Data Processing Agreement

The Supplier shall process personal data only in accordance with the Agreement, the Data Protection Laws, and the Customer's documented and lawful instructions. Where carrying out the Customer's instructions is not mandatory under the laws applicable to the Supplier, and would require the Supplier to incur material additional cost or effort, the Supplier may invoice that cost or effort on a time-and-materials basis after agreement with the Customer.

The Supplier shall process personal data only for the Purpose, and only to the extent and for the duration necessary to provide the Service.

The Supplier shall ensure that personnel authorised to process personal data have committed to confidentiality (whether by contract, by code of conduct, or by statutory duty).

The Supplier shall reasonably assist the Customer in responding to requests from data subjects exercising their statutory rights, and to requests from supervisory authorities. If the Supplier receives such a request directly, it shall notify the Customer without undue delay and shall not respond on behalf of the Customer unless authorised.

The Supplier shall reasonably assist the Customer in meeting its obligations on security, data-protection impact assessments, breach notifications, and prior consultations with supervisory authorities, in each case to the extent required by the Data Protection Laws and to the extent the Supplier has the necessary information.

Each party shall take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. The Supplier's measures are described in Appendix 3 (Trust & Security Annex). The Supplier shall limit access to personal data to authorised and properly trained personnel on a need-to-know basis.

On the Customer's written request, the Supplier shall provide the Customer with the information it needs to demonstrate the Supplier's compliance with this DPA, in accordance with section 4 (Proof of compliance and audits).

On written request from the Customer, the Supplier shall provide the Customer with Customer Data in an electronic form commonly in use, in accordance with section 14 of the MSA (Switching and data portability).

The Customer warrants that it is entitled to transfer the relevant personal data to the Supplier so that the Supplier may lawfully process the personal data for the Purpose and in accordance with the Agreement, on behalf of the Customer and where applicable as the Customer's sub-processor.

The Customer warrants that it is, and remains throughout the Term, in compliance with its obligations under the Data Protection Laws as a data controller, including in respect of informing data subjects and, where applicable, obtaining their consent.

General authorisation. The Customer authorises the Supplier to use sub-processors for the processing of personal data under the Agreement, on the terms set out in this section 3. The Supplier remains responsible for the acts and omissions of its sub-processors as if they were its own. The Supplier shall enter into written agreements with each sub-processor on terms that are materially equivalent to those in this DPA for the protection of personal data.

Current list. The Supplier's current sub-processors are listed in Schedule B. The Supplier maintains an up-to-date list of sub-processors and publishes it on the Supplier's website. The Supplier shall notify the Customer of any addition or replacement of a sub-processor at least thirty (30) days before the change takes effect.

Objection and refund. The Customer may, on justified grounds related to data protection or privacy, object in writing to the use of a specific new or replacement sub-processor. The parties shall use reasonable efforts to find an alternative solution. If no alternative solution can be agreed within thirty (30) days of the Customer's objection, the Customer may terminate the affected Service for convenience by written notice, and the Supplier shall refund the pro-rated portion of any pre-paid Service Fees for the period after termination takes effect in respect of that Service.

Marketplace third parties. Third parties that provide integrations, services, templates or other offerings listed on the Howspace Marketplace (the "Marketplace") are not sub-processors of the Supplier under this DPA, except where the Supplier has expressly added them to Schedule B. Where the Customer activates a third-party integration that exchanges personal data with the Service, the resulting data flow is initiated by the Customer through the Marketplace, and the Customer engages the relevant third party directly. The Customer is responsible for the lawful basis of any such data transfer and for putting in place any contractual arrangement (including any data processing agreement) it requires with that third party. The Supplier's role in respect of Marketplace third parties is limited to operating the Marketplace directory, as set out in the Howspace Marketplace Terms of Service.

Written questionnaire. The Customer may, no more than once per twelve-month period (except in the case of a documented suspicion of a material breach by the Supplier or following a personal data breach affecting the Customer), submit to the Supplier a reasonable written questionnaire concerning the Supplier's compliance with this DPA. The Supplier shall respond within a reasonable time, normally no more than thirty (30) calendar days.

Sub-processor facilities. The Customer acknowledges that audit rights in respect of certain sub-processors' facilities (in particular hyperscale cloud providers) may not be available in the form of on-site audits, and that the Supplier's reasonable cooperation in such cases consists of providing the relevant sub-processor's then-current third-party assurance reports and certifications (such as ISO/IEC 27001 and SOC 2 reports), and reasonable responses to written questions, in lieu of physical access to the sub-processor's facilities.

Default residency. Customer Data is hosted in the European Union or the European Economic Area (EU/EEA) by default. Personal data is processed within the EU/EEA except where Schedule C identifies a specific sub-processor that processes personal data outside the EU/EEA.

Transfer mechanisms. The Supplier shall not transfer any personal data processed under this DPA outside the EU/EEA unless the transfer is subject to a valid transfer mechanism under the Data Protection Laws, such as an adequacy decision (including the EU–US Data Privacy Framework) or the Standard Contractual Clauses adopted by the European Commission. Schedule C identifies the transfer mechanism and the supplementary measures relied on for each such sub-processor.

Notification. The Supplier shall notify the Customer without undue delay, and in any event within seventy-two (72) hours of the Supplier's confirmation of a personal data breach affecting the Customer's personal data. The notice shall include the information then reasonably available to the Supplier that the Customer needs to fulfil its own notification obligations under the Data Protection Laws.

Ongoing information. The Supplier shall continue to provide the Customer with additional information about the breach as it becomes available.

Cooperation. The Supplier shall reasonably cooperate with the Customer in any investigation, regulatory process or remediation arising from or in connection with the breach.

Order-Form-level variation. The parties may agree, in the Order Form, a shorter notification window than the seventy-two (72) hours specified in section 6.1.