Data processing agreement

This data processing agreement ("DPA") forms part of the contract between you, the customer and controller, and Jamie Castle trading as Clarwyn IT, a sole trader based in the UK, of 20 Sidbury Hill Avenue, Tidworth, Wiltshire SP9 7JN (the "Processor"). It meets the requirements of Article 28 of the UK GDPR.

1. Subject matter and duration

The Processor processes personal data only to provide the services in your quote and any Clarwyn Care plan, for as long as the contract lasts, plus the return or deletion period in clause 9.

2. Nature and purpose

Setting up, configuring, securing, migrating, monitoring and supporting your Microsoft 365 environment and devices, which involves accessing, copying, moving and administering data held in them.

3. Types of personal data and data subjects

Names, work contact details, account and sign-in information, device information, and the content of mailboxes and files where needed for the work (for example, during a mailbox move). Data subjects are your staff, contractors, and the customers and contacts whose data appears in your systems. The Processor will not deliberately access special category data. Where it is unavoidable incidental to a task, such as a migration, it's handled under the same protections.

4. Processor obligations

The Processor will:

1. process personal data only on your documented instructions, including those in the quote and in written requests, unless the law requires otherwise. The Processor will tell you if an instruction appears to break data protection law.
2. keep the data confidential. The Processor works alone. If anyone else is ever authorised, they will be bound by confidentiality.
3. take appropriate technical and organisational security measures, including: multi-factor authentication on all admin accounts; separate least-privilege admin accounts; encrypted, up-to-date devices used only for business; no storage of your data outside your tenant except where a task requires it, and then encrypted and deleted afterwards; and a written log of changes.
4. not use a sub-processor without your general written authorisation. You authorise the sub-processors listed in clause 5. The Processor will give 30 days' notice of changes, and you may object.
5. help you respond to data subject requests and meet your security, breach notification and impact assessment obligations, taking into account the nature of the processing.
6. notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data.
7. make available the information needed to show compliance with this DPA, and allow reasonable audits with reasonable notice, usually by written questionnaire.

5. Authorised sub-processors

Microsoft (your own Microsoft 365 tenant, which you contract for directly) and Microsoft (the Processor's own Microsoft 365, used for email). Payment and accounting providers process only the Processor's own billing data, not your customer data.

6. International transfers

The Processor will not transfer your personal data outside the UK except to sub-processors covered by UK adequacy regulations or appropriate safeguards.

7. Your obligations

You confirm that you have a lawful basis for the processing and have given any necessary notices to data subjects.

8. Liability

The liability terms in the terms of service apply to this DPA.

9. End of processing

When the services end, the Processor will remove its access to your systems, and within 30 days delete any copies of your personal data it holds, unless you ask in writing for it to be returned first or the law requires it to be kept. The Processor will confirm deletion in writing.

10. Law

This DPA is governed by the law of England and Wales.