Data Processing Addendum

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and PECR, each as amended, including by the Data (Use and Access) Act 2025. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the UK GDPR.

2. Roles

The Client is the Controller. Hawthorn is the Processor. Each party will comply with its own obligations under Data Protection Law. The Client warrants that it has a lawful basis for the processing it instructs, and that it has given the necessary information to Data Subjects.

3. Scope of processing under Article 28(3)

4. Our obligations

Hawthorn will:

1. 4.1

   Process only on documented instructions from the Client, including on international transfers, unless required otherwise by law, in which case we will tell the Client first unless the law prohibits it.

2. 4.2

   Tell the Client immediately if we believe an instruction infringes Data Protection Law.

3. 4.3

   Ensure confidentiality. Everyone we authorise to process the data is under a binding duty of confidentiality and has received data protection training.

4. 4.4

   Implement appropriate security under Article 32, including encryption in transit and at rest, role based access on least privilege, multi factor authentication on systems holding personal data, logging and monitoring, tested backups, and a documented business continuity plan.

5. 4.5

   Engage subprocessors only with the Client's general written authorisation. We maintain a list of current subprocessors and will give 30 days' notice before adding or replacing one, during which the Client may object on reasonable data protection grounds. If the objection cannot be resolved the Client may terminate the affected Services without penalty. Every subprocessor is bound by terms no less protective than these, and we remain fully liable for their performance.

6. 4.6

   Assist with Data Subject rights. Taking account of the nature of the processing, we will help the Client respond to requests under Articles 12 to 22. If a Data Subject contacts us directly we will not respond substantively, but will forward the request to the Client without undue delay and in any event within 3 working days.

7. 4.7

   Assist with compliance under Articles 32 to 36, including security, breach notification, data protection impact assessments and prior consultation, taking account of the information available to us.

8. 4.8

   Notify Personal Data Breaches without undue delay and in any event within 24 hours of becoming aware, giving the nature of the breach, categories and approximate numbers affected, likely consequences, and the measures taken. We will assist the Client with its own notifications to the ICO and to Data Subjects.

9. 4.9

   Delete or return all Personal Data at the Client's choice at the end of the engagement, and delete existing copies, unless we are required by law to retain them, for example payroll records for 6 years after the end of the relevant tax year. Where we retain data on that basis we continue to protect it under this Addendum.

10. 4.10

    Make available all information needed to demonstrate compliance with Article 28, and allow and contribute to audits or inspections by the Client or its auditor, on 30 days' notice, no more than once a year unless required by a Supervisory Authority or following a Personal Data Breach, during business hours, and subject to confidentiality.

5. International transfers

We will not transfer Personal Data outside the UK without the Client's prior written authorisation and one of the transfer mechanisms permitted by Articles 44 to 46, normally the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

A current list of subprocessors, including any that process outside the UK and the transfer mechanism relied on for each, is available to the Client on request and is maintained under clause 4.5.

6. Liability

Liability under this Addendum is subject to the limits in the Terms of Business, except that neither party limits liability where Data Protection Law does not permit it. Nothing in this Addendum affects a Data Subject's rights.

7. Governing law

This Addendum is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.