Data Processing Agreement

1. Parties and application

This Data Processing Agreement (DPA) is between:

• Processor: Haydon Turner-White, trading as Revamp Automation, of 70 Poynder Road, Corsham, SN13 9LZ (Revamp Automation); and
• Controller: the Customer identified in the applicable order form, proposal, quotation, invoice, checkout or account (Customer).

The DPA takes effect when the main Agreement takes effect and applies for as long as Revamp Automation processes personal data on the Customer's behalf in providing memberships, automation projects, QuickQuote or related Services.

Terms including controller, processor, personal data, processing, personal data breach, data subject and supervisory authority have the meanings given by applicable UK data-protection law.

2. Scope and documented instructions

The subject matter, duration, nature, purposes, personal-data types and data-subject categories are described in Schedule 1. The Customer instructs Revamp Automation to process Customer Personal Data only as necessary to provide, configure, secure, support and improve the contracted Services; comply with the Agreement and the Customer's documented configuration and support requests; and comply with further lawful written instructions agreed by the parties.

Revamp Automation will process Customer Personal Data only on those documented instructions, including in relation to international transfers, unless UK law requires otherwise. If the law permits, Revamp Automation will tell the Customer before carrying out legally required processing.

If Revamp Automation reasonably considers that an instruction infringes applicable data-protection law, it will inform the Customer and may suspend the affected processing while the parties address the concern.

3. Processor obligations

Revamp Automation will:

1. ensure that people authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality;
2. implement and maintain technical and organisational measures appropriate to the risk, taking account of the state of the art, implementation costs, the processing and the potential impact on individuals;
3. assist the Customer, taking account of the nature of processing and information available, with data-subject requests and the Customer's security, breach-notification, data-protection impact assessment and prior-consultation obligations;
4. notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data;
5. at the Customer's choice, return or delete Customer Personal Data after the relevant Services end, unless law requires its retention; and
6. make available information reasonably necessary to demonstrate compliance with this DPA and allow audits in accordance with clause 10.

4. Security measures

Measures will be appropriate to the particular Services and risks and may include:

• role-based and least-privilege access controls, authentication protections and periodic access review;
• encryption or protected storage for supported integration credentials, secrets and export archives;
• tenant separation, input validation, secure sessions, logging, monitoring and rate limiting;
• backups, recovery procedures, vulnerability and patch management, and protected hosting configurations;
• confidentiality requirements, secure support practices and controlled administrative access; and
• documented retention, account closure and deletion procedures.

The Customer is responsible for securely configuring its own accounts, users, permissions, devices, connections and backups. Revamp Automation may update its measures as technology and risks change, provided the overall protection is not materially reduced.

5. Customer obligations

The Customer warrants that its instructions and processing are lawful; it has provided required privacy information; it has a lawful basis for collecting, using and disclosing Customer Personal Data; and it has authority to instruct Revamp Automation.

The Customer will not instruct Revamp Automation to process personal data unlawfully and will use access permissions, AI automations and automatic-send features proportionately. The Customer will avoid supplying unnecessary special-category or criminal-offence data and will notify Revamp Automation before intentionally using a Service for processing that materially increases the agreed risk.

6. Sub-processors

The Customer gives general written authorisation for Revamp Automation to appoint the sub-processors and categories described in Schedule 2 where required for the contracted Services.

Revamp Automation will:

• carry out appropriate due diligence and use a written contract imposing data-protection obligations that provide materially equivalent protection;
• remain responsible to the Customer for the sub-processor's performance of those obligations;
• provide reasonable advance notice of a material new or replacement sub-processor where practicable; and
• allow the Customer to raise a reasoned objection based on data-protection grounds before the change takes effect.

The parties will work in good faith to resolve an objection. If no reasonable alternative is available, either party may terminate the affected Service on written notice. The Customer remains responsible for providers it selects, contracts with directly or instructs Revamp Automation to integrate.

7. International transfers

Revamp Automation will not make a restricted transfer of Customer Personal Data unless an appropriate lawful transfer mechanism and any required supplementary safeguards are in place. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or another valid mechanism.

Where a Customer-selected provider processes data internationally under the Customer's own account or contract, the Customer is responsible for assessing and approving that transfer, and Revamp Automation's instructions are limited to carrying out the configured integration.

8. Personal data breaches

Revamp Automation's notification will, as information becomes available, describe the nature of the breach, affected data and people, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases. Notification is not an admission of fault or liability.

The Customer remains responsible for deciding whether it must notify the Information Commissioner's Office, another supervisory authority or affected individuals. Revamp Automation will provide reasonable assistance, taking account of the Services and information available.

9. Individual rights and compliance assistance

If Revamp Automation receives a request from an individual relating to Customer Personal Data, it will normally refer the request to the Customer and will not respond substantively unless instructed or legally required. Revamp Automation will provide reasonable technical and organisational assistance with requests, impact assessments, consultations and regulatory enquiries.

Assistance that is unusually extensive, repetitive or caused by the Customer's breach may be charged at an agreed rate, unless the work is required because Revamp Automation breached this DPA.

10. Information and audits

Revamp Automation will provide information reasonably necessary to demonstrate compliance. The Customer may conduct an audit no more than once in any 12-month period, unless a personal data breach, regulator request or reasonable evidence of material non-compliance justifies an additional audit.

An audit must be proportionate, take place on reasonable written notice during normal business hours, minimise disruption, protect other customers and confidential information, and use an independent auditor subject to confidentiality where appropriate. The Customer bears its audit costs and Revamp Automation's reasonable costs of unusually burdensome assistance unless the audit identifies a material breach by Revamp Automation.

11. Return, deletion and retention

At the end of the relevant Services, Revamp Automation will disable access and, at the Customer's request made before deletion, provide a reasonable export of supported Customer Personal Data. Active-system data will then be returned or deleted in accordance with the documented service-specific process, subject to a reasonable recovery period and legal retention requirements.

Backup copies will be put beyond ordinary use and expire under the applicable backup cycle. Minimal security, billing, deletion and legal records may be retained for the period reasonably required by law or to establish, exercise or defend legal claims.

Data in the Customer's own ServiceM8, Google, Stripe or other provider account remains controlled through that provider account and is subject to the Customer's instructions and provider contract.

12. Liability, priority and duration

The liability provisions in the main Agreement apply to this DPA to the extent permitted by law. Nothing in the Agreement affects the statutory powers of a supervisory authority or an individual's rights that cannot lawfully be limited by contract.

If this DPA conflicts with the main Agreement on the processing of Customer Personal Data, this DPA takes priority. It continues for as long as Revamp Automation processes Customer Personal Data on the Customer's behalf.

Schedule 1 - Processing details

Schedule 2 - Authorised sub-processors and categories

Only providers required for the Customer's contracted and configured Services will be used. The current categories may include:

Advertising and analytics providers used by Revamp Automation for its own website or marketing are normally independent controllers or processors for Revamp Automation's controller activities and are addressed in the Privacy Policy, rather than this Customer processor schedule.

Contact