Data processing agreement
This agreement forms part of our Terms of service and applies when you use Handover Works. You do not need to sign it.
1. Parties and scope
1.1 This agreement is between the customer named on the workspace ("you") and P&B Perspective Ltd, trading as Handover Works, company number 11340172 ("we").
1.2 It covers personal data we process for you in providing Handover Works ("customer personal data"), described in the Annex. It does not cover personal data we use for our own purposes, which our Privacy policy covers.
1.3 "Data protection law" means the UK GDPR and the Data Protection Act 2018 and, where it applies, the EU GDPR. Terms such as "controller", "processor", "personal data breach" and "data subject" have the meanings given in that law.
2. Roles and instructions
2.1 You are the controller of customer personal data and we are your processor.
2.2 We process customer personal data only on your documented instructions, including as to transfers outside the UK, unless the law requires otherwise; in that case we tell you first unless the law forbids it. Your instructions are these terms and your use of Handover Works.
2.3 You instruct us to de-identify or aggregate customer personal data so that we can use the result to develop and improve Handover Works, as the Terms allow.
2.4 We tell you at once if we think an instruction breaks data protection law.
2.5 You are responsible for having a lawful basis for the customer personal data you put into Handover Works and for giving any notices the law requires.
3. Confidentiality and security
3.1 We make sure that people we authorise to process customer personal data are bound to keep it confidential.
3.2 We take the technical and organisational measures that Article 32 of the UK GDPR requires, appropriate to the risk. We may change them, provided they remain appropriate.
4. Sub-processors
4.1 You give us general authorisation to use sub-processors, including providers of hosting, storage, email, error monitoring and AI models. We give you our current list on request.
4.2 We impose on each sub-processor, by contract, data protection obligations that give at least the same protection as this agreement. We remain responsible to you for their performance.
4.3 We inform you of any intended addition or replacement of a sub-processor, by email. You may object on reasonable data protection grounds before the change takes effect. If we do not resolve the objection, your only remedy is to cancel your plan under the Terms.
5. Transfers
5.1 Where customer personal data is transferred outside the UK, or outside the EU where the EU GDPR applies, we make sure the transfer meets data protection law.
6. Assistance
6.1 Taking into account the nature of the processing and the information available to us, we help you, by appropriate measures and as far as possible, to respond to requests from data subjects, and to meet your obligations under Articles 32 to 36 of the UK GDPR. We may charge for help beyond what Handover Works already provides.
6.2 If we receive a request from a data subject about customer personal data, we pass it to you.
7. Personal data breaches
7.1 We notify you without undue delay after becoming aware of a personal data breach affecting customer personal data, and give you the information you reasonably need to meet your own obligations.
8. End of processing
8.1 At the end of the service, including any hosting period under the Terms, we delete customer personal data, unless the law requires us to keep it. Before then, you can download your content from Handover Works, or ask us in writing to return it to you. If you want us to delete customer personal data earlier, tell us in writing. Copies in backups are deleted as those backups expire.
9. Information and audits
9.1 We make available the information you reasonably need to show that we meet Article 28 of the UK GDPR.
9.2 If that information is not enough, or a regulator requires it, you or an independent auditor you appoint and who is bound to confidentiality may audit our compliance, at your cost, no more than once in any 12 months and with at least 30 days' notice. An audit must not disrupt the service or give access to other customers' data.
10. Liability and precedence
10.1 Liability under this agreement is subject to the limits in the Terms.
10.2 If this agreement and the Terms disagree about customer personal data, this agreement wins.
Annex. The processing
| Subject matter and duration | Providing Handover Works, for as long as you use it and any hosting period after, until deletion under section 8 |
|---|---|
| Nature and purpose | Storing, reading (including with AI), organising, rendering, publishing, sharing, backing up, de-identifying, exporting and deleting content, to provide Handover Works under the Terms |
| Data subjects | Your staff and users; your clients and their staff; other contractors, engineers and suppliers; building occupants; anyone else whose details are in content you upload |
| Personal data | Names, job titles, organisations, contact details, signatures, images, and any other personal data in content you upload |
| Special category data | None is required. Do not upload it |