Last updated: 10th December 2024.
This Arbor Data Processing Agreement (or Arbor DPA) forms part of the Harrap ICT Arbor Support Terms of Use, as updated from time to time, between Harrap ICT (as defined below) and you, the Customer (as defined below). The latest version of our Arbor Support Terms of Use are located at www.harrap.it/legal/arbor-terms-of-use/.
This Arbor DPA only applies where a Customer qualifies as a Data Controller with respect to the Personal Data which Harrap ICT Processes on behalf of that Customer under Applicable Data Protection Law (as defined below).
On the basis of the above, the parties agree as follows:
For the purposes of this Arbor DPA:
2.1 The Customer (the Controller) appoints Harrap ICT as a Processor to Process the Personal Data described in Appendix I
2.2 When Harrap ICT Processes Personal Data as a data Processor, it is acting as a data Processor on behalf of you, the data Controller
2.3 Harrap ICT will Process the data on the basis of the Controller’s documented instructions and as per the terms set out in this Arbor DPA, for the purposes described in the Arbor Support Terms of Use and this Arbor DPA
2.4 The Processing of Personal Data shall only take place to the extent necessary for Harrap ICT to provide the Services chosen by the Customer
3.1 The Personal Data Processed by the Processor may include, but is not limited to, the following types of data:
3.2 The categories of Data Subjects whose Personal Data will be Processed may include, but is not limited to:
3.3 The Customer will not disclose any “Special Categories of Personal Data” to Harrap ICT for Processing unless explicitly requested by Harrap ICT.
4.1 The Processor will Process Personal Data for the duration of the Arbor Support Terms of Use and this Arbor DPA and as necessary to fulfill the contractual relationship between the parties. Upon termination of this Arbor DPA, the Processor will archive all Personal Data for a period of up to 3 years and then delete the Personal Data, unless retention is required by law. The Customer may export the Personal Data prior to the end of their Subscription.
5.1 The Processor agrees to:
6.1 The Controller agrees to:
7.1 Harrap ICT will only transfer Personal Data outside of the European Economic Area (EEA) or the UK if it has been ensured that such transfers comply with the requirements of the GDPR, including the use of Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.
7.2 Harrap ICT will promptly inform you of any changes to the location(s) where the Personal Data is Processed.
8.1 Harrap ICT will provide reasonable assistance to the Controller in responding to requests from Data Subjects for exercising their rights under the GDPR (such as access, rectification, erasure, and portability) in a timely manner.
8.2 If the Processor receives a direct request from a Data Subject, the Processor will promptly notify the Controller and assist in responding.
9.1 Data Protection Impact Requirement. Harrap ICT shall, in accordance with Applicable Data Protection Laws, carry out a Data Protection Impact Assessment (DPIA) for any new Processing activity that is likely to result in a high risk to the rights and freedoms of individuals. The DPIA shall be conducted prior to the initiation of such Processing.
9.2 Notification of Processing Risks. In the event that the DPIA identifies a high risk to the privacy or data protection rights of Data Subjects, the Processor shall promptly notify the Data Controller of the identified risks and provide reasonable cooperation in connection with any DPIA that may be required under Applicable Data Protection Law.
10.1 You consent to Harrap ICT engaging subprocessors to Process Personal Data as necessary to perform the services. Harrap ICT’s list of subprocessors is located at www.libresoft.co.uk/legal/subprocessors (“Harrap ICT Subprocessor List”). You acknowledge that Harrap ICT’s subprocessors are essential to provide the services.
10.2 Harrap ICT shall ensure that the subprocessors are bound by the same data protection obligations as those in this Arbor DPA.
10.3 If a subprocessor fails to fulfill its data protection obligations, Harrap ICT will remain liable to you for the acts and omissions of its subprocessor to the same extent Harrap ICT would be liable.
11.1 The Processor agrees to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including but not limited to:
12.1 The Processor agrees to notify the Controller without undue delay after becoming aware of any data breach involving Personal Data Processed under this Arbor DPA. The notification will include:
13.1 The Controller has the right to audit the Processor’s compliance with this Arbor DPA. The Processor agrees to cooperate with such audits, including by providing reasonable access to necessary records, systems, and personnel.
14.1 Harrap ICT will publish any changes to this Arbor DPA and endeavour to let you know of upcoming material changes with reasonable notice via email, system notifications or other methods at least 30 days before the changes take effect. You may reasonably object to a change on legitimate grounds within 30 days after Harrap ICT publishes any changes or provides notice of the change, and you may choose to suspend or terminate the Arbor DPA without penalty (without prejudice to any Subscription Fees incurred by the Customer up to and including the date of suspension or termination).
15.1 This Arbor DPA will terminate upon termination or expiration of the main Arbor Support Terms of Use between the parties.
The subject matter of Personal Data to be Processed is that of (as applicable) the Authorised Users, employees, customers, visitors and/or volunteers of the Customer entered by or at the election of the Customer into the Harrap ICT Services.
The duration of Processing Personal Data shall be for as long as We maintain a business relationship with the Customer. Once this relationship ends, We will follow the procedures outlined in clause 4.1 for the deletion of the Personal Data.
The nature and purpose of Processing Personal Data is to enable the functionality of the Harrap ICT Services as set out in the Arbor Support Terms of Use, this Arbor DPA and related documentation.
The types of Personal Data Processed include:
a) Names
b) Contact details
c) Other Personal Data types for use in the Harrap ICT Services
The categories of Data Subjects include the following with whom the Customer has a relationship:
a) Suppliers / Service providers
b) Customers / Clients
c) Employees / Contractors
d) Governors
e) Other contacts