1. Roles

‘controller’ means the natural or legal person, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. This is the client (you). ‘processor’ means a natural or legal person, agency or other body which processes personal data on behalf of the controller. This is Despatch Cloud (Us)

2. GDPR Controller/Processor Agreement Policy

2.1  Information to be processed. The Data controller will pass on data including Personal Data to the data processor. In this case who will subcontract part of this processing (outlined below) to Despatch Cloud. This is limited to the information required by a courier to deliver an order. This will include Name, Address Line 1, Email Address, Telephone Number, and may include the individual Tax number for export orders to certain countries.

2.1.1 Subject matter and duration of the processing. The data is required for the processing of orders normally this would mean the transfer of a physical good to a named individual by means of a courier. 

The provider is therefore not permitted to use the data for any other purpose and cannot retain the data for longer than is contractually agreed.

2.1.2 Nature and purpose of the processing. The processing of orders for physical items which require delivery through a post or courier network.

2.1.3 Type of personal data and categories of data subjects. Name, contact details & address of individuals who have placed orders for physical products for delivery.

3.  Obligations and rights of the controller.

3.1 The controller of the personal data must comply with all obligations under the applicable Data Protection Laws and must therefore require the Customer to recognise and agree to specific terms that set out how they will assist the controller in remaining within the law. These terms are described in the following section.

4. Obligations of the Processor. 

4.1 Comply with all applicable Data Protection laws, which apply to the Data Controllers whose data we process.

4.2 Processes the personal data only on documented instructions from the controller (or the data processor as an agent of the data controller).

4.3 Ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality

4.4 Take all measures required pursuant to Article 32 of the GDPR (see Note 1)

4.5 Respect the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor (see Note 2)
A list of Sub-Processors will be provided to you in your statement of Work or updated in writing should a change be made. 

4.6 Assists the controller and/or the data processor by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR (see Note 3)

4.7 Assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (see Note 4) at the choice of the controller, or the data processor acting as an agent of the data controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless the law which applies to the controller requires storage of the personal data;

4.8 Makes available to the controller or data processor all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR (see Note 5) and allows for and contributes to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

4.9 Ensure that no personal data we are responsible for, is transferred outside of the United Kingdom and the European Economic Area (EEA) in a manner engaging Chapter V of the GDPR, unless first obtaining written consent from each Data Controller (understanding that such consent may be reasonably withheld) and, the implementation appropriate safeguards contemplated by Chapter V of the GDPR to protect the rights and freedoms of the affected data subjects. 
4.10 Keep an up-to-date Security Incident Response plan, which details how any security incident should be handled, including such matters as data preservation and communication with stakeholders. For the avoidance of doubt, this includes a requirement to alert all Data Controllers as soon as possible and certainly within 24 hours of a breach or suspected breach, of personal data.

4.11 At the election of the data controller delete or make available for the return of, all the personal data to the controller after the end of the provision of services relating to the processing, and delete existing copies unless the relevant laws require it continued storage, in each case in accordance with the time frames specified in clause 6.2 of the Extended Terms and Conditions.