Master Data Processing Agreement

1.1.

1.2.

A reference to a “person” means an individual, firm, company, unincorporated body or government entity, and any of its successors or permitted assignees.

1.3.

Clause, schedule and paragraph headings do not affect interpretation.

1.4.

References to legislation are to that legislation as amended, supplemented, re-enacted or replaced from time to time.

1.5.

The words “include”, “including” and similar expressions do not limit the words that precede them.

1.6.

A reference to “writing” or “written” includes email.

1.7.

If there is any conflict between this Agreement and the Principal Agreement in relation to the processing of Personal Data, this Agreement prevails.

1.8.

Capitalised terms used but not defined in this Agreement (including “Business Day” and “Business Hours”) have the meanings given to them in the Principal Agreement.

1.9.

Where the Supplier processes Customer Personal Data that is subject to the EU GDPR or Swiss data protection law, the EU Data Processing Addendum (available at setyl.com/legal) supplements this Agreement and applies to that processing.

2.1.

The Parties acknowledge that, for the purposes of the Data Protection Laws, the Customer is the controller and the Supplier is the processor of the Customer Personal Data uploaded, stored or transmitted via the Software by the Customer’s personnel.

2.2.

Each Party will comply with its obligations under the Data Protection Laws in relation to Personal Data shared or processed under this Agreement. This Agreement does not relieve either Party of its own obligations under the Data Protection Laws.

3.1.

Each Party will maintain records of its processing of Personal Data as required by the Data Protection Laws, and will make those records available to a DP Regulator on request.

3.2.

To the extent the Supplier processes Customer Personal Data on behalf of the Customer, the Supplier will:

3.3.

The Supplier will provide the assistance described in clauses 3.2.4 and 3.2.5 at no additional cost, save that the Customer will reimburse the Supplier’s reasonable costs where the assistance requested is unreasonable in scope or frequency, or requires material engineering effort beyond the standard functionality of the Software.

4.1.

The Customer provides general written authorisation for the Supplier to appoint Sub-Processors to process Customer Personal Data. The Supplier’s current Sub-Processors are listed on the Supplier’s sub-processor page at setyl.com/legal (the “Sub-processor Page”), which is referenced in Annex 2 and is the authoritative list of Sub-Processors for the purposes of this Agreement.

4.2.

Where the Supplier appoints a Sub-Processor, it will:

4.3.

If the Customer reasonably objects to a new Sub-Processor on legitimate data protection grounds within the notice period, the Parties will work together in good faith to find a mutually acceptable resolution. If no resolution is reached, the Customer may, as its sole remedy, terminate the affected part of the Services and receive a refund of any pre-paid Fees for the terminated period.

5.1.

The Supplier will not transfer Customer Personal Data outside the United Kingdom unless it has taken the measures necessary to ensure the transfer complies with the Data Protection Laws. Such measures may include transferring to a country subject to UK adequacy regulations, or entering into the Standard Contractual Clauses.

5.2.

The Customer authorises the Supplier to enter into the Standard Contractual Clauses (as the Customer’s agent where required) with any Sub-Processor located outside the United Kingdom, on the Customer’s behalf. Where the Customer’s own signature is required, the Customer will promptly comply with any reasonable request of the Supplier to enter into such clauses.

6.1.

The Supplier will maintain complete, accurate and up-to-date records of all categories of processing carried out on behalf of the Customer, including the information required by Articles 30(1) and 30(2) of the UK GDPR.

6.2.

The Supplier will make available to the Customer such information as is reasonably necessary to demonstrate compliance with this Agreement and the Data Protection Laws, and will allow for and contribute to audits (including inspections) conducted by the Customer or an auditor mandated by the Customer.

6.3.

The Customer may exercise its audit right no more than once in any 12-month period (except following a Personal Data Breach or where required by a DP Regulator), on at least 30 days’ prior written notice, during Business Hours, and in a manner that causes minimal disruption to the Supplier’s business. The Supplier may satisfy an audit request by providing its most recent third-party certifications or audit reports (such as ISO 27001), where these reasonably address the Customer’s request.

6.4.

Each Party bears its own costs of an audit, save that the Customer will reimburse the Supplier’s reasonable costs of supporting an audit that goes beyond the provision of existing certifications and records.

7.1.

This Agreement remains in effect for the Duration of Processing, after which it automatically terminates. It also terminates automatically on termination or expiry of the Principal Agreement.

7.2.

On termination, and at the Customer’s written direction, the Supplier will delete (so far as technically possible) or return the Customer Personal Data and any copies within 30 days, unless required by applicable law to retain it, in which case the Supplier will keep it confidential and process it only as required by that law.

7.3.

For the purposes of this clause 7, Customer Personal Data is considered deleted where it can no longer be accessed or used by the Supplier in the ordinary course, including where it is retained only in routine backups that are overwritten in the ordinary backup cycle.

8.1.

Costs. Except as otherwise stated in this Agreement, each Party is responsible for its own legal and other costs in relation to this Agreement.

8.2.

Survival. Clauses 1, 6, 7 and 8, and all clauses required for their interpretation, survive termination.

8.3.

Relationship of the Parties. The Parties are independent businesses and not partners, principal and agent, or employer and employee.

8.4.

Third party rights. For the purposes of the Contracts (Rights of Third Parties) Act 1999, this Agreement does not give any non-party any right to enforce its provisions, without affecting any right or remedy that exists apart from that Act.

8.5.

Assignment. Neither Party may assign, subcontract or encumber any right or obligation under this Agreement without the other Party’s prior written consent, except as expressly permitted in this Agreement or the Principal Agreement.

8.6.

Entire agreement. This Agreement and the Principal Agreement contain the whole agreement between the Parties relating to their subject matter and supersede any prior agreements, representations or understandings. Nothing in this clause limits liability for fraud or fraudulent misrepresentation.

8.7.

Variation. No variation of this Agreement is valid unless agreed in writing and signed by an authorised signatory of each Party.

8.8.

Severability. If any provision (or part of a provision) is found to be illegal, invalid or unenforceable, it will be modified to the minimum extent necessary to make it valid, and the remainder will continue in force.

8.9.

Waiver. No delay, act or omission by either Party in exercising any right or remedy is a waiver of that or any other right or remedy.

8.10.

Notices. Notices under this Agreement must be in writing and sent to the other Party’s address or email as set out in the Contract Details. Letters sent within the United Kingdom are deemed delivered 3 Business Days after posting. Emails are deemed delivered the same day, or the next Business Day if sent after 5pm or on a non-Business Day at the recipient’s location.

8.11.

Execution. This Agreement forms part of the Principal Agreement and does not require separate signature. It takes effect when the Parties sign the Order Form that incorporates the Principal Agreement.

8.12.

Liability. Each Party’s liability arising out of or in connection with this Agreement (whether in contract, tort (including negligence), breach of statutory duty or otherwise) is subject to, and counts towards, the exclusions and limitations of liability set out in the Principal Agreement, except to the extent that such exclusion or limitation is not permitted by the Data Protection Laws.

8.13.

Governing law and jurisdiction. This Agreement is governed by the laws of England and Wales. The Parties submit to the exclusive jurisdiction of the courts of England and Wales.