Data Processing Agreement (GDPR)

This Data Processing Agreement ("Agreement") forms part of the agreement between BCR Comply Limited ("Processor") and the Customer ("Controller") for the provision of the BCR Comply software platform.

The purpose of this Agreement is to satisfy the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

For the purposes of Customer Data processed within the BCR Comply platform:

The Customer acts as the Data Controller.

BCR Comply Limited acts as the Data Processor.

The Customer determines the purposes and means of processing personal data.

BCR Comply processes personal data only on documented instructions from the Customer, except where otherwise required by applicable law.

BCR Comply provides cloud-based software enabling Customers to manage projects, compliance records, surveys, forms, appointments, photographs, documents and related business information.

Processing activities may include:

• collection;
• storage;
• organisation;
• retrieval;
• transmission;
• backup;
• display;
• reporting; and
• deletion where instructed or required by law.

The processing is carried out for the purpose of providing, maintaining, securing and supporting the BCR Comply Service for the Customer.

Processing will continue for the duration of the Customer's use of the Service and for any subsequent period during which BCR Comply is required to retain or process Customer Data in accordance with this Agreement, the Customer's instructions or applicable law.

Depending upon how the Customer uses the Service, personal data may include:

• names;
• addresses;
• email addresses;
• telephone numbers;
• project information;
• appointment information;
• survey responses;
• compliance documentation;
• photographs;
• contractor information;
• property information; and
• other information uploaded or entered into the Service by the Customer or its authorised users.

Categories of data subjects may include:

• the Customer's employees and personnel;
• contractors and subcontractors;
• customers and homeowners;
• property occupants;
• surveyors, installers and other project participants; and
• other individuals whose information is entered into the Service by the Customer.

The Customer is responsible for determining what personal data is entered into the Service.

BCR Comply agrees to:

• process personal data only on documented instructions from the Customer, unless otherwise required by applicable law;
• ensure persons authorised to process personal data are subject to appropriate confidentiality obligations;
• implement appropriate technical and organisational security measures;
• assist the Customer in responding to requests from data subjects where reasonably required;
• assist the Customer in meeting GDPR obligations relating to security, breach notification, data protection impact assessments and supervisory authority enquiries where reasonably required;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data;
• maintain appropriate records where required by law; and
• make available information reasonably necessary to demonstrate compliance with its obligations under this Agreement.

The Customer agrees to:

• ensure it has a lawful basis for processing personal data;
• provide all required privacy notices;
• respond to data subject requests;
• determine appropriate retention periods;
• ensure information entered into the Service is collected and processed lawfully;
• take reasonable steps to ensure information entered into the Service is accurate; and
• provide instructions to BCR Comply where necessary.

BCR Comply maintains appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures are reviewed periodically and may evolve over time to reflect changes in technology, security risks and the operation of the Service.

BCR Comply will ensure that all personnel authorised to process Customer Data are subject to appropriate confidentiality obligations.

The Customer provides BCR Comply with general authorisation to engage reputable third-party service providers where reasonably necessary to operate the Service, including providers of cloud hosting, data storage, backup, email delivery, authentication, monitoring and other supporting infrastructure.

BCR Comply will ensure that sub-processors are subject to appropriate contractual data protection obligations consistent with applicable data protection law.

BCR Comply will inform the Customer of intended material changes concerning the addition or replacement of sub-processors, thereby providing the Customer with an opportunity to raise reasonable objections on data protection grounds.

BCR Comply remains responsible for the performance of its sub-processors' data protection obligations as required by applicable law.

Where personal data is transferred outside the European Economic Area, BCR Comply will ensure that an appropriate lawful transfer mechanism or safeguard is in place as required by applicable data protection legislation.

Taking into account the nature of the processing, BCR Comply will provide reasonable assistance to enable the Customer to fulfil its obligations in responding to requests from data subjects.

If BCR Comply becomes aware of a personal data breach affecting Customer Data, it will notify the Customer without undue delay and provide available information reasonably required to assist the Customer in meeting its legal obligations.

Upon reasonable written request, and subject to appropriate confidentiality and security requirements, BCR Comply will make available information reasonably necessary to demonstrate compliance with this Agreement.

Where required under applicable data protection law, BCR Comply will allow for and contribute to reasonable audits or inspections carried out by the Customer or an appropriately authorised independent auditor acting on the Customer's behalf.

Any audit must be conducted in a manner that does not unreasonably disrupt BCR Comply's business operations or compromise the security or confidentiality of other customers' data.

Customer Data remains the property of the Customer.

Upon termination or expiry of the Services, and at the choice of the Customer, BCR Comply will either:

• return the Customer's personal data to the Customer and subsequently delete remaining copies; or
• delete the Customer's personal data,

unless applicable European Union or Member State law requires BCR Comply to retain some or all of the personal data.

Where retention is required by law, BCR Comply will continue to protect the retained personal data in accordance with applicable data protection requirements and will process it only to the extent required by law.

Where reasonably necessary to facilitate an orderly termination of the Service, BCR Comply may provide a limited period of read-only access to enable the Customer to retrieve or export its data before its chosen return or deletion process is completed.

This Agreement shall be governed by the laws of Ireland.

Any disputes arising from or in connection with this Agreement shall be subject to the exclusive jurisdiction of the Irish courts.

This Data Processing Agreement forms part of the agreement between BCR Comply Limited and the Customer for use of the BCR Comply Service.

By entering into the BCR Comply Terms and Conditions or otherwise agreeing to use the Service on behalf of the Customer, the Customer agrees to be bound by this Data Processing Agreement.

This Agreement may be accepted electronically and does not require a separate handwritten signature in order to form part of the agreement between BCR Comply Limited and the Customer.