Data processing agreement

This agreement is between the Council, the parish or town council that accepts this agreement, a local council within the meaning of the Local Government Act 1972, acting as controller; and the Processor, Quorate Software Ltd, a company registered in England and Wales, number 17426317, registered office 12 Ellis Close, Cheddon Fitzpaine, Taunton TA2 8NG, which supplies the Quorate service, acting as processor.

It applies to all personal data the Processor processes on the Council's behalf through Quorate, from the day the Council's data first enters the service until it is deleted under clause 9.

The Council decides the purposes and means of the processing. The Processor acts only on the Council's instructions, except where UK law requires otherwise.

Where this agreement and any other agreement between the parties conflict on a data protection question, this agreement prevails.

"UK GDPR" has the meaning in section 3(10) of the Data Protection Act 2018. "Personal data", "controller", "processor", "processing", "personal data breach" and "data subject" have the meanings the UK GDPR gives them. "Working day" means a day other than a Saturday, a Sunday or a bank holiday in England. "The clerk" means the Council's proper officer for the time being, and "the Chairman" means the chairman of the Council for the time being or another member the Council names in writing for the purposes of this agreement.

Article 28(3) requires the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subject, and the Council's obligations and rights to be set out. They are in Annex A.

The Processor processes personal data only on the Council's documented instructions. Those instructions cover the sub-processing in Annex C, including any transfer named there, and no other transfer of the Council's data outside the United Kingdom. The one exception is where UK law requires the Processor to process the data in a way the instructions do not cover; then the Processor tells the Council before doing so, unless that law forbids telling the Council on important grounds of public interest.

The Council's initial documented instruction is: process the personal data as necessary to provide the Quorate service as described in Annex A, and as directed by the Council's clerk through the service's own functions.

Further instructions may be given by email or through the service. Any instruction given verbally is confirmed in writing by the party giving it.

The Processor tells the Council immediately if, in its opinion, an instruction infringes the UK GDPR, the Data Protection Act 2018 or any other UK law on data protection.

The Processor does not use the Council's personal data for its own purposes, including product improvement, analytics sold to others, or training any machine learning model. The one exception is anonymous, aggregate information about use of the service, from which no person and no council can be identified.

Everyone the Processor allows to process the Council's personal data is bound in writing by a duty of confidence before they are given access, whether by contract of employment, by contract for services or by statute. That duty survives the end of the person's engagement and the end of this agreement. It extends to everything the Council holds in the service, whether or not it is personal data, including the business of any item the Council takes in private.

The Processor takes all the measures Article 32 of the UK GDPR requires: technical and organisational measures giving a level of security appropriate to the risk. The measures are listed in Annex B.

The Council authorises the Processor to engage the sub-processors listed in Annex C for the purposes stated there, and gives its general written authorisation for additions and replacements made under clauses 6.3 and 6.4.

The Processor has in place with each sub-processor that processes the Council's personal data a written contract that imposes data protection obligations no less protective, in substance, than those this agreement imposes on the Processor, in particular sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the UK GDPR. The Processor remains fully liable to the Council for each sub-processor's performance of those obligations. The terms relied on for each sub-processor are named in Annex C.

The Processor publishes its current list of sub-processors on its website and gives notice of an addition or replacement by updating that list at least 30 days before the new sub-processor processes the Council's personal data.

Objecting. The Council may object in writing within 30 days of the list being updated, giving its reasons. On an objection the parties discuss it in good faith. If it is not resolved within a reasonable time, the Council may end the service without charge, and the Processor exports and returns the Council's data under clause 9. The Processor does not begin using the new sub-processor for the Council's data while a timely objection is unresolved.

If a request from an individual reaches the Processor, the Processor does not answer it on the Council's behalf. It passes the request to the Council's clerk within a reasonable time, and tells the individual that it has done so.

The Processor assists the Council with subject access, rectification, erasure, restriction, portability and objection requests by appropriate technical and organisational measures, taking into account the nature of the processing.

When the Council stops using Quorate, for any reason, the Processor exports everything it holds for the Council to the Council, and then deletes it. The Council may instead ask for return without deletion, or for the deletion of a particular record, and the Processor follows the instruction it is given.

The export. A complete copy in a machine-readable format: the minute book and the signed minutes, agendas, meetings, the notice and summons record, delivery evidence, councillor records, actions arising and the audit trail. The Processor provides it within a reasonable time of the request and without charge.

The deletion. Once the Council confirms in writing that the export is complete, the Processor deletes everything it holds for the Council, including the minute book and the signed minutes, within a reasonable time of that confirmation, unless UK law requires it to keep something. If the Council has not confirmed within six months of the export being delivered, the Processor may delete after giving the Council 30 days' written notice. The Processor confirms to the Council in writing what was deleted, when, and anything the law required it to keep. The same deletion is made at each sub-processor that held a copy.

A deleted record survives in the database provider's point-in-time recovery history for no more than seven days and is not retained after that.

The Processor makes available to the Council all information necessary to demonstrate compliance with Article 28, within a reasonable time of a written request.

The Processor allows for and contributes to audits and inspections carried out by the Council or by an auditor the Council appoints, on 30 days' written notice, during business hours, once in any twelve months at the Council's own cost. After a personal data breach affecting the Council the limit does not apply and the Processor bears its own costs of the audit.

An auditor the Council appoints must not be a competitor of the Processor and must accept reasonable confidentiality terms.

The Processor registers with the Information Commissioner as a fee payer, in its own right as controller of clerks' account data, within 14 days of this agreement being signed, and gives the Council its registration number.

The Processor notifies the Council without undue delay after becoming aware of a personal data breach affecting the Council's personal data, with whatever is known at that point.

Notification is by email from hello@quorate.org to the clerk and to the Chairman.

The notification includes, so far as known: what happened and when, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the Processor's contact point. Where the full picture is not yet available, the Processor sends what it has and follows up as more is known.

The Council decides whether to notify the ICO. The Article 33 duty to notify the ICO is the Council's. The Processor supplies the facts, the timeline and any technical assistance needed, and does not report to the ICO on the Council's behalf unless the Council asks in writing.

Nothing in this agreement limits or excludes either party's liability to a data subject under Article 82 of the UK GDPR, either party's right to claim back from the other its share of compensation paid under Article 82(5), or any liability that the law does not allow to be limited.

Subject to clause 12.1, the Processor's total liability to the Council arising out of or in connection with this agreement, however it arises, is limited to the greater of £5,000 and the total fees the Council paid the Processor for the service in the twelve months before the event giving rise to the claim.

This agreement starts on the date of signature and runs for as long as the Processor processes personal data for the Council, whatever the status of any other agreement between them.

Any variation is in writing and signed by both parties, except a sub-processor change made under clause 6.3.

A notice under this agreement is given in writing, by email or by post.

To the Processor: by email to hello@quorate.org, or by post to the registered office in clause 1.1. A data protection question or a rights request may also be sent to privacy@quorate.org.

To the Council: by email to the clerk and, for a notice under clause 11, to the Chairman as well, at the email addresses the Council gives the Processor in writing when the Council is set up and whenever they change; or by post to the address the Council gives for the purpose.

Email is accepted for service. A notice sent by email is treated as given on the next working day after it is sent, except a breach notification under clause 11, which is given when it is sent.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.