it has a reasonable degree of certainty that a security incident has affected Client Personal Data. Where an incident occurs at a sub-processor or third-party platform, the Supplier becomes aware when that provider informs it, or when the Supplier otherwise has enough information to identify the breach. The Supplier will not wait for its investigation to finish before notifying the Client. It will provide an initial notification and further information as it becomes available.
• c) The notification will include, so far as known at the time, the nature of the breach, the categories and approximate numbers of people and records affected, the likely consequences, the measures taken or proposed and a contact point. Missing information will be provided as it becomes available.
• d) The Supplier will assist the Client with investigation, containment, recovery and any notification the Client must make to the Information Commissioner’s Office or affected people. The Client, as Controller, decides whether those notifications are required.
• e) The Supplier will not notify a regulator or affected people on the Client’s behalf unless the Client instructs it to do so in writing.
• f) Suspected breaches can be reported to security@thisisit.uk.

12. Impact Assessments and Prior Consultation

• a) The Supplier will provide reasonable information and assistance to help the Client:
  • complete a Data Protection Impact Assessment where one is required; and
  • consult the Information Commissioner’s Office where the assessment identifies a high risk that cannot be sufficiently reduced.
• b) The assistance will take account of:
  • the type of processing carried out by the Supplier;
  • the information available to the Supplier; and
  • the Supplier’s role in providing the Services.
• c) Before using a new tool or service to process Client Personal Data, the Supplier will review the relevant data-protection and security risks and briefly record the review in its tool register, which also covers AI tools.
• d) If the proposed use may create a high risk for Client Personal Data, the Supplier will inform the Client before starting that use and provide reasonable information to support the Client’s assessment.

13. Return and Deletion

• a) When the Services end, or following the Client’s written request, the Client may choose whether the Supplier returns or deletes Client Personal Data. The Supplier will provide data requested for return in its original or a commonly used format within 30 days of the written request. After returning the data, the Supplier will delete its remaining copies, subject to the documentation and backup periods in paragraph b) and any retention required by UK law.
• b) Service documentation (including support ticket records) containing Client Personal Data may be retained for up to 90 days after agreed offboarding ends, or deleted sooner if the Client instructs. Backup copies remaining after the data is removed from active systems cannot be selectively deleted and will be deleted within 30 days of that removal. While retained, this information remains protected under this DPA and will not be used for another purpose. The Client may record specific return or deletion instructions in the DPA Execution Sheet or give them later in writing.
• c) Reasonable offboarding assistance will be provided as set out in the relevant Service Documents. Extended migration or bulk data-extraction work may be charged separately where it falls outside the agreed Services. The Supplier will explain and agree any additional charge before the work begins.
• d) If the Client requests written confirmation of deletion, the Supplier will confirm what has been deleted and identify any copies still held in backups, their expected deletion date, or any information retained because UK law requires it.

14. Records, Information and Audit

• a) The Supplier will maintain appropriate records of the processing it carries out for the Client and provide information reasonably required to show that it is meeting its obligations under this DPA.
• b) The Supplier will allow and reasonably assist with an audit or inspection by the Client or an independent auditor appointed by the Client. An appointed auditor must not be a competitor of the Supplier.

Audits must:

• be arranged with at least 30 days’ written notice, unless a shorter period is reasonably needed for an audit for cause;
• normally take place no more than once in any 12-month period;
• take place during normal business hours;
• be subject to suitable confidentiality requirements; and
• avoid unnecessary disruption to the Supplier’s business or risk to another client’s information.

An additional audit may be carried out where the information supplied is insufficient to demonstrate compliance, following a Personal Data Breach, to meet a regulatory requirement, or where there is another reasonable concern about compliance with this DPA.

• c) The Supplier may first provide relevant certifications, policies, reports or written answers. If these adequately address the Client’s reasonable questions, an on-site inspection will not normally be needed.
• d) The Client will pay its audit costs, unless the audit identifies material non-compliance by the Supplier with this DPA, in which case the Supplier will bear the reasonable costs of that audit.

15. Liability

• a) Liability between the Supplier and the Client under this DPA is governed by the Liability and Insurance section of the Supplier’s Terms and Conditions. Different limits apply only if expressly agreed in the signed agreement or proposal.
• b) Nothing in this DPA limits or excludes any responsibility, liability, individual right or regulatory power that cannot lawfully be limited or excluded.

16. Changes and Review

• a) The Supplier will review this DPA at least once a year and sooner where its Services, sub-processors or applicable data-protection requirements change.
• b) The Supplier may update its internal policies and procedures to reflect changes in law, technology, security risks or business operations. These updates will not:
  • a) materially reduce the protection provided to the Client;
  • b) change the agreed Services or fees; or
  • c) change the parties’ main contractual responsibilities.
• c) An updated version of this DPA may be used for new Clients from the issue date shown on that version.
• d) An updated version will apply to an existing Client when it is agreed in writing or identified in a replacement DPA Execution Sheet. Publishing a new version does not, by itself, replace the version already agreed with that Client.
• e) If a change to this DPA is required by law, the Supplier may make the change to the extent necessary and will notify affected Clients as soon as reasonably possible.
• f) Changes to sub-processors will be handled in accordance with the Sub-Processors section of this DPA.
• g) Each version of this DPA will show its version number, issue date and last review date. The Supplier will record the version agreed with each Client on their DPA Execution Sheet and keep a short, dated log of changes.
• h) Questions about this DPA may be sent to info@thisisit.uk.

17. Document Control