IROTA DATA PROCESSING ADDENDUM (DPA)

This Data Processing Addendum (the Addendum) forms part of the contract between the Service User (the Controller) and Gillett Limited (the Processor), in conjunction with:

• iRota Terms and Conditions of Use
• iRota Privacy and Consent Statement
• Gillett Limited General Data Protection Regulation (GDPR) Statement

Changes to contractual obligations under this Addendum take effect in accordance with the applicable contract and agreed variation arrangements.

DEFINITIONS

In our associated documents and this Addendum, the following terms have the following meanings:

a) Controller, processor, data subject, personal data, processing and special categories of personal data have the meanings given in the UK General Data Protection Regulation (UK GDPR).

b) Data Protection Law means the UK GDPR, the Data Protection Act 2018 and other applicable UK data protection legislation.

c) Data means personal data processed by the Processor on the Controller's behalf in connection with iRota, including service data and copies supplied for configuration or support.

d) Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Data transmitted, stored or otherwise processed.

RELATIONSHIP OF THE PARTIES

The Controller subscribes to iRota and appoints Gillett Limited to process Data on its behalf for the purposes described in this Addendum, the service agreement and the iRota Privacy and Consent Statement. Each party must comply with the obligations that apply to it under Data Protection Law.

The Processor shall process Data only on the Controller's documented instructions, including instructions concerning international transfers, unless required to do otherwise by UK law. The service agreement and this Addendum document the Controller's standing instructions for the Processor to host and process personal data that the Controller or its authorised users enter into iRota, and data generated through their use of the service, for the service purposes described below. The Controller decides what information to enter and how to use and configure the agreed service. If the Controller asks the Processor to carry out a specific action outside routine service operation, such as an export or deletion, the Processor shall act on an authorised instruction that can be recorded. A separate request is not needed for each routine service operation.

Where UK law requires processing outside those instructions, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Law.

The Controller determines the purposes of processing, the information entered into the service, authorised user access and its retention requirements. It is responsible for an appropriate lawful basis and, where applicable, a condition for processing special category personal data and associated legal requirements. Entering information into the service does not by itself establish the individual's consent. The Processor remains responsible for its own obligations under Data Protection Law.

The Processor shall not use Data for its own sales or marketing purposes. Its separate controller activities concerning business contacts and administration are explained in the Company GDPR Statement.

Service Data is hosted in Microsoft Azure in the UK. Any restricted international transfer, including overseas access constituting such a transfer, shall comply with the Controller's documented instructions and the applicable requirements of Data Protection Law. Where required, the Processor shall ensure an applicable adequacy arrangement, appropriate safeguards and associated assessment, or another lawful transfer mechanism is in place. Information about the applicable arrangements will be made available to the Controller on request.

CONFIDENTIALITY OF PROCESSING

The Processor shall ensure that persons authorised to process Data are subject to a contractual duty of confidentiality or an appropriate statutory obligation of confidentiality. Access shall be limited to what is necessary for their authorised responsibilities.

SECURITY

The Processor shall implement appropriate technical and organisational measures under Article 32 of the UK GDPR to protect Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures shall take account of the nature, scope, context and purposes of processing and the risks to individuals, including risks associated with health information.

The Processor uses an internal Information Security Management System (ISMS) to manage information security. Taking account of the nature of processing and the information available to it, the Processor shall assist the Controller in meeting its obligations under Article 32.

SUBCONTRACTING

The Processor uses Microsoft, as the provider of Microsoft Azure, as its hosting sub-processor. By entering into this Addendum, the Controller specifically authorises that hosting arrangement.

By entering into this Addendum, the Controller gives the Processor general written authorisation to engage additional or replacement sub-processors for iRota. The Processor shall give the Controller advance written notice of an intended addition or replacement, including any proposed move from Microsoft Azure to another hosting provider, and a reasonable opportunity to object before the new sub-processor processes Data. The parties shall address any objection before the proposed sub-processor processes the affected Data.

The Processor shall engage each sub-processor under binding written terms, which may be standard terms accepted electronically, imposing the data protection obligations required by Article 28(3) of the UK GDPR and providing an equivalent level of protection for Data, including sufficient guarantees of appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations. Details of the sub-processors used for the service shall be made available to the Controller on request.

COOPERATION AND DATA SUBJECTS' RIGHTS

Taking account of the nature of processing, the Processor shall assist the Controller through appropriate technical and organisational measures, insofar as possible, to fulfil its obligations to respond to requests to exercise data subject rights under Data Protection Law.

