Sprouto Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Contract entered into between SPROUTO LTD, trading as Sprouto ("Supplier" or "Sprouto"), and the organisation purchasing or receiving the Services ("Client").

This DPA applies where Sprouto processes Personal Data on behalf of the Client in its capacity as a Processor under the Data Protection Legislation.

This DPA supplements the Terms of Business and the applicable Statement of Work. It does not replace or remove either party's obligations under applicable Data Protection Legislation.

If there is a conflict between this DPA and the main Contract concerning the processing of Personal Data, this DPA takes precedence to the extent of that conflict.

The details of the processing, including the subject matter, duration, nature and purposes of processing, categories of Data Subjects and types of Personal Data, shall be set out in Schedule 1 or the relevant Statement of Work.

Each party shall comply with its respective obligations under applicable Data Protection Legislation in connection with the Contract.

The parties acknowledge that their respective roles as Controller, Processor or Joint Controller shall be determined by the actual nature and purposes of the processing activities and applicable law.

Where Sprouto processes Personal Data on behalf of the Client as a Processor:

(a) the Client shall act as Controller, unless otherwise agreed in writing;

(b) Sprouto shall act as Processor; and

(c) each party shall comply with the obligations applicable to its role under Data Protection Legislation.

Nothing in this DPA shall prevent Sprouto from acting as an independent Controller in respect of Personal Data it processes for its own legitimate business purposes, including its own billing, accounting, administration, legal compliance and business security activities.

Such independent processing is outside the scope of this DPA and shall be governed by Sprouto's Privacy Notice and applicable law.

The Client shall be responsible for:

(a) establishing and maintaining an appropriate lawful basis for the processing of Personal Data;

(b) ensuring that all necessary privacy notices have been provided to Data Subjects;

(c) ensuring that all necessary consents, permissions and authorisations have been obtained where required;

(d) ensuring that its instructions to Sprouto comply with applicable Data Protection Legislation;

(e) determining the purposes and essential means of the processing; and

(f) ensuring that the Personal Data provided to Sprouto is adequate, relevant and limited to what is necessary for the agreed purposes.

The Client shall provide Sprouto with documented instructions concerning the processing of Personal Data.

Such instructions may be included in the Statement of Work, this DPA, an agreed technical specification or subsequent written communications, including email.

The Client shall ensure that its instructions are sufficiently clear to enable Sprouto to perform the processing in accordance with the Contract.

The Client shall:

(a) maintain appropriate security measures for its own systems and access credentials;

(b) ensure that only authorised individuals have access to the Services and Personal Data;

(c) notify Sprouto promptly of any suspected compromise of Client credentials or systems that may affect the Services;

(d) cooperate reasonably with Sprouto in implementing appropriate security measures; and

(e) avoid providing Personal Data that is not necessary for the Services.

The Client shall notify Sprouto in writing before providing any Special Category Data or Personal Data relating to criminal convictions and offences, unless such processing has already been expressly agreed in the applicable Statement of Work.

The Client shall identify the additional safeguards and lawful conditions applicable to such processing.

Sprouto shall not be required to process such information unless the relevant processing arrangements have been agreed and appropriate safeguards have been established.

Sprouto shall:

(a) process Personal Data only in accordance with the Client's documented instructions, including instructions concerning international transfers, unless required to do otherwise by applicable law;

(b) where legally permitted, inform the Client before carrying out processing required by law that conflicts with the Client's instructions;

(c) process Personal Data only to the extent necessary to provide the Services or otherwise comply with the Contract and documented instructions;

(d) not use the Personal Data for its own independent commercial purposes or disclose it to third parties except as permitted under this DPA, the Contract or applicable law; and

(e) notify the Client promptly and, where practicable, within two (2) Business Days if Sprouto considers that an instruction infringes applicable Data Protection Legislation.

Sprouto shall ensure that all employees, contractors and other authorised individuals who have access to Personal Data:

(a) are subject to appropriate confidentiality obligations, whether contractual or statutory;

(b) receive access only to Personal Data necessary for their assigned responsibilities; and

(c) process Personal Data only in accordance with the Contract and documented instructions.

Sprouto shall maintain records of processing activities where required by applicable Data Protection Legislation.

Such records shall include information relating to the categories of processing performed on behalf of the Client, applicable subprocessors and relevant international transfers.

