Data processing addendum

This data processing addendum (the “Addendum”) forms part of our terms of service (the “Terms”). It applies whenever Headwater processes personal data in Customer Data (“Customer Personal Data”) for the Customer. It is written to meet Article 28 of the UK General Data Protection Regulation and of the EU General Data Protection Regulation.

The Customer is the controller of Customer Personal Data, and Headwater is its processor. Where the Customer is itself a processor for another controller, such as a company in its group, Headwater is its subprocessor, and the Customer confirms that its instructions are authorised by that controller.

Words defined in the Terms have the same meanings here. “Controller”, “processor”, “data subject”, “personal data”, “personal data breach”, and “processing” have the meanings given in Data Protection Law.

The details of the processing are in Annex 1.

We process Customer Personal Data only on the Customer’s documented instructions. The Terms, this Addendum, what Admins set and do in Headwater, and anything else the parties agree in writing are the Customer’s instructions.

If the law requires us to process Customer Personal Data in another way, we will tell the Customer before we do, unless the law forbids it.

We will tell the Customer straight away if we think an instruction breaks Data Protection Law.

We will not sell or share Customer Personal Data, or use it for advertising. We will not keep, use, or disclose it for any purpose other than providing the Service to the Customer, or outside our direct business relationship with the Customer, and we will not combine it with personal data from any other source except as the Service needs. Where US state privacy laws apply, we act as the Customer’s service provider or processor under them.

We will not use Customer Personal Data, or allow anyone else to use it, to train, fine-tune, test, or improve any artificial intelligence or machine learning model.

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality, is trained in data protection, and has only the access their job needs.

Our people open Customer Personal Data only in the cases set out in clause 6.4 of the Terms: with an Admin’s permission, which is logged where Admins can see it; to keep the Service secure; or when the law requires it.

We protect Customer Personal Data with the technical and organisational measures in Annex 2, which are appropriate to the risks of the processing. We review them at least once a year.

We may improve the measures over time, but we will not reduce the overall protection they give during the Terms.

The Customer authorises us to use the subprocessors listed in Annex 3 and in our privacy policy.

Each subprocessor is bound by a written contract that protects Customer Personal Data at least as well as this Addendum, including a ban on using it to train AI models, a limit on how long it is kept, and a duty to delete it.

We will email the Customer’s Admins at least 30 days before we add or replace a subprocessor, and update the list. The new subprocessor will not process Customer Personal Data until the 30 days have passed. If we must replace a subprocessor urgently to keep the Service running, we will tell the Customer as soon as we can, and the Customer’s rights in clause 5.4 still apply.

The Customer may object to a new subprocessor on reasonable data protection grounds within 30 days of our notice. We will then work with the Customer in good faith to resolve it. If we can’t, the Customer may end the Terms and we will refund the Fees paid for any time after they end.

We remain fully responsible to the Customer for everything our subprocessors do.

We store Customer Personal Data in the European Economic Area, in Ireland.

We transfer Customer Personal Data outside the UK and the European Economic Area only to subprocessors listed in Annex 3, and only with a transfer mechanism that Data Protection Law recognises. These are adequacy regulations or decisions, including the UK Extension to the EU-US Data Privacy Framework and the EU-US Data Privacy Framework for providers certified under them, or the EU Standard Contractual Clauses (module three, processor to processor) with the UK International Data Transfer Addendum for data from the UK. We assess each transfer, and add protections such as encryption where the assessment shows they are needed.

Where the law requires a transfer mechanism for Customer Personal Data that the Customer sends to us, the EU Standard Contractual Clauses (module two or three, as fits) are incorporated into this Addendum, with the UK International Data Transfer Addendum where it applies, unless an adequacy decision or regulation covers the transfer. The optional docking clause applies, the supervisory authority is the one that has jurisdiction over the Customer, and the clauses are governed by the law of Ireland for EU transfers.

If a data subject asks us to act on their rights about Customer Personal Data, we will pass the request to the Customer within five Working Days, and not answer it ourselves except to tell them we have done so. Headwater gives Admins tools to find, correct, export, and delete data, and we will give the Customer any other reasonable help it needs to answer.

We will give the Customer reasonable help with its duties under Data Protection Law, including security, breach notifications, data protection impact assessments, and consultations with a regulator, taking into account what we know about the processing. This help is free unless it is excessive.

We will tell the Customer without undue delay, and within 48 hours of becoming aware, of any personal data breach that affects Customer Personal Data.

We will tell the Customer what happened, what kinds of data and roughly how many people and records are affected, the likely consequences, what we have done and will do about it, and who to contact. If we don’t know all of this at first, we will tell the Customer what we know and add to it as we find out more.

We will take reasonable steps straight away to contain the breach, investigate it, and reduce its effects, and keep the Customer told throughout.

We will not tell data subjects or regulators about a breach of Customer Personal Data without the Customer’s agreement, unless the law requires us to.

Telling the Customer about a breach is not an admission of fault by us.

We will give the Customer the information it reasonably needs to show that we meet this Addendum, including our security documentation, summaries of any independent audits, and answers to one security questionnaire a year.

If that information isn’t enough, the Customer, or an independent auditor bound by confidentiality, may audit our compliance once a year, or more often after a breach or where a regulator requires it. The Customer must give us 30 days’ notice, keep to Working Days, and avoid disrupting the Service or seeing other customers’ data. Each party pays its own costs.

Admins can export Customer Personal Data at any time during the Terms, and for 30 days after they end, in common formats that other software can read.

After that, we delete all Customer Personal Data from our live systems within 30 days, and from our backups within a further 90 days, and confirm it in writing if the Customer asks. We keep it longer only where the law requires us to, and then we protect it and use it for nothing else.

If a public authority asks us for Customer Personal Data, we will follow clause 6.6 of the Terms. We will ask the authority to go to the Customer where we can, challenge any request we reasonably believe is unlawful or too broad, disclose only the least the law requires, and tell the Customer before we disclose anything, unless the law forbids it.

We will never build a way into the Service for anyone to get around this clause.

Liability under this Addendum is subject to clause 16 of the Terms, including the higher limit in clause 16.5.

If this Addendum conflicts with the Terms about personal data, this Addendum applies. If it conflicts with the Standard Contractual Clauses, they apply.

This Addendum lasts for as long as we process any Customer Personal Data.

Questions about this Addendum go to [email protected].