Data Protection Annex

This Annex is the written processor contract required by Article 28(3) UK GDPR. It forms part of the Agreement and cannot be disapplied. Terms defined in the Core Terms apply here.

1. Roles

You are the controller and we are the processor for personal data we process to run the service. Where we decide how to process data to secure and operate Our Platform, or to create anonymised data, we are an independent controller for those limited purposes and will comply with data protection law accordingly.

We are also an independent controller for Our Imagery (as defined in the Core Terms), including any personal data it contains, because we decide how it is recorded, used and kept. This Annex does not apply to that processing.

2. Our obligations as processor

We will:

2.1 Follow your instructions. Process personal data only on your documented instructions (which include this Agreement), unless the law requires otherwise — in which case we will tell you first unless we are legally barred from doing so.

2.2 Keep it confidential. Ensure everyone we authorise to process it is bound by confidentiality obligations.

2.3 Keep it secure. Maintain technical and organisational measures appropriate to the risk under Article 32, comprising at least: encryption in transit and at rest; secrets held in a managed secrets store; least-privilege administrative access with multi-factor authentication and keyless deployment credentials; organisation-scoped authenticated access to HypaFlow and the API; automated daily database backups; centralised logging; segregated production and development environments; and version-controlled, automatically built and deployed changes. The Information Security Schedule sets these out in full, and is provided on request whether or not it is identified in the Order Form.

2.4 Use only approved sub-processors, per clause 5 below.

2.5 Help with data-subject requests. Assist you, so far as we reasonably can given the nature of the processing, to respond to access, rectification, erasure, restriction, portability and objection requests. If a request comes to us directly we will refer it to you unless the law requires us to act.

2.6 Help with your compliance. Assist you with Articles 32–36 — security, breach notification, data protection impact assessments and prior consultation — taking account of the nature of the processing and the information available to us.

2.7 Tell you about breaches. Notify you without undue delay, and in any event within 48 hours of becoming aware, of a security incident affecting your personal data, with enough information (what happened, the categories and approximate numbers of people and records affected, likely consequences, and what we are doing) for you to meet your own obligations.

2.8 Delete or return it. On termination, delete or return your personal data as set out in Core Terms clause 14.3, except where the law requires us to keep it.

2.9 Demonstrate compliance. Make available the information reasonably needed to show we are meeting Article 28, including this Annex, the Service Facts sheet and our security documentation. (Additional Terms are available which add an on-site audit right.)

3. What we process

4. Your visitors — notice and consent

Your HypaMap loads Google Analytics when a Visitor opens it, and there is currently no consent banner and no visitor-facing opt-out. As operator of the map you are the controller for your Visitors’ data, so the privacy notice and any consent required under PECR are yours to provide; we will give you the information you need for it.

There is no consent mechanism or per-HypaMap analytics switch in the product at present. We will disable analytics for your HypaMap within 10 Business Days of a written request.

5. Sub-processors

5.1 You give general authorisation for the sub-processors below. We impose data protection obligations on each of them no less protective than this Annex, and we remain liable to you for what they do.

5.2 We will give you at least 30 days’ notice before adding or replacing a sub-processor. You may object on reasonable, documented data-protection grounds within that period; we will work with you in good faith, and if we cannot resolve it you may terminate the affected service and get back what you have prepaid for the unused period.

6. International transfers

6.1 Your personal data is stored in the locations set out in clause 5.1 and in the Service Facts sheet, which forms part of the Agreement.

6.2 Where personal data is transferred outside the UK/EEA — including to Google Cloud me-central1 (Qatar), and transfers by the sub-processors listed above — we will ensure an appropriate transfer mechanism is in place: the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, supported by a transfer risk assessment and any supplementary measures required.

7. General

7.1 This Annex is governed by the law of England and Wales. If it conflicts with the rest of the Agreement on the processing of personal data, this Annex wins.

7.2 Liability under this Annex is subject to the cap in Core Terms clause 12.6 (or, where Additional Terms apply a different cap to data-protection claims, the cap in those terms).

7.3 This Annex changes only as Core Terms clauses 5.3 to 5.5 allow. Those clauses do not permit a change that reduces the protection this Annex gives to personal data, unless the law requires it.

HypaMaps Ltd · Data Protection Annex v5.0 · Questions: [email protected]