Data Processing Agreement

DATA PROCESSING AGREEMENT

This document explains how Personal Data will be handled when Dr Logic provides Services to the Customer under the Agreement. It applies whenever Dr Logic processes Personal Data on the Customer’s behalf and sets out the data protection terms that both parties must comply with. This DPA forms part of the Agreement and does not replace the other contractual terms. Instead, it deals specifically with data protection and privacy matters. If there is any inconsistency between this DPA and the Agreement on a data protection issue, this DPA will take precedence for that issue.

1. Definitions
2. In this DPA:

applicable law	means applicable law of the United Kingdom (or of a part of the United Kingdom);
Controller	has the meaning given in applicable Data Protection Laws from time to time;
Data Protection Laws	means, as binding on either party or the Services:the GDPR;the Data Protection Act 2018; andany laws that supplement, replace, extend, re-enact, consolidate or amend any of the foregoing;
Data Subject	has the meaning given in applicable Data Protection Laws from time to time;
GDPR	means the General Data Protection Regulation, Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or of a part of the United Kingdom from time to time);
International Organisation	has the meaning given in applicable Data Protection Laws from time to time;
Personal Data	has the meaning given in applicable Data Protection Laws from time to time;
Personal Data Breach	has the meaning given in applicable Data Protection Laws from time to time;
processing	has the meaning given in applicable Data Protection Laws from time to time (and related expressions, including process, processed and processes shall be construed accordingly);
Processor	has the meaning given in applicable Data Protection Laws from time to time;
Protected Data	means Personal Data received from or on behalf of the Customer in connection with the performance of Dr Logic’s obligations under this Agreement; and
Sub-Processor	means any Processor engaged by Dr Logic (or by any other Sub-Processor) for carrying out any processing activities in respect of the Protected Data on behalf of the Customer.

2. Customer’s compliance with Data Protection Laws

The parties agree that the Customer is a Controller and that Dr Logic is a Processor for the purposes of processing Protected Data pursuant to this Agreement. The Customer shall, at all times, comply with all Data Protection Laws in connection with the processing of Protected Data. The Customer shall ensure all instructions given by it to Dr Logic in respect of Protected Data (including the terms of this Agreement) shall at all times be in accordance with all Data Protection Laws. Nothing in this Agreement relieves the Customer of any responsibilities or liabilities under any Data Protection Laws.

3. Supplier’s compliance with Data Protection Laws

Dr Logic shall process Protected Data in compliance with the obligations placed on it under Data Protection Laws and the terms of this Agreement.

4. Instructions

2. Dr Logic shall only process (and shall ensure its personnel only process) the Protected Data in accordance with the Statement of Work and this Agreement (including with regard to any transfer to which paragraph 10 of this DPA relates), except to the extent:
   1. that alternative processing instructions are agreed between the parties in writing; or
   2. otherwise required by applicable law (and shall inform the Customer of that legal requirement before processing, unless applicable law prevents it doing so on important grounds of public interest).
3. Without prejudice to paragraph 2 of this DPA, if Dr Logic believes that any instruction received by it from the Customer is likely to infringe the Data Protection Laws it shall be entitled to cease to provide the relevant Services until the parties have agreed appropriate amended instructions which are not infringing. The Charges payable to Dr Logic shall not be discounted or set-off as a result of any delay or non-performance of any obligation in accordance with this paragraph 4.2.
4. Security

4. Dr Logic shall implement and maintain the technical and organisational measures set out in the Appendix to this DPA to protect the Protected Data against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure or access.
5. During the period in which Dr Logic processes any Protected Data, the Customer shall undertake a documented assessment at least every 12 months of whether the security measures implemented in accordance with paragraph 5.1 of this DPA are sufficient (taking into account the state of technical development and the nature of processing) to protect the Protected Data against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure or access. The Customer shall notify Dr Logic within 10 days of full details of the assessment and its outcome and of any additional measures the Customer believes are required as a result of the assessment. Dr Logic shall not be obliged to implement any further or alternative security measures except as agreed as a binding variation of this Agreement.
6. Sub-processing and personnel
7. Dr Logic shall:
   1. prior to any Sub-Processor carrying out any processing activities in respect of the Protected Data, ensure such Sub-Processor is appointed under a binding written contract containing terms which reflect the requirements of the Data Protection Laws and ensure such Sub-Processor complies with all such obligations;
   2. remain fully liable to the Customer under this Agreement for all the acts and omissions of each Sub-Processor as if they were its own; and
   3. ensure that all natural persons authorised by Dr Logic or any Sub-Processor to process Protected Data are subject to a binding written contractual obligation to keep the Protected Data confidential.
8. List of authorised Sub-Processors

The Customer authorises (for the purposes of paragraph 6.1.1) the appointment of the Sub-Processors listed below and any other Sub-Processors listed in the Statement of Work.

