1022-00007 · Northgate Telecommunications PLC · Transfer Mechanisms

amended-dpa-ntp-pinnacle-redline.docx DOCUMENT Finance & Banking

33 / 39 ← → ✕

Contract analysis Extract to table

AMENDED AND RESTATED DATA PROCESSING AGREEMENT

between

NORTHGATE TELECOMMUNICATIONS PLC

(the "Controller")

and

PINNACLE CLOUD SERVICES LTD

(the "Processor")

Dated: 28 June 2023

This Agreement amends and restates in its entirety the Data Processing Agreement between the parties dated 14 September 2020.

CONFIDENTIAL — This document contains commercially sensitive and legally privileged information. Distribution is restricted to authorised personnel of the parties and their legal advisors.

Right-click to update Table of Contents

PREAMBLE AND RECITALS

This Amended and Restated Data Processing Agreement (this "Agreement") is entered into on 28 June 2023 (the "Effective Date").

BETWEEN:

(A) Northgate Telecommunications PLC, a public limited company incorporated in England and Wales under Company Number 04837291, whose registered office is at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and whose principal office is at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom (the "Controller" or "NTP"); and

(B) Pinnacle Cloud Services Ltd, a private limited company incorporated in England and Wales under Company Number 09142837, whose registered office is at Apex House, 24 Victoria Embankment, London EC4Y 0DZ, United Kingdom (the "Processor" or "Pinnacle"),

each a "Party" and together the "Parties."

WHEREAS:

(A) The Processor provides infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") cloud infrastructure and hosting services to the Controller pursuant to the overarching services agreement between the Parties dated 1 March 2019, as amended from time to time (the "Services Agreement"). The Services include, without limitation, hosting of the Controller's proprietary NorthCloud software-as-a-service platform and the Controller's internal enterprise systems. In the course of providing these Services, the Processor operates data centres located in London, Frankfurt, Amsterdam, Dublin, and Stockholm, and processes personal data on behalf of the Controller.

(B) The Parties entered into a Data Processing Agreement dated 14 September 2020 (the "Prior DPA") to govern the processing of personal data by the Processor on behalf of the Controller. The Parties now wish to amend and restate the Prior DPA in its entirety to reflect changes in the Services, to address evolving regulatory guidance, and to ensure full compliance with the requirements of the UK General Data Protection Regulation (as defined in Section 3(10) of the Data Protection Act 2018) (the "UK GDPR"), the General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), and in particular Article 28 thereof, and all applicable national implementing legislation in force in the member states of the European Union and the European Economic Area.

(C) The Controller is registered with the United Kingdom Information Commissioner's Office (the "ICO") under registration number ZA482917. The Controller's lead supervisory authority within the European Union for the purposes of the EU GDPR is the Data Protection Commission of Ireland (the "DPC"), by virtue of the Controller's EU establishment through its wholly-owned subsidiary, Northgate Ireland Ltd (Companies Registration Office Number 587214), situated at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland.

(D) The Parties acknowledge that the Controller processes personal data relating to approximately million consumer subscribers, approximately 42,000 enterprise clients, and approximately 11,400 employees across its United Kingdom and European Union operations. Portions of such personal data are processed by the Processor in the course of providing the Services. Given the scale, nature, and sensitivity of such processing, the Parties consider it essential that appropriate data protection safeguards are documented and implemented.

(E) Article 28(3) of the EU GDPR and the corresponding provisions of the UK GDPR require that processing by a processor on behalf of a controller is governed by a binding written agreement that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. This Agreement is intended to satisfy those requirements and forms part of the Controller's comprehensive GDPR compliance programme.

(F) This Agreement is supplemental to and forms part of the Services Agreement. In the event of any conflict between this Agreement and the Services Agreement, this Agreement shall prevail in respect of matters relating to data protection and the processing of personal data.

NOW, THEREFORE, the Parties agree as follows:

SECTION 1 — DEFINITIONS AND INTERPRETATION

1.1 Definitions. In this Agreement, unless the context otherwise requires, the following terms shall have the meanings set out below:

"Applicable Data Protection Law" means the UK GDPR, the EU GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended), and all applicable national implementing legislation, regulations, and binding guidance in force in the member states of the European Union and the European Economic Area, in each case as amended, replaced, or superseded from time to time.

"Approved Sub-processor" means a Sub-processor listed in Schedule 3 as at the date of this Agreement, or subsequently approved by the Controller in accordance with the procedure set out in Section 7.2 of this Agreement.

"Controller" means Northgate Telecommunications PLC, as identified in the Preamble to this Agreement.

"Controller Personal Data" means all personal data processed by the Processor (and/or any Sub-processor) on behalf of the Controller in connection with the provision of the Services, as further described in Schedule 1.

"Data Subject" means an identified or identifiable natural person whose personal data forms part of the Controller Personal Data or is otherwise processed under this Agreement.

"Data Protection Impact Assessment" or "DPIA" means an assessment of the impact of the envisaged processing operations on the protection of personal data, carried out in accordance with Article 35 of the EU GDPR and/or Section 64 of the UK GDPR, as applicable.

"EEA" means the European Economic Area, comprising the member states of the European Union together with Iceland, Liechtenstein, and Norway.

"EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, replaced, or superseded from time to time.

"IDTA" means the UK International Data Transfer Agreement, being the template international data transfer agreement issued by the ICO pursuant to Section 119A of the Data Protection Act 2018, as may be amended, replaced, or superseded from time to time.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data transmitted, stored, or otherwise processed by the Processor or any Sub-processor. For the avoidance of doubt, a Personal Data Breach a "personal data breach" as defined in Article 4(12) of the EU GDPR .

"Processor" means Pinnacle Cloud Services Ltd, as identified in the Preamble to this Agreement.

"Restricted Transfer" means a transfer of Controller Personal Data to a recipient located in a third country or to an international organisation that is not the subject of an adequacy decision by the European Commission (for the purposes of the EU GDPR) or the Secretary of State (for the purposes of the UK GDPR), and that therefore requires appropriate safeguards under Article 46 of the EU GDPR or the equivalent provisions of the UK GDPR.

"Services" means the IaaS, PaaS, and related cloud infrastructure and hosting services provided by the Processor to the Controller pursuant to the Services Agreement, as more particularly described in the Services Agreement and in Schedule 1 to this Agreement.

"Sub-processor" means any third party (including any affiliate of the Processor) engaged by the Processor, or by any existing Sub-processor of the Processor, to process Controller Personal Data on behalf of the Controller.

"Supervisory Authority" means, as the context requires: (a) the Information Commissioner's Office (the "ICO"), being the supervisory authority for the purposes of the UK GDPR; and/or (b) the Data Protection Commission of Ireland (the "DPC"), being the Controller's lead supervisory authority for the purposes of the EU GDPR; and/or (c) any other supervisory authority with jurisdiction over the processing activities contemplated by this Agreement.

"Technical and Organisational Measures" or "TOMs" means the technical and organisational security measures implemented by the Processor (and, where applicable, by its Sub-processors) to protect Controller Personal Data, as set out in Schedule 2 to this Agreement and as updated from time to time in accordance with this Agreement.

"UK Addendum" means the International Data Transfer Addendum to the EU issued by the ICO pursuant to Section 119A of the Data Protection Act 2018, as may be amended, replaced, or superseded from time to time.

1.2 Interpretation. In this Agreement, unless the context otherwise requires:

1. References to "Articles" are references to Articles of the EU GDPR, unless otherwise stated. References to "Sections" are references to Sections of this Agreement.

2. Terms defined in the EU GDPR or the UK GDPR (including, without limitation, "personal data," "processing," "controller," "processor," "data subject," "special categories of personal data," "filing system," "consent," "supervisory authority," and "personal data breach") shall have the same meaning when used in this Agreement, unless a different definition is expressly provided herein.

3. Headings and sub-headings are included for convenience of reference only and shall not affect the interpretation or construction of this Agreement.

4. References to "including," "include," "in particular," or any similar expression shall be construed as illustrative and without limitation to the generality of the preceding words.

5. References to any statute, statutory provision, regulation, or subordinate legislation include that statute, statutory provision, regulation, or subordinate legislation as amended, extended, consolidated, re-enacted, or replaced from time to time, and include all orders, regulations, instruments, and subordinate legislation made under or deriving validity from it.

6. References to "writing" or "written" include communication by email, but do not include communication by text message or instant messaging service.

7. Words in the singular include the plural and vice versa, and words importing one gender include all genders.

8. A reference to a "party" means a party to this Agreement and includes that party's successors and permitted assigns.

9. Where any provision of this Agreement refers to a specific time period in "days," such reference shall be to calendar days unless expressly stated to be "business days." "Business days" means days on which banks are generally open for business in London, England, excluding Saturdays, Sundays, and public holidays.

SECTION 2 — SCOPE AND DETAILS OF PROCESSING

2.1 Scope. This Agreement applies to all processing of Controller Personal Data carried out by the Processor (including through any Approved Sub-processor) in connection with the provision of the Services. The Processor shall not process Controller Personal Data for any purpose other than the provision of the Services and as otherwise expressly permitted or required under this Agreement or by the Controller's documented instructions.

2.2 Details of Processing

The details of the processing of Controller Personal Data under this Agreement are set out in full in Schedule 1 and include the following:

(a) Subject matter of processing: Cloud infrastructure hosting and platform services for the Controller's NorthCloud SaaS platform, which serves the Controller's consumer subscriber base and enterprise clients, and hosting of the Controller's internal enterprise systems, including human resources management, payroll, internal communications, and enterprise resource planning systems.

(b) Duration of processing: The processing shall continue for the term of the Services Agreement, and thereafter only to the extent expressly permitted by this Agreement (including Section 9).

