Data Processing Agreement

PARTIES

  • Mtech Communications Limited incorporated and registered in England and Wales with company number 11194386 whose registered office is at Hello House, 135 Somerford Road, Christchurch, England, BH23 3PY (“Mtech”).
  • The company or other person or entity to which Mtech has agreed to provide services under a Master Agreement (the “Customer“);

BACKGROUND

  • The Customer and Mtech have entered into an agreement for the provision of services by Mtech to the Customer (Master Agreement) that requires Mtech to process Personal Data on behalf of the Customer.
  • This Data Processing Agreement (Agreement) sets out the additional terms, requirements and conditions on which Mtech will process Personal Data when providing services under the Master Agreement. This Agreement contains the mandatory clauses required by Article 28(3) of the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) for contracts between controllers and processors and the General Data Protection Regulation ((EU) 2016/679).

AGREED TERMS

Definition

The following definitions and rules of interpretation apply in this Agreement.

  • “Business Purposes” the services to be provided by Mtech to the Customer as described in the Master Agreement and any other purpose specifically identified in Appendix A.
  • “Commissioner” the Information Commissioner (see Article 4(A3), UK GDPR and section 114, DPA 2018).
  • Controller, Processor, Data Subject, Personal Data, Personal Data Breach and Processing: have the meanings given in the Data Protection Legislation.
  • “Data Protection Legislation” all applicable data protection and privacy legislation in force from time to time in the UK including:
    • To the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of Personal Data.
    • To the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which the Customer or Mtech is subject, which relates to the protection of Personal Data.
  • “Data Subject” the identified or identifiable living individual to whom the Personal Data relates.
  • “EU GDPR” the General Data Protection Regulation ((EU) 2016/679).
  • “EEA” the European Economic Area.
  • “Personal Data” means any information relating to an identified or identifiable living individual that is processed by Mtech on behalf of the Customer as a result of, or in connection with, the provision of the services under the Master Agreement; an identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  • “Records” has the meaning given in Clause 12.
  • “Term” this Agreement’s term as defined in Clause 10.
  • “UK GDPR” has the meaning given in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.
  • This Agreement is subject to the terms of the Master Agreement and is incorporated into the Master Agreement. Interpretations and defined terms set forth in the Master Agreement apply to the interpretation of this Agreement.
  • The Annexes form part of this Agreement and will have effect as if set out in full in the body of this Agreement. Any reference to this Agreement includes the Annexes.
  • A reference to writing or written excludes fax and email.
  • In the case of conflict or ambiguity between:
    • any provision contained in the body of this Agreement and any provision contained in the Annexes, the provision in the body of this Agreement will prevail;
    • the terms of any accompanying invoice or other documents annexed to this Agreement and any provision contained in the Annexes, the provision contained in the Annexes will prevail; and
    • any of the provisions of this Agreement and the provisions of the Master Agreement, the provisions of this Agreement will prevail.

PERSONAL DATA TYPES AND PROCESSING PURPOSES

  • The Customer and Mtech agree and acknowledge that for the purpose of the Data Protection Legislation:
    • the Customer is the Controller and Mtech is the Processor.
    • the Customer retains control of the Personal Data and remains responsible for its compliance obligations under the Data Protection Legislation, including but not limited to, providing any required notices and obtaining any required consents, and for the written processing instructions it gives to Mtech.
  • Appendix A describes the subject matter, duration, nature and purpose of the processing and the Personal Data categories and Data Subject types in respect of which Mtech may process the Personal Data to fulfil the Business Purposes.

MTECH’S OBLIGATIONS

  • Mtech will only process the Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Customer’s written instructions (unless otherwise required by the Data Protection Legislation, which case it shall inform the Customer of any contrary requirements under the relevant legislation).

MTECH’S EMPLOYEES

  • Mtech will ensure that all of its employees are informed of the confidential nature of the Personal Data and are bound by written confidentiality obligations and use restrictions in respect of the Personal Data.

SECURITY

  • Mtech must at all times implement appropriate technical and organisational measures against accidental, unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data.
  • Mtech must implement such measures to ensure a level of security appropriate to the risk involved.

PERSONAL DATA BREACH

  • Mtech will without undue delay notify the Customer in writing if it becomes aware of:
    • the loss, unintended destruction or damage, corruption, or unusability of part or all of the Personal Data.
  • any accidental, unauthorised or unlawful processing of the Personal Data; or any Personal Data Breach.

