Data processing agreement

1. What is processed

• Purpose: providing the Intakt service to the controller, as described in the terms.
• People: the controller’s staff and contractors who use Intakt, and people at its suppliers and prospective suppliers.
• Data: names, work contact details, job roles, user activity, and any personal data contained in requests, quotes, contracts, purchase orders, invoices, comments and uploaded documents.
• Special categories: none are needed. The controller agrees not to upload them unless it is necessary and lawful.
• Duration: for the length of the subscription and the deletion period in the terms.

2. The processor’s commitments

• Process personal data only on the controller’s documented instructions, including these terms and how the controller configures Intakt, unless the law requires otherwise (in which case we will say so first, where allowed).
• Make sure everyone who can access the data is bound to confidentiality.
• Keep appropriate technical and organisational security measures, as described on our security page.
• Help the controller respond to requests from people exercising their rights, and with security, breach notification, impact assessments and consultations with regulators.
• Tell the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own obligations.
• At the end of the service, delete or return the data as the controller chooses, as set out in the terms, unless the law requires it to be kept.
• Make available the information needed to show compliance with this agreement, and allow audits, which will normally be met by our written answers and documentation, with an on-site audit where a regulator requires it or after a breach, on reasonable notice.

3. Sub-processors

The controller authorises the sub-processors listed on our sub-processors page. We will give at least 30 days’ notice before adding or replacing one, by email to the account’s administrators. The controller may object on reasonable data protection grounds; if we cannot resolve the objection, the controller may end the affected part of the service and receive a refund of prepaid fees for it. Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible for them.

4. International transfers

Where personal data is transferred outside the UK or EEA, we will make sure a lawful transfer mechanism is in place: an adequacy decision or regulation (including the UK Extension to the EU–US Data Privacy Framework), the ICO’s International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.

5. Anonymised benchmarks

The controller instructs the processor to anonymise commercial records, such as quotes, offers, orders and contracts, so that they can be used for the benchmarks described in section 5 of the terms. Anonymising means removing names, contact details and anything else that could identify a person, as well as the names of the controller and its suppliers. Once anonymised, the data is no longer personal data and this agreement no longer applies to it. If the controller stops contributing to benchmarks, this instruction ends.

6. The controller’s commitments

The controller is responsible for having a lawful basis for the personal data it puts into Intakt, for telling the people concerned, and for its instructions being lawful.

7. Liability and order of precedence

Liability under this agreement is subject to the limits in the terms. If this agreement conflicts with the terms on the processing of personal data, this agreement wins.