Data processing agreement

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR and other applicable data protection law. "Customer Personal Data" means personal data in the customer's content that Sepenta processes for the customer through Penta or Magnesia. Terms such as controller, processor, personal data, processing and personal data breach have the meaning in Data Protection Law.

2. Roles and instructions

1. The customer is the controller (or a processor acting for its own controller) and Sepenta is the processor of Customer Personal Data.
2. Sepenta processes it only on the customer's documented instructions, which are the agreement, the use of the services by the customer's users, and any further written instruction. Sepenta tells the customer if it thinks an instruction breaks Data Protection Law.
3. The subject matter, duration, nature, purpose, types of data and data subjects are in Annex 1.

3. Customer responsibilities

The customer is responsible for the lawfulness of its instructions and content, for having a lawful basis and giving notices to the people concerned (including for recording meetings), and for the access it gives its users.

4. Confidentiality

Sepenta makes sure that people authorised to process Customer Personal Data are bound by confidentiality, and limits access to those who need it.

5. Security

Sepenta applies the technical and organisational measures in Annex 2 and keeps them appropriate to the risk. They may be updated if the protection is not reduced.

6. Sub-processors

1. The customer gives general authorisation for the sub-processors on the sub-processors page.
2. Sepenta gives at least [NOTICE PERIOD, for example 30] days' notice of changes. The customer may object on reasonable data protection grounds in that time; if the parties cannot agree, the customer may end the affected service and receive a refund of prepaid fees for it.
3. Sepenta imposes on each sub-processor data protection obligations no less protective than these, and remains responsible to the customer for them.

7. International transfers

Sepenta stores Customer Personal Data in the EU. Where a sub-processor transfers it outside the UK or EEA, it is only under an adequacy decision or an appropriate safeguard. The parties incorporate the EU standard contractual clauses (Commission Decision 2021/914), Module 2 where the customer is a controller and Module 3 where it is a processor, and, for UK transfers, the ICO's International Data Transfer Addendum. [SCC DETAILS: choice of law and courts for the clauses, for example Ireland; competent supervisory authority; Annexes completed by Annexes 1 to 3 here]

8. Helping the customer

1. Data subject requests. Sepenta tells the customer without undue delay if it receives a request about Customer Personal Data, does not answer it itself unless told to, and gives reasonable help (Admins can remove content in the product, and Sepenta deletes it on request).
2. Security, breach notification, impact assessments and consultation. Sepenta gives reasonable help with Articles 32 to 36 of the GDPR.
3. Breaches. Sepenta tells the customer without undue delay, and within [BREACH NOTICE, for example 48] hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information it has and updates as it learns more.

9. Audit

Sepenta makes available the information needed to show compliance, including its security overview and, once a year on written request, answers to a reasonable security questionnaire. Where that is not enough, the customer may audit once a year, on [AUDIT NOTICE, for example 30] days' notice, during working hours and subject to confidentiality, at its own cost and without access to other customers' data. Audits by a regulator are always allowed.

10. Return and deletion

When the agreement ends, Sepenta makes the data available for export for [EXPORT PERIOD, for example 30 days] and then deletes it, including from backups on their normal cycle ([BACKUP RETENTION]), unless the law requires it to keep it. Sepenta confirms deletion in writing on request. The customer's Admins can delete content in the product at any time.

11. Liability and order of precedence

Liability under this agreement is subject to the limits in the terms of service, except where the law or the standard contractual clauses say otherwise. If this agreement conflicts with the standard contractual clauses, the clauses prevail.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

As described in the security overview, which forms this Annex.

Annex 3: Authorised sub-processors

As listed on the sub-processors page on the date of the agreement.

Signatures

Customer: [CUSTOMER LEGAL NAME], [SIGNATORY AND TITLE], [DATE]. Sepenta: Sepenta Eğitim Danışmanlık Yazılım Turizm Ticaret Limited Şirketi, [SIGNATORY AND TITLE], [DATE]. [OR: say this applies automatically when the customer accepts the terms]