Sub-Processor	Processing activities	CATEGORIES OF PERSONAL DATA	Location of Data Processing	Transfer mechanism
ServiceNow, Inc.	IT service management platform for case logging, tracking, and workflow automation	Name, email address, job title, contact details, support request content	United Kingdom	N/A (UK hosting)
SafeAeon Inc.	Security Operations Centre (SOC) services for security monitoring and incident response	Name, email address, device identifiers, IP addresses, security event data	European Union	N/A (EU adequacy)
			United States	The UK extension to the EU-US Data Privacy Framework
NinjaOne, LLC	Remote monitoring and management (RMM) of endpoint devices	Device identifiers, hostnames, IP addresses, user account names	European Union	N/A (EU adequacy)
Addigy, Inc.	Apple device management (MDM) for macOS and iOS endpoints	Device identifiers, hostnames, user account names, device configuration data	United States	The UK extension to the EU-US Data Privacy Framework
CrowdStrike, Inc.	Endpoint detection and response (EDR) for threat protection	Device identifiers, IP addresses, process data, file metadata, user account names	European Union	N/A (EU adequacy)
usecure Ltd	Security awareness training and phishing simulation	Name, email address, training completion records, phishing simulation results	United Kingdom	N/A (UK hosting)

8. Further Sub-Processors

The Customer shall reply to any communication from Dr Logic requesting any further prior specific authorisation of a Sub-Processor pursuant to paragraph 6.1.1 of this DPA promptly and in any event within 10 Business Days of request from time to time. The Customer shall not unreasonably withhold, delay or condition any such authorisation.

9. Assistance

7. Dr Logic shall (at the Customer’s cost and expense) assist the Customer in ensuring compliance with the Customer’s obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of the processing and the information available to Dr Logic.
8. Dr Logic shall (at the Customer’s cost and expense) and taking into account the nature of the processing, assist the Customer (by appropriate technical and organisational measures), insofar as this is possible, for the fulfilment of the Customer’s obligations to respond to requests for exercising the Data Subjects’ rights under Chapter III of the GDPR in respect of any Protected Data.
9. Dr Logic shall at the Customer’s cost and expense refer to the Customer all requests it receives for exercising any Data Subjects’ rights under Chapter III of the GDPR which relate to any Protected Data. It shall be the Customer’s responsibility to reply to all such requests as required by applicable law.
10. International transfers

10. The Customer acknowledges and agrees that Dr Logic may transfer the Protected Data outside of the UK or the EEA to the Sub-Processors listed in paragraph 7, in a Statement of Work, or otherwise agreed in accordance with paragraph 8.
11. Dr Logic will only process, or permit the processing, of the Protected Data outside the UK or the EEA under the following conditions:
    1. Dr Logic is processing the Protected Data in a territory which is subject to adequacy regulations under the Data Protection Laws that the territory provides adequate protection for the privacy rights of individuals; or
    2. Dr Logic participates in a valid cross-border transfer mechanism under the Data Protection Laws, so that Dr Logic (and, where appropriate, the Customer) can ensure that appropriate safeguards are in place to ensure an adequate level of protection with respect to the privacy rights of individuals as required by Article 46 of the UK GDPR and EU GDPR. Dr Logic must identify the transfer mechanism that enables the parties to comply with these cross-border data transfer provisions and Dr Logic must immediately inform the Customer of any change to that status; or
    3. the transfer otherwise complies with the Data Protection Laws.
12. If Dr Logic appoints a Sub-Processor located outside the UK or EEA, then the Customer authorises Dr Logic to enter into the ICO’s International Data Transfer Agreement for the transfer of personal data from the UK and/or the ICO’s International Data Transfer Addendum to EU Commission Standard Contractual Clauses and/or the European Commission’s Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 as set out in the Annex to Commission Implementing Decision (EU) 2021/914 (SCCs) with the subcontractor. Dr Logic will make the executed SCCs available to the Customer on request.
13. Audits and processing

