This is RA Creative Limited’s standard Data Processing Addendum (“DPA”). It applies where RA processes Personal Data on behalf of a Client and no alternative data processing terms have been separately agreed in writing.
Where RA and the Client have entered into a separate written agreement, contract or data processing agreement containing provisions relating to the Processing of Personal Data, those separately agreed provisions take precedence over this DPA to the extent of any conflict.
1. Application
1.1 This DPA applies only where the Client acts as Controller and RA acts as Processor of Personal Data on the Client’s behalf, and only to the Processing carried out by RA in that capacity.
1.2 It does not apply where RA processes Personal Data as an independent Controller, including for its own customer administration, accounting, invoicing, payment, legal and business records.
1.3 Where RA and the Client have entered into a separate written agreement, contract or data processing agreement containing provisions relating to the same Processing, those separately agreed provisions take precedence over this DPA to the extent of any conflict.
2. Data Protection Law
2.1 Each party shall comply with its obligations under applicable Data Protection Law.
2.2 “Data Protection Law” means applicable UK legislation relating to privacy and processing of Personal Data, including the UK GDPR and Data Protection Act 2018, as amended or replaced.
3. Details of Processing
3.1 The subject matter is provision of the Services described in the applicable Order.
3.2 Processing continues for the duration of the relevant Services and such period afterwards as necessary to comply with this DPA or applicable law.
3.3 Processing may include access, hosting, storage, development, testing, maintenance, migration, deployment, troubleshooting, support, backup, restoration and other Processing necessary to provide the Services.
3.4 Personal Data may include names, contact details, addresses, account information, customer identifiers, order/transaction information, website information, IP addresses, communications and other Personal Data contained within relevant systems.
3.5 Data Subjects may include the Client’s customers, prospects, website users, employees, contractors, suppliers and other individuals whose Personal Data is contained within relevant Client systems.
3.6 Unless expressly agreed otherwise, the Services are not specifically intended for significant volumes of special category Personal Data or criminal offence data.
3.7 The Client must notify RA before instructing RA to undertake Processing which materially differs from the Processing described in this DPA or the applicable Order.
4. Client responsibilities
4.1 The Client is responsible for determining the purposes and lawful basis of its Processing, lawful collection and disclosure, appropriate notices, lawful instructions to RA, and its obligations as Controller.
4.2 The Client shall not instruct RA to Process Personal Data unlawfully.
5. Processing instructions
5.1 RA shall Process Personal Data only on documented Client instructions, including an Order, agreement, support request, ticket, email or other written instruction, unless required by law.
5.2 Where required by law to Process otherwise, RA shall inform the Client beforehand unless prohibited by law.
5.3 If RA considers that an instruction infringes applicable Data Protection Law, RA shall inform the Client and may suspend the affected Processing pending clarification.
6. Confidentiality
6.1 RA shall ensure that persons authorised to Process Personal Data on behalf of the Client are subject to appropriate confidentiality obligations.
7. Security
7.1 RA shall implement appropriate technical and organisational measures as required by applicable Data Protection Law, taking account of the nature and risks of the relevant Processing.
7.2 RA may update those measures from time to time provided it continues to comply with applicable Data Protection Law.
8. Sub-processors
8.1 The Client gives RA general written authorisation to use Sub-processors where reasonably necessary to provide the Services.
8.2 RA shall impose the data protection obligations required by applicable Data Protection Law upon Sub-processors Processing Personal Data on RA’s behalf.
8.3 RA remains responsible for applicable Sub-processor obligations to the extent required by Data Protection Law.
8.4 RA shall make information about relevant Sub-processors available and, where required by Data Protection Law, inform the Client of intended additions or replacements so the Client has an opportunity to object on reasonable data protection grounds.
8.5 Where a reasonable objection cannot be resolved, RA may propose an alternative arrangement or terminate the affected Service on reasonable notice.
9. International transfers
9.1 Where RA or an authorised Sub-processor transfers Personal Data internationally, RA shall ensure that safeguards required by applicable Data Protection Law are in place.
