Data Processing Agreement

1. Parties, roles and processing particulars

The supplier is Chronicle Atlas Ltd, trading as treleto. The customer is the business named in the accepted order. Data Protection Law means applicable UK data-protection law, including the UK GDPR and Data Protection Act 2018 as amended, and EU GDPR where applicable. Statutory terms have their statutory meanings.

The customer is controller and we are processor for personal data processed on its instructions (Customer Personal Data). If it acts as processor, it confirms authority from the relevant controller to appoint us as subprocessor. We separately control necessary account administration, billing and service-security records as described in the privacy notice.

• Subject and duration: the agreed Business Desk service for its term and the necessary, bounded return/deletion period.
• Purpose and operations: requested evidence gathering, extraction, analysis, research, planning, people/role information, reports, exports and support; collection, transmission, organisation, storage, retrieval, correction and erasure.
• People: authorised users, staff, directors, suppliers, clients, prospects and ordinary business contacts lawfully supplied or researched on documented instructions.
• Information: names, business contacts, roles, public source references, relevant ordinary correspondence and incidental personal data in permitted business reports. Non-personal financial/commercial information remains confidential under the service agreement.
• Excluded information: special-category and criminal-offence data, children’s data, privileged files, identification documents, individual payroll/bank details, payment-card information and authentication secrets, unless expressly assessed and agreed with additional safeguards.

2. Documented instructions

We shall process Customer Personal Data only on documented instructions, including instructions about transfers, unless required by applicable law. We shall tell the customer of a legal requirement beforehand unless prohibited. The agreement, enabled features and authenticated authorised requests form the instructions. New purposes require written agreement. We shall immediately inform the customer if we believe an instruction infringes Data Protection Law and suspend that instruction while resolving it.

The customer determines lawful purposes, notices, bases and accuracy. We shall not reclassify workspace information to reuse it for our own unrelated purposes, shared-model training, marketing or publicity.

3. Confidentiality and security

We shall ensure that authorised personnel are subject to enforceable confidentiality duties and have access only as needed for their work. Taking account of the state of the art, implementation cost, nature, scope, context, purposes and risks, we shall implement appropriate technical and organisational measures to protect confidentiality, integrity, availability and resilience, restore access following an incident and regularly assess effectiveness.

Measures shall include authenticated and authorised access, separation of customer records, protected transmission, secure credential handling, least-privilege administration, change and vulnerability management, recovery arrangements, deletion controls and incident handling. Specific tested recovery times, backup expiry and any additional customer requirements must be recorded in the agreed security schedule; this clause does not assert a certification or an untested numeric service level. Agreed protections shall not be materially reduced without equivalent safeguards.

4. Subprocessors and changes

The customer gives general written authorisation only for subprocessors identified in the provider register incorporated into its order. We shall impose equivalent applicable data-protection obligations by binding contract, assess suitability and remain responsible to the customer for their performance.

We shall give at least 30 days’ advance written notice of intended additions or replacements and allow reasonable data-protection objections. We shall seek a reasonable alternative; if none resolves the concern, the customer may terminate the affected service before the change and receive a refund for unused prepaid service. Customer Personal Data shall not be sent to a proposed new recipient while an objection remains unresolved. Upstream changes must be managed consistently with this obligation.

5. International transfers

We shall not make or authorise a restricted transfer without documented instructions and a lawful mechanism. The incorporated register shall identify the recipient, purpose, relevant countries and applicable safeguard. Where required, approved UK IDTA/Addendum or EU standard contractual clauses and the necessary transfer assessment must be completed. A UK database region or encryption alone is not a transfer mechanism. The public directory is not a substitute for the agreed register.

6. Rights and regulatory assistance

Taking account of the nature of processing, we shall assist through appropriate technical and organisational measures with individual rights requests. We shall promptly forward relevant requests to the customer, responding substantively only on instructions or where legally required. We may explain how to contact the controller. Identity, confidentiality and others’ rights must be protected.

Taking account of the processing and information available to us, we shall assist with security duties, breach assessment/notifications, data protection impact assessments and consultation with regulators. Reasonable assistance charges may be agreed in advance, but shall not delay mandatory assistance or remedy of our breach.

7. Personal data breaches

We shall notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, without waiting for a completed investigation. Initial information shall include available details of the incident, affected categories and approximate numbers where known, likely consequences, containment and a contact. Further information shall follow without undue further delay. We shall preserve relevant evidence, mitigate harm, cooperate and document remediation. Contact us at support@brighterdesk.com.

The customer normally decides its controller notifications; each party retains its own legal duties. An unsuccessful attack without a personal data breach does not automatically require breach notification.

8. Compliance information and audits

We shall make available information necessary to demonstrate compliance with these duties and allow and contribute to audits, including inspections, by the customer or its mandated auditor. Reasonable confidentiality, safety and scheduling arrangements must not obstruct legal rights or urgent incident/regulatory checks. Other customers’ information must remain protected. Assurance reports may support review but do not replace inspection rights where required.

9. Return, deletion and continuing duties

At the end of the service, we shall, at the customer’s choice, return or delete Customer Personal Data and delete remaining copies unless law requires retention. The accepted order/security schedule must specify supported active-copy and maximum backup deletion periods before processing begins. We shall seek the customer’s choice before expiry. If it does not respond, we shall give at least 14 days’ written notice and then delete within the agreed period.

Return includes a machine-readable export and available report exports. Backups shall be isolated from ordinary use pending expiry; restores must reapply erasure instructions before access resumes. We shall require subprocessor compliance, document lawful exceptions and confirm completion on request. Failed deletions must be tracked to resolution. Legally retained data is restricted to its required purpose.

Confidentiality, security and deletion obligations continue while personal data is retained. This DPA does not authorise indefinite retention or reduce individuals’ rights or either party’s statutory obligations.