Data processing addendum.

Terms

1. Roles. You are the controller (or a processor acting for your own client) and SBD is a processor of the personal data described in Annex 1. Words such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR and the EU GDPR, and equivalent terms in other applicable law, including India’s Digital Personal Data Protection Act 2023.
2. Instructions. SBD processes personal data only on your documented instructions, which are the statement of work, this addendum and your written requests, unless the law requires otherwise. If we believe an instruction breaks data-protection law, we tell you.
3. Confidentiality. Everyone at SBD who can access the personal data is bound by confidentiality obligations and accesses only what the engagement needs.
4. Security. SBD applies the technical and organisational measures in Annex 2, which we may improve but not reduce during the engagement.
5. Sub-processors. You give general authorisation for the sub-processors listed in Annex 3. We tell you at least 30 days before adding or replacing one; you may object on reasonable data-protection grounds, and if we cannot resolve the objection you may end the affected services. Each sub-processor is bound by data-protection terms no less protective than these, and SBD remains responsible for its performance.
6. Data subject requests. SBD tells you promptly about any request it receives from an individual about your data, does not answer it unless you instruct us to, and helps you respond using the systems we built for you.
7. Personal data breaches. SBD notifies you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations, and keeps you updated as we learn more.
8. Assistance. SBD gives reasonable help with data protection impact assessments and consultations with supervisory authorities where they concern the processing we carry out.
9. Deletion and return. When the services end, SBD deletes or returns the personal data at your choice and deletes existing copies, unless the law requires us to keep them. Because the systems we build run in your accounts, in most engagements this means removing our access and deleting working files.
10. Audits. SBD makes available the information needed to show compliance with this addendum, including completed security questionnaires. You may audit SBD once a year, or after a personal data breach, on 30 days’ written notice, during business hours, at your cost, and subject to confidentiality.
11. International transfers. Where personal data from the UK, the EEA or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable) and the UK International Data Transfer Addendum are incorporated by reference, with SBD as data importer. Transfers subject to Indian law are made only to countries not restricted by the Government of India.
12. Liability and order of precedence. Liability under this addendum is subject to the limits in the statement of work or master agreement. If this addendum conflicts with those documents on data protection, this addendum prevails. The Standard Contractual Clauses prevail over both.
13. Term and law. This addendum lasts as long as SBD processes personal data for you. Governing law and jurisdiction follow the statement of work or master agreement, except where the Standard Contractual Clauses require otherwise.