(c) Nature and purpose of processing: The Processor shall carry out processing activities including, without limitation: storage of Controller Personal Data on the Processor's cloud infrastructure; hosting of applications and databases containing Controller Personal Data; backup and archival of Controller Personal Data; disaster recovery and business continuity services; infrastructure management and maintenance; performance monitoring and capacity planning; security monitoring, threat detection, and incident response; and such other processing as is necessary for the provision of the Services.

(d) Types of personal data processed: The categories of personal data processed include: names and contact details (email addresses, postal addresses, telephone numbers); account credentials and authentication data; IP addresses and device identifiers; service usage data and session logs; communications metadata (call detail records, messaging metadata); billing and payment information; human resources records (including employee personal details, employment history, compensation and benefits data, performance records, and disciplinary records); payroll information; access credentials for the Controller's systems; internal communications data; location data; and special categories of personal data as specified below.

(e) Special categories of personal data: To the extent present within the Controller's enterprise systems hosted on the Processor's infrastructure, the following special categories of personal data may be processed: employee health data (including occupational health records and sickness absence data); biometric data used for data centre and secure facility access control; and trade union membership data contained within human resources records.

(f) Categories of Data Subjects: Consumer subscribers of the Controller's telecommunications services (approximately 6.3 million individuals); enterprise clients and their employees, representatives, and end users (approximately 42,000 enterprise client organisations); employees and contractors of the Controller and its subsidiaries (approximately 11,400 employees and approximately contractors, temporary workers, and job applicants); and visitors to the Controller's websites and digital properties.

(g) Controller's obligations: The Controller shall ensure that its instructions to the Processor comply with Applicable Data Protection Law. The Controller shall ensure that there is a lawful basis for all processing of Controller Personal Data that the Processor is instructed to carry out. The Controller is solely responsible for the accuracy, quality, and legality of Controller Personal Data and the means by which the Controller acquired such personal data.

SECTION 3 — OBLIGATIONS OF THE PROCESSOR

3.1 Processing on Instructions

3.1.1 The Processor shall process Controller Personal Data only on the basis of documented instructions from the Controller. This Agreement, together with the Services Agreement (including all schedules, annexes, and work orders thereto), constitutes the Controller's initial documented instructions to the Processor for the processing of Controller Personal Data.

3.1.2 The Controller may issue additional or amended instructions to the Processor in writing from time to time. If the Processor considers that any instruction from the Controller infringes Applicable Data Protection Law, the Processor shall immediately inform the Controller thereof, and shall be entitled to suspend the relevant processing pending the Controller's further instructions.

3.1.3 If the Processor is required by the law of the European Union, the law of a member state of the European Union, or the law of the United Kingdom to process Controller Personal Data otherwise than on the Controller's instructions, the Processor shall inform the Controller of that legal requirement before carrying out the processing, unless the relevant law prohibits such notification on important grounds of public interest.

3.2 Confidentiality. 3.2.1 The Processor shall ensure that all natural persons authorised to process Controller Personal Data (including the Processor's employees, agents, contractors, and the personnel of any Sub-processor) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2.2 The Processor shall ensure that access to Controller Personal Data is limited to those members of its personnel who require such access for the purposes of performing the Services and who have received appropriate training regarding their data protection responsibilities.

3.2.3 The obligations of confidentiality set out in this Section 3.2 shall survive the termination or expiry of this Agreement and shall continue to bind the Processor and its personnel for so long as the relevant Controller Personal Data remains in the Processor's possession or control.

3.3 Security. 3.3.1 The Processor shall implement and maintain the Technical and Organisational Measures set out in Schedule 2 to this Agreement. The Processor shall ensure that such measures provide a level of security appropriate to the risk of varying likelihood and severity posed to the rights and freedoms of natural persons by the processing, having regard in particular to the risks presented by processing, including from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data.

3.3.2 Without limiting the generality of Section 3.3.1, the Technical and Organisational Measures shall include, as appropriate:

(a) the pseudonymisation and encryption of Controller Personal Data, including encryption at rest using the Advanced Encryption Standard with 256-bit key length (AES-256) and encryption in transit using Transport Layer Security version

(b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of the Processor's processing systems and services;

(c) the ability to restore the availability of and access to Controller Personal Data in a timely manner in the event of a physical or technical incident; and

(d) a process for regularly testing, assessing, and evaluating the effectiveness of the Technical and Organisational Measures for ensuring the security of the processing.

3.3.3 The Processor shall not materially reduce the overall level of protection afforded by the Technical and Organisational Measures without the prior written consent of the Controller. The Processor may update or modify the Technical and Organisational Measures from time to time, provided that such updates or modifications do not result in a material reduction in the overall level of security. The Processor shall notify the Controller of any material changes to the Technical and Organisational Measures promptly and in any event within 30 days of implementing such changes.

3.3.4 The Processor shall take reasonable steps to ensure the reliability of any personnel who have access to Controller Personal Data, ensuring that such personnel are aware of and comply with the Processor's obligations under this Agreement and Applicable Data Protection Law.

3.4 Assistance with Data Subject Rights

3.4.1 The Processor shall, taking into account the nature of the processing and the information available to the Processor, assist the Controller by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the EU GDPR and the corresponding provisions of the UK GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to automated decision-making (including profiling).

3.4.2 Such assistance shall include, without limitation: providing the Controller with the ability to search, retrieve, export, correct, and delete Controller Personal Data stored on the Processor's infrastructure; providing reasonable technical support to enable the Controller to respond to data subject requests within the time limits prescribed by Applicable Data Protection Law; and promptly informing the Controller of any request received directly from a Data Subject.

3.5 Assistance with Controller Obligations

3.5.1 The Processor shall assist the Controller in ensuring compliance with the Controller's obligations under Articles 32 to 36 of the EU GDPR (and the corresponding provisions of the UK GDPR), taking into account the nature of the processing and the information available to the Processor. Such assistance shall extend to, without limitation:

(a) the Controller's obligations in relation to the security of processing (Article 32);

(b) the Controller's obligations in relation to notification of a personal data breach to a Supervisory Authority (Article 33);

(d) the Controller's obligations in relation to Data Protection Impact Assessments (Article 35); and

(e) the Controller's obligations in relation to prior consultation with a Supervisory Authority (Article 36).

3.5.2 The Processor shall provide such information, documentation, and cooperation as the Controller reasonably requires to conduct Data Protection Impact Assessments relating to the Services or to the processing of Controller Personal Data. The Processor shall respond to reasonable requests for information in connection with a DPIA within 15 business days of receiving such request, or such shorter period as may be required by the circumstances.

3.6 Records of Processing

3.6.1 The Processor shall create and maintain a written record of all categories of processing activities carried out on behalf of the Controller, in accordance with Article 30(2) of the EU GDPR. Such record shall include, at a minimum:

(a) the name and contact details of the Processor and, where applicable, each Sub-processor, and of the Controller on whose behalf the Processor is acting;

(b) the categories of processing carried out on behalf of the Controller;

(c) where applicable, details of transfers of Controller Personal Data to a third country or international organisation, including the identification of that country or organisation and, in the case of a Restricted Transfer, the documentation of suitable safeguards;

(d) where possible, a general description of the Technical and Organisational Measures referred to in Article 32(1).

3.6.2 The Processor shall make such records available to the Controller or to the relevant Supervisory Authority upon reasonable request and in a timely manner.

SECTION 4 — PERSONAL DATA BREACH NOTIFICATION

4.1 Notification to Controller

4.1.1 The Processor shall notify the Controller of any Personal Data Breach without undue delay and in any event within hours of the Processor (or any Sub-processor) becoming aware of such breach. For the purposes of this Section 4, the Processor shall be deemed to have become "aware" of a Personal Data Breach at the point at which a member of the Processor's security operations or management team has a reasonable degree of certainty that a security event has occurred that has resulted in, or is reasonably likely to have resulted in, the compromise of Controller Personal Data.

4.1.2 The initial notification shall be directed to the Controller's Data Protection Officer (currently Sanjay Mehta) using the contact details set out in Schedule 4 to this Agreement. The Processor shall use reasonable efforts to ensure that the initial notification is delivered by telephone call in addition to email or other written communication, so as to ensure prompt receipt.

4.2 Content of Notification

4.2.1 The Processor's notification under Section 4.1 shall include, to the extent the following information is available at the time of notification:

(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of personal data records concerned;

(b) the name, position, and contact details of the Processor's data protection contact point or other designated individual from whom additional information may be obtained;

(c) a description of the likely consequences of the Personal Data Breach, including an assessment of the potential impact on the rights and freedoms of affected Data Subjects;

(d) a description of the measures taken or proposed to be taken by the Processor to address the Personal Data Breach, including, where appropriate, measures to contain and mitigate the possible adverse effects of the breach; and

(e) any other information reasonably required by the Controller to fulfil its notification obligations under Articles 33 and 34 of the EU GDPR and the corresponding provisions of the UK GDPR.

4.3 Ongoing Obligation

4.3.1 Where the Processor is unable to provide all of the information specified in Section 4.2 at the time of initial notification, the Processor shall provide such information in phases without further undue delay as it becomes available. The Processor shall provide regular updates to the Controller on the status of its investigation and response efforts at intervals agreed between the Parties, and in any event no less frequently than every 24 hours during the first 72 hours following the Processor becoming aware of the breach.

4.3.2 The Processor shall cooperate fully with the Controller in relation to any investigation, mitigation, or remediation of a Personal Data Breach. Without limiting the foregoing, the Processor shall take all steps to:

(a) contain the breach and prevent further unauthorised access to, or loss of, Controller Personal Data;

(b) preserve evidence relating to the breach, including system logs, access records, and other forensic data;

(d) support the Controller in notifying affected Data Subjects if the Controller determines that such notification is required; and

(e) cooperate with any investigation by a Supervisory Authority relating to the breach.

