Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Agreement between Record OS and Customer.

In providing the Service, Record OS will Process Personal Data on behalf of the Customer. The parties wish to ensure that their arrangements for the Processing of Personal Data comply with Data Protection Laws. This DPA sets out the terms on which Record OS will Process Personal Data on behalf of the Customer and the respective obligations of the parties in relation to such Processing.

1. Definitions and Interpretation

1.1 In this DPA, the following terms have the meanings set out below:

• "Approved Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, as may be amended or replaced from time to time.
• "Controller" has the meaning given in UK GDPR.
• "Customer Data" means any data and information provided by the Customer to Record OS, or collected by Record OS on behalf of the Customer, in connection with the Service, including End User Data.
• "Customer Personal Data" means any Personal Data contained within the Customer Data that is Processed by Record OS on behalf of the Customer in connection with the Service.
• "Data Protection Laws" means: (a) the UK GDPR; (b) the Data Protection Act 2018; (c) the Privacy and Electronic Communications (EC Directive) Regulations 2003; and (d) any other applicable laws relating to the Processing of Personal Data and privacy that apply to either party in connection with this DPA, in each case as amended, superseded, or replaced from time to time.
• "Data Subject" has the meaning given in UK GDPR.
• "Data Subject Request" means a request from a Data Subject to exercise any of their rights under Data Protection Laws in relation to their Personal Data.
• "End User" means a taxpayer or other individual client of the Customer who uses the Service to submit their Self Assessment information to the Customer.
• "End User Data" means any data submitted to the Service by End Users, or by the Customer on behalf of End Users, including Personal Data relating to End Users.
• "EEA" means the European Economic Area.
• "EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as set out in the Annex to European Commission Implementing Decision (EU) 2021/914.
• "IDTA" means the International Data Transfer Agreement issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, as may be amended or replaced from time to time.
• "Information Commissioner" means the UK Information Commissioner's Office (ICO), or any successor body.
• "Personal Data" has the meaning given in UK GDPR.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.
• "Processing" has the meaning given in UK GDPR, and "Process" and "Processed" shall be construed accordingly.
• "Processor" has the meaning given in UK GDPR.
• "Restricted Transfer" means a transfer of Customer Personal Data from the United Kingdom to a country or territory outside the United Kingdom that is not subject to an adequacy decision by the UK Secretary of State.
• "Security Measures" means the technical and organisational security measures implemented by Record OS as described in Annex 2.
• "Service" means the Record OS platform and related services provided by Record OS to the Customer under the Agreement.
• "Special Category Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.
• "Sub-processor" means any third party engaged by Record OS (or by any other Sub-processor) to Process Customer Personal Data on behalf of the Customer in connection with the Service.
• "Supervisory Authority" means any regulatory authority responsible for the enforcement of Data Protection Laws, including the Information Commissioner.
• "UK Addendum" means the Approved Addendum, being the UK Addendum to the EU SCCs.
• "UK GDPR" means the General Data Protection Regulation ((EU) 2016/679) as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (as amended).

1.2 In this DPA: (a) terms defined in the Agreement have the same meaning when used in this DPA, unless otherwise defined herein; (b) references to clauses and Annexes are to clauses of, and annexes to, this DPA; (c) headings are for convenience only and do not affect interpretation; (d) references to any statute or statutory provision include any subordinate legislation made under it and any amendments, re-enactments, or replacements of it; words in the singular include the plural and vice versa; (e) and a reference to "writing" or "written" includes email.

2. Status of the Parties

2.1 Customer as Controller. The parties acknowledge and agree that, with respect to the Processing of Customer Personal Data:

• the Customer is the Controller;
• Record OS is the Processor acting on behalf of the Customer; and
• Record OS will Process Customer Personal Data only in accordance with the Customer's documented instructions as set out in this DPA and the Agreement.

2.2 Record OS as Controller. Notwithstanding clause 2.1, the parties acknowledge that Record OS acts as an independent Controller in respect of the following Processing activities, which are necessary for Record OS's legitimate business purposes:

• account registration and management;
• billing and payment processing;
• service usage analytics (in aggregated and anonymised form);
• compliance with legal obligations applicable to Record OS; and
• communicating with the Customer about the Service.

