1. Definitions

“UK Data Protection Law” means the UK GDPR, the Data Protection Act 2018, and any other applicable UK laws relating to the processing of personal data, each as amended or replaced from time to time.

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing” and “Personal Data Breach” have the meanings given to them in UK Data Protection Law.

“Sub-processor” means any third party appointed by Catchlio to process Personal Data on the Client’s behalf in order to provide the services.

2. Roles of the Parties

This DPA applies only where Catchlio processes Personal Data on behalf of, and under the instructions of, the Client, for example, enquiries submitted through a website Catchlio has built for the Client, or business listing and Google Business Profile data managed on the Client’s behalf.

In this relationship, the Client is the Controller and Catchlio is the Processor.

This DPA does not apply to Personal Data that Catchlio collects and processes for its own business purposes (for example, a Client’s own contact details used to manage the relationship between Catchlio and the Client), which is instead governed by Catchlio’s own Privacy Policy.

3. Details of Processing

The subject matter, duration, nature and purpose of processing, and the categories of Personal Data and Data Subjects, are set out below. This is a general description covering the range of services Catchlio offers, the specific detail relevant to any individual Client will depend on which services they have purchased.

4. Catchlio’s Obligations as Processor

Catchlio will:

• only process Personal Data on the documented instructions of the Client, including with regard to international transfers, unless required to do otherwise by UK law;
• ensure that any personnel authorised to process the Personal Data are subject to a duty of confidentiality;
• implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, and against accidental loss, destruction or damage;
• not engage another processor (a Sub-processor) without the Client’s prior general authorisation, as set out in Section 8 below;
• taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures, so far as reasonably possible, with fulfilling the Client’s obligations to respond to requests from Data Subjects exercising their rights under UK Data Protection Law;
• assist the Client in ensuring compliance with its obligations relating to the security of processing, breach notification and data protection impact assessments, taking into account the nature of processing and the information available to Catchlio;
• at the Client’s choice, delete or return all Personal Data to the Client at the end of the provision of services, and delete existing copies unless UK law requires storage of the Personal Data; and
• make available to the Client information reasonably necessary to demonstrate compliance with this DPA.

5. Client’s Obligations as Controller

The Client is responsible for ensuring that it has a lawful basis under UK Data Protection Law for the Personal Data it instructs Catchlio to process, and for the accuracy, quality and legality of Personal Data provided to Catchlio.

The Client’s instructions to Catchlio must comply with UK Data Protection Law, and the Client must not instruct Catchlio to process Personal Data in a way that would place Catchlio in breach of its obligations under this DPA or UK Data Protection Law.

6. Security Measures

Catchlio maintains appropriate technical and organisational security measures appropriate to the nature of the Personal Data being processed, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of Data Subjects.

These measures include, where appropriate to the service provided, restricting access to Personal Data to authorised personnel, using reputable hosting and software providers, keeping software and systems reasonably up to date, and taking reasonable steps to guard against unauthorised access.

7. Personal Data Breaches

Catchlio will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting the Client’s Personal Data, and will provide reasonably available information to help the Client meet any obligation to report the breach to the Information Commission or affected Data Subjects.

Catchlio will take reasonable steps to contain and investigate any such breach.

8. Sub-processors

The Client provides general authorisation for Catchlio to engage the following categories of Sub-processor in order to provide the services, each acting under contractual terms consistent with this DPA:

• Website hosting and domain providers
• Email delivery and business communication providers
• Website form and enquiry-handling software providers
• Payment processing providers
• Analytics providers
• Artificial intelligence and automation technology providers
• Cloud storage and data backup providers

Catchlio will inform the Client of any intended changes concerning the addition or replacement of Sub-processors where reasonably practicable, giving the Client the opportunity to object on reasonable grounds relating to data protection. If Catchlio and the Client cannot resolve such an objection, either party may terminate the affected part of the services.

Catchlio remains responsible for a Sub-processor’s compliance with its data protection obligations under this DPA.

9. International Transfers

Some Sub-processors used by Catchlio may process Personal Data outside the United Kingdom.

Where this occurs, Catchlio will ensure that appropriate safeguards are in place as required by UK Data Protection Law, such as the UK’s International Data Transfer Agreement or Addendum, an applicable adequacy decision, or another lawful transfer mechanism.

10. Audit Rights

Catchlio will make available to the Client information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client, subject to reasonable notice, confidentiality obligations, and limited to what is reasonably necessary to verify compliance with this DPA.

11. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the liability provisions set out in the Terms and Conditions and the applicable Service Agreement between the parties.

12. Term and Termination

This DPA takes effect from the date the Client agrees to Catchlio’s Terms and Conditions or Service Agreement, and continues for as long as Catchlio processes Personal Data on the Client’s behalf.

Sections of this DPA that by their nature should survive termination, including confidentiality and Section 4’s obligation to delete or return Personal Data, will continue to apply after this DPA ends.

13. Governing Law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales will have jurisdiction in relation to any disputes arising from it, subject to any mandatory legal rights that apply.

14. Contact

For questions about this Data Processing Agreement, please contact:

Catchlio Ltd
Email: admin@catchlio.co.uk
Website: catchlio.co.uk