Data Processing Agreement

5. Security. The Processor implements appropriate technical and organisational measures under Article 32, as set out in Annex 3.

6. Sub-processors. You give general authorisation for the Processor to engage the sub-processors listed in Annex 2. The Processor imposes data-protection terms on each sub-processor no less protective than this DPA and remains liable for their performance. The Processor will give you at least 30 days' notice of any intended addition or replacement of a sub-processor and an opportunity to object. If you reasonably object on data-protection grounds and the parties cannot resolve the objection, you may suspend or terminate the affected part of the Service.

7. International transfers. Personal data submitted through the Service (documents and the details collected via secure links) is stored in the United Kingdom. Certain sub-processors (see Annex 2) operate in the EEA (UK-adequate) or are US-incorporated entities; for any transfer outside the UK the Processor relies on an adequacy decision or appropriate safeguards (e.g. the UK International Data Transfer Agreement / Addendum to the EU SCCs).

8. Data subject rights. Taking into account the nature of the processing, the Processor assists you by appropriate technical and organisational measures, insofar as possible, to respond to data subject requests.

9. Assistance. The Processor assists you in ensuring compliance with Articles 32–36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of processing and information available to the Processor.

10. Personal data breach. The Processor notifies you without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting your personal data. The notification describes, to the extent available, the nature of the breach (including, where possible, the categories and approximate number of data subjects and records concerned), its likely consequences, and the measures taken or proposed to address it.

11. Deletion and return. The Service is designed so that personal data submitted by data subjects is deleted automatically after collection or expiry. On termination, or on your request, the Processor, at your choice, deletes or returns all remaining personal data and deletes existing copies unless required by law to retain it.

12. Audits. The Processor makes available information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate. The Processor may satisfy this obligation by providing relevant certifications or summary audit reports (for example Cyber Essentials); on-site inspection applies only where those are insufficient to address a specific, reasonable concern, on reasonable notice (no more than once in any 12-month period except following a personal data breach) and subject to confidentiality.

13. Liability. Each party is liable to the other for loss it causes by breaching this DPA or applicable data protection law. Notwithstanding any limitation of liability in the main agreement, and except for the liabilities in the next sentence, each party's total aggregate liability arising out of or in connection with this DPA shall not exceed £1,000,000. Nothing in this DPA or the main agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited or excluded by law. Neither party is liable to the other for administrative fines or penalties imposed on that other party by a supervisory authority. This clause governs liability for data-protection matters in place of any conflicting cap in the main agreement, and nothing in it limits a data subject's rights under Article 82 of the UK GDPR.

14. General. This DPA is governed by the laws of England and Wales. In the event of conflict between this DPA and the main agreement on data-protection matters, this DPA prevails.

15. Notices and survival. Data-protection notices to the Processor — including a personal data breach, a sub-processor objection, or a request for assistance with data subject rights — may be sent to legal@fileseal.uk. Clauses 4 (confidentiality), 11 (deletion and return) and 12 (audits) survive termination of this DPA.