Data Processing Agreement

Roles of the parties

2.1 The Customer is the controller of Customer Personal Data and Propr is the processor.

2.2 The Customer is responsible for establishing a lawful basis for the processing, for the accuracy of the personal data it provides, and for giving data subjects the information required by Data Protection Legislation. This includes drivers and other individuals whose location or activity the Customer monitors through the Service.

2.3 Propr acts as a controller in relation to Aggregated Data as defined in the Master Services Terms, and in relation to the contact and account data it uses to administer the relationship, invoice the Customer and provide support. Propr's privacy notice governs that processing.

2.4 Neither party acts as a joint controller with the other.

Processing instructions

3.1 Propr will process Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by law, in which case Propr will inform the Customer before processing unless the law prohibits it.

3.2 The Master Services Terms, the Order Form, this DPA and the Customer's use of the features of the Service are the Customer's documented instructions.

3.3 Propr will inform the Customer if, in its opinion, an instruction infringes Data Protection Legislation.

3.4 Propr will process Customer Personal Data for the purposes set out in Annex 1 and for no other purpose.

3.5 Instructions outside the scope of the Service may be given in writing. Propr may charge for implementing them on a time and materials basis, and may decline any instruction that is technically impracticable.

Confidentiality of personnel

4.1 Propr will ensure that personnel authorised to process Customer Personal Data are bound by a duty of confidentiality, are trained appropriately, and have access only where needed to perform their role.

Security

5.1 Propr will implement and maintain the technical and organisational measures set out in Annex 2, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.

5.2 Propr may update those measures, provided the level of protection is not materially reduced.

Sub-processors

6.1 The Customer gives Propr general authorisation to engage sub-processors. The sub-processors engaged at the date of this DPA are listed in Annex 3.

6.2 Propr will impose on each sub-processor data protection obligations equivalent to those in this DPA, and remains liable to the Customer for a sub-processor's performance.

6.3 Propr will give the Customer at least 30 days' written notice before adding or replacing a sub-processor. Notice may be given by email to the Customer's nominated contact or through the Service.

6.4 The Customer may object to a change on reasonable data protection grounds within 30 days of notice. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected Order Form on 30 days' written notice, and Propr will refund Charges paid for the unused period.

6.5 Propr may engage a replacement sub-processor without prior notice where necessary to maintain the security or continuity of the Service, and will notify the Customer as soon as practicable afterwards.

Assistance to the Customer

7.1 Taking into account the nature of the processing, Propr will assist the Customer by appropriate technical and organisational measures, so far as is reasonably possible, in responding to requests from data subjects exercising their rights.

7.2 Where Propr receives a request directly from a data subject in relation to Customer Personal Data, it will not respond substantively, and will forward the request to the Customer without undue delay.

7.3 Propr will provide reasonable assistance with data protection impact assessments and prior consultations with the Information Commissioner, so far as they relate to the Service and taking into account the information available to Propr.

7.4 Propr may charge on a time and materials basis for assistance under clauses 7.1 and 7.3 that goes beyond the self-service functionality of the Service.

Personal data breach

8.1 Propr will notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notification will describe, so far as the information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

8.3 Where the information is not all available at the time of notification, Propr will provide it in phases as it becomes available.

8.4 Propr will take reasonable steps to contain and remediate the breach, and will not make any public statement identifying the Customer in connection with it without the Customer's consent, unless required by law.

8.5 Notification of a breach is not an admission of fault or liability.

International transfers

9.1 Propr hosts Customer Personal Data in the United Kingdom or the European Economic Area.

9.2 Propr will not transfer Customer Personal Data outside the United Kingdom or the European Economic Area unless an appropriate safeguard under Data Protection Legislation is in place, including the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations.

9.3 Where a transfer is made on the basis of such a safeguard, the relevant terms are incorporated into this DPA, with Propr as data exporter or importer as applicable.

Audit

10.1 Propr will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR. Propr will satisfy this obligation in the first instance by providing its security documentation, its most recent penetration test summary, and responses to a reasonable security questionnaire.

10.2 Where that information is not sufficient, the Customer may audit Propr's processing, on the following basis: no more than once in any 12-month period, except following a personal data breach or where required by a regulator; on at least 30 days' written notice; during business hours; without unreasonably disrupting Propr's business; and subject to confidentiality obligations.

10.3 An auditor must not be a competitor of Propr. The Customer bears the cost of the audit, including Propr's reasonable costs of assisting.

10.4 An audit does not extend to Propr's other customers' data, its commercial information, or the premises or systems of its sub-processors.

Deletion and return

11.1 On termination or expiry, Propr will make Customer Personal Data available for export for the period set out in clause 20.2 of the Master Services Terms.

11.2 After that period, Propr will delete Customer Personal Data within 90 days, except to the extent it is required by law to retain it, or to the extent it forms part of Aggregated Data.

11.3 Backups are deleted on their ordinary retention cycle. Personal data held in backups remains subject to this DPA until deleted.

11.4 Propr will certify deletion in writing on request.

General

12.1 If there is a conflict between this DPA and the Master Services Terms in relation to the processing of personal data, this DPA prevails.

12.2 Each party's liability under this DPA is subject to the limitations and exclusions in clause 17 of the Master Services Terms.

12.3 Propr may update this DPA on 60 days' written notice where required by a change in Data Protection Legislation or in its processing arrangements, provided the update does not materially reduce the protection given to Customer Personal Data.

12.4 This DPA is governed by the law of England and Wales.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

Annex 3 — Sub-processors

The sub-processors engaged at the date of this DPA are listed below. Propr will notify the Customer of changes in accordance with clause 6.3.