4.4 Controller Obligations

4.4.1 The Controller retains sole responsibility for determining whether notification of a Personal Data Breach to the ICO, the DPC, any other Supervisory Authority, and/or to affected Data Subjects is required under Applicable Data Protection Law. The Processor acknowledges that such determination is the prerogative of the Controller and shall not make any determination or representation to third parties regarding the requirement for notification without the Controller's prior written authorisation.

4.4.2 The Processor shall not notify any Supervisory Authority, law enforcement body, or Data Subject directly in respect of a Personal Data Breach affecting Controller Personal Data without the Controller's prior written authorisation, unless the Processor is compelled to do so by applicable law. If the Processor is so compelled, the Processor shall notify the Controller of the legal requirement and the content of the proposed notification before making such notification, to the extent permitted by law.

SECTION 5 — INTERNATIONAL TRANSFERS

5.1 General Restriction

5.1.1 The Processor shall not transfer, and shall not permit any Sub-processor or other third party to transfer, any Controller Personal Data to any country or territory outside the United Kingdom or the EEA (a "Restricted Transfer"), except where one or more of the following conditions is satisfied:

(a) the transfer is to a country, territory, or specified sector within a country or territory that has been the subject of an adequacy decision by the European Commission (for the purposes of the EU GDPR) or the Secretary of State for Science, Innovation and Technology (for the purposes of the UK GDPR), and such adequacy decision remains in force;

(b) appropriate safeguards have been put in place in accordance with this Section 5, including the execution of the EU SCCs, the UK IDTA, and/or the UK Addendum, as applicable; or

(c) one of the derogations set out in Article 49 of the EU GDPR (or the equivalent provision of the UK GDPR) applies and the Controller has provided its prior written consent to the transfer on that basis.

5.1.2 The Processor shall maintain a register of all locations in which Controller Personal Data is processed (including locations of Sub-processors) and shall make such register available to the Controller upon request.

5.2 Transfer Mechanisms — EU GDPR

5.2.1 Where a Restricted Transfer of Controller Personal Data is subject to the EU GDPR, the Parties shall ensure that the EU SCCs (Module 3: Processor to Sub-processor) are duly incorporated, executed, and complied with as between the Processor (as data exporter) and the relevant Sub-processor (as data importer).

5.2.2 The EU SCCs applicable to the current Restricted Transfers are set out in the following Schedules to this Agreement:

(a) Schedule 5A: EU SCCs (Module 3) between Pinnacle Cloud Services Ltd (Processor) and Pinnacle India Pvt Ltd (Sub-processor), covering the transfer of Controller Personal Data to India in connection with infrastructure support and monitoring services; and

(b) Schedule 5B: EU SCCs (Module 3) between Pinnacle Cloud Services Ltd (Processor) and Pinnacle APAC Pte Ltd (Sub-processor), covering the transfer of Controller Personal Data to Singapore in connection with network monitoring and incident response services.

5.2.3 The Parties acknowledge that the optional clauses and annexes of the EU SCCs shall be completed as set out in the relevant Schedule.

5.3 Transfer Mechanisms — UK GDPR

5.3.1 Where a Restricted Transfer of Controller Personal Data is subject to the UK GDPR, the Parties shall ensure that either:

(a) the UK International Data Transfer Agreement (IDTA) is executed between the relevant data exporter and data importer; or

(b) the UK Addendum to the EU SCCs is incorporated into and forms part of the relevant EU SCCs, thereby extending the protections of those clauses to transfers of personal data subject to the UK GDPR.

5.3.2 The UK Addendum applicable to the current Restricted Transfers (covering transfers from Pinnacle Cloud Services Ltd to both Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd) is set out in Schedule 5C to this Agreement.

5.4 Transfer Impact Assessments

5.4.1 The Processor shall cooperate with the Controller in conducting Transfer Impact Assessments ("TIAs") for any Restricted Transfer, whether existing or proposed. Such cooperation shall include providing the Controller with all reasonably requested information concerning:

(a) the legal framework of the destination country, including laws and practices relating to government surveillance, national security, lawful interception, and law enforcement access to personal data;

(b) the Processor's and/or Sub-processor's experience with government access requests, including the volume and nature of any requests received and the Processor's or Sub-processor's response to such requests;

(c) the technical and organisational measures in place to protect Controller Personal Data in the destination country, including any supplementary measures adopted beyond those required by the applicable transfer mechanism; and

(d) any other information that the Controller reasonably requires to assess the adequacy of the protections afforded to Controller Personal Data in connection with the Restricted Transfer.

5.4.2 The Processor confirms that Transfer Impact Assessments have been completed for the following Restricted Transfers as at the date of this Agreement:

(a) TIA-002: Assessment of the transfer of Controller Personal Data from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd, covering the legal and regulatory framework in India, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (to the extent in force); and

(b) TIA-003: Assessment of the transfer of Controller Personal Data from Pinnacle Cloud Services Ltd to Pinnacle APAC Pte Ltd, covering the legal and regulatory framework in Singapore, including the Personal Data Protection Act 2012 (No. 26 of 2012) and subsidiary legislation thereunder.

5.4.3 The Processor shall promptly notify the Controller of any change in circumstances that may affect the validity or conclusions of an existing TIA, including any changes to the laws or practices of the destination country, and shall cooperate with the Controller in conducting any necessary reassessment.

5.5 Supplementary Measures

5.5.1 In addition to the protections afforded by the EU SCCs, the UK IDTA, or the UK Addendum (as applicable), the following supplementary technical and organisational measures shall apply to all Restricted Transfers of Controller Personal Data:

(a) Encryption at rest: All Controller Personal Data stored at the destination shall be encrypted using AES-256 or an equivalent or superior encryption standard;

(b) Encryption in transit: All Controller Personal Data in transit between the Processor and the Sub-processor, or within the Sub-processor's infrastructure, shall be encrypted using TLS 1.3 or an equivalent or superior encryption protocol;

(c) Pseudonymisation: Direct identifiers within Controller Personal Data shall be pseudonymised prior to or upon transfer, where technically feasible and compatible with the purpose of the transfer; and

(d) Data localisation: shall not be transferred outside the United Kingdom or the EEA and shall be subject to data localisation controls ensuring that such data is processed and stored exclusively within the Processor's London, Frankfurt, Amsterdam, Dublin, or Stockholm data centres.

5.6 Government Access Requests

5.6.1 The Processor and each Sub-processor shall promptly notify the Controller if the Processor or Sub-processor receives a request or demand from any government authority, law enforcement body, intelligence service, or other public body for access to or disclosure of Controller Personal Data, unless the Processor or Sub-processor is prohibited by law from making such notification.

5.6.2 The Processor and each Sub-processor shall not disclose Controller Personal Data to any government authority or public body unless compelled to do so by binding legal process. In any such case, the Processor or Sub-processor shall:

(a) carefully review the legality and scope of the request and challenge the request where there are reasonable grounds to consider it to be unlawful or overbroad;

(b) seek to limit the scope of any required disclosure to the minimum amount of Controller Personal Data strictly necessary to comply with the legal obligation;

(c) to the extent permitted by law, notify the Controller as soon as practicable of the existence, content, and circumstances of the request; and

(d) provide the Controller with copies of all relevant correspondence and documentation relating to the request.

5.6.3 The Processor shall maintain a record of all government access requests received in respect of Controller Personal Data and shall provide the Controller with a summary of such requests at least annually, and more frequently upon reasonable request.

SECTION 6 — DATA SUBJECT RIGHTS

6.1 Assistance with Data Subject Requests

6.1.1 The Processor shall, taking into account the nature of the processing and the technical capabilities of the Processor's systems, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law. Such rights include, without limitation:

(a) the right of access (Article 15 EU GDPR);

(b) the right to rectification (Article 16 EU GDPR);

(d) the right to restriction of processing (Article 18 EU GDPR);

(e) the notification obligation regarding rectification, erasure, or restriction (Article 19 EU GDPR);

(f) the right to data portability (Article 20 EU GDPR);

(g) the right to object (Article 21 EU GDPR); and

(h) the right not to be subject to automated individual decision-making, including profiling (Article 22 EU GDPR).

6.1.2 The Processor's assistance under this Section 6.1 shall include, where technically feasible: enabling the Controller to search for and locate Controller Personal Data relating to a specific Data Subject; enabling the Controller to extract, export, or copy Controller Personal Data in a structured, commonly used, and machine-readable format; enabling the Controller to correct, amend, or update Controller Personal Data; enabling the Controller to delete or securely erase Controller Personal Data; and implementing technical restrictions on processing of Controller Personal Data where the Controller determines that restriction is required.

6.1.3 To the extent that the Controller is unable to fulfil a data subject request independently through its own access to the Processor's systems, the Processor shall provide reasonable assistance to the Controller upon written request. The Processor shall respond to such requests within ten (10) business days, or such shorter period as may be necessary for the Controller to comply with the applicable time limits under Applicable Data Protection Law.

6.2 Notification of Direct Requests

6.2.1 The Processor shall promptly, and in any event within three (3) business days, notify the Controller if the Processor receives any request, complaint, or communication directly from a Data Subject in relation to the processing of Controller Personal Data. The Processor shall provide the Controller with a copy of such request, complaint, or communication.

6.2.2 The Processor shall not respond to any such request, complaint, or communication from a Data Subject, except to acknowledge receipt and inform the Data Subject that the request has been forwarded to the Controller, unless the Controller provides documented instructions to the Processor to respond in a specific manner.

