1. For the purpose of this Data Processing Schedule, in addition to the definitions set out in the main Term and Conditions, these terms shall have the following meanings:
Applicable Laws means the UK Data Protection Legislation and any other law that applies in the UK.
UK Data Protection Legislation: any data protection legislation from time to time in force in the UK including the Data Protection Act 2018, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) any other laws and regulations relating to the processing of personal data and privacy which apply to a party and, if applicable, the guidance and codes of practice issued by the relevant data protection or supervisory authority.
Personal Data: means any personal data (as defined in the UK Data Protection Legislation) provided to and/or processed by Terry Forsey on behalf of the Customer in connection with the Agreement.
2. In the event of any conflict or inconsistency between any provision of the main body of the Agreement and any provision of this Data Processing Schedule, the provisions of this Data Processing Schedule shall take precedence.
3. Both parties will comply with all applicable requirements of the UK Data Protection Legislation. This paragraph 3 is in addition to, and does not relieve, remove or replace, a party's obligations under the UK Data Protection Legislation.
4. The parties acknowledge that for the purposes of the UK Data Protection Legislation, the Customer is the data controller and Terry Forsey is the data processor (where data controller and data processor and data processing have the meanings as defined in the UK Data Protection Legislation). Paragraph 9 of this Data Processing Schedule sets out the scope, nature and purpose of processing by Terry Forsey, the duration of the processing and the types of Personal Data and categories of data subjects (as defined in the UK Data Protection Legislation).
5. Without prejudice to the generality of paragraph 3, Terry Forsey shall, in relation to any Personal Data processed in connection with the performance by Terry Forsey of its obligations under the Agreement:
5.1 process that Personal Data only on the written instructions of the Customer (whether specific instructions or instructions of a general nature as set out or provided for in the Agreement) unless Terry Forsey is required by Applicable Laws to otherwise process that Personal Data. Terry Forsey shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Terry Forsey from so notifying the Customer.
5.2 ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential.
5.3 subject to making a reasonable charge therefor based on its then current charging rates assist the Customer in responding to any request from a Data Subject and in ensuring compliance with its obligations under the UK Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
5.4 notify the Customer without undue delay on becoming aware of a Personal Data breach;
5.5 at the written direction of the Customer, promptly delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless required by Applicable Law to store the Personal Data; and
5.6 maintain complete and accurate records and information to demonstrate its compliance with this Data Processing Schedule, upon the Customer’s request, take reasonable steps to demonstrate such compliance and/or shall, upon receipt of reasonable prior notice from the Customer, allow for audits by the Customer or the Customer's designated auditor.
6. The Customer consents to Terry Forsey appointing SharpSpring Inc. as a third-party processor of Personal Data under the Agreement.
7. Terry Forsey agrees to indemnify on demand and keep indemnified and defend at its own expense the Customer against all costs, claims, damages or expenses incurred by the Customer arising out of or in connection with any failure by Terry Forsey or its employees, agents or subcontractors to comply with any obligations under this Data Processing Schedule.
8. This Data Processing Schedule shall survive termination or expiry of the Agreement for any reason for as long as Terry Forsey processes any Personal Data.
9. Specification of processing:
Scope: Provision of cloud-based Marketing & CRM.
Nature: Business and personal data.
Purpose of processing: Provision of cloud-based Marketing & CRM.
Duration of the processing: Until termination of this agreement
Types of Personal Data: Name, contact details, employer, interest
Categories of data subject: Customers and prospective customers