Organisation Data Protection Addendum

This current consolidated Data Protection Addendum was published on 25 SEPTEMBER 2024. For previous versions, see https://tellarnie.com/organisation-data-protection-addendum/ .

This is the Data Protection Addendum referred to in the end user licence agreement (EULA) between you and us relating to your right to use and access the Tell Arnie app developed by us for the provision of online accident record keeping and first aid stock control. 

 

Definitions

In this Data Protection Addendum defined terms shall have the same meaning, and the same rules of interpretation shall apply as in the EULA. In addition, in this Data Protection Addendum the following definitions have the meanings given below: 
Applicable Law: means the following to the extent forming part of the law of United Kingdom (or a part of the United Kingdom) as applicable and binding on either party or the Services:

  1. any law, legislation, regulation, byelaw or subordinate legislation in force from time to time;
  2. the common law and laws of equity as applicable to the parties from time to time;
  3. any binding court order, judgment or decree; or
  4. any applicable direction, policy, rule or order made or given by any regulatory body having jurisdiction over a party or any of that party’s assets, resources or business;


Controller: has the meaning given to that term in Data Protection Laws;

Data Protection Laws: means as applicable and binding on either party or the Services:

  1. the GDPR;
  2. the Data Protection Act 2018;
  3. any laws which implement or supplement any such laws; and
  4. any laws that replace, extend, re-enact, consolidate or amend any of the foregoing;


Data Protection Losses: means all liabilities arising directly or indirectly from any breach or alleged breach of any of the Data Protection Laws or of this Data Protection Addendum, including all:

  1. costs (including legal costs), claims, demands, actions, settlements, interest, charges, procedures, expenses, losses and damages (including relating to material or non-material damage);
  2. administrative fines, penalties, sanctions, liabilities or other remedies imposed by a Supervisory Authority;
  3. compensation which is ordered by a court or Supervisory Authority to be paid to a Data Subject; and/or
  4. costs of compliance with investigations by a Supervisory Authority;


Data Subject: has the meaning given to that term in Data Protection Laws and includes (for the avoidance of doubt) in respect of any accident or incident being recorded via the Services, any individual in respect of whom that accident or incident occurred);

Data Subject Request: means a request made by a Data Subject to exercise any rights of Data Subjects under Chapter III of the GDPR in relation to any Protected Data;

GDPR: means the General Data Protection Regulation, Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or of a part of the United Kingdom from time to time);

Initial Sub–Processors: means AWS and Azure;

Personal Data: has the meaning given to that term in Data Protection Laws;

Personal Data Breach: means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Protected Data;

processing: has the meaning given to that term in Data Protection Laws (and related terms such as process, processes and processed have corresponding meanings);

Processing Instructions: has the meaning given to that term in paragraph 3.1.1;

Processor: has the meaning given to that term in Data Protection Laws;

Protected Data: means Personal Data in the Customer Data;

Sub-Processor: means a Processor engaged by the Supplier or by any other Sub-Processor for carrying out processing activities in respect of the Protected Data on behalf of the Customer;

Supervisory Authority: means any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering Data Protection Laws; and

Transfer: bears the same meaning as the word ‘transfer’ in Article 44 of the GDPR (and related terms such as Transfers, Transferred and Transferring have corresponding meanings).

 

Processor and Controller

  1. The parties agree that, for the Protected Data, the Customer shall be the Controller and the Supplier shall be the Processor. Nothing in our Agreement relieves the Customer of any responsibilities or liabilities under any Data Protection Laws.
  2. To the extent the Customer is not sole Controller of any Protected Data it warrants that it has full authority and authorisation of all relevant Controllers to instruct the Supplier to process the Protected Data in accordance with our Agreement.
  3. The Supplier shall process Protected Data in compliance with:
    1. the obligations of Processors under Data Protection Laws in respect of the performance of its obligations under our Agreement; and
    2. the terms of our Agreement.
  4. The Customer shall ensure that it, its authorised representatives, each Authorised User and each App User shall at all times comply with:
    1. all Data Protection Laws in connection with the processing of Protected Data, the use of the Services (and each part) and the exercise and performance of its respective rights and obligations under our Agreement, including maintaining all relevant regulatory registrations and notifications as required under Data Protection Laws; and
    2. the terms of our Agreement.
  5. The Customer warrants, represents and undertakes, that at all times:
    1. the processing of all Protected Data (if processed in accordance with our Agreement) shall comply in all respects with Data Protection Laws, including in terms of its collection, use and storage;
    2. fair processing and all other appropriate notices have been provided to the Data Subjects of the Protected Data (and all necessary consents from such Data Subjects obtained and at all times maintained) to the extent required by Data Protection Laws in connection with all processing activities in respect of the Protected Data that may be undertaken by the Supplier and its Sub-Processors in accordance with our Agreement;
    3. the Protected Data is accurate and up to date;
    4. the Protected Data is not subject to the laws of any jurisdiction outside of the United Kingdom;
    5. it shall establish and maintain adequate security measures to safeguard the Protected Data in its possession or control (including from unauthorised or unlawful destruction, corruption, processing or disclosure) and maintain complete and accurate backups of all Protected Data provided to the Supplier (or anyone acting on its behalf) so as to be able to immediately recover and reconstitute such Protected Data in the event of loss, damage or corruption of such Protected Data by the Supplier or any other person; and
    6. all instructions given by it to the Supplier in respect of Personal Data shall at all times be in accordance with Data Protection Laws.

