{"id":9099,"date":"2024-07-12T09:17:23","date_gmt":"2024-07-12T08:17:23","guid":{"rendered":"https:\/\/www.humatica.com\/?page_id=9099"},"modified":"2025-10-10T14:56:10","modified_gmt":"2025-10-10T13:56:10","slug":"dataprocessingagreement-uk","status":"publish","type":"page","link":"https:\/\/www.humatica.com\/de\/dataprocessingagreement-uk\/","title":{"rendered":"Data Processing Agreement – Humatica Ltd."},"content":{"rendered":"

Data Processing Agreement – Humatica Ltd.<\/strong><\/p>\n

This Data Processing Agreement (\u201cAgreement<\/strong>\u201c) forms part of the contract for services (\u201cPrincipal Agreement<\/strong>\u201c or \u201cService Contract<\/strong>\u201d) between<\/p>\n

Humatica Ltd., Holborn Town Hall, 193 \u2013 197 High Holborn, London, WC1V 7BD, United Kingdom
\n(\u201cData Processor<\/strong>\u201d)<\/p>\n

und<\/p>\n

the client of the Data Processor (\u201cClient<\/strong>\u201d) as specified in the applicable Engagement Confirmation,<\/p>\n

together referred as the \u201cParties<\/strong>\u201d.<\/p>\n

WHEREAS<\/strong><\/p>\n

(A) Client acts as a Data Controller.<\/p>\n

(B) Client wishes to retain the Data Processor to provide certain Services, which require the processing of personal data of data subjects for the purposes specified in Annex 1 <\/strong>(\u201cData Subjects \/ Personal Data \/ Processing Activities \/ Purposes\u201d).<\/p>\n

(C) The Parties seek to implement a data processing agreement that complies with the requirements of the applicable legal framework in relation to data processing.<\/p>\n

IT IS AGREED AS FOLLOWS:<\/p>\n

    \n
  1. Definitions and Interpretation<\/strong><\/li>\n<\/ol>\n

    1.1 Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:<\/p>\n

    1.1.1 \u201cAgreement<\/strong>\u201d means this Data Processing Agreement and all Annexes and Schedules;<\/p>\n

    1.1.2 \u201cClient Personal Data<\/strong>\u201d means any Personal Data Processed by the Data Processor or a Subprocessor on behalf of the Client pursuant to or in connection with the Principal Agreement;<\/p>\n

    1.1.3 \u201cData Protection Laws<\/strong>\u201d means EU and UK Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;<\/p>\n

    1.1.4 \u201cEEA<\/strong>\u201d means the European Economic Area;<\/p>\n

    1.1.5 \u201cEU Data Protection Laws<\/strong>\u201d means the GDPR and laws implementing or supplementing the GDPR;<\/p>\n

    1.1.6 \u201cGDPR<\/strong>\u201d means EU General Data Protection Regulation 2016\/679;<\/p>\n

    1.1.7 \u201cData Transfer<\/strong>\u201d means:<\/p>\n

    1.1.7.1 a transfer of Client Personal Data from the Data Processor to a Subprocessor; or<\/p>\n

    1.1.7.2 an onward transfer of Client Personal Data from a Subprocessor to a third party;<\/p>\n

    1.1.8 \u201cServices<\/strong>\u201d means the consulting services the Data Processor provides to Client.<\/p>\n

    1.1.9 \u201cSubprocessor<\/strong>\u201d means any person appointed by or on behalf of the Data Processor to process Personal Data on behalf of Client in connection with the Agreement.<\/p>\n

    1.2 The terms, \u201cCommission\u201d, \u201cController\u201d, \u201cData Subject\u201d, \u201cMember State\u201d, \u201cPersonal Data\u201d, \u201cPersonal Data Breach\u201d, \u201cProcessing\u201d and \u201cSupervisory Authority\u201d shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.<\/p>\n

      \n
    1. Processing of Client Personal Data \/ General Obligations<\/strong><\/li>\n<\/ol>\n

      2.1 The Data Processor shall:<\/p>\n

      2.1.1 comply with all applicable Data Protection Laws in the Processing (including Data Transfer) of Client Personal Data; and<\/p>\n

      2.1.2 Process (including Data Transfer) Client Personal Data exclusively in accordance with this Agreement in conjunction with the underlying Principal Agreement and in accordance with the Client\u2019s instructions.<\/p>\n

      2.2 Client hereby instructs the Data Processor to process Client Personal Data to provide the Services.<\/p>\n

      2.3 The Data Processor shall inform the Client immediately if, in its opinion, an instruction issued by the Client violates legal regulations. In such cases, the Data Processor shall be entitled to suspend execution of the relevant instruction until it is confirmed or changed by the Client.<\/p>\n

