1. Purpose, Scope and Application
1.1 This Data Processing Agreement ("DPA") forms part of the service agreement between the Controller and the Processor (the "Service Agreement"). It governs the processing of Personal Data in connection with the Services in accordance with the Data Protection Laws. Where the Services are provided in respect of data subjects located in, or Personal Data originating from, a jurisdiction other than the United Kingdom, this DPA applies to that processing and the Data Protection Laws of that jurisdiction form part of the Data Protection Laws for the purposes of this DPA.
1.2 The Parties acknowledge that, in connection with the Services, the Processor acts in two distinct capacities, as set out in Section 3. Sections 5 to 8 of this DPA apply solely to the extent that the Processor acts as a processor in respect of Controller Personal Data. Those Sections do not apply to Personal Data in respect of which the Processor acts as an independent controller under clause 3.2.
1.3 Service levels, availability commitments and support response targets are not addressed in this DPA and are set out in the Service Agreement or an SLA schedule to it.
2. Definitions
Terms defined in the Data Protection Laws apply to this DPA. Where a term is defined differently under two or more Data Protection Laws applicable to the same processing, the definition under the law applicable to that processing shall prevail in respect of it. In addition:
- "Data Protection Laws": all laws and regulations applicable to the processing of Personal Data under this DPA, in any jurisdiction in which or in respect of which Personal Data is processed, including UK GDPR, the Data Protection Act 2018, EU GDPR, and any other national, federal, state or provincial law or regulation relating to privacy, data protection, data security or direct marketing, however such law designates the parties to the processing, in each case as amended, replaced or superseded from time to time and together with any implementing regulations, codes and binding regulatory guidance.
- "Services": the AI-powered sales orchestration, data enrichment and outbound execution platform and related services provided by the Processor.
- "Personal Data": any information relating to an identified or identifiable data subject that is processed under this DPA, and, where the applicable Data Protection Laws so provide, information relating to a juristic, legal or corporate person.
- "Controller Personal Data": Personal Data provided by, or on behalf of, the Controller to the Processor, or otherwise made available to the Processor by the Controller, which the Processor processes on the Controller’s behalf in connection with the Services. For the avoidance of doubt, Controller Personal Data does not include Haku Sourced Data. Controller Personal Data is further described in Annex I (Processing Details).
- "Haku Sourced Data": Personal Data that the Processor collects, compiles, verifies, enriches or otherwise obtains from its own sources, from publicly available sources, or from third-party data providers, whether or not that data is subsequently made available to the Controller through the Services.
- "Instructions": the Controller’s instructions to the Processor as to the processing of Controller Personal Data, as given under the Service Agreement, under this DPA, through the Controller’s use of the features and functionality of the Services, or as otherwise agreed in writing between authorised representatives of the Parties.
- "Sub-processor": any third party engaged by the Processor to process Controller Personal Data.
- "Personal Data Breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
- "data subject", "controller", "processor" and "processing" have the meanings given under the applicable Data Protection Laws, and shall be read as including any equivalent or cognate term used by those laws to designate the same role or activity.
3. Roles of the Parties
3.1 Where the Processor acts as a processor
To the extent that the Processor processes Controller Personal Data solely in order to provide the Services to the Controller — including to match Controller Personal Data against the Processor’s data sources, to enrich records supplied by the Controller, to enable the Controller to configure and execute email, telephone and multichannel outbound sequences through the Services, and to provide reporting on those activities — the Processor acts as a processor and the Controller acts as a controller. In that capacity the Processor processes Controller Personal Data only in accordance with the Instructions.
3.2 Where the Processor acts as an independent controller
The Processor is an independent controller in respect of Haku Sourced Data. The Processor determines the purposes and means of processing Haku Sourced Data, and is solely responsible for:
- establishing and maintaining a lawful basis under the Data Protection Laws for its own processing of Haku Sourced Data;
- providing any transparency information required by the Data Protection Laws in respect of that processing;
- responding to data subject rights requests it receives in respect of Haku Sourced Data; and
- maintaining its own record of processing activities in respect of that data.
