UB - Data Processing Agreement (DPA)

Effective Date: [Insert Date]

This Data Processing Agreement ("DPA") forms part of the agreement between UB Ltd. ("UB ", "we", "us", or "our"), headquartered in London, United Kingdom, and any user or customer ("Controller" or "Customer") of UB services, where UB processes personal data on behalf of the Customer under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and EU GDPR where applicable.

1. Definitions

  • "Controller": The entity that determines the purposes and means of processing personal data.
  • "Processor": UB , which processes personal data on behalf of the Controller.
  • "Personal Data": Any information relating to an identified or identifiable natural person.
  • "Sub-processor": A third party engaged by UB to process personal data on its behalf.

2. Roles and Responsibilities

UB acts as the Processor with respect to personal data processed in the provision of its services.

The Customer remains the Controller and is responsible for ensuring that data subjects are informed of their rights and the data processing activities.

3. Subject Matter and Duration

This DPA governs the processing of personal data as necessary to provide services to the Customer for the duration of the service agreement.

4. Nature and Purpose of Processing

The processing will involve data hosting, collaboration tools (e.g., email, chat, file sharing), support services, and related functionalities, as described in the primary service agreement.

5. Categories of Data Subjects and Data

Data Subjects:

Employees, customers, contractors, users, and other data subjects as determined by the Customer.

Personal Data:

  • Names
  • Email addresses
  • Contact details
  • File contents
  • Metadata
  • Communication logs
  • Other user-generated content

6. Sub-processors

UB may engage third-party Sub-processors to provide its services. UB shall:

  1. Maintain an up-to-date list of Sub-processors (available upon request)
  2. Inform the Controller of any changes to Sub-processors and allow objections within 14 days
  3. Ensure each Sub-processor is bound by obligations equivalent to this DPA

7. Security Measures

UB implements appropriate technical and organizational measures including:

  • Encryption of data in transit and at rest
  • Access control and authentication
  • Regular security assessments
  • Backup and disaster recovery plans

8. Data Subject Rights

UB shall assist the Controller in responding to requests from data subjects to exercise their rights under applicable laws, including access, rectification, erasure, restriction, portability, and objection.

9. Data Breach Notification

In the event of a personal data breach, UB shall notify the Controller without undue delay and provide relevant information for the Controller to meet any reporting or notification obligations.

10. Data Transfers

UB may transfer personal data outside the UK or EEA in compliance with applicable data protection laws, using appropriate safeguards such as Standard Contractual Clauses (SCCs).

11. Audit and Compliance

UB shall make available all information necessary to demonstrate compliance with this DPA and allow for audits by the Controller or an authorized third-party auditor, provided reasonable notice is given.

12. Return or Deletion of Data

Upon termination of services, UB shall, at the Controller’s choice, return all personal data or delete it unless otherwise required by law to retain it.

13. Governing Law

This DPA shall be governed by the laws of England and Wales.

14. Contact

UB Ltd.
[Insert Registered Address]
London, United Kingdom
Email: [Insert Contact Email]