Sprouto shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures shall take into account:

(a) the nature, scope, context and purposes of processing;

(b) the likelihood and severity of risks to Data Subjects;

(c) the state of technological development; and

(d) the reasonable costs of implementation.

Depending on the Services, these measures may include:

• Access controls and appropriate authentication mechanisms.
• Encryption of data in transit and, where appropriate, at rest.
• Access restrictions based on personnel responsibilities.
• Appropriate logging and security monitoring.
• Secure development and deployment practices.
• Appropriate backup and recovery arrangements.
• Vulnerability management and security updates.
• Measures designed to ensure the ongoing confidentiality, integrity and availability of systems.
• Procedures for identifying, assessing and responding to security incidents.

The specific security measures applicable to an engagement may be further described in Schedule 3.

Taking into account the nature of the processing, Sprouto shall provide reasonable assistance to the Client in responding to requests from Data Subjects exercising their rights under Data Protection Legislation.

Where Sprouto receives a request directly from a Data Subject relating to Personal Data processed on behalf of the Client, Sprouto shall:

(a) notify the Client promptly and, where practicable, within two (2) Business Days;

(b) not respond to the request on the Client's behalf unless instructed by the Client or legally required to do so; and

(c) provide reasonable assistance to enable the Client to respond within applicable legal deadlines.

Such assistance may include searching for, retrieving, correcting, restricting, exporting or deleting relevant Personal Data, subject to the technical capabilities of the applicable Services and legal requirements.

Sprouto shall notify the Client promptly and, where practicable, within two (2) Business Days if it receives a communication from a supervisory authority or regulator relating directly to the processing of Personal Data under the Contract.

Sprouto shall provide reasonable cooperation and assistance in relation to any such communication, subject to applicable law.

Taking into account the nature of the processing and the information reasonably available to Sprouto, Sprouto shall provide reasonable assistance to the Client with:

(a) Data Protection Impact Assessments (DPIAs);

(b) consultations with supervisory authorities;

(c) assessments of processing risks; and

(d) other obligations arising under Data Protection Legislation in connection with the Services.

Where such assistance involves work outside the agreed scope of Services, Sprouto may charge reasonable additional Fees, provided these are agreed with the Client in advance.

If Sprouto is required by law to process Personal Data in a manner not otherwise authorised by the Client, Sprouto shall, where legally permitted, inform the Client of the relevant legal requirement before performing the processing.

Sprouto shall notify the Client without undue delay and, where practicable, within twenty-four (24) hours after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Client.

The notification shall, to the extent information is available, include:

(a) a description of the nature of the breach;

(b) the categories and approximate number of Data Subjects affected;

(c) the categories and approximate number of Personal Data records affected;

(d) the likely consequences of the breach;

(e) the measures taken or proposed to address and mitigate the breach; and

(f) the contact details of the person responsible for coordinating the incident response.

Where all information is not available at the time of the initial notification, Sprouto may provide the information in phases without undue further delay.

Sprouto shall:

(a) investigate the breach and take reasonable steps to contain and mitigate its effects;

(b) preserve relevant information and evidence where reasonably necessary;

(c) provide reasonable cooperation to the Client in meeting its regulatory and notification obligations; and

(d) keep the Client reasonably informed of material developments.

The Client shall remain responsible for determining whether a breach must be reported to a supervisory authority or communicated to affected Data Subjects, except where Sprouto has an independent legal obligation to make such a notification.

The parties shall cooperate in good faith in connection with any Personal Data Breach and shall not unreasonably delay the provision of relevant information.

The Client provides Sprouto with general written authorisation to engage subprocessors to process Personal Data where reasonably necessary for the performance of the Services.

The categories of currently identified subprocessors and their intended functions are set out in Schedule 2.

Sprouto shall notify the Client of any intended addition or replacement of a subprocessor that will process the Client's Personal Data.

Where reasonably practicable, Sprouto shall provide at least thirty (30) days' prior written notice of the proposed change.

The Client may object to a proposed subprocessor on reasonable data protection grounds within fifteen (15) days of receiving notification.

Where the Client raises a reasonable objection, the parties shall discuss the objection in good faith and attempt to identify an appropriate alternative arrangement.

If Sprouto cannot reasonably accommodate the objection, the parties may agree to:

(a) use an alternative subprocessor or service;

(b) modify the relevant processing arrangements; or

(c) terminate the affected Services without penalty for the Client, subject to payment of Fees properly accrued and approved non-cancellable costs incurred before termination.

