Data processing agreement

This agreement forms part of the Terms of service between Noah Resources Ltd ("we", "us") and the customer ("you"). It applies whenever we process personal data on your behalf to provide the Services, and it sets out the terms required by Article 28 of the UK GDPR. Words with capital letters that are not defined here have the meanings given in the Terms of service.

1. Definitions

1.1"Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR.

1.2Customer Personal Data means personal data in Customer Content and Outputs that we process on your behalf.

1.3Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended or replaced.

1.4Subprocessor means a third party we engage to process Customer Personal Data.

2. Roles and scope

2.1You are the controller and we are your processor for Customer Personal Data. Annex 1 describes the processing.

2.2We act as a controller in our own right, not as your processor, when we run accounts and billing, keep the Services secure, keep approval and audit records about your users, and publish approved Interviews on Our Channels on the basis of your Approval. Our Privacy notice covers that processing.

2.3You are responsible for having a lawful basis for the processing you instruct, for giving data subjects the information they need (including Executives you put forward for an Interview and colleagues who use your Account), and for the accuracy of Customer Personal Data.

2.4Customer Content should not include special category data or data about criminal convictions unless an announcement genuinely needs it and you have a lawful basis. Please tell us before you upload such data in any quantity.

3. What we will do

3.1Instructions. We will process Customer Personal Data only on your documented instructions, which are the Agreement and the settings and choices you make in the Services, unless the law requires otherwise. In that case we will tell you first, unless the law prevents it. We will tell you if we think an instruction breaks Data Protection Law.

3.2Confidentiality. Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

3.3Security. We will apply the measures in Annex 2, which are appropriate to the risk, and review them regularly.

3.4Subprocessors. You give general authorisation for the Subprocessors listed in Annex 3. We will give at least 30 days' notice of a new Subprocessor, by email to your Owners and on this page. You may object on reasonable data protection grounds during that period. If we cannot reasonably meet the objection, you may end the affected Services and receive a refund of fees paid for the period after they end. Each Subprocessor is bound by data protection terms that protect Customer Personal Data at least as well as this agreement, and we remain responsible for them.

3.5Transfers. We will not transfer Customer Personal Data outside the UK except where UK adequacy regulations apply (including the UK Extension to the EU-U.S. Data Privacy Framework for certified recipients in the United States), or with appropriate safeguards such as the International Data Transfer Agreement or the Standard Contractual Clauses with the UK International Data Transfer Addendum, as listed in Annex 3.

3.6Requests from individuals. If we receive a request from a data subject about Customer Personal Data, we will tell you without undue delay and will not answer it ourselves except to refer the person to you. We will help you respond, using the features of the Services where we can.

3.7Breaches. We will tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting Customer Personal Data. We will give you the information you need to meet your own duties to notify the Information Commissioner and data subjects, and keep you updated as we learn more.

3.8Assistance. We will give you reasonable help with data protection impact assessments and any prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to us.

3.9At the end. When the Services end, you may ask us within 30 days for a copy of the Customer Personal Data we hold for you, in a commonly used format, and, where your Plan included own-channel rights, your approved videos. We then delete Customer Personal Data within 90 days, and from backups as they expire on their normal cycle, except for:

• approval and audit records, which we keep for six years so that either party can show what was approved, by whom and when, and which you instruct us to keep for that purpose; and
• anything the law requires us to keep.

3.10Audits. We will make available the information needed to show that we comply with this agreement. We will allow audits by you, or by an independent auditor you appoint who is bound by confidentiality, on 30 days' notice, during business hours, and no more than once a year unless a regulator requires it or a personal data breach has occurred. Each party bears its own costs, unless the audit shows a material breach by us.

4. What you will do

4.1You will comply with Data Protection Law when you use the Services and give us instructions.

4.2You will make sure you are entitled to share Customer Personal Data with us, and that Executives and colleagues know how their data will be used, including the recording of Interviews and, once approved, their publication.

5. Liability, duration and law

5.1Each party's liability under this agreement is subject to the limits in the Terms of service.

5.2This agreement lasts as long as we process Customer Personal Data for you, and continues after the Terms of service end until the data has been deleted or returned under clause 3.9.

5.3This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1. The processing

Annex 2. Security measures

• Hosting in the European Union (Amsterdam, the Netherlands), with data encrypted at rest by the hosting provider and in transit over HTTPS.
• Each customer's data kept separate in the application and the database, with every request checked against the signed-in user's company, and automated tests that try to reach another customer's data.
• Private file storage under random names. Media is served only through short-lived signed links that are checked against the user's permissions, and downloads are logged.
• Passwords and publication PINs stored as salted scrypt hashes, with account lockout and limits on repeated attempts. Two-step sign-in is available to every user.
• Access by role for customer users and for our staff, with staff access limited to the people who need it to provide the Services.
• An append-only, hash-chained audit log of sign-ins, approvals, downloads and changes, and approval records that the database does not allow to be altered.
• Checks on every upload: file type, size, file signature and malware scanning.
• Logs that automatically remove secrets, PINs and document text.
• Encrypted backups of the database and file storage, with restores tested every quarter.
• An independent penetration test before live client data is handled, and Cyber Essentials Plus certification.

Annex 3. Subprocessors