SECTION 7 — SUB-PROCESSORS

7.1 Current Approved Sub-processors

7.1.1 The Controller hereby provides a general written authorisation for the Processor to engage the Sub-processors listed in Schedule 3 to this Agreement for the purposes and scope specified therein. As at the date of this Agreement, the following Sub-processors are Approved Sub-processors:

(a) Pinnacle India Pvt Ltd, a private limited company incorporated under the laws of India, with Corporate Identification Number (CIN) U72200HR2016PTC065412, having its registered office at Tower B, Level 14, Cyber City, Gurugram 122002, Haryana, India. Pinnacle India Pvt Ltd has approximately 600 employees and is engaged by the Processor to provide infrastructure support and monitoring services in relation to the Controller's hosted environments.

(b) Pinnacle APAC Pte Ltd, a private limited company incorporated under the laws of Singapore, with Unique Entity Number (UEN) 201824567K, having its registered office at 8 Marina View, #32-01 Asia Square Tower 1, Singapore 018960. Pinnacle APAC Pte Ltd has approximately 180 employees and is engaged by the Processor to provide network monitoring and incident response services in relation to the Controller's hosted environments.

7.1.2 Full details of the Approved Sub-processors, including the scope of processing, location of processing, and applicable transfer mechanisms, are set out in Schedule 3.

7.2 Procedure for New Sub-processors

7.2.1 The Processor shall provide the Controller with prior written notice of not less than calendar days before:

(a) engaging any new Sub-processor to process Controller Personal Data; or

(b) making any material change to the scope of processing carried out by an existing Approved Sub-processor; or

7.2.2 The Processor's notice under Section 7.2.1 shall include the following information in respect of the proposed Sub-processor:

(a) the identity and legal status of the proposed Sub-processor;

(b) the registered office address and principal place of business of the proposed Sub-processor;

(d) a description of the scope and nature of the processing to be carried out by the proposed Sub-processor;

(e) information regarding the proposed Sub-processor's data protection capabilities, including its technical and organisational security measures and any relevant certifications (such as ISO 27001, SOC 2 Type II, or equivalent); and

(f) where the proposed Sub-processor is located outside the United Kingdom or the EEA, details of the proposed transfer mechanism and any completed or proposed Transfer Impact Assessment.

7.2.3 The Controller shall have the right to object to the appointment or engagement of a new Sub-processor on reasonable data protection grounds. Any such objection shall be communicated to the Processor in writing within calendar days of the Controller's receipt of the Processor's notice under Section 7.2.1. The Controller's objection shall set out the specific data protection grounds for the objection in reasonable detail.

7.2.4 If the Controller objects to a proposed Sub-processor, the Parties shall engage in good-faith discussions to resolve the objection. Such discussions may include, without limitation, the Processor proposing additional safeguards, the Processor proposing an alternative Sub-processor, or the Parties agreeing to modify the scope of the proposed Sub-processor's processing activities. If the Parties are unable to resolve the objection within calendar days of the Controller's objection, the Controller may terminate the affected Services (being those Services or parts of Services for which the proposed Sub-processor was to be engaged) by written notice to the Processor, without penalty, fee, or charge for early termination.