      2.4 The Data Processor shall assist the Client in complying with the obligations set out in Articles 32 to 36 GDPR taking into account the nature of Processing and the information available to the Data Processor.<\/p>\n

        \n
      1. Data Processor Personnel<\/strong><\/li>\n<\/ol>\n

        Data Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may have access to Client Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know \/ access the relevant Client Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with applicable Data Protection Laws in the context of that individual\u2019s duties to the Data Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.<\/p>\n

          \n
        1. Security<\/strong><\/li>\n<\/ol>\n

          4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall in relation to Client Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.<\/p>\n

          4.2 In assessing the appropriate level of security, the Data Processor shall take account in particular the risks that are presented by Processing, in particular from a Personal Data Breach.<\/p>\n

          4.3 A summary of the security measures currently taken by the Data Processor is provided in Annex 2<\/strong> to this Agreement. Any changes of the security measures will be documented by means of an addendum to this Agreement.<\/p>\n

            \n
          1. Subprocessing<\/strong><\/li>\n<\/ol>\n

            5.1 The Data Processor shall not appoint (or disclose any Client Personal Data to) any Subprocessor unless required or authorized by Client.<\/p>\n

            5.2 The Data Processor currently works with the Subprocessors specified in Annex 3<\/strong> and the Controller hereby agrees to their appointment. Further Subprocessors (if any) will be added by means of an addendum to this Agreement.<\/p>\n

            5.3 The Data Processor warrants to have carefully selected the Subprocessors, particularly considering the suitability of the technical and organizational measures taken by the Subprocessor.<\/p>\n

            5.4 The Data Processor warrants that the Subprocessors have been contractually bound to comply with data protection obligations comparable to those agreed to in this Agreement. Upon request, the Client shall have access to the relevant contracts between the Data Processor and the Subprocessors.<\/p>\n

              \n
            1. Data Subject Rights<\/strong><\/li>\n<\/ol>\n

              6.1 Taking into account the nature of the Processing, Processor shall assist Client by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Client obligations to respond to requests to exercise Data Subject rights under the Data Protection Laws.<\/p>\n

              6.2 Processor shall:<\/p>\n

              6.2.1 promptly notify the Client if it receives a request from a Data Subject under any Data Protection Law in respect of Client Personal Data; and<\/p>\n

              6.2.2 ensure that it does not respond to that request except on the documented instructions of the Client or as required by applicable Data Protection Laws to which the Processor is subject, in which case Processor shall to the extent permitted by applicable Data Protection Laws inform the Client of that legal requirement before responding to the request.<\/p>\n

                \n
              1. Personal Data Breach<\/strong><\/li>\n<\/ol>\n

                7.1 The Data Processor shall notify the Client without undue delay upon Data Processor becoming aware of a Personal Data Breach affecting Client Personal Data, providing the Client with sufficient information to allow the Client to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.<\/p>\n

                7.2 The Data Processor shall co-operate with Client and take reasonable commercial steps as are directed by the Client to assist in the investigation, mitigation and remediation of each such Personal Data Breach.<\/p>\n

                  \n
                1. Data Protection Impact Assessment and Prior Consultation <\/strong><\/li>\n<\/ol>\n

                  The Data Processor shall provide reasonable assistance to Client with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Client reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Client Personal Data by, and taking into account the nature of the Processing and information available to, the Data Processor or the Subprocessors.<\/p>\n

                    \n
                  1. Deletion or return of Client Personal Data<\/strong><\/li>\n<\/ol>\n

                    9.1 Data Processor shall promptly and in any event within 6 months of the date of cessation of any Services involving the Processing of Client Personal Data (the \u201cCessation Date\u201d), delete or return and procure the deletion (or return) of all copies of those Client Personal Data, provided that the deletion of these data does not conflict with any statutory storage obligations of the Data Processor.<\/p>\n

                    9.2 The deletion in accordance with data protection and data security regulations must be documented and confirmed upon request to the Client.<\/p>\n

                      \n
                    1. Audit rights<\/strong><\/li>\n<\/ol>\n

                      10.1 Subject to this section 10, Data Processor shall make available to Client on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by Client or an auditor mandated by Client in relation to the Processing of Client Personal Data by the Data Processor.<\/p>\n

                      10.2 Audits must be carried out without undue disruption to Data Processor\u2019s business operations. Unless otherwise indicated for urgent reasons, which are to be documented by the Client, audits shall be carried out after reasonable advance notice and during the Data Processor’s business hours, and no more frequently than every 12 months.<\/p>\n

