Agreement DCDP

Print this Page	code of practice...	Data Controller : Data Processor Agreement	data protection...	Close this Page

Whereas the Data Controller wishes to to have their Bespoke Application Service provided and the Data Processor wishes to provide that Bespoke Application Service; this is a private statement of that Agreement in compliance with UK laws including GDPR Article 26. Both parties understand that this formal agreement document may be shared with the Information Commissioners Office.

2. Parties:

Data Controller means Owner.

Data Processor means Application Service Provider.

3. Glossary of Terms:

BAS means Bespoke Application Service as owned by the Data Controller and provided by the Data Processor.

Owner means Data Controller who own intellectual property as the Bespoke Application Service, its business data and its associated procedures.

ASP means Application Service Provider as the Data Processor who provides the Bespoke Application Service that is owned by the Data Controller.

GDPR means General Data Protection Regulation as a replacement of the Data Protection Act as UK law.

ICO means Information Commissioners Office as the UK data protection regulator.

DPO means Data Protection Officer as part of the service provided by the Data Processor.

DPIA means Data Protection Impact Assessment as managed as a strategic document by the Data Protection Officer provided by the Data Processor.

ITIL means Information Technology Infrastructure Library as the international standard ISO 20001 and the organisation structure used by the Data Processor.

HTML means Hypertext Markup Language as the programming method used to present the Bespoke Application Service to the Data Controller.

CSS means Cascade Style Sheet as the layout style method used to present the Bespoke Application Service.

4. This Agreement:

1. The Data Controller is of the opinion that the Data Processor has the necessary qualification, experience and abilities to operate the Bespoke Application Service for the Data Controller.

2. The Data Processor is agreeable to operate the Bespoke Application Service for the Data Controller on the terms and conditions set out in this Agreement.

5. Bespoke Application Service:

1. Both parties agree that the Bespoke Application Service as defined by its specification of business requirements is owned by the Data Controller.

2. Both parties agree that the scope of the Bespoke Application Service is limited by the specification of business requirements provided by the Data Controller to the Data Processor.

3. Both parties agree that the Bespoke Application Service shall include relentless evolutionary commercial improvements to the business requirements as specified by the Data Controller to the Data Processor.

4. Both parties agree that the Bespoke Application Service shall include the services of a Data Protection Officer provided by the Data Processor who is responsible to the ICO for the protection of business data processed by the Bespoke Application Service.

5. Both parties agree that the Bespoke Application Service shall support any number of approved people working from any number of approved locations in any number of approved countries as specified by the Data Controller.

6. Both parties agree that the Bespoke Application Service shall support any number of approved languages, any number of approved time zones and any number of approved currencies as specified by the Data Controller.

7. Both parties agree that the Bespoke Application Service shall be usable from any kind of Internet connected computer as a desktop, laptop, tablet or smart phone using any modern operating system and secure browser.

8. Both parties agree that the Bespoke Application Service shall be available as specified in attached schedule 811 as potentially 24 hours per day, 7 days per week, 52 weeks per year without downtime for modification or patching or upgrades.

9. Both parties agree that the Bespoke Application Service shall be fully compliant with the General Data Protection Regulations with respect to article 32 protection by design default using pseudonymised and replicated encrypted data to ensure that business data cannot be lost or stolen.

10. Both parties agree that the Bespoke Application Service shall not involve any software and shall not require any application program to be installed.

6. Improvements:

1. Both parties agree that ITIL Change Management process shall be deployed by the Data Processor for improvements specified by the Data Controller, to include:-

(a) Change Manager to prioritise and schedule.

(b) Project Manager to plan interactions and implications with regard scope and existing data values.

(d) Validation Manager to test effect of the improvement against a proven set of business procedures.

(e) Deployment Manager to deploy business rules and revise existing business data as planned.

(f) Audit Manager to review impact on the business procedures.

2. Both parties agree that the Data Processor shall apply technical improvements to protect against threats and attacks according to ITIL best practice.

3. Both parties agree that the majority of business improvements provided by the Data Controller shall be deployed within the duration specified in schedule 821 and any improvement that does not extend the scope of the Bespoke Application Service shall be deployed as specified in schedule 822.

4. Both parties agree that the commercially viable business improvements that extend the data stored by the Bespoke Application Service shall be deployed as specified in schedule 823.