7.3 Sub-processor Obligations

AMENDED AND RESTATED DATA PROCESSING AGREEMENT
between
NORTHGATE TELECOMMUNICATIONS PLC
(the "Controller")
and
PINNACLE CLOUD SERVICES LTD
(the "Processor")
Dated: 28 June 2023
This Agreement amends and restates in its entirety the Data Processing Agreement between the parties dated 14 September 2020.
CONFIDENTIAL — This document contains commercially sensitive and legally privileged information. Distribution is restricted to authorised personnel of the parties and their legal advisors.
Right-click to update Table of Contents
PREAMBLE AND RECITALS
This Amended and Restated Data Processing Agreement (this "Agreement") is entered into on 28 June 2023 (the "Effective Date").
BETWEEN:
(A) Northgate Telecommunications PLC, a public limited company incorporated in England and Wales under Company Number 04837291, whose registered office is at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and whose principal office is at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom (the "Controller" or "NTP"); and
(B) Pinnacle Cloud Services Ltd, a private limited company incorporated in England and Wales under Company Number 09142837, whose registered office is at Apex House, 24 Victoria Embankment, London EC4Y 0DZ, United Kingdom (the "Processor" or "Pinnacle"),
each a "Party" and together the "Parties."
WHEREAS:
(A) The Processor provides infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") cloud infrastructure and hosting services to the Controller pursuant to the overarching services agreement between the Parties dated 1 March 2019, as amended from time to time (the "Services Agreement"). The Services include, without limitation, hosting of the Controller's proprietary NorthCloud software-as-a-service platform and the Controller's internal enterprise systems. In the course of providing these Services, the Processor operates data centres located in London, Frankfurt, Amsterdam, Dublin, and Stockholm, and processes personal data on behalf of the Controller.
(B) The Parties entered into a Data Processing Agreement dated 14 September 2020 (the "Prior DPA") to govern the processing of personal data by the Processor on behalf of the Controller. The Parties now wish to amend and restate the Prior DPA in its entirety to reflect changes in the Services, to address evolving regulatory guidance, and to ensure full compliance with the requirements of the UK General Data Protection Regulation (as defined in Section 3(10) of the Data Protection Act 2018) (the "UK GDPR"), the General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), and in particular Article 28 thereof, and all applicable national implementing legislation in force in the member states of the European Union and the European Economic Area.
(C) The Controller is registered with the United Kingdom Information Commissioner's Office (the "ICO") under registration number ZA482917. The Controller's lead supervisory authority within the European Union for the purposes of the EU GDPR is the Data Protection Commission of Ireland (the "DPC"), by virtue of the Controller's EU establishment through its wholly-owned subsidiary, Northgate Ireland Ltd (Companies Registration Office Number 587214), situated at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland.
(D) The Parties acknowledge that the Controller processes personal data relating to approximately   million consumer subscribers, approximately 42,000 enterprise clients, and approximately 11,400 employees across its United Kingdom and European Union operations. Portions of such personal data are processed by the Processor in the course of providing the Services. Given the scale, nature, and sensitivity of such processing, the Parties consider it essential that appropriate data protection safeguards are documented and implemented.
(E) Article 28(3) of the EU GDPR and the corresponding provisions of the UK GDPR require that processing by a processor on behalf of a controller is governed by a binding written agreement that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. This Agreement is intended to satisfy those requirements and forms part of the Controller's comprehensive GDPR compliance programme.
(F) This Agreement is supplemental to and forms part of the Services Agreement. In the event of any conflict between this Agreement and the Services Agreement, this Agreement shall prevail in respect of matters relating to data protection and the processing of personal data.
NOW, THEREFORE, the Parties agree as follows:
SECTION 1 — DEFINITIONS AND INTERPRETATION
1.1 Definitions.  In this Agreement, unless the context otherwise requires, the following terms shall have the meanings set out below:
"Applicable Data Protection Law" means the UK GDPR, the EU GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended), and all applicable national implementing legislation, regulations, and binding guidance in force in the member states of the European Union and the European Economic Area, in each case as amended, replaced, or superseded from time to time.
"Approved Sub-processor" means a Sub-processor listed in Schedule 3 as at the date of this Agreement, or subsequently approved by the Controller in accordance with the procedure set out in Section 7.2 of this Agreement.
"Controller" means Northgate Telecommunications PLC, as identified in the Preamble to this Agreement.
"Controller Personal Data" means all personal data processed by the Processor (and/or any Sub-processor) on behalf of the Controller in connection with the provision of the Services, as further described in Schedule 1.
"Data Subject" means an identified or identifiable natural person whose personal data forms part of the Controller Personal Data or is otherwise processed under this Agreement.
"Data Protection Impact Assessment" or "DPIA" means an assessment of the impact of the envisaged processing operations on the protection of personal data, carried out in accordance with Article 35 of the EU GDPR and/or Section 64 of the UK GDPR, as applicable.
"EEA" means the European Economic Area, comprising the member states of the European Union together with Iceland, Liechtenstein, and Norway.
"EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, replaced, or superseded from time to time.
"IDTA" means the UK International Data Transfer Agreement, being the template international data transfer agreement issued by the ICO pursuant to Section 119A of the Data Protection Act 2018, as may be amended, replaced, or superseded from time to time.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data transmitted, stored, or otherwise processed by the Processor or any Sub-processor. For the avoidance of doubt, a Personal Data Breach   a "personal data breach" as defined in Article 4(12) of the EU GDPR .
"Processor" means Pinnacle Cloud Services Ltd, as identified in the Preamble to this Agreement.
"Restricted Transfer" means a transfer of Controller Personal Data to a recipient located in a third country or to an international organisation that is not the subject of an adequacy decision by the European Commission (for the purposes of the EU GDPR) or the Secretary of State (for the purposes of the UK GDPR), and that therefore requires appropriate safeguards under Article 46 of the EU GDPR or the equivalent provisions of the UK GDPR.
"Services" means the IaaS, PaaS, and related cloud infrastructure and hosting services provided by the Processor to the Controller pursuant to the Services Agreement, as more particularly described in the Services Agreement and in Schedule 1 to this Agreement.
"Sub-processor" means any third party (including any affiliate of the Processor) engaged by the Processor, or by any existing Sub-processor of the Processor, to process Controller Personal Data on behalf of the Controller.
"Supervisory Authority" means, as the context requires: (a) the Information Commissioner's Office (the "ICO"), being the supervisory authority for the purposes of the UK GDPR; and/or (b) the Data Protection Commission of Ireland (the "DPC"), being the Controller's lead supervisory authority for the purposes of the EU GDPR; and/or (c) any other supervisory authority with jurisdiction over the processing activities contemplated by this Agreement.
"Technical and Organisational Measures" or "TOMs" means the technical and organisational security measures implemented by the Processor (and, where applicable, by its Sub-processors) to protect Controller Personal Data, as set out in Schedule 2 to this Agreement and as updated from time to time in accordance with this Agreement.
"UK Addendum" means the International Data Transfer Addendum to the EU   issued by the ICO pursuant to Section 119A of the Data Protection Act 2018, as may be amended, replaced, or superseded from time to time.
1.2 Interpretation.  In this Agreement, unless the context otherwise requires:
1.  References to "Articles" are references to Articles of the EU GDPR, unless otherwise stated. References to "Sections" are references to Sections of this Agreement.
2.  Terms defined in the EU GDPR or the UK GDPR (including, without limitation, "personal data," "processing," "controller," "processor," "data subject," "special categories of personal data," "filing system," "consent," "supervisory authority," and "personal data breach") shall have the same meaning when used in this Agreement, unless a different definition is expressly provided herein.
3.  Headings and sub-headings are included for convenience of reference only and shall not affect the interpretation or construction of this Agreement.
4.  References to "including," "include," "in particular," or any similar expression shall be construed as illustrative and without limitation to the generality of the preceding words.
5.  References to any statute, statutory provision, regulation, or subordinate legislation include that statute, statutory provision, regulation, or subordinate legislation as amended, extended, consolidated, re-enacted, or replaced from time to time, and include all orders, regulations, instruments, and subordinate legislation made under or deriving validity from it.
6.  References to "writing" or "written" include communication by email, but do not include communication by text message or instant messaging service.
7.  Words in the singular include the plural and vice versa, and words importing one gender include all genders.
8.  A reference to a "party" means a party to this Agreement and includes that party's successors and permitted assigns.
9.  Where any provision of this Agreement refers to a specific time period in "days," such reference shall be to calendar days unless expressly stated to be "business days." "Business days" means days on which banks are generally open for business in London, England, excluding Saturdays, Sundays, and public holidays.
SECTION 2 — SCOPE AND DETAILS OF PROCESSING
2.1 Scope.  This Agreement applies to all processing of Controller Personal Data carried out by the Processor (including through any Approved Sub-processor) in connection with the provision of the Services. The Processor shall not process Controller Personal Data for any purpose other than the provision of the Services and as otherwise expressly permitted or required under this Agreement or by the Controller's documented instructions.
2.2 Details of Processing
The details of the processing of Controller Personal Data under this Agreement are set out in full in Schedule 1 and include the following:
(a) Subject matter of processing: Cloud infrastructure hosting and platform services for the Controller's NorthCloud SaaS platform, which serves the Controller's consumer subscriber base and enterprise clients, and hosting of the Controller's internal enterprise systems, including human resources management, payroll, internal communications, and enterprise resource planning systems.
(b) Duration of processing: The processing shall continue for the term of the Services Agreement, and thereafter only to the extent expressly permitted by this Agreement (including Section 9).
(c) Nature and purpose of processing: The Processor shall carry out processing activities including, without limitation: storage of Controller Personal Data on the Processor's cloud infrastructure; hosting of applications and databases containing Controller Personal Data; backup and archival of Controller Personal Data; disaster recovery and business continuity services; infrastructure management and maintenance; performance monitoring and capacity planning; security monitoring, threat detection, and incident response; and such other processing as is necessary for the provision of the Services.
(d) Types of personal data processed: The categories of personal data processed include: names and contact details (email addresses, postal addresses, telephone numbers); account credentials and authentication data; IP addresses and device identifiers; service usage data and session logs; communications metadata (call detail records, messaging metadata); billing and payment information; human resources records (including employee personal details, employment history, compensation and benefits data, performance records, and disciplinary records); payroll information; access credentials for the Controller's systems; internal communications data; location data; and special categories of personal data as specified below.
(e) Special categories of personal data: To the extent present within the Controller's enterprise systems hosted on the Processor's infrastructure, the following special categories of personal data may be processed: employee health data (including occupational health records and sickness absence data); biometric data used for data centre and secure facility access control; and trade union membership data contained within human resources records.
(f) Categories of Data Subjects: Consumer subscribers of the Controller's telecommunications services (approximately 6.3 million individuals); enterprise clients and their employees, representatives, and end users (approximately 42,000 enterprise client organisations); employees and contractors of the Controller and its subsidiaries (approximately 11,400 employees and approximately   contractors, temporary workers, and job applicants); and visitors to the Controller's websites and digital properties.