2.3 Compliance. Each party shall comply with its obligations under Data Protection Laws. The Customer shall ensure that its instructions to Record OS comply with Data Protection Laws and that it has all necessary rights and lawful bases to provide Customer Personal Data to Record OS for Processing in accordance with this DPA.

3. Scope of Processing

3.1 Details of Processing. The subject matter, duration, nature, and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex 1 to this DPA.

3.2 Purpose Limitation. Record OS shall Process Customer Personal Data only: (a) for the purposes of providing the Service as described in the Agreement and this DPA; (b) in accordance with the Customer's documented instructions; and (c) as required to comply with applicable law.

3.3 Documented Instructions. The Customer's instructions to Record OS are documented in this DPA and the Agreement. The Customer may issue additional written instructions consistent with the terms of the Agreement. Record OS shall inform the Customer if, in its opinion, an instruction infringes Data Protection Laws, unless prohibited from doing so by applicable law.

3.4 Special Category Data. The Service is not intended for the Processing of Special Category Data. The Customer shall not submit Special Category Data to the Service unless: (a) the Customer has notified Record OS in writing; (b) the Customer has entered into any additional agreements required by Record OS; and (c) Record OS has confirmed in writing that appropriate safeguards are in place.

4. Record OS Obligations

4.1 General Obligations. Record OS shall:

• Process Customer Personal Data only on the Customer's documented instructions, unless Processing is required by applicable law, in which case Record OS shall (to the extent permitted by law) inform the Customer of that legal requirement before Processing;
• ensure that persons authorised to Process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implement and maintain the Security Measures;
• comply with the conditions for engaging Sub-processors set out in clause 6;
• taking into account the nature of the Processing, assist the Customer by appropriate technical and organisational measures, insofar as this is reasonably possible, for the fulfilment of the Customer's obligation to respond to Data Subject Requests;
• provide reasonable assistance the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 of UK GDPR, taking into account the nature of Processing and the information available to Record OS;
• at the Customer's choice, delete or return all Customer Personal Data to the Customer after the end of the provision of the Service, and delete existing copies unless applicable law requires storage of the Personal Data;
• make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 of UK GDPR and this DPA; and
• allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, subject to the terms set out in clause 10.

4.2 No Sale of Personal Data. Record OS shall not sell Customer Personal Data or otherwise Process Customer Personal Data for any purpose other than as specified in this DPA and the Agreement.

5. Customer Obligations

5.1 Compliance. The Customer shall:

• comply with Data Protection Laws in its use of the Service and in its Processing of Personal Data;
• ensure that it has a valid lawful basis under Data Protection Laws for the Processing of Customer Personal Data through the Service;
• provide all required privacy notices to End User/Data Subjects and obtain all required consents (where consent is the lawful basis);
• ensure that the Customer's instructions to Record OS comply with Data Protection Laws;
• ensure that it has all necessary rights and authorisations to provide Customer Personal Data to Record OS;
• be responsible for the accuracy, quality, and legality of Customer Personal Data;
• implement appropriate security measures for its own systems and any data transmitted to the Service; and
• promptly notify Record OS of any Data Subject Requests received directly by the Customer that relate to Record OS's Processing activities.

5.2 End User Notices and Consents. The Customer is responsible for providing all required privacy notices to End Users and obtaining all necessary consents from End Users for Record OS to Process End User Data in accordance with this DPA and the Agreement. The Customer warrants that it has provided such notices and obtained such consents.

6. Sub-processors

6.1 General Authorisation. The Customer provides a general authorisation for Record OS to engage Sub-processors to Process Customer Personal Data, subject to the requirements of this clause 6.

6.2 Current Sub-processors. Record OS's current Sub-processors as at the date of this DPA are listed at [insert URL] ("Sub-processor List"). The Customer hereby approves the engagement of those Sub-processors for the Processing described in the Sub-processor List.

6.3 New Sub-processors. Record OS shall update the Sub-processor List before engaging any new Sub-processor. The Customer is responsible for reviewing the list periodically. If the Customer objects to a new Sub-processor on reasonable data protection grounds, the Customer shall notify Record OS in writing within seven (7) days of the list being updated. The parties shall discuss the objection in good faith, but Record OS shall have final discretion over Sub-processor selection. Continued use of the Service after the seven (7) day period constitutes acceptance of the new Sub-processor.

