Data Processing Schedule

1. Definitions and status

In this Schedule, "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and other applicable UK data protection legislation, in each case as amended or replaced.

"Customer Personal Data" means personal data processed by Haystack on behalf of the Customer in connection with the Services. "Controller", "Processor", "Data Subject", "Personal Data Breach" and "processing" have the meanings given by Data Protection Law.

For Customer Personal Data, the Customer is the Controller and Haystack is the Processor unless the parties expressly agree otherwise. Each party remains responsible for its own obligations under Data Protection Law.

2. Processing instructions

Haystack will process Customer Personal Data only on the Customer’s documented instructions, including the Agreement, configuration of the Services, support requests and other written instructions, unless UK law requires otherwise.

If Haystack is required by law to process Customer Personal Data other than on the Customer’s instructions, Haystack will inform the Customer before doing so unless the law prohibits that notification.

Haystack will promptly inform the Customer if, in Haystack’s reasonable opinion, an instruction infringes Data Protection Law. Haystack may suspend the affected processing while the parties address the issue.

3. Customer responsibilities

The Customer is responsible for determining and documenting a lawful basis for its processing, providing required privacy information, handling Data Subject rights as Controller, and ensuring its instructions to Haystack comply with Data Protection Law.

The Customer warrants that it has the rights, permissions and lawful basis necessary to provide Customer Personal Data to Haystack and instruct the processing described in the Agreement.

4. Confidentiality and personnel

Haystack will ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality and receive access only where reasonably necessary for their role.

5. Security

Haystack will implement and maintain appropriate technical and organisational measures under Article 32 UK GDPR, taking account of the nature of the processing and risks to Data Subjects.

Measures will include, as appropriate to the Service: access controls and authentication; least-privilege access; encryption in transit; appropriate hosting and database security controls; logging and monitoring; secure development and change practices; vulnerability and dependency management; backup and recovery measures where appropriate; and incident response procedures.

The Customer acknowledges that security measures may evolve as technology and the Services develop, provided the overall level of protection is not materially reduced.

6. Sub-processors

The Customer gives Haystack general written authorisation to use sub-processors to provide the Services. The current sub-processors relevant to Hitch are listed in Annex 2.

Haystack will impose data protection obligations on each sub-processor that provide an equivalent level of protection for Customer Personal Data as required by Article 28 UK GDPR and this Schedule.

Haystack remains responsible to the Customer for the performance of its sub-processors’ data protection obligations.

Haystack may add or replace a sub-processor. Where a change is material to the processing of Customer Personal Data, Haystack will provide reasonable advance notice by email, in-product notice or an updated sub-processor list. The Customer may raise reasonable, evidence-based data protection objections before the change takes effect. The parties will work in good faith to resolve the objection; if no reasonable solution is available, either party may terminate the affected Service.

7. International transfers

Haystack will not knowingly make a restricted transfer of Customer Personal Data outside the UK unless the transfer is permitted by Data Protection Law, including through applicable adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.

Where a sub-processor arrangement involves a restricted transfer initiated by Haystack, Haystack will ensure that an appropriate transfer mechanism and any required supplementary measures are in place.

8. Data Subject requests

Taking into account the nature of the processing, Haystack will provide reasonable assistance through appropriate technical and organisational measures to help the Customer respond to requests by Data Subjects to exercise their rights.

If Haystack receives a request relating to Customer Personal Data directly from a Data Subject, Haystack will, where legally permitted, direct the request to the Customer and will not respond substantively except on the Customer’s instructions or as required by law.

9. Assistance and compliance

Taking into account the nature of processing and information available to Haystack, Haystack will provide reasonable assistance to the Customer with its obligations concerning security, Personal Data Breaches, data protection impact assessments and prior consultation with supervisory authorities.

Where assistance goes materially beyond the ordinary operation of the Service and is caused by circumstances not attributable to Haystack, Haystack may charge reasonable professional services fees agreed in advance.

10. Personal Data Breaches

Haystack will notify the Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

The notification will provide information reasonably available to Haystack concerning the nature of the breach, affected data and Data Subjects, likely consequences and measures taken or proposed. Information may be provided in phases as it becomes available.

Haystack’s notification or response to an incident is not an admission of fault or liability.

11. Return and deletion

During the term, Haystack may retain Customer Personal Data only for as long as reasonably necessary to provide, secure, troubleshoot and support the Services, subject to any more specific retention period in the applicable Product Schedule.

On termination or expiry of the affected Service, Haystack will, at the Customer’s choice and subject to reasonable technical capability, return or delete Customer Personal Data and delete remaining copies within a reasonable period, unless UK law requires retention.

Residual copies in encrypted or access-controlled backups may remain until overwritten in the ordinary backup cycle, during which time they remain protected and are not used for other purposes.

12. Audit and information rights

Haystack will make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and this Schedule.

The Customer may audit Haystack’s compliance no more than once in any 12-month period, unless a Personal Data Breach, regulator request or reasonable evidence of material non-compliance justifies an additional audit.

Audits must be on reasonable prior written notice, during normal business hours, minimise disruption, protect other customers’ confidentiality and, where appropriate, first use available documentation, questionnaires or independent assurance before requiring an on-site inspection.

The Customer bears its audit costs. Haystack may charge reasonable costs for extensive audit assistance unless the audit identifies a material breach by Haystack.

13. Liability and precedence

The liability provisions in the Master Terms apply to this Schedule to the fullest extent permitted by Data Protection Law. Nothing in the Agreement limits a party’s direct statutory liability to Data Subjects or regulators where such liability cannot lawfully be limited.

If this Schedule conflicts with the Master Terms on the processing of Customer Personal Data, this Schedule prevails.

Annex 1 — Details of processing

Annex 2 — Current Hitch sub-processors