Data processing agreement

This Data Processing Agreement (“DPA”) applies where UK Merchandising Limited (“UKM”, “we”, “us” or “our”) processes Personal Data on behalf of a Business Customer (“Customer”) as a data processor under applicable UK data protection law. It supplements the parties’ main contract or UKM Terms and Conditions and does not apply where UKM processes data as an independent controller.

1. Definitions

For this DPA, “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and applicable privacy and electronic communications laws. “Personal Data”, “Controller”, “Processor”, “Data Subject”, “Process”, “Processing” and “Sub-processor” have the meanings given to them by applicable Data Protection Law.

The Customer is the Controller and UKM is the Processor only to the extent UKM is processing Personal Data on the Customer’s behalf. The subject matter, duration, nature and purpose of Processing are the provision of branded merchandise, fulfilment and related services under the main contract. The types of Personal Data may include names, work contact details, delivery addresses, product sizes and order details. Data Subjects may include employees, contractors, customers or other individuals whose details are supplied by the Customer.

2. Customer instructions and compliance

UKM will Process Personal Data only on the Customer’s documented instructions, including the instructions in the main contract and this DPA, unless UKM is required by law to Process the Personal Data. Where legally required, UKM will inform the Customer of that requirement unless prohibited by law.

The Customer is responsible for ensuring that it has a lawful basis for the Processing and for providing any privacy information required to Data Subjects. The Customer must not provide UKM with special category data unless the parties have agreed in writing that it is necessary and appropriate safeguards are in place.

3. Confidentiality

UKM will ensure that persons authorised to Process the Personal Data are subject to an appropriate duty of confidentiality and will access the Personal Data only as necessary to perform the services.

4. Security

UKM will implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, appropriate authentication, secure systems and procedures for managing access to customer information.

The Customer acknowledges that security requirements must be appropriate to the nature of the Processing and the risk to individuals.

5. Sub-processors

The Customer authorises UKM to use appropriate Sub-processors, including manufacturers, decorators, fulfilment providers, IT providers, hosting providers, couriers and other service providers, where reasonably necessary to provide the services.

UKM will remain responsible for its Sub-processors’ performance of their relevant data protection obligations and will require appropriate contractual protections where required by law.

6. Assistance with Data Subject rights

Taking into account the nature of the Processing, UKM will provide reasonable assistance to the Customer with requests from Data Subjects to exercise their rights, where the Customer does not have the information or ability to respond directly. UKM may charge a reasonable fee for assistance that is disproportionate or outside the normal scope of the services, where permitted by law.

7. Personal data breaches

UKM will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed on the Customer’s behalf and will provide reasonably available information about the nature of the breach, likely consequences and measures being taken to address it.

The Customer remains responsible for assessing whether the breach must be reported to the ICO or communicated to Data Subjects. UKM will provide reasonable assistance with that assessment and with any required notification.

8. International transfers

If UKM transfers Personal Data outside the UK, it will do so only where a lawful transfer mechanism or other appropriate safeguard is available under Data Protection Law, unless the Customer has expressly instructed or authorised the transfer and the transfer is otherwise lawful.

9. Return and deletion

At the Customer’s reasonable request on termination of the relevant services, UKM will return or securely delete Personal Data processed on the Customer’s behalf, unless applicable law requires UKM to retain it. Where UKM is required to retain Personal Data, it will continue to protect it and will not Process it except as required by law.

10. Information and audits

UKM will make available information reasonably necessary to demonstrate compliance with the Processor obligations directly applicable to it under Data Protection Law. Any audit requested by the Customer must be reasonable, proportionate, subject to appropriate confidentiality arrangements and carried out during normal business hours. The Customer must not disrupt UKM’s operations or require access to unrelated customers’ information.

11. Term and precedence

This DPA starts when UKM first Processes Personal Data on the Customer’s behalf and continues for as long as UKM does so. If there is a conflict between this DPA and the main contract in relation to data protection, this DPA will prevail to the extent necessary to comply with applicable Data Protection Law.