DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") forms part of the agreement between Analytix Labs Ltd, a company registered in England and Wales under company number 14275466, trading as UserSearch ("UserSearch"), and the customer using the UserSearch services ("Customer"). It applies automatically, without signature, wherever UserSearch processes personal data on the Customer's behalf.

It should be read alongside our Privacy Policy and our Terms of Service.

1. Definitions

1.1 "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and, where it applies to the Customer, Regulation (EU) 2016/679, each as amended or replaced.

1.2 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in Data Protection Law.

1.3 "Customer Personal Data" means personal data processed by UserSearch on the Customer's behalf in providing the Services.

1.4 "Sub-processor" means a processor engaged by UserSearch to process Customer Personal Data.

1.5 "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles and scope

2.1 The Customer is the Controller and appoints UserSearch as Processor in respect of Customer Personal Data. The Customer is responsible for complying with the obligations that Data Protection Law places on controllers, including having a lawful basis for each search it runs.

2.2 The subject matter, nature, purpose, duration, categories of data subject and categories of personal data are set out in Annex 1.

2.3 Where the Customer is itself acting as a processor for a third-party controller, the Customer is UserSearch's single point of contact, must hold the necessary authority from that controller, and gives all instructions on its behalf.

2.4 UserSearch also processes data relating to the operation and use of the Services — account management, billing, support, security, and product development — as a Controller in its own right. That processing is described in the UserSearch Privacy Policy and is outside this DPA.

2.5 The Customer confirms that it has the lawful basis, the notices and the authority needed for UserSearch to process Customer Personal Data as this DPA describes, that its instructions comply with Data Protection Law, and that it keeps the record of its reason for each search that the Terms of Service require.

3. Instructions

3.1 UserSearch will process Customer Personal Data only to provide the Services and on the Customer's documented instructions, which are set out in this DPA and the Terms of Service.

3.2 The Customer may issue further reasonable instructions necessary for compliance with Data Protection Law. UserSearch may charge a reasonable fee for acting on instructions that go beyond the Services.

3.3 UserSearch will tell the Customer if it believes an instruction infringes Data Protection Law, and may pause that processing until the instruction is confirmed or amended in writing.

3.4 Where UserSearch is required by law to process Customer Personal Data otherwise than on the Customer's instructions, it will inform the Customer beforehand unless the law prohibits it from doing so.

4. Confidentiality

4.1 UserSearch will ensure that everyone authorised to process Customer Personal Data is bound by an obligation of confidentiality, and that access is limited to those who need it to provide the Services.

5. Security

5.1 UserSearch will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those set out in Annex 2.

5.2 The Customer accepts that the measures in Annex 2 are appropriate to the risks of the processing it intends to carry out.

5.3 UserSearch will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide the information reasonably available to it that the Customer needs to meet its own notification obligations. A notification, or help given under this DPA, is not an admission of fault or liability.

6. Sub-processors

6.1 The Customer gives general authorisation for UserSearch to engage the Sub-processors listed in Annex 3.

6.2 UserSearch will impose on each Sub-processor, by written contract, obligations equivalent to those in this DPA, and remains responsible to the Customer for its Sub-processors' performance.

6.3 UserSearch will give reasonable advance notice before adding or replacing a Sub-processor, by email or by updating Annex 3 on this page. The Customer may object in writing, on reasonable and documented data protection grounds, within fourteen days of that notice. The parties will try in good faith to resolve the objection. If it cannot be resolved, either party may end the affected part of the Services on reasonable notice, and the Terms of Service apply to any refund.

6.4 The third-party data sources queried at the Customer's direction act on their own account under their own terms, and are not Sub-processors under this DPA.

7. Assistance

7.1 Taking into account the nature of the processing and the information available to it, UserSearch will assist the Customer with: responding to requests from data subjects exercising their rights; carrying out data protection impact assessments and any prior consultation with a Supervisory Authority; and meeting its security and breach notification obligations.

7.2 UserSearch does not record the terms the Customer searches for, so it cannot search its own records for a particular person, and its help is limited to the information it actually holds. If a data subject contacts UserSearch about Customer Personal Data, UserSearch may refer that person to the Customer, or pass the request on where it is able to identify the Customer concerned, unless the law requires UserSearch to respond itself.

7.3 The Customer remains responsible for deciding whether its use of the Services needs a data protection impact assessment or a consultation with a Supervisory Authority, and for their content and conclusions.

7.4 UserSearch may charge a reasonable fee for assistance under this clause.

8. Audit

8.1 UserSearch will make available the information reasonably necessary to demonstrate compliance with this DPA. The Customer will rely on that information first, and may ask for an audit only where it is not enough.

8.2 An audit may take place once in any twelve-month period, or more often if a Supervisory Authority requires it. It is limited to the documents and systems relevant to Customer Personal Data, takes place on at least sixty days' written notice and during normal business hours, is carried out by an independent auditor both parties agree to, follows an audit plan agreed in advance, and must cause minimal disruption. For systems run by a Sub-processor, the audit is limited to the reports and certifications that Sub-processor makes available.

8.3 The Customer and its auditor are bound by confidentiality as to the conduct and results of the audit, and must comply with UserSearch's security rules.

8.4 The Customer bears the cost of any audit it requests, and UserSearch may charge for the time it spends on one at its reasonable rates.

9. International transfers

9.1 UserSearch's hosting and several of its Sub-processors are based in the United States, as shown in Annex 3.

9.2 The Customer authorises those transfers. UserSearch will make them only under an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the Standard Contractual Clauses, the Standard Contractual Clauses, or another lawful transfer mechanism under Data Protection Law.

9.3 If a transfer mechanism is invalidated or replaced, the parties will work together in good faith to put an alternative in place.

10. Return and deletion

10.1 This DPA ends when the Customer's account is closed. Its obligations continue for as long as UserSearch holds Customer Personal Data.

10.2 The Customer can export its saved Cases and results from its account at any time while the account is open, and is responsible for doing so before it closes. After that, UserSearch deletes Customer Personal Data in accordance with the retention periods in its Privacy Policy, except where it is required by law to keep it.

10.3 Copies held in backups are deleted as those backups are overwritten in the normal cycle.

11. General

11.1 Notices under this DPA go to [email protected] and to the email address on the Customer's account.

11.2 UserSearch may update this DPA in the same way as the Terms of Service. No update will reduce the Customer's protection below what Data Protection Law requires of a processor.

11.3 If any provision is invalid or unenforceable, the rest continues to apply.

11.4 This DPA is governed by the law of England and Wales, and disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

11.5 Where this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails. In every other respect the Terms of Service apply to this DPA, including their limits and exclusions of liability, which cover any claim under or in connection with it.

Annex 1 — description of the processing

Annex 2 — security measures

Annex 3 — sub-processors