Data Processing Agreement

Effective date: 10/11/2026

1. Definitions

1.1

"GDPR" means Regulation (EU) 2016/679. "Data Protection Law" means the GDPR, the Data Protection Acts 1988 to 2018 and any other law on the protection of personal data that applies to the processing. Terms such as "controller", "processor", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the GDPR.

1.2

"Customer Personal Data" means personal data that we process on your behalf in providing the services under the Agreement.

1.3

"Sub-processor" means a third party we engage to process Customer Personal Data.

1.4

"SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by Commission Implementing Decision (EU) 2021/914.

2. Roles and instructions

2.1

You are the controller (or, where you act for another controller, a processor) and we are your processor (or sub-processor) of Customer Personal Data. The details of the processing are set out in Annex 1.

2.2

We process Customer Personal Data only on your documented instructions, including with regard to transfers outside the European Economic Area (EEA), unless EU or Member State law requires otherwise; in that case we will inform you before processing unless the law prohibits this. The Agreement, this DPA and your use and configuration of the services are your complete instructions at the time of signature. We will tell you immediately if, in our opinion, an instruction infringes Data Protection Law.

2.3

You are responsible for having a lawful basis for the processing and for providing any required information to data subjects.

3. Our obligations

3.1

Confidentiality. We ensure that everyone authorised to process Customer Personal Data is bound by confidentiality.

3.2

Security. We implement and maintain the technical and organisational measures in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. We may update them provided the overall level of security is not reduced.

3.3

Data subject requests. Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights. If we receive a request directly, we will pass it to you without undue delay and will not respond except on your instructions.

3.4

Assistance. We assist you, taking into account the information available to us, with your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36 GDPR).

3.5

Personal data breaches. We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own obligations, and we update you as more information becomes available. We take reasonable steps to contain and remedy the breach.

3.6

Records. We keep a record of processing activities carried out on your behalf as required by Article 30(2) GDPR.

4. Sub-processors

4.1

You give us general authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex 3.

4.2

We will notify you at least 30 days before adding or replacing a Sub-processor. You may object on reasonable data protection grounds within that period. If we cannot reasonably accommodate your objection, you may terminate the affected services and receive a refund of prepaid charges for the unused period.

4.3

We impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and we remain fully liable to you for their performance.

5. International transfers

5.1

We will not transfer Customer Personal Data to a country outside the EEA unless that country benefits from a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework for certified organisations) or the transfer is subject to appropriate safeguards under Article 46 GDPR.

5.2

Where we (as data importer) receive Customer Personal Data from you outside the EEA, or where you are established outside the EEA, the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor, completed as follows: Clause 7 (docking clause) applies; Clause 9, Option 2 (general written authorisation) applies with the notice period in clause 4.2; the optional wording in Clause 11 does not apply; Clauses 13, 17 and 18: the supervisory authority is the Data Protection Commission (Ireland), the governing law is Irish law and the courts are those of Ireland. Annexes I to III of the SCCs are completed with Annexes 1 to 3 of this DPA. If there is a conflict, the SCCs prevail.

5.3

Where we engage a Sub-processor outside the EEA, we put in place the SCCs (Module Three) or another valid transfer mechanism, and carry out a transfer risk assessment where required.

6. Audits and information

6.1

We make available to you all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allow for and contribute to audits, including inspections, by you or an independent auditor you appoint, who is bound by confidentiality.

6.2

Audits are limited to once in any 12-month period unless required by a supervisory authority or following a personal data breach, require at least 30 days' notice, take place during business hours and must not unreasonably disrupt our operations or compromise other customers' data. Each party bears its own costs, unless the audit reveals a material breach by us. We may first offer recent independent certifications or audit reports where they answer your request.

7. Return and deletion

7.1

When the services end, we will, at your choice, return Customer Personal Data to you (by making it available for export as described in the Agreement) and then delete it, including existing copies, unless EU or Member State law requires us to keep it. Deletion from backups is completed within 35 days. We will confirm deletion in writing on request.

8. Liability and precedence

8.1

Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law or the SCCs do not allow a limitation.

8.2

If there is a conflict between this DPA and the Agreement, this DPA prevails for the processing of Customer Personal Data. If there is a conflict with the SCCs, the SCCs prevail.

8.3

This DPA is governed by the laws of Ireland and the courts of Ireland have jurisdiction, without affecting clause 5.2.

Annex 1 – Details of the processing

Annex 2 – Technical and organisational measures

The Processor maintains the following measures:

• Encryption of personal data in transit and at rest
• Access control: role-based access, unique accounts, multi-factor authentication for administrative access, prompt removal of leavers
• Logical separation of each customer's data
• Backups and tested recovery procedures; business continuity arrangements
• Vulnerability management, patching and malware protection
• Logging and monitoring of administrative access and security events
• Staff confidentiality obligations and data protection training
• Incident response procedure
• Secure deletion and disposal of data and equipment
• Physical security provided by the data centre provider

Annex 3 – Sub-processors

The hosting service the Processor sells to customers (websites, email and other hosted services) runs on the Processor's own servers in Europe; no sub-processor is used for it. Transactional and support email is sent from the Processor's own self-hosted servers.