(g) Controller's obligations: The Controller shall ensure that its instructions to the Processor comply with Applicable Data Protection Law. The Controller shall ensure that there is a lawful basis for all processing of Controller Personal Data that the Processor is instructed to carry out. The Controller is solely responsible for the accuracy, quality, and legality of Controller Personal Data and the means by which the Controller acquired such personal data.
SECTION 3 — OBLIGATIONS OF THE PROCESSOR
3.1 Processing on Instructions
3.1.1 The Processor shall process Controller Personal Data only on the basis of documented instructions from the Controller. This Agreement, together with the Services Agreement (including all schedules, annexes, and work orders thereto), constitutes the Controller's initial documented instructions to the Processor for the processing of Controller Personal Data.
3.1.2 The Controller may issue additional or amended instructions to the Processor in writing from time to time. If the Processor considers that any instruction from the Controller infringes Applicable Data Protection Law, the Processor shall immediately inform the Controller thereof, and shall be entitled to suspend the relevant processing pending the Controller's further instructions.
3.1.3 If the Processor is required by the law of the European Union, the law of a member state of the European Union, or the law of the United Kingdom to process Controller Personal Data otherwise than on the Controller's instructions, the Processor shall inform the Controller of that legal requirement before carrying out the processing, unless the relevant law prohibits such notification on important grounds of public interest.
3.2 Confidentiality.  3.2.1 The Processor shall ensure that all natural persons authorised to process Controller Personal Data (including the Processor's employees, agents, contractors, and the personnel of any Sub-processor) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.2.2 The Processor shall ensure that access to Controller Personal Data is limited to those members of its personnel who require such access for the purposes of performing the Services and who have received appropriate training regarding their data protection responsibilities.
3.2.3 The obligations of confidentiality set out in this Section 3.2 shall survive the termination or expiry of this Agreement and shall continue to bind the Processor and its personnel for so long as the relevant Controller Personal Data remains in the Processor's possession or control.
3.3 Security.  3.3.1 The Processor shall implement and maintain the Technical and Organisational Measures set out in Schedule 2 to this Agreement. The Processor shall ensure that such measures provide a level of security appropriate to the risk of varying likelihood and severity posed to the rights and freedoms of natural persons by the processing, having regard in particular to the risks presented by processing, including from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data.
3.3.2 Without limiting the generality of Section 3.3.1, the Technical and Organisational Measures shall include, as appropriate:
(a) the pseudonymisation and encryption of Controller Personal Data, including encryption at rest using the Advanced Encryption Standard with 256-bit key length (AES-256) and encryption in transit using Transport Layer Security version  
(b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of the Processor's processing systems and services;
(c) the ability to restore the availability of and access to Controller Personal Data in a timely manner in the event of a physical or technical incident; and
(d) a process for regularly testing, assessing, and evaluating the effectiveness of the Technical and Organisational Measures for ensuring the security of the processing.
3.3.3 The Processor shall not materially reduce the overall level of protection afforded by the Technical and Organisational Measures without the prior written consent of the Controller. The Processor may update or modify the Technical and Organisational Measures from time to time, provided that such updates or modifications do not result in a material reduction in the overall level of security. The Processor shall notify the Controller of any material changes to the Technical and Organisational Measures promptly and in any event within 30 days of implementing such changes.
3.3.4 The Processor shall take reasonable steps to ensure the reliability of any personnel who have access to Controller Personal Data, ensuring that such personnel are aware of and comply with the Processor's obligations under this Agreement and Applicable Data Protection Law.
3.4 Assistance with Data Subject Rights
3.4.1 The Processor shall, taking into account the nature of the processing and the information available to the Processor, assist the Controller by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the EU GDPR and the corresponding provisions of the UK GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to automated decision-making (including profiling).
3.4.2 Such assistance shall include, without limitation: providing the Controller with the ability to search, retrieve, export, correct, and delete Controller Personal Data stored on the Processor's infrastructure; providing reasonable technical support to enable the Controller to respond to data subject requests within the time limits prescribed by Applicable Data Protection Law; and promptly informing the Controller of any request received directly from a Data Subject.
3.5 Assistance with Controller Obligations
3.5.1 The Processor shall assist the Controller in ensuring compliance with the Controller's obligations under Articles 32 to 36 of the EU GDPR (and the corresponding provisions of the UK GDPR), taking into account the nature of the processing and the information available to the Processor. Such assistance shall extend to, without limitation:
(a) the Controller's obligations in relation to the security of processing (Article 32);
(b) the Controller's obligations in relation to notification of a personal data breach to a Supervisory Authority (Article 33);
(c) the Controller's obligations in relation to communication of a personal data breach to Data Subjects (Article 34);
(d) the Controller's obligations in relation to Data Protection Impact Assessments (Article 35); and
(e) the Controller's obligations in relation to prior consultation with a Supervisory Authority (Article 36).
3.5.2 The Processor shall provide such information, documentation, and cooperation as the Controller reasonably requires to conduct Data Protection Impact Assessments relating to the Services or to the processing of Controller Personal Data. The Processor shall respond to reasonable requests for information in connection with a DPIA within 15 business days of receiving such request, or such shorter period as may be required by the circumstances.
3.6 Records of Processing
3.6.1 The Processor shall create and maintain a written record of all categories of processing activities carried out on behalf of the Controller, in accordance with Article 30(2) of the EU GDPR. Such record shall include, at a minimum:
(a) the name and contact details of the Processor and, where applicable, each Sub-processor, and of the Controller on whose behalf the Processor is acting;
(b) the categories of processing carried out on behalf of the Controller;
(c) where applicable, details of transfers of Controller Personal Data to a third country or international organisation, including the identification of that country or organisation and, in the case of a Restricted Transfer, the documentation of suitable safeguards;
(d) where possible, a general description of the Technical and Organisational Measures referred to in Article 32(1).
3.6.2 The Processor shall make such records available to the Controller or to the relevant Supervisory Authority upon reasonable request and in a timely manner.
SECTION 4 — PERSONAL DATA BREACH NOTIFICATION
4.1 Notification to Controller
4.1.1 The Processor shall notify the Controller of any Personal Data Breach without undue delay and in any event within   hours of the Processor (or any Sub-processor) becoming aware of such breach. For the purposes of this Section 4, the Processor shall be deemed to have become "aware" of a Personal Data Breach at the point at which a member of the Processor's security operations or management team has a reasonable degree of certainty that a security event has occurred that has resulted in, or is reasonably likely to have resulted in, the compromise of Controller Personal Data.
4.1.2 The initial notification shall be directed to the Controller's Data Protection Officer (currently Sanjay Mehta)  using the contact details set out in Schedule 4 to this Agreement. The Processor shall use reasonable efforts to ensure that the initial notification is delivered by telephone call in addition to email or other written communication, so as to ensure prompt receipt.
4.2 Content of Notification
4.2.1 The Processor's notification under Section 4.1 shall include, to the extent the following information is available at the time of notification:
(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name, position, and contact details of the Processor's data protection contact point or other designated individual from whom additional information may be obtained;
(c) a description of the likely consequences of the Personal Data Breach, including an assessment of the potential impact on the rights and freedoms of affected Data Subjects;
(d) a description of the measures taken or proposed to be taken by the Processor to address the Personal Data Breach, including, where appropriate, measures to contain and mitigate the possible adverse effects of the breach; and
(e) any other information reasonably required by the Controller to fulfil its notification obligations under Articles 33 and 34 of the EU GDPR and the corresponding provisions of the UK GDPR.
4.3 Ongoing Obligation
4.3.1 Where the Processor is unable to provide all of the information specified in Section 4.2 at the time of initial notification, the Processor shall provide such information in phases without further undue delay as it becomes available. The Processor shall provide regular updates to the Controller on the status of its investigation and response efforts at intervals agreed between the Parties, and in any event no less frequently than every 24 hours during the first 72 hours following the Processor becoming aware of the breach.
4.3.2 The Processor shall cooperate fully with the Controller in relation to any investigation, mitigation, or remediation of a Personal Data Breach. Without limiting the foregoing, the Processor shall take all   steps to:
(a) contain the breach and prevent further unauthorised access to, or loss of, Controller Personal Data;
(b) preserve evidence relating to the breach, including system logs, access records, and other forensic data;
(c) identify the root cause of the breach and implement appropriate remedial measures to prevent recurrence;
(d) support the Controller in notifying affected Data Subjects if the Controller determines that such notification is required; and
(e) cooperate with any investigation by a Supervisory Authority relating to the breach.
4.4 Controller Obligations
4.4.1 The Controller retains sole responsibility for determining whether notification of a Personal Data Breach to the ICO, the DPC, any other Supervisory Authority, and/or to affected Data Subjects is required under Applicable Data Protection Law. The Processor acknowledges that such determination is the prerogative of the Controller and shall not make any determination or representation to third parties regarding the requirement for notification without the Controller's prior written authorisation.
4.4.2 The Processor shall not notify any Supervisory Authority, law enforcement body, or Data Subject directly in respect of a Personal Data Breach affecting Controller Personal Data without the Controller's prior written authorisation, unless the Processor is compelled to do so by applicable law. If the Processor is so compelled, the Processor shall notify the Controller of the legal requirement and the content of the proposed notification before making such notification, to the extent permitted by law.
SECTION 5 — INTERNATIONAL TRANSFERS
5.1 General Restriction
5.1.1 The Processor shall not transfer, and shall not permit any Sub-processor or other third party to transfer, any Controller Personal Data to any country or territory outside the United Kingdom or the EEA (a "Restricted Transfer"), except where one or more of the following conditions is satisfied:
(a) the transfer is to a country, territory, or specified sector within a country or territory that has been the subject of an adequacy decision by the European Commission (for the purposes of the EU GDPR) or the Secretary of State for Science, Innovation and Technology (for the purposes of the UK GDPR), and such adequacy decision remains in force;
(b) appropriate safeguards have been put in place in accordance with this Section 5, including the execution of the EU SCCs, the UK IDTA, and/or the UK Addendum, as applicable; or
(c) one of the derogations set out in Article 49 of the EU GDPR (or the equivalent provision of the UK GDPR) applies and the Controller has provided its prior written consent to the transfer on that basis.
5.1.2 The Processor shall maintain a register of all locations in which Controller Personal Data is processed (including locations of Sub-processors) and shall make such register available to the Controller upon request.
5.2 Transfer Mechanisms — EU GDPR
5.2.1 Where a Restricted Transfer of Controller Personal Data is subject to the EU GDPR, the Parties shall ensure that the EU SCCs (Module 3: Processor to Sub-processor) are duly incorporated, executed, and complied with as between the Processor (as data exporter) and the relevant Sub-processor (as data importer).
5.2.2 The EU SCCs applicable to the current Restricted Transfers are set out in the following Schedules to this Agreement:
(a) Schedule 5A: EU SCCs (Module 3) between Pinnacle Cloud Services Ltd (Processor) and Pinnacle India Pvt Ltd (Sub-processor), covering the transfer of Controller Personal Data to India in connection with infrastructure support and monitoring services; and
(b) Schedule 5B: EU SCCs (Module 3) between Pinnacle Cloud Services Ltd (Processor) and Pinnacle APAC Pte Ltd (Sub-processor), covering the transfer of Controller Personal Data to Singapore in connection with network monitoring and incident response services.
