Data Processing Agreement

1. Definitions and interpretation

Capitalised terms used but not defined in this DPA have the meanings given in the Principal Agreement or, where not so defined, in the GDPR. For the avoidance of doubt:

• (a) "Personal Data" means any personal data, as defined in the GDPR, that the Processor Processes on behalf of the Controller in connection with the Principal Agreement.
• (b) "Process", "Processing" and "Processed" bear the meaning given in Article 4(2) of the GDPR.
• (c) "Sub-processor" means any third party engaged by the Processor to Process Personal Data on behalf of the Controller, other than the Processor's own employees.
• (d) "Data Subject Request" means a request by a Data Subject to exercise any right under Chapter III of the GDPR.
• (e) "Personal Data Breach" bears the meaning given in Article 4(12) of the GDPR.
• (f) "Supervisory Authority" bears the meaning given in Article 4(21) of the GDPR; in the United Kingdom this is the Information Commissioner's Office ("ICO").

2. Scope, subject matter and duration

The subject matter, nature and purpose of the Processing, the categories of Personal Data and of Data Subjects, and the duration of the Processing are as set out in Annex I to this DPA.

This DPA takes effect on the later of the Effective Date of the Principal Agreement and the date this DPA is signed by both Parties, and continues in force for so long as the Processor Processes Personal Data on behalf of the Controller, together with any survival periods expressly provided for in this DPA.

3. Status of the parties

In respect of the Personal Data described in Annex I, the Controller is the controller and the Processor is a processor. Each Party will comply with the obligations that apply to it under the GDPR and any other applicable data protection laws.

The Processor Processes Personal Data only for, and on behalf of, the Controller, and only for the purposes set out in Annex I. The Processor has no independent right to use or disclose the Personal Data for any other purpose.

4. Processing on documented instructions

The Processor will Process Personal Data only on the documented instructions of the Controller. The Principal Agreement (including configuration options selected by the Controller, any statement of work, and reasonable ad-hoc instructions given in the ordinary course of operating the Verus service) constitutes the Controller's documented instructions.

If the Processor is required by applicable law to Process Personal Data otherwise than on the Controller's instructions, the Processor will (unless prohibited from doing so by that law on important grounds of public interest) inform the Controller of that requirement before carrying out the Processing.

If the Processor considers that a Controller instruction infringes the GDPR or other applicable data protection law, the Processor will inform the Controller without undue delay and is entitled to suspend performance of the instruction until it is amended or confirmed.

5. Confidentiality

The Processor will ensure that any person authorised to Process the Personal Data (including the Processor's employees, contractors and Sub-processors) is subject to binding obligations of confidentiality — whether by contract, professional or regulatory duty — and has received appropriate data-protection training.

6. Security of Processing (Article 32)

The Processor will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing, as well as the likelihood and severity of the risks to the rights and freedoms of natural persons.

The technical and organisational measures applied by the Processor as of the Effective Date of this DPA are set out in Annex II. The Processor may update those measures from time to time without the Controller's consent provided the updates maintain or improve the level of protection; the Controller may request an up-to-date statement at any time.

7. Sub-processors

The Controller authorises the Processor to engage the Sub-processors listed in Annex III to this DPA, as published and updated from time to time at https://markst.com/legal/subprocessors, subject to the conditions of this clause.

The Processor will give the Controller prior notice of any intended addition or replacement of Sub-processors, by updating the Sub-processor register and emailing the Controller's designated contact, at least thirty (30) calendar days before the change takes effect, save where a shorter notice period is strictly required by security, legal or force-majeure circumstances (in which case the Processor will explain the shorter window in writing).

The Controller may object in writing to the proposed change on reasonable grounds relating to data protection within the notice period. The Parties will discuss the objection in good faith; if the objection cannot be resolved, the Controller may terminate the affected part of the Principal Agreement without penalty and receive a pro-rata refund of pre-paid fees for the unused period.

The Processor remains fully liable to the Controller for the acts and omissions of its Sub-processors as if they were the Processor's own, and will impose on each Sub-processor data-protection obligations substantially equivalent to those in this DPA by written contract.

8. Data subject requests

The Processor will, to the extent technically possible and taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to Data Subject Requests under Chapter III of the GDPR.

If the Processor receives a Data Subject Request directly from a Data Subject and the request relates to Personal Data Processed on behalf of the Controller, the Processor will (i) not respond to the request other than to acknowledge receipt and direct the Data Subject to the Controller, and (ii) notify the Controller without undue delay.