5. Both parties agree that the Request Fulfilment Manager provided by the Data Processor shall manage the life cycle of every improvement request that is provided by the Data Controller.

6. Both parties agree that the Service Level Manager provided by the Data Processor shall manage the service level Agreement as attached as schedules 811, 821, 822 and 823.

7. Data Protection:

1. Both parties agree that the Data Protection Officer provided by the Data Processor for the benefit of the Data Controller shall review and revise the Data Protection Impact Assessment (DPIA) every 3 to 6 months.

2. Both parties agree that the Data Protection Officer responsibilities are limited to the business data processed by the Bespoke Application Service and excluding any business data processed by local computers and phones.

3. Both parties agree that the Data Protection Officer is the single point of contact for the ICO in the event of a data breach within the Bespoke Application Service and excluding any external business data.

4. Both parties agree that an adequate authentication service shall be used by all approved people and that no back-doors shall be provided.

5. Both parties agree that no "super user" or "system administrator" role shall exist with the right to access readable business data.

6. Both parties agree that the Data Processor shall undertake continual monitoring of all transactions and consolidation of behaviour to ensure that any criminal behaviour is stopped and blacklisted to prevent it happening again.

7. Both parties agree that the Information Security Manager provided by the Data Processor shall continually deploy adequate security measures to minimise the strategic risks identified by the Data Protection Impact Assessment (DPIA).

8. Both parties agree that all personally identifiable information and associated business data shall be encrypted using a large number of different methods to ensure that readable data cannot be stolen.

9. Both parties agree that encrypted data shall be replicated to a large number of different secure data centers to ensure that data cannot be lost.

8. Interface:

1. Both parties agree that the Bespoke Application Service involves safe and secure electronic communications that shall be used as the principal interface between the Data Controller and Data Processor.

2. Both parties agree that the Bespoke Application Service includes a secure shared business support facility that shall be used as the primary communications method.

3. Both parties agree that in the event that the business support facility cannot be used, then the secure "contact us" message facility shall be used.

4. Both parties agree that private, confidential or sensitive business information shall not be communicated and leaked by phone or email.

5. Both parties agree that phone messages and email messages containing business information shall be physically erased by the end of each day as if they did not exist.

6. Both parties agree that the Bespoke Application Service shall include a secure self-service support facility to reduce delays with a 24*7 service.

9. Education:

1. Both parties agree that the provision of the Bespoke Application Service includes guides to how facilities may be used, but specifically excludes education liabilities.

2. Both parties agree that each party shall manage their own business work instructions, staff training, policies and procedures.

3. Both parties agree to the provision of training for their own people that should not impact on the education of other people.

4. Both parties agree that the Knowledge Manager provided by the Data Processor shall consolidate business rules, policies and procedures as advice to approved people upon request. The Knowledge Manager is not liable for people who do not have the skills or experience to use facilities of the Bespoke Application Service.

5. Both parties agree that induction training of their own people is managed by and is the responsibility of each party.

10. Replicated Data:

1. Both parties agree that the Business Continuity Manager provided by the Data Processor shall replicate all encrypted business data to a number of secure data centers to ensure that business data cannot be lost or stolen.

2. Both parties agree that the Data Controller may take backups of their own business data from time to time, but such data could never be reused by the Bespoke Application Service.

3. Both parties agree that in the event of a failure of one data center, business shall continue to be provided by other secure data centers. When switching between data centers, those transactions that were active at the time of the hardware failure may need to be started again. Once data is marked as "saved" then it exists in at least two physically different data centers where it is unlikely to be lost.

4. Both parties agree that readable business data is not stored in any physical place and that only unintelligible encrypted data is hidden in many secure data centers.

11. Approved People:

1. Both parties agree that the Data Controller shall specify who and when approved people may access the Bespoke Application Service.

2. Both parties agree that the majority of Data Processor people shall never access the Bespoke Application Service or its business data.

3. Both parties agree that the Second Level Support people provided by the Data Processor shall have access to the Bespoke Application Service with the same rights as any approved person so support requests can be replicated and improvements verified. All business data is encrypted so no other Data Processor people can access any readable business data. All Second Level Support people are service contract bound to retain data privacy and confidentiality of business data.

4. Both parties agree that the Data Controller may assign different functional roles and different data access rights to different approved people. Not everybody will have identical skills and experience, so alternative ways of working may evolve to accommodate the needs of different approved people.