5.2.3 The Parties acknowledge that the optional clauses and annexes of the EU SCCs shall be completed as set out in the relevant Schedule.
5.3 Transfer Mechanisms — UK GDPR
5.3.1 Where a Restricted Transfer of Controller Personal Data is subject to the UK GDPR, the Parties shall ensure that either:
(a) the UK International Data Transfer Agreement (IDTA) is executed between the relevant data exporter and data importer; or
(b) the UK Addendum to the EU SCCs is incorporated into and forms part of the relevant EU SCCs, thereby extending the protections of those clauses to transfers of personal data subject to the UK GDPR.
5.3.2 The UK Addendum applicable to the current Restricted Transfers (covering transfers from Pinnacle Cloud Services Ltd to both Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd) is set out in Schedule 5C to this Agreement.
5.4 Transfer Impact Assessments
5.4.1 The Processor shall cooperate with the Controller in conducting Transfer Impact Assessments ("TIAs") for any Restricted Transfer, whether existing or proposed. Such cooperation shall include providing the Controller with all reasonably requested information concerning:
(a) the legal framework of the destination country, including laws and practices relating to government surveillance, national security, lawful interception, and law enforcement access to personal data;
(b) the Processor's and/or Sub-processor's experience with government access requests, including the volume and nature of any requests received and the Processor's or Sub-processor's response to such requests;
(c) the technical and organisational measures in place to protect Controller Personal Data in the destination country, including any supplementary measures adopted beyond those required by the applicable transfer mechanism; and
(d) any other information that the Controller reasonably requires to assess the adequacy of the protections afforded to Controller Personal Data in connection with the Restricted Transfer.
5.4.2 The Processor confirms that Transfer Impact Assessments have been completed for the following Restricted Transfers as at the date of this Agreement:
(a) TIA-002: Assessment of the transfer of Controller Personal Data from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd, covering the legal and regulatory framework in India, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (to the extent in force); and
(b) TIA-003: Assessment of the transfer of Controller Personal Data from Pinnacle Cloud Services Ltd to Pinnacle APAC Pte Ltd, covering the legal and regulatory framework in Singapore, including the Personal Data Protection Act 2012 (No. 26 of 2012) and subsidiary legislation thereunder.
5.4.3 The Processor shall promptly notify the Controller of any change in circumstances that may affect the validity or conclusions of an existing TIA, including any changes to the laws or practices of the destination country, and shall cooperate with the Controller in conducting any necessary reassessment.
5.5 Supplementary Measures
5.5.1 In addition to the protections afforded by the EU SCCs, the UK IDTA, or the UK Addendum (as applicable), the following supplementary technical and organisational measures shall apply to all Restricted Transfers of Controller Personal Data:
(a) Encryption at rest: All Controller Personal Data stored at the destination shall be encrypted using AES-256 or an equivalent or superior encryption standard;
(b) Encryption in transit: All Controller Personal Data in transit between the Processor and the Sub-processor, or within the Sub-processor's infrastructure, shall be encrypted using TLS 1.3 or an equivalent or superior encryption protocol;
(c) Pseudonymisation: Direct identifiers within Controller Personal Data shall be pseudonymised prior to or upon transfer, where technically feasible and compatible with the purpose of the transfer; and
(d) Data localisation:   shall not be transferred outside the United Kingdom or the EEA and shall be subject to data localisation controls ensuring that such data is processed and stored exclusively within the Processor's London, Frankfurt, Amsterdam, Dublin, or Stockholm data centres.
5.6 Government Access Requests
5.6.1 The Processor and each Sub-processor shall promptly notify the Controller if the Processor or Sub-processor receives a request or demand from any government authority, law enforcement body, intelligence service, or other public body for access to or disclosure of Controller Personal Data, unless the Processor or Sub-processor is prohibited by law from making such notification.
5.6.2 The Processor and each Sub-processor shall not disclose Controller Personal Data to any government authority or public body unless compelled to do so by binding legal process. In any such case, the Processor or Sub-processor shall:
(a) carefully review the legality and scope of the request and challenge the request where there are reasonable grounds to consider it to be unlawful or overbroad;
(b) seek to limit the scope of any required disclosure to the minimum amount of Controller Personal Data strictly necessary to comply with the legal obligation;
(c) to the extent permitted by law, notify the Controller as soon as practicable of the existence, content, and circumstances of the request; and
(d) provide the Controller with copies of all relevant correspondence and documentation relating to the request.
5.6.3 The Processor shall maintain a record of all government access requests received in respect of Controller Personal Data and shall provide the Controller with a summary of such requests at least annually, and more frequently upon reasonable request.
SECTION 6 — DATA SUBJECT RIGHTS
6.1 Assistance with Data Subject Requests
6.1.1 The Processor shall, taking into account the nature of the processing and the technical capabilities of the Processor's systems, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law. Such rights include, without limitation:
(a) the right of access (Article 15 EU GDPR);
(b) the right to rectification (Article 16 EU GDPR);
(c) the right to erasure (Article 17 EU GDPR);
(d) the right to restriction of processing (Article 18 EU GDPR);
(e) the notification obligation regarding rectification, erasure, or restriction (Article 19 EU GDPR);
(f) the right to data portability (Article 20 EU GDPR);
(g) the right to object (Article 21 EU GDPR); and
(h) the right not to be subject to automated individual decision-making, including profiling (Article 22 EU GDPR).
6.1.2 The Processor's assistance under this Section 6.1 shall include, where technically feasible: enabling the Controller to search for and locate Controller Personal Data relating to a specific Data Subject; enabling the Controller to extract, export, or copy Controller Personal Data in a structured, commonly used, and machine-readable format; enabling the Controller to correct, amend, or update Controller Personal Data; enabling the Controller to delete or securely erase Controller Personal Data; and implementing technical restrictions on processing of Controller Personal Data where the Controller determines that restriction is required.
6.1.3 To the extent that the Controller is unable to fulfil a data subject request independently through its own access to the Processor's systems, the Processor shall provide reasonable assistance to the Controller upon written request. The Processor shall respond to such requests within ten (10) business days, or such shorter period as may be necessary for the Controller to comply with the applicable time limits under Applicable Data Protection Law.
6.2 Notification of Direct Requests
6.2.1 The Processor shall promptly, and in any event within three (3) business days, notify the Controller if the Processor receives any request, complaint, or communication directly from a Data Subject in relation to the processing of Controller Personal Data. The Processor shall provide the Controller with a copy of such request, complaint, or communication.
6.2.2 The Processor shall not respond to any such request, complaint, or communication from a Data Subject, except to acknowledge receipt and inform the Data Subject that the request has been forwarded to the Controller, unless the Controller provides documented instructions to the Processor to respond in a specific manner.
SECTION 7 — SUB-PROCESSORS
7.1 Current Approved Sub-processors
7.1.1 The Controller hereby provides a general written authorisation for the Processor to engage the Sub-processors listed in Schedule 3 to this Agreement for the purposes and scope specified therein. As at the date of this Agreement, the following Sub-processors are Approved Sub-processors:
(a) Pinnacle India Pvt Ltd, a private limited company incorporated under the laws of India, with Corporate Identification Number (CIN) U72200HR2016PTC065412, having its registered office at Tower B, Level 14, Cyber City, Gurugram 122002, Haryana, India. Pinnacle India Pvt Ltd has approximately 600 employees and is engaged by the Processor to provide infrastructure support and monitoring services in relation to the Controller's hosted environments.
(b) Pinnacle APAC Pte Ltd, a private limited company incorporated under the laws of Singapore, with Unique Entity Number (UEN) 201824567K, having its registered office at 8 Marina View, #32-01 Asia Square Tower 1, Singapore 018960. Pinnacle APAC Pte Ltd has approximately 180 employees and is engaged by the Processor to provide network monitoring and incident response services in relation to the Controller's hosted environments.
7.1.2 Full details of the Approved Sub-processors, including the scope of processing, location of processing, and applicable transfer mechanisms, are set out in Schedule 3.
7.2 Procedure for New Sub-processors
7.2.1 The Processor shall provide the Controller with prior written notice of not less than   calendar days before:
(a) engaging any new Sub-processor to process Controller Personal Data; or
(b) making any material change to the scope of processing carried out by an existing Approved Sub-processor; or
(c) replacing an existing Approved Sub-processor with a different entity.
7.2.2 The Processor's notice under Section 7.2.1 shall include the following information in respect of the proposed Sub-processor:
(a) the identity and legal status of the proposed Sub-processor;
(b) the registered office address and principal place of business of the proposed Sub-processor;
(c) the country or countries in which the proposed Sub-processor will process Controller Personal Data;
(d) a description of the scope and nature of the processing to be carried out by the proposed Sub-processor;
(e) information regarding the proposed Sub-processor's data protection capabilities, including its technical and organisational security measures and any relevant certifications (such as ISO 27001, SOC 2 Type II, or equivalent); and
(f) where the proposed Sub-processor is located outside the United Kingdom or the EEA, details of the proposed transfer mechanism and any completed or proposed Transfer Impact Assessment.
7.2.3 The Controller shall have the right to object to the appointment or engagement of a new Sub-processor on reasonable data protection grounds. Any such objection shall be communicated to the Processor in writing within   calendar days of the Controller's receipt of the Processor's notice under Section 7.2.1. The Controller's objection shall set out the specific data protection grounds for the objection in reasonable detail.
7.2.4 If the Controller objects to a proposed Sub-processor, the Parties shall engage in good-faith discussions to resolve the objection. Such discussions may include, without limitation, the Processor proposing additional safeguards, the Processor proposing an alternative Sub-processor, or the Parties agreeing to modify the scope of the proposed Sub-processor's processing activities. If the Parties are unable to resolve the objection within   calendar days of the Controller's objection, the Controller may terminate the affected Services (being those Services or parts of Services for which the proposed Sub-processor was to be engaged) by written notice to the Processor, without penalty, fee, or charge for early termination.
7.3 Sub-processor Obligations
7.3.1 The Processor shall impose on each Sub-processor, by way of a written contract, data protection obligations that are   than those set out in this Agreement, including in particular obligations relating to: processing only on documented instructions; confidentiality; security; assistance with data subject rights; breach notification; international transfers; audit rights; and data return or deletion upon termination.
7.3.2 The Processor shall carry out appropriate due diligence on each Sub-processor before engagement and on an ongoing basis to satisfy itself that the Sub-processor is capable of providing the level of protection for Controller Personal Data required by this Agreement and Applicable Data Protection Law.
7.3.3 The Processor shall remain fully liable to the Controller for the performance of each Sub-processor's obligations in relation to the processing of Controller Personal Data. Where a Sub-processor fails to fulfil its data protection obligations, the Processor shall be liable to the Controller for the acts and omissions of the Sub-processor as if they were the acts and omissions of the Processor itself.
7.4 Sub-processor International Transfers
7.4.1 Where a Sub-processor is located outside the United Kingdom or the EEA, or where Controller Personal Data will be processed by a Sub-processor in a country outside the United Kingdom or the EEA, the Processor shall ensure that the relevant transfer mechanism (EU SCCs Module 3, UK Addendum, UK IDTA, or other appropriate safeguard under Article 46 of the EU GDPR or the equivalent provision of the UK GDPR) is duly executed and in place before any Controller Personal Data is transferred to or accessed by such Sub-processor.
7.4.2 The Processor shall provide the Controller with copies of all executed transfer mechanism documents (including executed EU SCCs, UK Addenda, and/or UK IDTAs) relating to Sub-processors upon the Controller's request.
SECTION 8 — AUDIT RIGHTS
8.1 Information and Access
8.1.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the EU GDPR, the corresponding provisions of the UK GDPR, and this Agreement. Such information shall be provided promptly upon the Controller's reasonable written request.