The Processor shall provide reasonable and timely assistance with correspondence, enquiries or complaints relating to processing of Data. Where a request, enquiry or complaint concerning the Controller's Data is received directly by the Processor, it shall promptly inform the Controller and provide relevant details, unless prohibited by law. It shall not respond on the Controller's behalf without authorisation, except where required by law.

DATA PROTECTION IMPACT ASSESSMENT

Taking account of the nature of processing and the information available to it, the Processor shall assist the Controller with data protection impact assessments and any required prior consultation with the supervisory authority under Articles 35 and 36 of the UK GDPR.

If the Processor becomes aware that processing is likely to result in a high risk to individuals' rights and freedoms, it shall inform the Controller and provide relevant information and cooperation.

SECURITY INCIDENTS

The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Data. Notification shall not be delayed until the investigation is complete.

The Processor shall provide available information about the nature of the breach, affected categories and approximate numbers of individuals and records where possible, a contact for further information, likely consequences, and measures taken or proposed to address the breach and mitigate its effects. Further information shall be supplied without undue delay as it becomes available.

The Processor shall take appropriate steps to contain and mitigate the breach and assist the Controller in meeting its obligations under Articles 33 and 34 of the UK GDPR. The Controller is responsible for assessing and making any required notifications to the supervisory authority and affected individuals concerning Data it controls.

AUDIT

The Processor shall make available all information necessary to demonstrate compliance with its obligations under Article 28 of the UK GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

SUMMARY OF DATA PROCESSING

Subject matter and processing

The subject matter is personal data entered into iRota by the Controller and its authorised users, generated through use of the service, or supplied for configuration and support, relating to the categories of individuals described below.

Duration of processing

Processing continues for the provision of the service and any subsequent period necessary to complete agreed return or deletion and backup expiry, subject to the Controller's instructions and any legal requirement to retain Data.

At the end of services relating to processing, the Processor shall, at the Controller's choice, return or delete all Data and delete existing copies unless UK law requires retention. The parties shall agree the practical arrangements for secure return and deletion, including any export required before deletion.

The Processor shall delete live service Data as soon as reasonably practicable and within 30 days of receiving an authorised deletion request, or within 30 days of a future deletion date agreed with the Controller. Any earlier contractual deadline continues to apply. Pending deletion cases shall be reviewed through the monthly ISMS review.

Routine SQL backups are retained for up to 35 days. Following deletion of live service Data, existing backup copies remain until they expire under that cycle. Pending expiry, Data awaiting deletion shall be put beyond ordinary use and protected against unauthorised access. If a backup is restored, applicable deletion instructions shall be reapplied before the restored Data is made available for ordinary use.

Support or archive copies remain subject to the same return or deletion obligation; their existence does not authorise indefinite retention. Any separate retention required by UK law shall be limited to that requirement, and the Processor shall inform the Controller unless prohibited by law. The Processor shall provide confirmation of completed deletion on request, identifying any copies still awaiting scheduled backup expiry or legally required retention.

Nature and purpose of processing personal data

Processing enables staff scheduling and management through iRota, including attendance and absence management, user access, reporting, service security, hosting, backup, configuration, maintenance, support, return and deletion. Operations include collection, recording, storage, retrieval, use, organisation, transmission to authorised recipients and erasure as necessary for those purposes.

Types of Personal Data involved

Data includes identity and contact details; login details, login times and IP addresses; roles, contracted hours, working patterns and rota records; leave and sickness-absence records; employment arrangements, payroll identifiers and dates of birth; training, qualifications, skills and work history; performance-review dates and free-text notes; emergency contact and next-of-kin details; and passport, visa, permit, licence and membership information where entered by the Controller. The Information Held within iRota section of the privacy statement provides further detail.

Special category personal data includes health information revealed by brief sickness-absence reasons, such as headache, fracture or cold. This is processed for attendance and absence management, not diagnosis, treatment or management of health conditions. The Controller shall limit entries to information necessary for its purposes and identify any additional special category processing it requires under the agreed service arrangements.

Categories of Data Subjects

a) The Controller's employees and other workers.

b) The Controller's suppliers or their representatives, where their personal information is entered.

c) The Controller's contractors.

d) The Controller's volunteers.

e) Authorised users and administrators.

f) Emergency contacts and next of kin, including children where their details are entered by the Controller.