DATA PROCESSING AGREEMENT
"Unica", a company registered office at
Unica consultancy ltd
78 Dulwich village, se21 7aj, London, United Kingdom
(“Controller”);
1. DEFINITIONS
1.1. Personal Data: As defined in Article 4(1) of the UK General Data Protection Regulation (UK GDPR).
1.2. Processing: Any operation performed on Personal Data as defined in Article 4(2) of the UK GDPR.
1.3. Data Subject: An identified or identifiable natural person.
1.4. Supervisory Authority: The UK Information Commissioner’s Office (ICO).
1.5. Applicable Law: The UK GDPR, the Data Protection Act 2018, and other applicable data protection laws and regulations.
2. SUBJECT MATTER
This Agreement sets out the terms and conditions under which the Processor will process Personal Data on behalf of the Controller in accordance with Applicable Law.
3. PROCESSING DETAILS
The Processor will process Personal Data as described below:
• Purpose: provision of services under a specific agreement.
• Nature of Processing: data storage, analysis, transmission.
• Categories of Data Subjects: customers.
• Duration: Until termination of this Agreement or as required under Applicable Law.
4. PROCESSOR’S OBLIGATIONS
The Processor agrees to:
4.1. Process Personal Data only on the documented instructions of the Controller, unless required by law.
4.2. Ensure that individuals processing the data are subject to confidentiality obligations.
4.3. Implement appropriate technical and organisational measures to ensure the security of Personal Data.
4.4. Assist the Controller in responding to requests from Data Subjects and Supervisory Authorities.
4.5. Notify the Controller without undue delay after becoming aware of a Personal Data Breach.
4.6. Delete or return all Personal Data to the Controller after the termination of services, unless required to retain it under Applicable Law.
5. CONTROLLER’S OBLIGATIONS
The Controller agrees to:
5.1. Ensure that the Personal Data is collected lawfully and that the Processor is provided with lawful instructions for processing.
5.2. Notify the Processor of any changes to the purpose or scope of the processing.
5.3. Ensure that Data Subjects are informed of their rights in accordance with Applicable Law.
6. DATA SUBJECT RIGHTS
The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests under Chapter III of the UK GDPR, including requests for access, rectification, erasure, and restriction of processing.
7. SUB-PROCESSORS
7.1. The Processor shall not engage sub-processors without the prior written authorisation of the Controller.
7.2. The Processor shall ensure that any sub-processor is bound by obligations no less protective than those set out in this Agreement.
8. INTERNATIONAL TRANSFERS
8.1. The Processor shall not transfer Personal Data outside the United Kingdom without the Controller’s prior written consent and ensuring compliance with Applicable Law.
8.2. Where such transfers occur, appropriate safeguards, such as standard contractual clauses or adequacy decisions, shall be implemented.
9. AUDIT RIGHTS
The Controller may, upon reasonable notice, audit the Processor’s compliance with this Agreement. The Processor shall cooperate fully and provide necessary access to systems, records, and personnel.
10. LIABILITY AND INDEMNITY
10.1. The Processor shall be liable for breaches of this Agreement only to the extent that it has failed to comply with its obligations under Applicable Law.
10.2. Each Party agrees to indemnify the other against any claims, fines, or damages arising from its own non-compliance with Applicable Law.
11. TERMINATION
11.1. This Agreement shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller.
11.2. Upon termination, the Processor shall delete or return all Personal Data, as instructed by the Controller.
12. GOVERNING LAW AND JURISDICTION
This Agreement shall be governed by and construed in accordance with the laws of England and Wales. The Parties submit to the exclusive jurisdiction of the courts of England and Wales.
13. ENTIRE AGREEMENT
This Agreement constitutes the entire agreement between the Parties concerning the processing of Personal Data and supersedes any prior agreements on the subject.
Signed for and on behalf of the Controller:
Unica consultancy ltd
78 Dulwich village, se21 7aj, London, United Kingdom