8.1.2 Without limiting the foregoing, the Processor shall provide the Controller with copies of relevant policies, procedures, certifications, audit reports, and other documentation relating to the Processor's data protection and information security practices upon reasonable request.
8.2 Audits and Inspections
8.2.1 The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or by a qualified, independent auditor mandated by the Controller (provided that such auditor is bound by appropriate confidentiality obligations and is not a competitor of the Processor). Such audits and inspections may include examination of the Processor's   facilities, systems, network infrastructure, personnel practices, and documentation, to the extent relevant to the processing of Controller Personal Data.
8.2.2 Audits may be conducted no more than once in any calendar year, unless:
(a) a Personal Data Breach has occurred that affects or may affect Controller Personal Data;
(b) the Controller is required or requested to conduct an audit by a Supervisory Authority;
(c) the Controller has reasonable grounds to believe that the Processor is not in compliance with its obligations under this Agreement or Applicable Data Protection Law; or
(d) the Parties agree otherwise in writing,
in which case additional audits may be conducted as reasonably necessary.
8.2.3 The Controller shall give the Processor at least   calendar days' prior written notice of any planned audit, including the proposed scope, duration, and identity of any third-party auditor. In the case of an audit required by a Supervisory Authority, the Controller shall provide notice to the Processor as soon as reasonably practicable.
8.2.4 Audits shall be conducted during normal business hours in a manner that minimises disruption to the Processor's operations. The Processor shall cooperate fully with the Controller and the Controller's auditors and shall provide them with reasonable access to relevant facilities, systems, personnel, and documentation.
8.2.5 The Controller and its auditors shall comply with the Processor's reasonable security and confidentiality requirements when accessing the Processor's premises and systems. The Controller shall ensure that any third-party auditor enters into a non-disclosure agreement with the Processor on terms reasonably satisfactory to the Processor before commencing any audit.
8.3 Audit Costs
8.3.1 Each Party shall bear its own costs and expenses in connection with any audit conducted under this Section 8, including the costs of its own personnel and any third-party auditor. However, if an audit reveals a material non-compliance by the Processor with its obligations under this Agreement or Applicable Data Protection Law, the Processor shall reimburse the Controller for the reasonable and documented costs of the audit.
8.3.2 For the purposes of this Section 8.3, "material non-compliance" means a failure by the Processor to comply with its obligations under this Agreement or Applicable Data Protection Law that, in the reasonable opinion of the Controller (or the Controller's auditor), poses a significant risk to the rights and freedoms of Data Subjects or to the security of Controller Personal Data.
8.4 Third-Party Certifications and Audit Reports
8.4.1 The Processor may, at its option, make available to the Controller current, relevant third-party audit reports and certifications to assist in satisfying the Controller's audit requirements. Such reports may include, without limitation:
(a) ISO/IEC 27001 certification (information security management systems);
(b) SOC 2 Type II reports (trust services criteria: security, availability, processing integrity, confidentiality, privacy);
(c) ISO/IEC 27701 certification (privacy information management); and
(d) such other certifications or reports as the Processor may obtain from time to time.
8.4.2 The provision of third-party certifications and audit reports under this Section 8.4 shall not limit or prejudice the Controller's right to conduct its own audit in accordance with Section 8.2. The Controller retains full discretion as to whether third-party certifications and reports are sufficient for its purposes.
SECTION 9 — DATA RETENTION, RETURN, AND DELETION
9.1 Duration of Processing
The Processor shall process Controller Personal Data for the duration of the Services Agreement and this Agreement, and thereafter only to the extent expressly permitted by this Section 9.
9.2 Return or Deletion on Termination
9.2.1 Upon the termination or expiry of the Services Agreement (or upon the Controller's earlier written request in respect of specific categories of Controller Personal Data), the Processor shall, at the Controller's election and as specified in the Controller's written instruction:
(a) return all Controller Personal Data to the Controller in a commonly used, structured, machine-readable format agreed between the Parties (and, in the absence of agreement, in a format reasonably requested by the Controller), together with all copies thereof in the Processor's possession or control; or
(b) securely and permanently delete all Controller Personal Data, and all copies thereof, from the Processor's systems (including from backup and archival systems), using industry-standard data sanitisation methods appropriate to the sensitivity of the data (such as NIST SP 800-88 or equivalent), and certify such deletion to the Controller in accordance with Section 9.4.
9.2.2 The Processor shall complete the return or deletion of Controller Personal Data within   calendar days of receiving the Controller's instruction. The Processor shall ensure that all Sub-processors comply with the same obligation in respect of any Controller Personal Data in their possession or control.
9.2.3 During the period between termination or expiry of the Services Agreement and the completion of the return or deletion of Controller Personal Data, the Processor shall continue to apply the Technical and Organisational Measures and comply with its obligations under this Agreement in respect of such data.
9.3 Retention Exceptions
9.3.1 The Processor may retain Controller Personal Data (or specific categories thereof) beyond the period specified in Section 9.2 to the extent that such retention is required by applicable EU or UK law, including without limitation laws relating to tax, accounting, anti-money laundering, or regulatory record-keeping. In any such case, the Processor shall:
(a) promptly notify the Controller of the specific legal requirement, identifying the applicable law, the categories of Controller Personal Data affected, and the required retention period;
(b) process the retained Controller Personal Data only for the specific purpose or purposes required by the applicable law, and for no other purpose;
(c) apply the Technical and Organisational Measures set out in Schedule 2 to the retained Controller Personal Data for the entire duration of retention; and
(d) securely delete the retained Controller Personal Data promptly upon the expiry of the legally required retention period.
9.4 Certification of Deletion
9.4.1 The Processor shall provide written certification to the Controller, signed by an authorised representative of the Processor, confirming that all Controller Personal Data (and all copies thereof) has been securely and permanently deleted from the Processor's systems in accordance with this Section 9. Such certification shall be provided within   business days of the completion of the deletion.
9.4.2 The certification shall specify the date on which deletion was completed, the categories of Controller Personal Data deleted, the methods of deletion employed, and confirmation that deletion extends to backup and archival systems (subject to any retention exception under Section 9.3).
SECTION 10 — LIABILITY
10.1 Liability under Services Agreement
10.1.1 Subject to Section 10.3, the liability of each Party arising under or in connection with this Agreement (whether in contract, tort (including negligence), breach of statutory duty, or otherwise) shall be subject to the limitations and exclusions of liability set out in the Services Agreement, to the extent that such limitations and exclusions are applicable.
10.1.2 Notwithstanding the foregoing, no limitation or exclusion of liability set out in the Services Agreement shall apply to the extent that it would contravene or be rendered unenforceable by Applicable Data Protection Law, including any provisions of the EU GDPR or UK GDPR that impose mandatory liability on controllers or processors for damage caused by processing that infringes the relevant Regulation.
10.2 Indemnification.  10.2.1 The Processor shall indemnify and hold harmless the Controller, its officers, directors, employees, agents, and affiliates against all claims, actions, proceedings, losses, damages, liabilities, costs, and expenses (including   legal fees and disbursements) arising out of or in connection with:
(a) any breach by the Processor (or any Sub-processor) of this Agreement;
(b) any breach by the Processor (or any Sub-processor) of Applicable Data Protection Law in connection with the processing of Controller Personal Data;
(c) any failure by a Sub-processor to comply with its data protection obligations, to the extent that such failure causes or contributes to loss or damage suffered by the Controller;
(d) any claims brought by Data Subjects against the Controller arising out of or in connection with a breach by the Processor (or any Sub-processor) of this Agreement or Applicable Data Protection Law; and
(e) any investigation, enforcement action, or proceedings initiated by a Supervisory Authority against the Controller arising out of or in connection with a breach by the Processor (or any Sub-processor) of this Agreement or Applicable Data Protection Law.
10.2.2 The indemnification obligations in this Section 10.2 are subject to the Controller promptly notifying the Processor in writing of any claim, providing the Processor with reasonable information and cooperation in the defence of such claim, and not settling any claim without the Processor's prior written consent (such consent not to be unreasonably withheld or delayed).
10.3 No Limitation for Regulatory Fines
Nothing in this Agreement or in the Services Agreement shall limit or exclude the liability of either Party for administrative fines imposed by a Supervisory Authority under Article 83 of the EU GDPR, or under the equivalent provisions of the UK GDPR, or for any other penalties imposed under Applicable Data Protection Law. Each Party shall be responsible for any such fines or penalties to the extent imposed upon it, and where a fine or penalty is imposed on one Party as a consequence of the other Party's breach of this Agreement or Applicable Data Protection Law, the Party in breach shall indemnify the other Party in accordance with Section 10.2.
SECTION 11 — TERM AND TERMINATION
11.1 Term.  This Agreement shall come into force on the Effective Date ( ) and shall continue in full force and effect for so long as the Processor processes Controller Personal Data on behalf of the Controller, including any post-termination retention period permitted under Section 9.
11.2 Termination.  11.2.1 This Agreement shall terminate automatically upon the termination or expiry of the Services Agreement, subject to the survival provisions in Section 11.3 and the Processor's obligations under Section 9 with respect to the return or deletion of Controller Personal Data.
11.2.2 The Controller may terminate this Agreement  by written notice to the Processor if:
(a) the Processor is in material breach of any provision of this Agreement and fails to remedy such breach within  
(b) the Processor breaches any provision of Applicable Data Protection Law in connection with the processing of Controller Personal Data and such breach is incapable of remedy;
(c) the Processor undergoes a change of control, merger, acquisition, or restructuring that, in the Controller's reasonable opinion, materially affects the Processor's ability to comply with its obligations under this Agreement; or
(d) the Processor enters into administration, liquidation, receivership, or any analogous insolvency proceeding.
11.3 Survival.  The following provisions of this Agreement shall survive the termination or expiry of this Agreement for any reason and shall continue in full force and effect: Section 3.2 (Confidentiality); Section 4 (Personal Data Breach Notification); Section 8 (Audit Rights); Section 9 (Data Retention, Return, and Deletion); Section 10 (Liability); and Section 12 (General Provisions). In addition, any other provision of this Agreement that by its nature is intended to survive termination or expiry shall so survive.
SECTION 12 — GENERAL PROVISIONS
12.1 Governing Law
This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.
12.2 Jurisdiction.  The courts of England and Wales shall have   jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims). Each Party irrevocably submits to the   jurisdiction of such courts and waives any objection to the exercise of such jurisdiction.
12.3 Entire Agreement
12.3.1 This Agreement (including all Schedules hereto) constitutes the entire agreement between the Parties with respect to the processing of personal data by the Processor on behalf of the Controller and supersedes and replaces in its entirety the Prior DPA and all prior agreements, understandings, representations, and discussions between the Parties relating to such subject matter.
12.3.2 This Agreement is supplemental to the Services Agreement. In the event of any conflict or inconsistency between this Agreement and the Services Agreement, the provisions of this Agreement shall prevail to the extent of the conflict or inconsistency in respect of matters relating to data protection and the processing of personal data.
12.4 Amendments.  No amendment, variation, or modification of this Agreement (including any Schedule) shall be effective unless made in writing and signed by a duly authorised representative of each Party. For the avoidance of doubt, amendments to the Schedules (including the list of Approved Sub-processors in Schedule 3) may be made in accordance with the procedures set out in

AMENDED AND RESTATED DATA PROCESSING AGREEMENT

NORTHGATE TELECOMMUNICATIONS PLC

PINNACLE CLOUD SERVICES LTD

PREAMBLE AND RECITALS

BETWEEN:

WHEREAS:

Record

Parties

Dates

Amounts