Data processing addendum

1. Application and definitions

This addendum becomes binding only when expressly incorporated into an accepted Order or signed agreement that identifies the processing and completes the processing particulars described below. Publication alone does not create a processor relationship or amend an existing agreement. Global Data Intelligence Limited is the "Processor" and the business customer is the "Controller" for that defined activity. Where the customer is itself a processor, the parties must record the upstream authorisation and corresponding subprocessor obligations.

"Customer Personal Data" means personal data processed by us solely on your behalf for that activity. "Data Protection Law" means the applicable UK GDPR, Data Protection Act 2018, EU GDPR and other applicable privacy law. Terms such as personal data, controller, processor and personal data breach have their meanings under that law. Independently sourced datasets and our separate account, security, legal and billing purposes remain outside this processor scope.

2. Required processing particulars

Before processing begins, the Order or its attached schedule must record:

• The subject matter, service, purposes, nature and processing operations.
• The term, any return period, deletion method and treatment of residual backups.
• The personal data categories and data subject categories actually included.
• The Controller’s documented instructions, contact and relevant rights and obligations.
• The approved processing locations and authorised subprocessors, with functions and locations.
• The technical and organisational measures, including access control, encryption where appropriate, resilience, recovery, testing and incident handling.
• Any restricted transfer, applicable transfer mechanism, required annex information and supplementary measures.

Ordinary permitted processing can include receiving, matching, storing, securing, retrieving and returning business-contact or company-matching information where specified. Special-category, criminal-offence, children’s or other sensitive information must not be supplied unless expressly scoped with a lawful basis and suitable safeguards. There is no default authorisation for unspecified data or locations.

3. Instructions and confidentiality

We will process Customer Personal Data only on documented instructions, including instructions about international transfers, unless applicable law requires otherwise. In that case we will inform you before processing unless the law prohibits notice. We will promptly tell you if, in our opinion, an instruction infringes Data Protection Law and may pause that instruction while the parties resolve the issue.

We will ensure that people authorised to process the data are bound by confidentiality or an appropriate statutory duty and have access only as needed for their role. We will not use Customer Personal Data for our own unrelated marketing, public database enrichment or general-purpose model training without a separate lawful arrangement.

4. Security

We will implement appropriate technical and organisational measures under Article 32, taking account of the state of the art, implementation costs, processing and risks to people. The agreed security schedule must reflect the actual service. Measures must address access control, confidentiality, integrity, availability, resilience, recovery and proportionate testing. Changes must not materially reduce the agreed level of protection.

You are responsible for the lawfulness of your instructions, the information you supply, user permissions and the security of your own environment and chosen integrations. These responsibilities do not reduce our obligations as Processor.

5. Subprocessors

We will not appoint a subprocessor for Customer Personal Data without your prior specific written authorisation or documented general authorisation. The initial list, functions and locations must be supplied as part of the processing particulars. A generic list of website providers does not automatically authorise them for every customer processing activity.

If general authorisation is agreed, we will give at least 30 days’ prior notice of a proposed addition or replacement, unless a shorter period is necessary for a documented emergency and lawful safeguards are maintained. You may raise a reasonable data protection objection during that period. The parties will seek an alternative. If none is reasonably available, either may end the affected processing before the change takes effect, with a refund of unused prepaid fees for the discontinued affected service.

We will impose materially equivalent data protection obligations in a written contract and remain responsible to you for the subprocessor’s performance of those obligations.

6. Assistance and individual requests

Taking account of the nature of processing, we will provide appropriate technical and organisational assistance with individual rights requests. We will promptly forward a request relating to Customer Personal Data and will not answer substantively except on instructions or where law requires it.

Taking account of the information available to us, we will assist you with security obligations, personal data breach assessment and notifications, data protection impact assessments and required prior consultation. Reasonable additional assistance costs may be agreed for work beyond the service, but charges or commercial disputes must not prevent performance of mandatory duties or timely action.

7. Personal data breaches

We will notify your nominated contact without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the nature and likely consequences, available information about affected data and people, a contact point and measures taken or proposed, as known. Information may be supplied in phases without undue further delay.

We will take reasonable steps to contain, investigate and remediate the breach, preserve relevant evidence and cooperate with your response. You determine notifications for which you are responsible as Controller. Neither party’s statutory reporting duties are restricted. Notification is not an admission of fault.

8. International transfers

We will make a restricted transfer only on documented instructions and using a valid mechanism under applicable law. Where standard clauses are required, the parties must identify the appropriate EU module and any UK Addendum or IDTA, complete the mandatory annexes and carry out the relevant assessment before the transfer. This addendum does not itself replace those instruments or silently incorporate incomplete annexes.

Mandatory transfer clauses prevail over conflicting commercial terms for their subject matter. We will inform you if we can no longer comply with the required safeguards and cooperate on appropriate measures, suspension or lawful termination.

9. Demonstrating compliance

We will provide information reasonably needed to demonstrate our compliance with Article 28 and allow and contribute to audits and inspections by you or an independent auditor you appoint. The parties should first use relevant documents and existing assurance where sufficient, then agree a proportionate further audit where needed.

Reasonable notice, confidentiality, security and non-disruption arrangements apply. They must not prevent an audit required by law, a regulator or a material incident, or conceal a material deficiency. Audits must protect other customers’ information. Each party bears its ordinary costs unless otherwise agreed, without restricting mandatory rights.

10. Return and deletion

At the end of the processing, we will, at your choice, return or securely delete Customer Personal Data and delete existing copies unless applicable law requires retention. The schedule must set a practical return/deletion period and any bounded backup expiry. During permitted residual retention, the data must remain protected, isolated from ordinary use and processed only for the lawful retention purpose or recovery that preserves required deletion.

We will provide confirmation on reasonable request. Retention rights for independently licensed business information do not authorise us to keep personal data processed solely on your behalf.

11. Contractual provisions

The underlying agreement governs liability, fees, notices and disputes unless this addendum or mandatory law requires otherwise. Nothing reduces data subjects’ statutory rights, a party’s liability to a regulator or obligations under mandatory transfer clauses. For a conflict on processing duties, this addendum prevails over the general commercial terms; mandatory law and binding transfer clauses take priority.