Where the Controller receives Haku Sourced Data through the Services and processes it for its own purposes, the Controller acts as an independent controller in respect of that processing. Nothing in this DPA makes the Processor a controller or joint controller in respect of the Controller’s own use of Haku Sourced Data.
3.3 Required notices and consents
3.3.1 The Controller has sole responsibility and liability for the means by which it acquires Controller Personal Data and makes it available to the Processor. Where required by the Data Protection Laws, the Controller shall ensure that it has provided all necessary notices and obtained all necessary consents, and that it has and maintains a valid lawful basis, for the processing of Controller Personal Data contemplated by the Service Agreement and this DPA, including for the purposes of outbound communications sent through the Services on the Controller’s Instructions.
3.3.2 Where the Data Protection Laws applicable to any outbound communication require the prior consent of the recipient, or restrict the number or manner of approaches that may be made to a recipient in order to obtain that consent, the Controller is responsible for ensuring that such consent has been obtained and recorded, or that a recognised exemption applies, before configuring or initiating that communication through the Services. The Controller shall retain records evidencing compliance and shall make them available to the Processor on reasonable request.
3.4 Configuration of outbound activity
3.4.1 The Controller determines the target audience, targeting criteria, geographic scope, message content, channel mix and send schedule for outbound activity, and configures, schedules and initiates that activity through the Services. The Controller’s use of the features and functionality of the Services constitutes an Instruction to the Processor for the purposes of this DPA.
3.4.2 Where the Controller configures outbound activity directed at data subjects in a particular jurisdiction, the Controller is responsible for determining that the activity is lawful under the Data Protection Laws of that jurisdiction, including any requirement as to consent, message content, identification of the sender, and provision of an opt-out or unsubscribe mechanism.
3.4.3 The Processor shall inform the Controller where an Instruction of which the Processor is actually aware would, in the Processor’s opinion, infringe the Data Protection Laws. The Processor is not obliged to monitor, review, verify or approve the Controller’s audience selection, targeting criteria, message content or send schedule, and does not do so. Nothing in this clause imposes on the Processor an obligation to advise the Controller on the lawfulness of its outbound activity.
4. Processing Details
The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are set out in Annex I (Processing Details), which forms part of this DPA.
5. Processor Obligations
5.1 Instructions
In respect of Controller Personal Data, the Processor shall:
- process Controller Personal Data only on the Instructions, including as to international transfers;
- inform the Controller if, in the Processor’s opinion, an instruction infringes the Data Protection Laws; and
- notify the Controller of any legal requirement to process Controller Personal Data otherwise than on the Instructions, unless prohibited from doing so by law.
5.2 Confidentiality
The Processor shall ensure that persons authorised to process Controller Personal Data are subject to a binding duty of confidentiality, both during and after their engagement, and receive appropriate data protection training.
5.3 Security measures
The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as detailed in Annex II (Security Measures), including encryption of data in transit (TLS 1.3) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, and regular security assessment. The Processor may modify or update those measures provided that no such change results in a material degradation of the overall security of the Services.
5.4 Sub-processing
5.4.1 The Controller provides general written authorisation for the engagement of the Sub-processors listed in Annex III.
5.4.2 The Processor shall notify the Controller at least thirty (30) days before a new Sub-processor commences processing of Controller Personal Data.
5.4.3 The Controller may object to a new Sub-processor within thirty (30) days of notice, on reasonable grounds relating to the protection of Controller Personal Data. If the Controller does not object within that period, the new Sub-processor is deemed accepted.
5.4.4 Where the Controller objects, the Parties shall seek to resolve the objection in good faith for a period of thirty (30) days. If the Parties are unable to agree a resolution within that period, the Controller may terminate the affected part of the Services on written notice and shall be entitled to a pro-rata refund of any prepaid fees for Services not received as at the effective date of termination. This right of termination and refund is the Controller’s sole and exclusive remedy in respect of an objection to a Sub-processor.