 

Instructions and details of processing

  1. Insofar as the Supplier processes Protected Data on behalf of the Customer, the Supplier:
    1. unless required to do otherwise by Applicable Law, shall (and shall take steps to ensure each person acting under its authority shall) process the Protected Data only on and in accordance with the Customer’s documented instructions as set out in our Agreement, as updated from time to time or as required to provide the Services (Processing Instructions);
    2. if Applicable Law requires it to process Protected Data other than in accordance with the Processing Instructions, shall notify the Customer of any such requirement before processing the Protected Data (unless Applicable Law prohibits such information on important grounds of public interest); and
    3. shall promptly inform the Customer if the Supplier becomes aware of a Processing Instruction that, in the Supplier’s opinion, infringes Data Protection Laws, provided that:
      1. this shall be without prejudice to paragraph 2.4 and paragraph 2.5; and
      2. to the maximum extent permitted by Applicable Law, the Supplier shall have no liability howsoever arising (whether in contract, tort (including negligence) or otherwise) for any losses, costs, expenses or liabilities (including any Data Protection Losses) arising from or in connection with any processing in accordance with the Processing Instructions following the Customer’s receipt of the information required by this paragraph 3.1.3.
  2. The Customer shall be responsible for ensuring all its authorised representatives, Authorised Users and App Users read and understand the Supplier’s privacy notice (as updated from time to time).
  3. The Customer acknowledges and agrees that the execution of any computer command to process (including deletion of) any Protected Data made in the use of the Services by an Authorised User or an App User will be a Processing Instruction (other than to the extent such command is not fulfilled due to technical, operational or other reasons). The Customer shall ensure that Authorised Users and App Users do not execute any such command unless authorised by the Customer (and by all other relevant Controller(s)) and acknowledges and accepts that if any Protected Data is deleted pursuant to any such command the Supplier is under no obligation to seek to restore it.
  4. The processing of the Protected Data by the Supplier under our Agreement shall be for the subject-matter, duration, nature and purposes and involve the types of Personal Data and categories of Data Subjects set out in schedule 1.

 

Technical and organisational measures

  1. The Supplier shall implement and maintain technical and organisational measures:
    1. in relation to the processing of Protected Data by the Supplier, as agreed between the parties from time to time; and
    2. to assist the Customer insofar as is possible (taking into account the nature of the processing) in the fulfilment of the Customer’s obligations to respond to Data Subject Requests relating to Protected Data, in each case at the Customer’s cost. The parties have agreed that (taking into account the nature of the processing) the Supplier’s compliance with paragraph 6.1 shall constitute the Supplier’s sole obligations under this paragraph 4.1.2.

 

Using staff and other Processors

  1. The Supplier shall not engage (nor permit any other Sub-Processor to engage) any Sub-Processor for carrying out any processing activities in respect of the Protected Data in connection with our Agreement without the Customer’s prior written authorisation. The Customer shall not unreasonably object to any new Sub-Processor (or any change to any of the Sub-Processors).
  2. The Customer authorises the appointment of the Initial Sub-Processors.