Dr Logic shall, in accordance with Data Protection Laws (and at the Customer’s cost and expense), make available to the Customer on request such information that is in its possession or control as is necessary to demonstrate Dr Logic’s compliance with the obligations placed on it under this Schedule and to demonstrate compliance with the obligations on each party imposed by Article 28 of the GDPR, and allow for and contribute to audits, including inspections, by the Customer (or another auditor mandated by the Customer, except for any competitor of Dr Logic) for this purpose (subject to a maximum of one audit request in any 12 month period under this paragraph 11). 

12. Breach

Dr Logic shall notify the Customer without undue delay and in writing on becoming aware of any Personal Data Breach in respect of any Protected Data.

13. Deletion/return
14. On the end of the provision of the Services relating to the processing of Protected Data (the Processing End Date), at the Customer’s cost and expense and the Customer’s option, Dr Logic shall either return all of the Protected Data to the Customer or securely dispose of the Protected Data (and thereafter promptly delete all existing copies of it) except to the extent that any applicable law requires Dr Logic to store such Protected Data. To the extent the Customer has not notified Dr Logic within 30 days of the Processing End Date that it requires the return of any Protected Data, Dr Logic is irrevocably authorised to securely dispose of the Protected Data at the Customer’s cost and expense.
15. Survival
16. This DPA shall survive termination or expiry of the Agreement:
    1. indefinitely in the case of paragraph 13 of this DPA; and 
    2. in the case of all other paragraphs and provisions of this Schedule, until the later of:
       1. the termination or expiry of this Agreement; or
       2. return or secure deletion or disposal of the last of the Protected Data in Dr Logic’s (or any of its Sub-Processor’s) possession or control in accordance with this Agreement.

APPENDIX 

Appropriate Technical and Organisational Security Measures

Dr Logic has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of individuals.

1. Governance and Information Security Management

Dr Logic maintains a documented information security framework aligned to recognised standards and good industry practice. Information security roles and responsibilities are formally defined, including designated responsibility for information security and data protection oversight. Information security policies are reviewed periodically and updated as required.

2. Access Control and Identity Management

Access to systems and data is restricted based on role and business need. Administrative privileges are controlled and granted only where required. Multi-factor authentication is enforced for access to critical systems. User access is reviewed and removed as part of onboarding and offboarding processes.

3.  Device and Endpoint Security

Managed devices are subject to endpoint protection controls, including malware protection and monitoring. Devices are configured in accordance with documented hardening guidelines. Encryption is applied where appropriate to protect data on devices. Lost or compromised devices may be remotely secured or wiped where supported.

4. Logging, Monitoring, and Security Detection

System and security logs are generated and retained in accordance with documented policies. Automated monitoring and alerting mechanisms are used to detect suspicious or anomalous activity. Security events are investigated and managed through defined incident handling processes.

5. Incident Management and Response

A documented incident management process is in place to identify, assess, respond to, and recover from security incidents. Incidents involving Personal Data are escalated appropriately and handled in accordance with applicable legal obligations. Lessons learned from incidents are used to improve controls and processes.

6. Data Handling, Retention, and Disposal

Personal Data is classified and handled according to its sensitivity. Data is retained only for as long as necessary for the provision of the Services, compliance with legal obligations, or as otherwise agreed with the Customer. Secure deletion and disposal processes are applied when data is no longer required.

7. Backup and Business Continuity

Data and system configurations are backed up in line with documented retention and recovery procedures. Backup data is protected against unauthorised access. Business continuity and recovery arrangements are in place to support service restoration following disruption.

8. Physical and Environmental Security

As a remote-first organisation, Dr Logic does not operate on-premise data centres. Physical access to any facilities or environments used by Dr Logic is controlled and restricted. Clear desk and secure handling practices apply to physical documents and devices.

9. Training and Awareness

Personnel receive information security and data protection awareness training. Staff are required to comply with security policies and report suspected incidents or weaknesses.

10. Data Transfers

Where Personal Data is processed outside the United Kingdom or the European Economic Area, appropriate safeguards are applied in accordance with applicable data protection law, including Standard Contractual Clauses or other lawful transfer mechanisms where required.