5.4.5 The Processor shall impose data protection obligations on each Sub-processor that are substantially equivalent to those imposed on the Processor under this DPA. The Processor is liable for the acts and omissions of its Sub-processors as if they were its own acts and omissions, subject to the limitations and exclusions of liability in Section 9.
5.5 Data subject rights
In respect of Controller Personal Data, the Processor shall promptly notify the Controller of any data subject request it receives, shall not respond directly to the data subject unless authorised to do so, and shall provide reasonable assistance to the Controller in responding, taking into account the nature of the processing and the information available to the Processor.
5.6 Personal Data Breach notification
5.6.1 On confirming a Personal Data Breach affecting Controller Personal Data, the Processor shall notify the Controller without undue delay and in any event within twenty-four (24) hours of that confirmation.
5.6.2 The notification shall include, to the extent then known to the Processor, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it. The Processor shall provide further information as it becomes available.
5.6.3 The Processor shall cooperate with the Controller in the investigation, mitigation and remediation of the breach, and shall take reasonable steps to remedy any non-compliance with this DPA.
5.6.4 Notification of, or response to, a Personal Data Breach under this clause shall not be construed as an acknowledgement by the Processor of any fault or liability in respect of that breach.
6. International Data Transfers
6.1 Any transfer of Controller Personal Data to a country outside the UK or EEA that is not the subject of an adequacy decision shall be made under the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or another transfer mechanism approved under Chapter V UK GDPR.
6.2 The Parties are deemed to have entered into the transfer mechanism set out in Annex IV in respect of transfers to Sub-processors outside the UK and EEA. Annex IV takes precedence over this DPA to the extent of any conflict, save in respect of Section 9 (Liability), which continues to apply to the maximum extent permitted.
6.3 The Processor shall conduct transfer risk assessments in respect of transfers to jurisdictions identified as higher risk and shall implement supplementary measures where required.
6.4 For transfers to US-based Sub-processors, the Processor verifies Data Privacy Framework certification where applicable, and, in respect of AI and inference services, seeks zero-retention terms where commercially available.
7. Audit and Demonstration of Compliance
7.1 On the Controller’s reasonable written request, the Processor shall make available the information reasonably necessary to demonstrate compliance with its obligations under this DPA and the Data Protection Laws.
7.2 The Processor shall allow for and contribute to audits of its compliance with this DPA, subject to the following:
- audits shall be conducted no more than once in any twelve (12) month period, unless required by a supervisory authority or following a confirmed Personal Data Breach affecting Controller Personal Data;
- the Controller shall give at least thirty (30) days’ written notice;
- audits shall be conducted during normal business hours and in a manner that causes minimal disruption to the Processor’s operations and business;
- the Processor’s primary method of demonstrating compliance is documentation review, completion of security questionnaires and provision of applicable certifications; an on-site inspection may be conducted where that documentation is reasonably insufficient to demonstrate compliance;
- any third party appointed by the Controller to conduct an audit shall not be a competitor of the Processor and shall be bound by confidentiality obligations no less protective than those in the Service Agreement; and
- each Party bears its own costs, save that the Controller shall reimburse the Processor’s reasonable costs of supporting an on-site inspection.
7.3 The Processor shall maintain and, on request, make available its record of processing activities in respect of Controller Personal Data, its applicable security certifications and third-party audit reports, and a summary of any security incident affecting Controller Personal Data.
7.4 Nothing in this Section requires the Processor to disclose information that is subject to a confidentiality obligation owed to a third party, that constitutes the Processor’s commercially sensitive information (including its agreements with Sub-processors and the commercial terms of those agreements), or that would compromise the security of the Services or the data of the Processor’s other customers.
8. Data Retention and Deletion
8.1 Controller Personal Data shall be retained only for as long as necessary to provide the Services, unless longer retention is required by law, the Controller provides specific retention instructions, or the data has been effectively anonymised.