Assistance with compliance and Data Subject rights

  1. The Supplier shall refer all Data Subject Requests it receives to the Customer without undue delay. The Customer shall pay the Supplier for all work, time, costs and expenses incurred by the Supplier or any Sub-Processor(s) in connection with such activity.
  2. The Supplier shall provide such assistance as the Customer reasonably requires (taking into account the nature of processing and the information available to the Supplier) to the Customer in ensuring compliance with the Customer’s obligations under Data Protection Laws with respect to:
    1. security of processing;
    2. data protection impact assessments (as such term is defined in Data Protection Laws);
    3. prior consultation with a Supervisory Authority regarding high risk processing; and
    4. notifications to the Supervisory Authority and/or communications to Data Subjects by the Customer in response to any Personal Data Breach,

provided the Customer shall pay the Supplier for all work, time, costs and expenses incurred the Supplier or any Sub-Processor(s) in connection with providing the assistance in this paragraph 6.2.

 

International data Transfers

The Supplier shall not Transfer any Protected Data:

    1. to any country or territory outside the United Kingdom; and/or
    2. to an organisation and/or its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries, without the Customer’s prior written authorisation except (a) where required by Applicable Law or (b) where such transfer is a result of a change in the Initial Processors provision of services to the Supplier (in which case the provisions of paragraph 3.1 shall apply).


Breach notification

In respect of any Personal Data Breach, the Supplier shall, without undue delay (and in any event within 72 hours):

      1. notify the Customer of the Personal Data Breach; and
      2. provide the Customer with details of the Personal Data Breach.


Deletion of Protected Data and copies

Following the end of the provision of the Services (or any part) relating to the processing of Protected Data the Supplier shall dispose of Protected Data in accordance with its obligations under our Agreement. The Supplier shall have no liability (howsoever arising, including in negligence) for any deletion or destruction of any such Protected Data undertaken in accordance with our Agreement.


Compensation and claims

  1. The Supplier shall be liable for Data Protection Losses (howsoever arising, whether in contract, tort (including negligence) or otherwise) under or in connection with our Agreement:
    1. only to the extent caused by the processing of Protected Data under our Agreement and directly resulting from the Supplier’s breach of our Agreement; and
    2. in no circumstances to the extent that any Data Protection Losses (or the circumstances giving rise to them) are contributed to or caused by any breach of our Agreement by the Customer (including in accordance with paragraph 3.1.3).
  2. If a party receives a compensation claim from a person relating to processing of Protected Data in connection with our Agreement or the Services, it shall promptly provide the other party with notice and full details of such claim.
  3. The parties agree that the Customer shall not be entitled to claim back from the Supplier any part of any compensation paid by the Customer in respect of such damage to the extent that the Customer is liable to indemnify or otherwise compensate the Supplier in accordance with our Agreement.
  4. This paragraph 10 is intended to apply to the allocation of liability for Data Protection Losses as between the parties, including with respect to compensation to Data Subjects, notwithstanding any provisions under Data Protection Laws to the contrary, except:
    1. to the extent not permitted by Applicable Law (including Data Protection Laws); and
    2. that it does not affect the liability of either party to any Data Subject.


Survival

This Data Protection Addendum (as Updated from time to time) shall survive termination (for any reason) or expiry of our Agreement and continue until no Protected Data remains in the possession or control of the Supplier or any Sub-Processor, except that paragraphs 9 to 11 (inclusive) shall continue indefinitely.

 

Data processing details

Subject-matter of processing:

  • Individuals at the Customer’s site in respect of whom an accident or incident occurs which is required to be recorded in the Customer’s accident book (Injured Data Subject) which is recorded by or on behalf of the Customer via the App
  • Customer’s first aid stocks and usage
  • Medical information recorded by the Customer (for example allergies and other information relevant to the provision of first aid treatment to individuals)

Duration of the processing:

During the Subscription Period and for a period of 3 months after the end of the Subscription Period.

Nature and purpose of the processing:

  • Processing in accordance with the rights and obligations of the parties under our Agreement;
  • Processing as reasonably required to provide the Services
  • Processing as initiated, requested or instructed by Authorised Users or App Users in connection with their use of the Services, or by the Customer, in each case in a manner consistent with our Agreement

Type of Personal Data:

  • Legal and other names
  • Titles
  • Positions
  • Email addresses
  • Phone numbers
  • Medical information relevant to the provision of first aid treatment
  • Incident details
  • First aid treatment details

Categories of Data Subjects:

  • Authorised Users
  • App Users
  • Injured Data Subjects
  • Customer’s employees and other visitors to its premises where the Customer records medical information relevant to the provision of first aid treatment

Special categories of Personal Data:

Medical information relevant to the provision of first aid treatment (for example allergies)

In respect of Injured Data Subjects only:

  • Injury received
  • First aid treatment provided
  • Individuals at the Customer’s site in respect of whom an accident or incident occurs which is required to be recorded in the Customer’s accident book