Data Processing Agreement

This Data Processing Agreement applies where DTI Tech processes personal data on behalf of the Customer as part of agreed services.

The Customer is the controller.

DTI Tech is the processor where we process personal data only on the Customer's documented instructions.

In some cases, DTI Tech may act as an independent controller, including for account management, billing, fraud prevention, legal compliance and supplier management.

Processing relates to the provision of IT procurement, support, managed services, cloud services, consultancy, project services and related services.

Processing continues for the duration of the relevant contract and any period required for lawful retention, service closure, audit, dispute management or legal compliance.

Personal data may include:

• names
• business contact details
• usernames
• device identifiers
• IP addresses
• support records
• licence information
• system logs
• email metadata
• documents, tickets or files shared for support
• any other personal data made available through the Customer's systems

Data subjects may include:

• Customer employees
• contractors
• directors
• customers
• suppliers
• end users
• support contacts

DTI Tech shall:

• process personal data only on documented instructions
• ensure authorised personnel are subject to confidentiality obligations
• apply appropriate technical and organisational measures
• assist the Customer with data subject rights where reasonable
• assist with security and breach obligations where reasonable
• delete or return personal data at the end of services where required, subject to lawful retention
• make available reasonable information required to demonstrate compliance
• notify the Customer if an instruction appears to breach data protection law

The Customer authorises DTI Tech to use sub-processors where reasonably necessary to provide the services.

Sub-processors may include vendors, cloud providers, distributors, managed service providers, hosting providers, security providers, ticketing systems and professional advisers.

DTI Tech shall ensure sub-processors are subject to appropriate contractual obligations.

Where personal data is transferred outside the UK, DTI Tech shall ensure appropriate safeguards are in place where required.

Security measures may include, where appropriate:

• access controls
• multi-factor authentication
• least privilege access
• encryption in transit
• secure password handling
• logging and monitoring
• backup procedures
• vulnerability management
• staff confidentiality
• supplier due diligence

DTI Tech shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data processed by DTI Tech as processor.

The notification shall include available information to help the Customer assess the breach and meet its own obligations.

The Customer is responsible for:

• having a lawful basis for processing
• providing required privacy notices
• ensuring data shared with DTI Tech is necessary and proportionate
• maintaining its own security controls
• managing user access
• ensuring backups and recovery processes are appropriate unless expressly included in the services