Data Processing Addendum

Last updated on 1 July 2024

This Data Processing Addendum (DPA) sets out the terms that apply when Your Personal Data is processed by ScreenCloud under the Terms of Service (the “Agreement”). Capitalised terms not defined in this DPA can be found in the Agreement. The DPAs purpose is to ensure such processing is conducted in accordance with Data Protection Laws and respects Your rights where Your Personal Data is processed under the Agreement. A list of ScreenCloud’s Subprocessors can be found at the end of this DPA. 

1. Roles of the Parties

1.1 The Parties accept and agree that the Services shall include processing of Personal Data. In respect of Customer Personal Data processed by ScreenCloud on Your behalf as part of the Services, the Parties acknowledge that ScreenCloud shall act as Processor and You shall act as Controller of such Personal Data.

2. Your Obligations

2.1 You shall comply (and shall require that Your personnel comply) with the Data Protection Laws. You warrant and represent that You have an appropriate registration or notification with all and any relevant data protection authorities.

2.2 You shall obtain all consents and licences required to allow ScreenCloud to process Personal Data in accordance with this Agreement.  

3. ScreenCloud Obligations

3.1 ScreenCloud shall comply (and shall require that its personnel comply) with the Data Protection Laws.

3.2 ScreenCloud, as Processor of Personal Data under this Agreement on Your behalf, shall in relation to the Personal Data provided by You:

1. act only on Your instructions as set out in this Agreement or as documented elsewhere in writing; 
2. process such Personal Data only to the extent, and in such manner, as is necessary for the purposes of this Agreement;
3. ensure that appropriate technical and organisational measures are taken against unauthorised or unlawful processing of such Personal Data and against accidental loss, destruction or alteration  to, such Personal Data, taking into account the nature of the Personal Data;  
4. operate appropriate security procedures, processes and systems to ensure that unauthorised persons do not have access to any equipment used to process such Personal Data or to the Personal Data itself; 
5. use reasonable endeavours to ensure the reliability of its staff with access to such Personal Data and ensure that all such staff are under obligations of confidentiality in relation to such Personal Data;
6. provide You with reasonable assistance for You to meet a request or complaint made by a Data Subject in respect of such Personal Data in order to meet the requirements of the DPA 2018 in respect of Data Subject rights;
7. notify You of a personal data breach of which it is aware without undue delay and shall provide You with reasonable assistance in responding to a personal data breach;
8. notify You if, in its opinion, an instruction given by You breaches the Data Protection Laws; and
9. on termination of this Agreement or the end of the carrying out of data processing, delete or return all such Personal Data to You and delete existing copies unless required to retain a copy to meet its legal or regulatory obligations.

3.3 ScreenCloud shall, if requested, provide You with information necessary to demonstrate Your compliance with obligations under Data Protection Laws and this Data Processing Addendum. ScreenCloud shall allow for audits at Your reasonable request, provided that audits are limited to once a year and during business hours, except in the event of a security incident.

4. Sub-processing

4.1 You consent to ScreenCloud using the sub-processors set out in the ScreenCloud Sub-processors table when processing Personal Data under this Agreement.

4.2 ScreenCloud shall ensure that any sub-processor it engages in relation to this Agreement is engaged on a written agreement giving commitments in relation to the processing of such Personal Data no less onerous than those set out in this Agreement. ScreenCloud shall remain liable to You for the acts of any such sub-processor in relation to such Personal Data.

4.3 ScreenCloud may appoint new sub-processors provided that it notifies You in advance via email and/or other announcement on the Platform and an updated ScreenCloud Sub-processors table. 

4.4 You have thirty (30) days from the notification of the addition of a sub-processor to reasonably object. Continued use of the Services after this time will be taken as You having agreed to the addition. 

5. International Personal Data Transfers

5.1 ScreenCloud shall only transfer any Personal Data provided by You outside the UK, the EEA or a country with an adequacy agreement, with Your prior authorisation and where a suitable transfer mechanism is in place in accordance with Data Protection Laws.

ScreenCloud Sub-processors