5. Both parties agree that the Second Level Support people provided by the Data Processor shall only process business data under the written direction of a shared support request provided by the Data Controller.

12. Problem Management:

1. Both parties agree that the Data Controller may request the Data Processor to carry out analysis and reporting of a historic incident.

2. Both parties agree that the Data Processor shall use ITIL problem management procedures to analyse an incident, to prevent an incident from happening again, to replace infrastructure where that is a cause and to configure the Bespoke Application Service to work as expected.

3. Both parties agree that the Incident Manager provided by the Data Processor shall carry out initial analysis of any reported incident.

4. Both parties agree that the Problem Manager provided by the Data Processor shall resolve any incident that cannot be resolved by the Incident Manager.

13. Term of Agreement:

1. Both parties agree that the term of this Agreement shall be one calendar month.

2. Both parties agree that the Agreement may be terminated at any time without any liabilities.

3. Both parties agree that this Agreement may continue without interruption to a subsequent month where the Bespoke Application Service provided by the Data Processor is adequate for the Data Controller to pay the amount due as acknowledgement. This means: that the service is provided for a month and that months service is paid so the service can continue to the next month.

4. Both parties agree that where the Data Controller chooses not to make a payment for a months service then the Data Processor shall have provided that months service free of charge to be paid for by adverts, marketing and associated third party means.

5. Both parties agree that the Bespoke Application Service only exists for the benefit of the Data Controller and when the Data Controller does not need the Bespoke Application Service then it must be terminated and destroyed.

14. Payment:

1. Both parties agree that the Data Controller shall pay the Data Processor the monthly subscription fee agreed in schedule 801 attached to this Agreement.

2. Both parties agree that the currency of this Agreement shall be UK sterling as GBP.

3. Both parties agree that the monthly subscription fee stated in schedule 801 is net of any taxes that may be imposed by UK Government. This means: that Value Added Tax will be charged in addition to the agreed monthly amount in schedule 801.

4. Both parties agree that the Data Processor shall invoice the Data Controller on the first day of the calendar month for payment by the Data Controller within that calendar month for the previous calendar months service.

5. Both parties agree that where payment is not made within the calendar month then this Agreement has been terminated without any liability.

6. Both parties agree that the monthly amount agreed and specified in schedule 801 shall be reviewed each year based on actual capacity used and revised to match the capacity to be provided for the next year.

7. The Data Processor is responsible for all taxes relating to the monthly payment made by the Data Controller and shall indemnify the Data Controller in respect of any such payments made by the Data Controller.

8. Both parties agree that no expenses, training, maintenance, new release, termination or other charges will be made with respect to this Agreement.

9. Both parties agree that no late payment charges will be made with respect to this Agreement because the term of the agreement is one calendar month.

10. Both parties agree to monitor commercially viable charges for such Bespoke Application Services with the expectation that the Data Controller will switch when the price is too high and the Data Processor will not not match service levels when the price is too low.

11. The financial stability of the Data Processor is maintained by the Data Controller paying the monthly fee in arrears for as long as the Data Controller wishes. The Data Processor maintains financial stability by ensuring that no Data Controller ever exceeds two percent of the total infrastructure capacity.

12. The financial liability to the Data Controller shall never exceed one months subscription fee.

15. Secrecy:

1. Both parties agree to keep secret this Agreement and all benefits and obligations reflected by this Agreement, except as required by UK laws.

2. Both parties agree to conform with each and every aspect of the General Data Protection Regulation to keep business information secret so it can never be lost or stolen by a third party.

3. Both parties agree that they will not disclose, divulge, reveal, report or use for any purpose, any business information which the other party has obtained, except as authorized by the other party or as required by law. This means that business data owned by the Data Controller shall not be accessed or changed by the Data Processor without the prior written consent of the Data Controller.

4. Both parties agree to conform with GDPR provisions to keep secret any Personally Identifiable Information (PII) such as the names of people. Both parties agree that people shall be identified by role and job title, rather than by name to prevent the leaking of PII.

5. Both parties agree that Data Processor people are service contract bound not to be involved in any survey, marketing, conference or publicity regarding the Bespoke Application Service.

16. Intellectual Property:

1. Both parties agree that the Data Controller owns the copyright and intellectual property rights to all business data, the Bespoke Application Service and all policies and procedures.

2. Both parties agree that the Data Processor shall use its best endeavours to defend the Data Controllers intellectual property rights and ensure access to all business data at all times.