6.4 Emergency Sub-processor Changes. Notwithstanding clause 6.3, where a Sub-processor change is necessary to maintain Service continuity (for example, if an existing Sub-processor becomes unavailable), Record OS may engage a replacement Sub-processor immediately and shall update the Sub-processor list as soon as reasonably practicable.

6.5 Sub-processor Agreements. Record OS shall enter into a written agreement with each Sub-processor that imposes data protection obligations on the Sub-processor that are no less protective than those imposed on Record OS under this DPA. Record OS shall ensure that each Sub-processor agreement provides sufficient guarantees to implement appropriate technical and organisational measures to meet the requirements of Data Protection Laws.

6.6 Liability for Sub-processors. Record OS shall remain fully liable to the Customer for the performance of each Sub-processor's obligations. Where a Sub-processor fails to fulfil its data protection obligations, Record OS shall remain responsible for the performance of that Sub-processor's obligations.

7. Data Subject Requests

7.1 Notification. Record OS shall, to the extent legally permitted, promptly notify the Customer if Record OS receives a Data Subject Request relating to Customer Personal Data. Record OS shall not respond to any such request except on the Customer's documented instructions or as required by applicable law.

7.2 Assistance. Taking into account the nature of the Processing, Record OS shall assist the Customer by reasonable and appropriate technical and organisational measures, insofar as this is reasonably possible, in responding to Data Subject Requests. Such assistance may include:

• providing the Customer with the ability to access, correct, delete, or export Customer Personal Data through the Service;
• providing information reasonably requested by the Customer to enable the Customer to respond to a Data Subject Request; and
• complying with the Customer's reasonable instructions to correct, amend, delete, or block Customer Personal Data.

7.3 Costs. Where assistance under this clause 7 requires significant resources beyond the standard functionality of the Service, Record OS may charge a reasonable fee based on Record OS's costs of providing such assistance. Record OS shall notify the Customer of any such fees before commencing the work.

8. Personal Data Breaches

8.1 Notification. Record OS shall, as soon as reasonably practicable, and in any event within seventy two (72) hours, notify the Customer after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall include a description of the measures taken or proposed to be taken by Record OS to address the Personal Data Breach, including measures to mitigate its possible adverse effects.

8.2 Cooperation. Record OS shall cooperate with the Customer and take such reasonable steps as directed by the Customer to assist in the investigation, mitigation, and remediation of any Personal Data Breach. Record OS shall not inform any third party of any Personal Data Breach without first obtaining the Customer's written consent, except where required by applicable law or at the direction of a Supervisory Authority.

8.3 No Acknowledgment of Fault. Notification of a Personal Data Breach to the Customer under this clause 8 shall not be construed as an acknowledgement by Record OS of any fault or liability with respect to the Personal Data Breach.

9. Security

9.1 Security Measures. Record OS shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Such measures are described in Record OS' information security policies.

9.2 Updates to Security Measures. Record OS may update the security measures from time to time, provided that such updates do not materially decrease the overall security of the Service.

9.3 Customer Security. The Customer acknowledges that the security of Customer Personal Data also depends on the Customer's implementation of appropriate security measures, including maintaining the confidentiality of user credentials, implementing appropriate access controls, and ensuring secure transmission of data to the Service.

10. Audits

10.1 Audit Rights. Record OS shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations set out in Article 28 of UK GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer.

10.2 Audit Conditions. Any audit shall be subject to the following conditions:

• the Customer shall give Record OS at least thirty (30) days' prior written notice of any audit (except in the case of an audit required by a Supervisory Authority or following a Personal Data Breach, where reasonable notice shall be given);
• audits shall be conducted during normal business hours and shall not unreasonably disrupt Record OS's business operations;
• the Customer (and any auditor) shall comply with Record OS's reasonable security and confidentiality requirements;
• any third-party auditor shall be bound by confidentiality obligations and shall not be a competitor of Record OS;
• audits shall be limited to once per year, unless required by a Supervisory Authority or following a Personal Data Breach; and
• the Customer shall be responsible for all costs associated with any audit, except where the audit reveals a material breach by Record OS of this DPA.

10.3 Third-Party Certifications. Record OS may satisfy audit requests by providing relevant third-party certifications, audit reports, or other evidence of compliance with security and data protection standards. The Customer agrees that such documentation may be used to satisfy audit requirements where it adequately addresses the Customer's audit objectives.