8.2 On termination or expiry of the Service Agreement, or on the Controller’s written request, the Processor shall, at the Controller’s election and within ninety (90) days:
- delete Controller Personal Data from its active production systems; or
- return a complete copy of Controller Personal Data to the Controller by secure transfer in a commonly used, machine-readable format (CSV or JSON), following which the data shall be deleted in accordance with paragraph (1).
8.3 Controller Personal Data held in backups, replicas and snapshots is not purged on demand but ages out of the Processor’s systems as part of its ordinary data lifecycle. During that period such data remains subject to the access controls in Annex II, is not used for any active processing, and is placed on a suppression list so that it is not re-collected, re-used or made available following a valid deletion request.
8.4 The Processor shall instruct its Sub-processors to give effect to deletion in accordance with this Section.
8.5 The Processor may retain Controller Personal Data to the extent required by applicable law, provided that it continues to ensure the confidentiality of that data and processes it only for the purpose requiring its retention.
8.6 On the Controller’s written request following deletion, the Processor shall confirm in writing that it has completed deletion from its active production systems in accordance with clause 8.2.
9. Liability and Indemnification
9.1 Application of Service Agreement limitations. The limitations and exclusions of liability set out in the Service Agreement apply to this DPA and to any transfer mechanism incorporated into it, and each Party’s aggregate liability arising out of or relating to this DPA is subject to those limitations and exclusions.
9.2 Data protection cap. Notwithstanding clause 9.1, and subject to clause 9.4, the Processor’s aggregate liability for all claims arising out of or in connection with this DPA, including claims arising from a breach of the Data Protection Laws, shall not exceed two (2) times the total fees paid or payable by the Controller under the Service Agreement in the twelve (12) month period immediately preceding the first event giving rise to the liability.
9.3 Indemnity. Subject to clauses 9.1, 9.2 and 9.4, the Processor shall indemnify the Controller against direct losses, and regulatory fines properly levied against the Controller, to the extent arising from the Processor’s breach of this DPA or of the Data Protection Laws in its capacity as processor. The Controller shall indemnify the Processor against direct losses, and regulatory fines properly levied against the Processor, to the extent arising from the Controller’s breach of clause 3.3 or clause 3.4.
9.4 Excluded liabilities. Nothing in this DPA limits or excludes either Party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded.
9.5 Regulatory cooperation. The Processor shall cooperate with supervisory authorities, provide information properly requested by the Information Commissioner’s Office or another competent regulator, implement remedial measures as directed, and shall not obstruct the Controller’s own compliance efforts.
10. Term and Termination
10.1 This DPA commences on the effective date of the Service Agreement and continues for the duration of the Services.
10.2 The Controller may terminate this DPA and the Service Agreement where the Processor commits a material breach of its data protection obligations and fails to remedy that breach within thirty (30) days of written notice, or where the Processor fails to comply with a binding order of a supervisory authority.
10.3 On termination, the Processor shall cease processing Controller Personal Data other than as permitted by Section 8, shall delete or return the data in accordance with Section 8, and shall return the Controller’s confidential information. The provisions relating to confidentiality, audit, liability and data deletion survive termination.
11. General Provisions
11.1 Amendments. This DPA may be amended only in writing signed by both Parties, save that the Processor may update Annex II and Annex III in accordance with clauses 5.3 and 5.4.
11.2 Severability. If any provision is held invalid, the remainder continues in full force, and the invalid provision shall be replaced with a valid provision achieving a similar effect.
11.3 Governing law. This DPA is governed by the laws of England and Wales.
11.4 Dispute resolution. Disputes shall be resolved by good faith negotiation for thirty (30) days, then mediation, and failing resolution, by the courts of England and Wales.
11.5 Precedence. In the event of conflict, this DPA prevails over the Service Agreement in respect of data protection matters, save that the limitations and exclusions of liability set out in the Service Agreement, as applied and modified by Section 9, prevail over any conflicting provision of this DPA. The Data Protection Laws prevail over the contractual provisions of both documents.
Annexes
The following annexes form part of this DPA and are published in full.