3. Both parties agree that the Data Processor shall not access and not process any business data without prior written consent.

4. Both parties agree that the Data Controller has the right to download their own business data at any time and that the Data Processor shall provide every assistance in this endeavour.

5. Both parties agree that the Bespoke Application Service includes forms, pages, lists and reports presented using HTML, CSS and JavaScript source code that are owned and may be saved by the Data Controller.

6. Both parties understand that Personally Identifiable Information is owned by the Data Subject and not by the Data Controller. The data subject has the right to access, rectify, object and erase their Personally Identifiable Information at any time.

17. Relationship:

1. Both parties agree that this Agreement does not create a partnership or joint venture.

2. Both parties agree that the Data Processor is acting as an Application Service Provider (ASP) for the Data Controller and not as an employee.

3. Both parties agree that a large number of people are used by the Data Processor to provide the Bespoke Application Service on behalf of the Data Controller and the Data Processor shall use alternative people from time to time.

4. Both parties agree that the Data Processor uses its own infrastructure to provide the Bespoke Application Service from many secure and secret data centers.

5. Both parties agree that there is no representation, warranty, collateral Agreement or condition affecting this Agreement except as expressly provided in this Agreement.

6. Both parties agree that this Agreement shall be governed by the laws of England.

18. Indemnification:

1. Except to the extent paid in settlement from any applicable insurance policies and to the extent permitted by UK laws, both parties agree to indemnify and hold harmless the other party and its respective affiliates, officers, agents, employees and permitted successors and assigns against any and all claims, losses, damages, liabilities, penalties, punitive damages, expenses, reasonable legal fees and costs of any kind or amount whatsoever which result from or arise out of any act or omission of the indemnifying party,, it respective affiliates, officers, agents, employees and permitted successors and assigns that occurs in connection with this Agreement.

2. Both parties agree that this indemnification shall survive the termination of this Agreement.

19. Warranty:

1. The processor represents and warrants that it will perform the Bespoke Application Services with reasonable care and skill.

2. The Bespoke Application Service provided by the Data Processor to the Data Controller under this Agreement will not infringe or violate any intellectual property rights or other right of any third party.

3. Subject to the Data Controllers obligation to pay the monthly subscription fee to the Data Processor, either parties liability in contract, tort or otherwise (including negligence) arising directly out of or in connection with this Agreement or the performance or observance of its obligations under this Agreement and every applicable part of it shall be limited in aggregate to the monthly subscription fee.

4. To the extent it is lawful to exclude the following heads of loss and subject to the Data Controllers obligation to pay the monthly subscription fee, in no event shall either party be liable for any loss of profits, goodwill, loss of business, loss of data or any other indirect or consequential loss or damage whatsoever.

5. Nothing in this clause will serve to limit or exclude either parties liability for death or personal injury arising from its own negligence.

20. Provisions:

1. Both parties agree that in the event that any of the provisions of this Agreement are held to be invalid or unenforceable in whole or in part, all other provisions will nevertheless continue to be valid and enforceable with the invalid or unenforceable parts severed from the remainder of this Agreement.

2. The waiver by either party of a breach, default, delay or omission of any of the provisions of this Agreement by the other party shall not be construed as a waiver of any subsequent breach of the same or other provisions.

3. Both parties agree that headings are inserted for the convenience of both parties only and are not to be considered with interpreting this Agreement.

4. Both parties agree that this Agreement shall not be changed in any way, except that its attached schedule shall be reviewed and revised from time to time.

21. Dated and Confirmed:

1. Date: 2018

2. Data Controller:

3. Data Processor:

4. This agreement is verified and confirmed by both parties each month when the Data Processor issues an invoice on the first day of the month and the Data Controller pays that invoice during that calendar month to acknowledge the provision of the Bespoke Application Service and to confirm that this agreement is to be continued for the following calendar month.

22. Addendum (not part of agreement)

23. Schedule:

801 Payment: monthly subscription net amount as one twelfth of the agreed annual cost of service with an annual review based on actual capacity used.

811 Availability: 24 by 7 without any downtime for maintenance.

821 Improvement Day: majority of business improvement requests are resolved within one day.

822 Improvement Week: all business improvements requests that do not expand the scope of the data are resolved within one week.

823 Improvement Month: business improvement requests that expand the scope of business data are resolved within one month.