Terms and Conditions & Data Processing Agreement

1.1 In this Agreement the following terms have the meanings given below. Terms not defined here have the meaning given in the Data Protection Laws or the Principal Agreement.

1.2 The terms Controller, Processor, Data Subject, Personal Data, Processing and Supervisory Authority have the meanings given in the UK GDPR.

1.3 If there is a conflict, this Agreement takes precedence over the Principal Agreement in relation to the processing of Customer Personal Data.

2.1 The Customer is the Controller and Site-Mate is the Processor in respect of Customer Personal Data. Each party complies with its own obligations under the Data Protection Laws.

2.2 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Schedule 1.

2.3 The Customer warrants that it has a lawful basis for the processing it instructs, that it has provided the necessary privacy information to data subjects, and that it will not upload special category data or criminal offence data except where Schedule 1 provides for it.

2.4 Site-Mate acts as a Controller only in respect of its own account administration, billing, security logging and service-improvement analytics carried out on aggregated or anonymised data. That processing is governed by the Site-Mate privacy notice, not by this Agreement.

3.1 Site-Mate processes Customer Personal Data only on the Customer's documented instructions, which comprise this Agreement, the Principal Agreement, the configuration choices made by the Customer's administrators in the Platform, and any further written instruction agreed by the Parties.

3.2 Site-Mate may process Customer Personal Data where required by law. Where it does so it will inform the Customer beforehand unless the law prohibits it.

3.3 Site-Mate will tell the Customer without delay if, in its opinion, an instruction infringes the Data Protection Laws. Site-Mate may suspend that instruction until it is withdrawn or amended.

4.1 Site-Mate limits access to Customer Personal Data to those personnel who need it to deliver the Platform or to meet Site-Mate's obligations under this Agreement.

4.2 All such personnel are bound by written confidentiality obligations that survive the end of their engagement, receive data protection and information security training at least annually, and are subject to pre-engagement screening proportionate to their access.

5.1 Taking account of the state of the art, cost of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects, Site-Mate implements the technical and organisational measures set out in Schedule 2 to ensure a level of security appropriate to that risk, in line with Article 32 of the UK GDPR.

5.2 Site-Mate may update the measures in Schedule 2 provided the change does not materially reduce the overall level of security.

5.3 The Customer is responsible for the security decisions within its control, including managing user accounts and permissions, and controlling what personal data its users choose to enter into records and evidence uploads.

6.1 The Customer gives general authorisation for Site-Mate to appoint the Sub-processors listed in Schedule 3.

6.2 Site-Mate will give the Customer at least 30 days' notice, by email to the account's nominated data protection contact and by notice in the Platform, before adding or replacing a Sub-processor.

6.3 The Customer may object on reasonable data protection grounds within that notice period. If the Parties cannot agree a resolution, the Customer may terminate the affected part of the Principal Agreement without penalty, with a pro-rata refund of prepaid fees.

6.4 Site-Mate imposes on each Sub-processor data protection obligations no less protective than those in this Agreement, and remains fully liable to the Customer for each Sub-processor's performance.

7.1 The Platform provides self-service tools that allow the Customer's administrators to search, export, correct and delete records, so that the Customer can respond to data subject requests itself.

7.2 Where those tools are not sufficient, Site-Mate provides reasonable assistance to the Customer, taking account of the nature of the processing.

7.3 If Site-Mate receives a request directly from a data subject relating to Customer Personal Data, it will not respond to the substance of the request. It will acknowledge receipt, direct the individual to the Customer, and notify the Customer within 3 business days.

8.1 Site-Mate notifies the Customer without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2 The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not yet available, Site-Mate provides information in phases without further undue delay.

8.3 Site-Mate cooperates with the Customer and takes the reasonable steps directed by the Customer to investigate, contain, mitigate and remediate the breach.

8.4 Site-Mate does not notify a Supervisory Authority or any data subject about a breach on the Customer's behalf unless the Customer instructs it in writing or the law requires it.

9.1 Site-Mate provides reasonable assistance to the Customer with data protection impact assessments and any prior consultation with a Supervisory Authority under Articles 35 and 36 of the UK GDPR, so far as this relates to processing by Site-Mate and taking account of the information available to it.

9.2 Site-Mate maintains a standard information pack covering the Platform's data flows, hosting locations, retention behaviour and AI features, and makes it available to support the Customer's assessment.

10.1 For 30 days after the date the Principal Agreement ends or the relevant services cease (the Cessation Date), the Customer may export Customer Personal Data using the Platform's export tools. Site-Mate will assist with a full export on request during that period.

10.2 Site-Mate deletes Customer Personal Data from live systems within 30 days of the Cessation Date, and from encrypted backups within a further 90 days as those backups expire on their normal cycle.

10.3 Site-Mate may retain Customer Personal Data where the law requires it, in which case it continues to protect that data under this Agreement and processes it only for the purpose that requires retention.

10.4 Site-Mate provides written confirmation of deletion within 10 business days of the Customer's request.

11.1 Site-Mate makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, including its current certifications, penetration test summary and completed security questionnaire.

11.2 Where that information is not sufficient, the Customer, or an independent auditor it appoints who is not a competitor of Site-Mate, may audit Site-Mate's processing once in any 12-month period on 30 days' written notice, during business hours, and without unreasonable disruption to Site-Mate's operations.

11.3 Additional audits may be carried out following a Personal Data Breach affecting the Customer, or where a Supervisory Authority requires one.

11.4 Each party bears its own costs, except that the Customer meets Site-Mate's reasonable costs for audits beyond the first in any 12-month period unless the audit identifies a material breach of this Agreement.

12.1 Customer Personal Data is hosted in the United Kingdom or the European Economic Area, as selected for the Customer's account and recorded in Schedule 1.

12.2 Site-Mate will not make a Restricted Transfer unless it has put in place an approved safeguard, being adequacy regulations, the Standard Contractual Clauses with the UK Addendum or the ICO International Data Transfer Agreement, together with a transfer risk assessment and any supplementary measures the assessment identifies.

12.3 Schedule 3 records, for each Sub-processor, the processing location and the transfer mechanism relied on.

12.4 If a safeguard relied on is invalidated or withdrawn, Site-Mate will without undue delay implement an alternative safeguard or, if none is available, suspend the affected transfer.

13.1 Confidentiality. Each party keeps confidential the information it receives about the other under this Agreement, except where disclosure is required by law or the information is already public.

13.2 Liability. The liability of each party under this Agreement is subject to the limitations and exclusions in the Principal Agreement, except that nothing limits liability that cannot be limited by law.

13.3 Notices. Notices under this Agreement are given in writing, by email to the data protection contact recorded in each party's account details, or in the Platform for notices to the Customer's administrators.

13.4 Changes. Site-Mate may update this Agreement to reflect changes in law, guidance or the Platform. Material changes are notified at least 30 days before they take effect, and continued use of the Platform after that date constitutes acceptance. The Customer may terminate the Principal Agreement without penalty if it does not accept a material change.

13.5 Term. This Agreement takes effect on acceptance and continues for as long as Site-Mate processes Customer Personal Data. Clauses 10, 11 and 13.1 survive its end.

13.6 Severance. If any provision is held invalid, the rest of the Agreement continues in force.

14.1 This Agreement is governed by the laws of England and Wales.

14.2 The courts of England and Wales have exclusive jurisdiction over any dispute arising in connection with this Agreement, subject to any right of appeal.

14.3 Where the Customer is established in the EEA, nothing in this clause deprives a data subject of the protections of the EU GDPR or of the jurisdiction provided for in the Standard Contractual Clauses.