1. Parties & definitions
Controller: the client business, which decides the purposes and means of processing its customers' and staff's personal data. Processor: Kaidence, which processes that data on the Controller's behalf while building, running or supporting automations and software for it. "Personal data", "processing" and "data subject" have the meanings given in UK GDPR.
2. When this agreement applies
This agreement applies whenever a project or ongoing support involves Kaidence handling personal data for the Controller. It lasts for as long as that work continues, and until the data has been returned or deleted under section 8.
3. Processing details
| Nature & purpose | Building, testing, running and supporting the automations and software described in the Controller's proposal, such as booking, email, follow-up and review workflows. |
| Categories of data | Whatever the proposal's systems handle, typically names, contact details, booking and job details, and messages. |
| Categories of data subjects | The Controller's customers, prospective customers and staff. |
The proposal for each project records the specifics.
4. Processor obligations
The Processor agrees to:
- Process personal data only on the Controller's documented instructions
- Keep it confidential, and ensure anyone processing it is under a duty of confidentiality
- Implement appropriate technical and organisational security measures
- Assist the Controller in responding to data subject rights requests
- Assist the Controller with data protection impact assessments where relevant
- Delete or return all personal data at the end of the work, at the Controller's choice
- Make available the information needed to demonstrate compliance with this agreement
5. Sub-processors
The tools a project relies on (for example email, hosting, calendar or AI services) depend on what's being built, so the sub-processors for each project are listed in its proposal. By approving the proposal, the Controller authorises them. The Processor will give reasonable notice before adding or replacing a sub-processor, and the Controller may object on reasonable data-protection grounds.
6. International transfers
Where a sub-processor is located outside the UK, the Processor ensures an appropriate transfer mechanism is in place (such as the UK International Data Transfer Addendum) before any personal data is transferred.
7. Breach notice
If the Processor becomes aware of a personal data breach affecting the Controller's data, it will notify the Controller without undue delay, and no later than 72 hours after becoming aware, with enough detail for the Controller to meet its own reporting obligations.
8. Ending & data return
When the work ends, the Processor will, at the Controller's choice, delete or return all personal data processed under this agreement, except where retention is required by law.