                      10.3 Information and audit rights of Client only arise under section 10.1 to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.<\/p>\n

                        \n
                      1. Location of processing<\/strong><\/li>\n<\/ol>\n

                        The Processing of the Client Personal Data shall in principle take place in the European Union \/ EEA. Any transfer to a third country may only take place with the prior written consent of Client and if the special requirements of Art. 44 et seqq. GDPR are fulfilled.<\/p>\n

                          \n
                        1. Requests by government agencies<\/strong><\/li>\n<\/ol>\n

                          12.1 If the Data Processor receives a request from a government agency to provide the Personal Data or access thereto, the Data Processor will only cooperate with a request to that effect if it has a statutory obligation to do so (including an obligation under foreign laws or regulations).<\/p>\n

                           <\/p>\n

                          12.2 In order to guarantee the protection of the Personal Data, the Processor must ensure that it does not provide the government agency with more Personal Data than strictly necessary to comply with the government agency\u2019s request. If it is possible to take legal action against a request to provide Personal Data or to obtain a prohibition on informing third parties about the request, the Processor will make full use of this possibility.<\/p>\n

                            \n
                          1. Costs<\/strong><\/li>\n<\/ol>\n

                            The costs related to the performance of this Agreement are already included in the prices and fees as agreed in the Service Contract, unless the Data Processor can demonstrate that a data breach or additional work or costs under this Agreement are the result of an act or omission of the Client.<\/p>\n

                              \n
                            1. Duration of the Agreement<\/strong><\/li>\n<\/ol>\n

                              14.1. This Agreement will be in force for as long as the Service Contract continues. On termination of the Service Contract, this Agreement will end by operation of law without any further act being required.<\/p>\n

                              14.2. This Agreement cannot be terminated separately by the Data Processor or Client.<\/p>\n

                              14.3. Obligations under this Agreement which by their nature are intended to continue after termination of this Agreement will continue to exist after its termination.<\/p>\n

                                \n
                              1. General Terms<\/strong><\/li>\n<\/ol>\n

                                15.1 Confidentiality<\/strong>. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (\u201cConfidential Information\u201d) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:<\/p>\n

                                (a) disclosure is required by law;<\/p>\n

                                (b) the relevant information is already in the public domain.<\/p>\n

                                15.2 Notices<\/strong>. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address.<\/p>\n

                                15.3 In the event of any conflict between the provisions of this Agreement and the provisions of the Service Contract, the provisions of this Agreement will prevail.<\/p>\n

                                15.4. The parties will renegotiate this Agreement in good faith if changes of applicable laws, in the processed Personal Data or in the reliability requirements give rise to such renegotiation.<\/p>\n

                                15.5. Deviations from and additions to this Agreement are valid only if these have been expressly agreed in writing (including by exchange of email).<\/p>\n

                                15.6 Should individual parts of this Agreement be invalid, this shall not affect the validity of the remaining parts of the Agreement.<\/p>\n

                                  \n
                                1. Governing Law and Jurisdiction<\/strong><\/li>\n<\/ol>\n

                                  16.1 This Agreement is governed by the laws of England and Wales without regard to its conflict of law provisions.<\/p>\n

                                  16.2 Any dispute arising in connection with this Agreement, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of London, United Kingdom.<\/p>\n

                                   <\/p>\n

                                  IN WITNESS WHEREOF, this Agreement is entered into with effect from the date set out in the applicable Engagement Confirmation.<\/p>\n

                                   <\/p>\n

                                   <\/p>\n

                                  Schedule of Annexes <\/u><\/p>\n

                                   <\/p>\n

                                  Annex 1<\/strong>: Data Subjects \/ Personal Data \/ Processing Activities \/ Purposes<\/p>\n

                                  Annex 2<\/strong>: Humatica Cyber Security Readiness Measures<\/p>\n

                                  Annex 3<\/strong>: Subprocessors<\/p>\n

                                   <\/p>\n

                                  Annex 1 Data Subjects \/ Personal Data \/ Processing Activities \/ Purposes<\/strong><\/p>\n

                                  \u00a0<\/strong><\/p>\n

                                  Data Subjects- Description of the affected data subjects<\/u><\/strong><\/p>\n

                                  \u00a0<\/u><\/strong><\/p>\n

                                  Data Subjects are Client\u2019s employees (\u201cClient Employees\u201d).<\/p>\n

                                  \u00a0<\/u><\/strong><\/p>\n

                                  \u00a0<\/u><\/strong><\/p>\n

                                  Personal Data – Description of the personal data being processed<\/u><\/strong><\/p>\n

                                  \u00a0<\/strong><\/p>\n