9. Assistance with Controller compliance (Articles 32–36)

The Processor will provide reasonable assistance to the Controller, taking into account the nature of the Processing and the information available to the Processor, in ensuring compliance with the Controller's obligations under Articles 32 to 36 of the GDPR, namely:

• (a) the security of Processing (Article 32), by maintaining the measures set out in Annex II and making up-to-date information about them available on request;
• (b) notifying Personal Data Breaches to the Supervisory Authority (Article 33) and to affected Data Subjects (Article 34) in accordance with clause 10 below;
• (c) conducting Data Protection Impact Assessments (Article 35), by providing reasonable information about the Processing on request; and
• (d) consulting the Supervisory Authority prior to Processing where required (Article 36).

10. Personal Data Breach notification

The Processor will notify the Controller without undue delay and in any event within forty-eight (48) hours of becoming aware of a Personal Data Breach affecting Personal Data Processed on behalf of the Controller. The notification will include, to the extent known at the time of the notification and updated as further information becomes available:

• (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records affected;
• (b) the name and contact details of the Processor's Data Protection Lead or other point of contact from whom further information can be obtained;
• (c) a description of the likely consequences of the Personal Data Breach; and
• (d) a description of the measures taken or proposed to be taken by the Processor to address the Personal Data Breach and mitigate its possible adverse effects.

11. International transfers of Personal Data

The Processor will not transfer Personal Data outside the United Kingdom or the European Economic Area without the Controller's prior written consent, unless such transfer is to a country in respect of which the UK or the European Commission has adopted an adequacy decision, or unless the transfer is protected by one of the safeguards listed in Article 46 of the GDPR.

The Parties incorporate by reference into this DPA the EU SCCs (module 2, controller-to-processor) and, where the Controller is a UK-established controller or the Personal Data originates from the United Kingdom, the UK IDTA, in each case as amended or replaced from time to time. Annex I of this DPA serves as Annex I of the SCCs; Annex II of this DPA serves as Annex II of the SCCs; Annex III of this DPA serves as the list of authorised Sub-processors under the SCCs.

The Processor will provide the Controller, on request, with a Transfer Impact Assessment in respect of any Sub-processor located outside the UK/EEA.

12. Return or deletion at end of Processing

On termination or expiry of the Principal Agreement, or at any earlier date on written request of the Controller, the Processor will, at the Controller's written choice, return all Personal Data to the Controller or delete all Personal Data in its possession, together with all existing copies, and certify the deletion in writing on request, except to the extent that applicable law requires storage of the Personal Data.

The Processor may retain Personal Data to the extent required by applicable law or for legitimate back-up or record-keeping purposes, in which case the Personal Data will remain subject to the obligations of confidentiality and security under this DPA for the residual retention period.

13. Audits and demonstration of compliance

The Processor will make available to the Controller all information necessary to demonstrate compliance with this DPA, including by providing (on reasonable written request and subject to reasonable confidentiality protections) copies of relevant policies, the Sub-processor register, incident-response runbooks, pen-test summary reports, and any third-party audit or certification reports then in force.

The Controller may, no more than once in any twelve-month period and on at least thirty (30) days' prior written notice, conduct an audit of the Processor's compliance with this DPA, either itself or through a reputable independent third-party auditor bound by appropriate confidentiality obligations. Audits will be conducted during normal business hours, without unreasonable disruption to the Processor's operations, and will make use of any third-party audit or certification reports already available wherever reasonably possible. The Controller is responsible for its own costs of such audits; the Processor bears its own.

If a Personal Data Breach or a material regulatory concern reasonably requires earlier or more frequent audit activity, the Processor will cooperate in good faith to facilitate the necessary investigation.

14. Liability

Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Principal Agreement, except to the extent that those limitations or exclusions would be prohibited by applicable law.

Nothing in this DPA limits or excludes either Party's liability for (i) death or personal injury caused by negligence, (ii) fraud or fraudulent misrepresentation, (iii) any liability that cannot be excluded or limited under applicable law, or (iv) a Party's own infringement of Article 82 of the GDPR.

15. General

Precedence. This DPA prevails over any conflicting provision of the Principal Agreement on matters of data protection. In all other respects, the Principal Agreement continues in force unchanged.

Amendments. Any amendment to this DPA must be in writing and signed by both Parties, save that the Processor may update Annex II and Annex III unilaterally in accordance with clauses 6 and 7.

Severability. If any provision of this DPA is held to be invalid, illegal or unenforceable, the remaining provisions continue in full force and effect.

Notices. Notices under this DPA will be sent to the data-protection contacts notified by each Party from time to time. For the Processor, notices may be sent to dpo@markst.com.

Governing law and jurisdiction. This DPA is governed by the laws of England and Wales, and the Parties submit to the exclusive jurisdiction of the courts of England and Wales in respect of any dispute arising out of or in connection with it, without prejudice to any right of a Data Subject or a Supervisory Authority to bring proceedings under applicable law.