Sprouto shall not be required to use a subprocessor to which the Client has reasonably objected on data protection grounds.

Sprouto shall ensure that each subprocessor processing Personal Data on behalf of the Client is subject to written contractual obligations providing an appropriate level of data protection.

Such obligations shall include, where applicable:

(a) processing Personal Data only for authorised purposes;

(b) maintaining appropriate technical and organisational security measures;

(c) ensuring confidentiality;

(d) providing assistance in relation to Data Subject requests and security incidents;

(e) complying with applicable international transfer requirements; and

(f) deleting or returning Personal Data when the relevant services end, subject to applicable legal retention requirements.

Sprouto shall remain responsible to the Client for the performance of its subprocessors' data protection obligations to the extent required by applicable Data Protection Legislation and the Contract.

Sprouto shall not transfer Personal Data to a separate organisation outside the United Kingdom in circumstances requiring an international transfer safeguard unless an appropriate transfer mechanism is in place in accordance with applicable Data Protection Legislation.

Where a restricted transfer is required, Sprouto shall ensure that the transfer is covered by one of the following, as applicable:

(a) UK adequacy regulations;

(b) an appropriate safeguard, including the UK International Data Transfer Agreement (IDTA);

(c) the UK Addendum to the European Commission's Standard Contractual Clauses, where appropriate; or

(d) another valid transfer mechanism or exception permitted by applicable Data Protection Legislation.

Where appropriate safeguards are relied upon, the parties shall cooperate in completing any required transfer risk assessment and implementing any supplementary measures reasonably necessary to protect the Personal Data.

Sprouto shall ensure that its authorised subprocessors comply with applicable international transfer requirements when processing Personal Data on behalf of the Client.

Where the Client instructs Sprouto to transfer Personal Data to a recipient outside the United Kingdom, the Client shall identify the intended recipient, destination and purpose of the transfer.

The parties shall cooperate to establish the appropriate transfer mechanism before the relevant transfer takes place.

Details of the relevant subprocessors, processing locations and applicable transfer safeguards shall be maintained in the subprocessor information provided under Schedule 2 or an updated subprocessor register.

Sprouto shall make available to the Client information reasonably necessary to demonstrate compliance with its obligations under this DPA and applicable Processor obligations under Data Protection Legislation.

The Client may conduct an audit or appoint an independent auditor to conduct an audit of Sprouto's relevant processing activities, subject to the following conditions:

(a) the Client provides at least thirty (30) days' written notice;

(b) the audit is limited to systems, processes and facilities relevant to the processing of the Client's Personal Data;

(c) the audit is carried out during normal business hours;

(d) the auditor is subject to appropriate confidentiality obligations;

(e) the audit does not unreasonably disrupt Sprouto's business operations or compromise the security or confidentiality of other clients' information; and

(f) the Client bears the reasonable costs of the audit unless the audit identifies a material failure by Sprouto to comply with this DPA.

Sprouto may initially satisfy reasonable audit requests by providing relevant documentation, questionnaires, independent security reports, certifications or other appropriate evidence of compliance.

The Client shall not be entitled to unrestricted access to Sprouto's systems, source code, other clients' information or confidential third-party materials.

If an audit identifies material non-compliance with this DPA, Sprouto shall take reasonable steps to address the identified issue within an appropriate timeframe, taking into account the severity and nature of the issue.

Nothing in this clause prevents a party from complying with a binding request or requirement from a competent supervisory authority.

Upon completion, expiry or termination of the Services, or upon the Client's written request where processing is no longer necessary, Sprouto shall, at the Client's choice:

(a) return the Personal Data processed on the Client's behalf in a reasonably accessible format; or

(b) securely delete or destroy the Personal Data.

Sprouto shall, subject to applicable law and the technical limitations of routine backup systems, delete existing copies of the Personal Data held on behalf of the Client.

Where Personal Data is retained in routine backups or archives that cannot reasonably be individually deleted immediately, Sprouto shall:

(a) ensure that the information is placed beyond active use;

(b) maintain appropriate security protections;

(c) not restore or otherwise process the information except where required for legitimate disaster recovery or legal purposes; and

(d) delete the information in accordance with the applicable backup-retention cycle.

Sprouto may retain Personal Data where required by applicable law, provided that:

(a) the Personal Data is retained only for the period required;

(b) it remains protected under appropriate security measures; and

(c) it is not processed for any other purpose.