11. International Transfers

11.1 Data Location. Customer Personal Data is stored and Processed in the United Kingdom. Record OS's primary data hosting location is Amazon Web Services (AWS) in the United Kingdom.

11.2 Restricted Transfers. Record OS shall not transfer Customer Personal Data outside the United Kingdom unless: (a) the transfer is to a country or territory that has been determined by the UK Secretary of State to provide an adequate level of protection for Personal Data; (b) Record OS has put in place appropriate safeguards in accordance with Data Protection Laws, such as the IDTA or the EU SCCs; or (c) the transfer is otherwise permitted under Data Protection Laws.

11.3 Transfer Mechanism. Insofar as the Agreement involves the transfer of Personal Data:

• from the EEA to a Non-Adequate Country, the parties agree to comply with the applicable module of the Standard Contractual Clauses incorporated by reference in Exhibit 1.
• outside of the United Kingdom (UK) and/or governed by the UK DPA, the International Data Transfer Addendum (IDTA) to the EU Commission Standard Contractual Clauses (Version B1.0) issued by the UK Information Commissioner for Parties making Restricted Transfers, as amended, updated, or superseded from time to time, will apply as follows stated in Exhibit 2.

11.4 In the event that the European Commission, any applicable data protection authority, or other body with competent authority and jurisdiction and/or the analogous competent authority in the EEA or United Kingdom revises and thereafter publishes new Standard Contractual Clauses or as otherwise required or implemented by such authority, such new Standard Contractual Clauses will supersede and replace the existing Standard Contractual Clauses. If such revision or publication requires that this DPA be adjusted to accommodate new or changing requirements, the parties agree to promptly negotiate in good faith to amend this DPA.

11.5 Except as covered or permitted by the Standard Contractual Clauses, applicable law, or a country in respect of which a valid adequacy decision has been issued by the European Commission, as the case may be, Record OS shall not process Personal Data outside the European Economic Area or the United Kingdom without the express written consent of the Customer.

12. Data Retention and Deletion

12.1 Retention During Term. During the Term, Record OS shall retain Customer Personal Data as necessary to provide the Service and in accordance with the Customer's instructions.

12.2 Data Export. During the Term and for a period of thirty (30) days following the termination or expiry of the Agreement (the "Retrieval Period"), the Customer may export Customer Personal Data from the Service upon request. Customer Personal Data will be available for export in a commonly used, machine-readable format.

12.3 Deletion on Termination. Following the Retrieval Period, Record OS shall, at the Customer's choice: (a) delete all Customer Personal Data from Record OS's systems; or (b) return all Customer Personal Data to the Customer and delete existing copies.

12.4 Exception for Legal Requirements. Record OS may retain Customer Personal Data to the extent required by applicable law, provided that Record OS: (a) maintains the confidentiality of such Personal Data; (b) Processes it only as necessary to comply with the applicable legal requirement; and (c) deletes it as soon as the legal requirement expires.

13. Data Protection Impact Assessments and Prior Consultation

13.1 DPIA Assistance. Record OS shall provide reasonable assistance to the Customer with any data protection impact assessments that the Customer is required to carry out under Article 35 of UK GDPR in relation to the Customer's use of the Service, taking into account the nature of the Processing and the information available to Record OS.

13.2 Prior Consultation. Record OS shall provide reasonable assistance to the Customer with any prior consultations with Supervisory Authorities that the Customer is required to undertake under Article 36 of UK GDPR in relation to the Customer's use of the Service.

13.3 Costs. Where the assistance required under this clause 13 requires significant resources, Record OS may charge a reasonable fee based on Record OS's costs. Record OS shall notify the Customer of any such fees before commencing the work.

14. Liability

14.1 Liability Cap. The liability of each party under or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement.

15. Term and Termination

15.1 Term. This DPA shall come into effect on the Effective Date of the Agreement and shall continue in force until the termination or expiry of the Agreement.

15.2 Survival. Clauses 1, 8, 12, 14, and this clause 15.2 shall survive termination or expiry of this DPA.

16. General

16.1 Conflict. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Customer Personal Data. In the event of any conflict between this DPA and any transfer mechanism (such as the IDTA or EU SCCs with UK Addendum), the transfer mechanism shall prevail.

16.2 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect, and the invalid or unenforceable provision shall be modified to the minimum extent necessary to make it valid and enforceable.

16.3 Governing Law. This DPA shall be governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.