10. Data Subject requests
10.1 Taking account of the nature of Processing, RA shall provide assistance required by applicable Data Protection Law to enable the Client to respond to Data Subject requests.
10.2 Where RA receives a request directly concerning Personal Data for which the Client is Controller, RA shall refer it to the Client where appropriate and shall not respond substantively except on Client instructions or where required by law.
10.3 Substantial assistance outside the normal scope of Services may be chargeable where permitted by law.
11. Personal Data Breaches
11.1 RA shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed by RA on the Client’s behalf.
11.2 RA shall provide information and assistance required of a Processor under applicable Data Protection Law, taking account of the nature of Processing and information available.
11.3 Information may be provided in stages where it is not all immediately available.
11.4 Notification does not constitute an admission of fault or liability by RA.
11.5 Where the Client is Controller, the Client remains responsible for determining whether notification to Data Subjects, the ICO or another authority is required.
12. Compliance assistance
12.1 Taking account of the nature of Processing and information available, RA shall provide assistance required of a Processor under applicable Data Protection Law in relation to security, breaches, impact assessments and regulatory consultation.
12.2 Substantial assistance outside the normal scope of Services may be chargeable where permitted by law.
13. Return and deletion
13.1 At the end of the relevant Services, RA shall, at the Client’s choice, delete or return Personal Data Processed on behalf of the Client and delete existing copies, except to the extent applicable law requires retention.
13.2 The Client is responsible for notifying RA of its choice and requesting any required return or export.
13.3 Additional migration, conversion, technical assistance or preparation beyond a reasonably available export may be chargeable.
13.4 Personal Data within backups or archives may remain until the applicable deletion cycle is completed, provided it remains appropriately protected and is not used for other purposes.
13.5 This clause does not require RA to delete information it holds independently as Controller, including appropriate contractual, accounting, payment or legal records.
14. Information and audits
14.1 RA shall provide information reasonably necessary to demonstrate compliance with its applicable Article 28 obligations.
14.2 RA shall allow for and contribute to audits and inspections as required by applicable Data Protection Law.
14.3 Where reasonably practicable, compliance should first be demonstrated using relevant documentation or information supplied by RA.
14.4 Any audit shall, so far as reasonably practicable, be on reasonable notice, during normal business hours, minimise disruption, protect confidential information, be limited to relevant Processing and not compromise the rights/security of RA, other Clients or third parties.
14.5 Clause 14.4 does not prevent an audit or inspection required by law or a competent regulatory authority.
14.6 RA may charge reasonable costs for substantial audit assistance where permitted by law.
15. Liability
15.1 Each party remains responsible for obligations and liabilities imposed directly upon it by applicable Data Protection Law.
15.2 As between RA and the Client, liability under this DPA is subject to the exclusions and limitations in RA’s Terms of Business or applicable principal agreement to the extent permitted by law.
15.3 Nothing excludes or limits liability where it would be unlawful to do so.
16. Order of precedence
16.1 Where the parties have entered into a separate written agreement, contract or data processing agreement containing provisions relating to the same Processing, those separately agreed provisions take precedence over this DPA to the extent of any conflict.
16.2 Subject to clause 16.1, if this DPA conflicts with RA’s Terms of Business or an applicable Order concerning the Processing of Personal Data, this DPA takes precedence only to the extent necessary to comply with applicable Data Protection Law.
16.3 All other provisions of RA’s Terms of Business or applicable agreement, including applicable limitations and exclusions of liability, continue to apply to the extent permitted by law.
17. Changes
17.1 This DPA may be updated where reasonably necessary to comply with changes to applicable Data Protection Law or binding regulatory requirements.
17.2 Other material changes affecting an existing Client’s Processing arrangements shall be dealt with under the applicable agreement or agreed with the Client as appropriate.
18. Governing law
18.1 This DPA is governed by the laws of England and Wales.
18.2 The courts of England and Wales shall have jurisdiction, subject to mandatory requirements of applicable Data Protection Law.
RA Creative Limited
Company Number: 01940817
Registered Office: 7 Poplars Court, Lenton Lane, Nottingham, England, NG7 2RR
Working master for publication/solicitor review and internal record.