TRANSFERS OF PERSONAL DATA

  • Mtech (and any subcontractor) may transfer or otherwise process the Personal Data outside the UK or, the EEA.  Mtech shall ensure that such transfers are made in accordance with applicable Data Protection Laws.

SUBCONTRACTORS

  • The initial subcontractors used by Mtech in the processing of the Personal Data are listed in Appendix A.
    • Mtech may only authorise another third-party (subcontractor) to process the Personal Data if:
    • the Customer is provided with an opportunity to object to the appointment of each subcontractor within 10 working days after Mtech supplies the Customer with full details in writing regarding such subcontractor; and
  • Mtech enters into a written contract with the subcontractor that contains terms substantially the same as those set out in this Agreement, in particular, in relation to requiring appropriate technical and organisational data security measures.
  • Mtech remains liable to the Customer for the subcontractor’s performance of its agreement obligations.

COMPLAINTS, DATA SUBJECT REQUESTS AND THIRD-PARTY RIGHTS

  • Mtech must, at the cost of the Customer, take such technical and organisational measures as may be appropriate, and promptly provide such information to the Customer as the Customer may reasonably require, to enable the Customer to comply with:
    • the rights of Data Subjects under the Data Protection Legislation, including, but not limited to, subject access rights, the rights to rectify, port and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
    • information or assessment notices served on the Customer by the Commissioner or other relevant regulator under the Data Protection Legislation.
  • Mtech must notify the Customer promptly in writing if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party’s compliance with the Data Protection Legislation.
  • Mtech must notify the Customer promptly if it receives a request from a Data Subject for access to their Personal Data or to exercise any of their other rights under the Data Protection Legislation.

TERM AND TERMINATION

  • This Agreement will remain in full force and effect so long as:
    • the Master Agreement remains in effect; or
    • Mtech retains any of the Personal Data related to the Master Agreement in its possession or control (Term).
  • Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the Master Agreement in order to protect the Personal Data will remain in full force and effect.

DATA RETURN AND DESTRUCTION

  • On termination of the Master Agreement for any reason or expiry of its term, Mtech will securely delete or destroy or, if directed in writing by the Customer, return and not retain, all or any of the Personal Data related to this Agreement in its possession or control.
  • If any law, regulation, or government or regulatory body requires Mtech to retain any documents, materials or Personal Data that Mtech would otherwise be required to return or destroy, it will notify the Customer in writing of that retention requirement, giving details of the documents, materials or Personal Data that it must retain, the legal basis for such retention, and establishing a specific timeline for deletion or destruction once the retention requirement ends.

RECORDS

  • Mtech will keep detailed, accurate and up-to-date written records regarding any processing of the Personal Data (Records).
  • Mtech will ensure that the Records are sufficient to enable the Customer to verify Mtech’s compliance with its obligations under this Agreement and the Data Protection Legislation and Mtech will provide the Customer with copies of the Records upon request.

AUDIT

  • Mtech will permit the Customer to audit Mtech’s compliance with its agreement obligations, on reasonable prior notice, during the Term. Mtech will give the Customer reasonable assistance to conduct such audits at the cost of the Customer. The Customer will ensure that its audit does not unreasonably interrupt Mtech’s business. 

NOTICE

  • Any notice given to a party under or in connection with this Agreement shall be in writing and shall be given in accordance with the terms of the Master Services Agreement.
  • This Agreement has been entered into on the date stated at the beginning of it.
  •  

PERSONAL DATA PROCESSING PURPOSES AND DETAILS

  • Subject matter of processing: Processing ancillary to the provision of telephony and other IT based services by Mtech to the Customer.
  • Duration of Processing: the term of the Master Services Agreement
  • Nature of Processing: Handling phone calls and storage of call related data, including call recordings and call metadata consequent on the provision of the services provided under the Master Services Agreement.
  • Business Purposes: provision of the Services under the Master Services Agreement
  • Personal Data Categories: Names, telephone numbers, call metadata, contents of call recordings.
  • Data Subject Types: Individuals using the telephony services provided by Mtech to the Customer.

Approved Subcontractors:

  • Mtech Communications Limited: All Customer information for the provision and delivery of the Services.
  • Gamma Telecom/Pragma: All Customer information required for the provision of the Services, (broadband/SIP Services, call recording, etc).
  • Giacom (aBILLity), Go Cardless: Secure storage of Customers bank details for invoicing and payment.