Data Processing Terms

These Data Processing Terms shall apply to the extent that Forfusion processes any Personal Data on behalf of the Customer in performing any Services.

1. DEFINITIONS
1. In these Data Processing Terms the following terms shall (unless the context requires otherwise) have the following meanings:
2. "Agreement" means the contract or agreement between Forfusion and the Customer under which Forfusion supplies Services to the Customer, and which incorporates these Data Processing Terms by reference.
3. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "processing" and "appropriate technical and organisational measures":  shall have the meaning given in the Data Protection Legislation.
4. "Customer" means the customer identified in the Agreement.
5. "Data Protection Legislation":  means all applicable data protection and privacy legislation in force from time to time in the UK including the UK GDPR; the Data Protection Act 2018 (DPA 2018) (and regulations made thereunder) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications).
6. "Domestic Law":  means the law of the United Kingdom or a part of the United Kingdom.
7. "Forfusion" means Forfusion Ltd a company incorporated under the laws of England and Wales with company number 06051770 and having its registered office at CBX, Cobalt Park Way, Wallsend, Tyne And Wear, NE28 9NZ.
8. "Parties" means Forfusion and the Customer and a "Party" shall mean either one of them (as applicable).
9. "Services" means any services to be provided by Forfusion to the Customer under the Agreement, including (without limitation and where applicable) the provision of any products or software.
10. "UK GDPR": has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
2. DATA PROTECTION
1. Both Parties will comply with all applicable requirements of the Data Protection Legislation. These Data Processing Terms are in addition to, and do not relieve, remove or replace, a Party's obligations or rights under the Data Protection Legislation.
2. The Parties acknowledge that for the purposes of the Data Protection Legislation, to the extent that Forfusion processes any Personal Data on behalf of the Customer in providing any Services or performing its obligations under the Agreement, Forfusion shall be the Processor and the Customer shall be the Controller. Section 3 of these Data Processing Terms set out the scope, nature and purpose of processing by Forfusion, the duration of the processing and the types of Personal Data and categories of Data Subject.
3. Without prejudice to the generality of Clause 2.1 of these Data Processing Terms, Forfusion shall, in relation to any Personal Data processed in connection with the provision by Forfusion of any Services or in the performance of its obligations under the Agreement:
1. process that Personal Data only on the documented written instructions of the Customer unless Forfusion is required by Domestic Law to otherwise process that Personal Data. Where Forfusion is relying on Domestic Law as the basis for processing Personal Data, Forfusion shall promptly notify the Customer of this before performing the processing required by the Domestic Law unless the Domestic Law prohibits Forfusion from so notifying the Customer;
2. ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);
3. ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential; and
4. not transfer any Personal Data outside of the UK or EEA unless the following conditions are fulfilled:
1. appropriate safeguards have been provided in relation to the transfer;
2. the Data Subject has enforceable rights and effective legal remedies;
3. Forfusion complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred; and
4. Forfusion complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the Personal Data;
5. assist the Customer in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
6. notify the Customer without undue delay (and in any event within 2 working days) on becoming aware of a Personal Data Breach;
7. at the written direction of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of a Contract unless required by Domestic Law to store the Personal Data; and
8. maintain complete and accurate records and information to demonstrate its compliance with these Data Processing Terms and allow for audits by the Customer or the Customer's designated auditor and immediately inform the Customer if, in the opinion of Forfusion, an instruction infringes the Data Protection Legislation.
4. The Customer consents to Forfusion appointing third-parties as third-party processors of Personal Data under this Agreement, provided that Forfusion provides the Customer on request with details of all such third-party processors and the opportunity to object to their use. Forfusion confirms that it has entered or (as the case may be) will enter with each third-party processor into a written agreement incorporating terms which are substantially similar to those set out in these Data Processing Terms and in any event which Forfusion undertakes reflect and will continue to reflect the requirements of the Data Protection Legislation. As between Forfusion and the Customer, Forfusion shall remain fully liable for all acts or omissions of any third-party processor appointed by it pursuant to this clause 2.4 of these Data Processing Terms.
3. PROCESSING, PERSONAL DATA AND DATA SUBJECTS
1. PROCESSING BY FORFUSION:
1. SCOPE: In connection with a Contract, Forfusion will supply certain Services to the Customer.
2. NATURE: In connection with the performance of the Services described above, Forfusion may process Personal Data on behalf of the Customer.
3. PURPOSE OF PROCESSING: The purposes of the processing shall be to provide the Services.
4. DURATION OF THE PROCESSING: The processing shall continue for so long as the Services are being provided under the Agreement.
5. TYPES OF PERSONAL DATA: Any personal data concerning the Data Subjects detailed below which is processed by Forfusion in providing the Services, including (but not necessarily limited to) names, contact details, log-in credentials, business phone numbers and usage data.
6. CATEGORIES OF DATA SUBJECT: Personnel, contractors, suppliers, customers and prospective customers of the Customer.
2. Further details of the Processing to be undertaken by Forfusion may be contained in the Agreement.
4. VERSION CONTROL
1. This is Version 1.0 of the Forfusion Data Processing Terms which was last updated on 11.02.2024