The Client acknowledges that the deletion of data held by independent third-party Controllers is subject to their own applicable privacy arrangements and legal obligations.

Each party shall be responsible for complying with its own obligations under this DPA and applicable Data Protection Legislation.

Each party shall be responsible for losses, claims, damages, liabilities and reasonable costs to the extent arising from its own breach of this DPA or failure to comply with applicable Data Protection Legislation.

Where a party seeks compensation or indemnification from the other party, it shall provide reasonable details of the relevant claim and allow the other party an opportunity to investigate and respond.

Subject to applicable law, liability arising under or in connection with this DPA shall be subject to the limitations and exclusions set out in the main Contract.

Nothing in this DPA excludes or limits any liability that cannot lawfully be excluded or limited, or affects the statutory rights of Data Subjects.

This DPA shall commence on the date the relevant Contract becomes effective and shall continue for as long as Sprouto processes Personal Data on behalf of the Client.

The termination of this DPA shall not affect any obligations which, by their nature, are intended to continue after termination, including confidentiality, security, deletion, retention and liability obligations.

The obligations relating to the return or deletion of Personal Data shall continue until the applicable data has been returned, deleted or retained in accordance with this DPA and applicable law.

Any amendment to this DPA shall be agreed in writing by both parties.

Any notices under this DPA shall be provided in writing using the contact details set out in the relevant Contract or SOW.

If any provision of this DPA is found to be invalid or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, where legally possible. The remaining provisions shall remain in full force and effect.

This DPA shall be governed by and interpreted in accordance with the laws of England and Wales.

The courts of England and Wales shall have exclusive jurisdiction over disputes arising out of or in connection with this DPA, subject to the dispute resolution provisions in the main Contract.

Controller / Client: The organisation identified in the relevant SOW.

Processor / Supplier: SPROUTO LTD, trading as Sprouto.

The provision of software development, AI implementation, consulting, engineering, hosting, support, data processing, integration and other related Services specified in the relevant Statement of Work.

For the duration of the applicable Contract and any subsequent period necessary to complete agreed transition, return, deletion or legally required retention activities.

Depending on the Services, processing may include:

• Collection and receipt of Personal Data from the Client.
• Hosting and storage of Personal Data.
• Access, retrieval and organisation of information.
• Software development, testing and integration.
• Data analysis and transformation.
• Transmission to authorised service providers.
• AI model processing where expressly agreed.
• Customer support and troubleshooting.
• Backup, recovery and security monitoring.
• Return or deletion of Personal Data.

Depending on the Services, Data Subjects may include:

• The Client's employees and personnel.
• The Client's customers and prospective customers.
• The Client's suppliers and business contacts.
• End users and registered users of the Client's services.
• Website visitors and application users.
• Other individuals whose data is supplied or made accessible by the Client.

Depending on the Services, Personal Data may include:

• Names and contact information.
• Business contact details and job titles.
• Account identifiers and user IDs.
• Authentication and access information.
• Transaction and billing information.
• Communication records and customer support information.
• Device, technical and usage information.
• IP addresses and online identifiers.
• Uploaded documents, files and associated metadata.
• Other information provided by or on behalf of the Client.

Special Category Data and Personal Data relating to criminal convictions and offences shall not be included unless expressly agreed in the relevant SOW or other documented instructions, together with the appropriate safeguards and lawful conditions.

The Controller retains responsibility for determining the purposes and lawful basis of processing and for issuing documented instructions to the Processor.

The Controller may exercise its rights under this DPA, including requesting information, exercising audit rights and instructing the return or deletion of Personal Data.

(a) The actual legal entity contracting with Sprouto, relevant services and processing locations shall be recorded in Sprouto's current subprocessor register.

(b) The use of PostgreSQL or another database technology does not, by itself, constitute engagement of a separate subprocessor. The hosting provider must be identified where it processes Personal Data.

(c) Stripe and Xero may process information for payment, fraud-prevention, accounting and regulatory purposes under their own terms. Their role must be assessed for the particular processing activity. They shall be treated as subprocessors under this DPA only where they process Personal Data on behalf of Sprouto in that capacity.

(d) A provider's inclusion in this Schedule does not authorise Sprouto to transfer Personal Data in breach of the international transfer provisions of this DPA.

(e) Any provider not listed above that is required to process Client Personal Data shall be subject to the notification and authorisation procedure in clause 6.