Terms & Conditions.

Master Terms & Conditions

Rabb-IT (IT) Limited (“Supplier”) provides a range of services including managed services and professional services and resells various cloud services including Microsoft cloud services, in accordance with these terms and conditions and the applicable ‘Associated Agreement’. The Supplier may amend or replace these terms and conditions on one month’s written notice to the Customer at any time (for existing Contracts the terms and conditions in place at the time that the Contract was made continue to apply for that Contract, unless the Customer agrees otherwise in writing). By ordering services such as managed services, professional services and/or cloud services from the Supplier, the Customer accepts the terms and conditions that apply at that time. Any additional or different terms that the Customer includes in any communication with the Supplier will not be binding on the Supplier or included in any Contract unless expressly agreed upon in writing by the Supplier.

Definitions and interpretation

Definitions: In these Master Terms and Conditions:

“Associated Agreement” means:

any agreement or statement of work or statement of supply that is entered into between the parties which is made pursuant to these terms and conditions (for example by referencing that it is made under these Master Terms and Conditions) and may include by way of example only a ‘Managed Services Agreement’ or ‘Statement of Work – Managed Services’, and/or ‘Cloud Supply Agreement’ or ‘Statement of Supply – Cloud Supply’;
the Quotation; and
any additional terms and conditions (including by way of example only the ‘Professional Services Terms and Conditions’) together with:

the relevant order, proposal, statement of work or other document that is accepted and agreed by the Customer in the manner required under those additional terms and conditions; or
a request by the Customer of a type which is anticipated and not out of scope in any way under those terms and conditions and which is accepted by the Supplier in the manner required under those additional terms and conditions (including a request that is not required to be in writing where applicable under those additional terms and conditions, such as a request that is a “Small Task” under the Professional Services Terms and Conditions),

which are expressed as being subject to these Master Terms and Conditions.

“Confidential Information” means any information (however preserved or recorded) disclosed in confidence to one party by the other party including, but not limited to:

the existence of this Contract;
any information that would be regarded as confidential by a reasonable business person relating to the business, assets, affairs, customers, clients, suppliers, or plans, intentions, or market opportunities of the disclosing party and the operations, processes, product information, know-how, designs, trade secrets or software of the disclosing party;
any information developed by the parties in the course of carrying out the Contract; and
any information expressly designated as being confidential by the Supplier.

but does not include any information which is:

on receipt by the receiving party, in the public domain or which subsequently enters the public domain without any breach or default by the receiving party;
on receipt by the receiving party, already known by that party (otherwise than as a result of disclosure by the other party);
at any time after the date of receipt by the receiving party, received in good faith by the receiving party from a third party; or
required by law to be disclosed by the recipient party,

“Contract” means these terms and conditions and the GDPR Attachment, and the relevant Associated Agreement;

“Customer Data” means the Customer’s data including all text, sound, video or image files and the Customer’s software and includes Personal Data;

“Data Protection Laws” means the GDPR as incorporated into UK law by the UK Data Protection Act 2018, and the UK Data Protection Act 2018 itself, and, to the extent applicable, the data protection or privacy laws of any other country, and includes any statutory modification or re-enactment of such laws for the time being in force;

“Force Majeure Event” means any event, circumstance or cause beyond the reasonable control of the affected party;

“GDPR” means the EU General Data Protection Regulation 2016/679;

“Intellectual Property” patents, rights to inventions, copyright and related rights, trade marks, trade names, domain names, rights in get-up, rights in goodwill or to sue for passing off, unfair competition rights, rights in designs, rights in computer software, database right, topography rights, moral rights, rights in confidential information (including without limitation know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all existing and future rights capable of present assignment, applications for and renewals or extensions of those rights, and all similar or equivalent rights or forms of protection in any part of the world;

“Payment Terms Policy” means the policy included as an attachment to these terms and conditions:

“Personal Data” means any information relating to an identified or identifiable natural person, as defined in the Data Protection Laws;

“Personal Data Breach” has the meaning given to that term in the Data Protection Laws (and includes unauthorised access to, unauthorised disclosure of, or loss of, Personal Data), in respect of Personal Data that is Processed by the Supplier under a Contract);

“Processing” has the meaning given to that term in the Data Protection Laws, in respect of any operation which is performed on Personal Data by the Supplier (whether or not by automated means, and includes but is not limited to collection, recording or storage of the Personal Data), in respect of and ‘Process’ and ‘Processed’ has/have a corresponding meaning;

“Products, Deliverables and Services” means the products, deliverables and/or services provided under an Associated Agreement, as described in the relevant Associated Agreement;

“Working Day” means a day other than a Saturday, Sunday or public holiday in England.

Interpretation

In these terms and conditions, reference to the plural includes reference to the singular, and vice versa.
Headings inserted in these terms and conditions are for convenience of reference only and do not affect the interpretation of these terms and conditions.

Term

Each Contract will commence on the date specified in the relevant Associated Agreement or if not specified will commence on the date that the Associated Agreement is signed by both parties or, where signing by both parties is not required, on the date that the Customer accepts in writing or signs the relevant Associated Agreement (as applicable).
Each Contract will, subject to the parties’ rights of earlier termination, continue:

for the term specified in the relevant Associated Agreement (including any roll over periods); or
if no term is specified, until terminated in accordance with the relevant Associated Agreement or under the termination provisions in these terms and conditions; and
for a further period of twelve (12) months subject to clause 13.1 on notice of termination

Order of precedence

If there is any conflict or inconsistency between these terms and conditions and an Associated Agreement, the following order of precedence applies to the extent of that conflict or inconsistency (listed below in order of high to low priority):

the GDPR Attachment to these terms and conditions;
each Associated Agreement (with the order of priority of the parts of each Associated Agreement being as described in the relevant Associated Agreement);
these terms and conditions.

Products, Deliverables and Services

The Suppler will provide Products, Deliverables and Services (as applicable) to the Customer:

in accordance with each Associated Agreement;
using reasonable care and skill;
using people who have the necessary skills and experience; and
in accordance with all applicable laws.

If the Customer requests services which are not covered by an existing Associated Agreement, the Change Control process set out in Schedule 3 shall apply.
The Customer will:

only use the Products, Deliverables and Services for lawful purposes and not for fraudulent, illegal or destructive purposes;
adhere to any specific requirements or restrictions in respect of the Products, Deliverables and Services included or referenced in an Associated Agreement;
not sell, re-sell, or otherwise provide the Products, Deliverables and Services to any third party unless such selling, re-selling, or provision is expressly permitted or anticipated in the relevant Associated Agreement;
not decompile, modify, alter or amend in any way the Products, Deliverables and Services; and
not allow the Products, Deliverables or Services to be affected by any virus or destructive media, or use the Products, Deliverables or Services in any way which is intended to be, or is, detrimental to:

the use of those Products, Deliverables or Services by other customers of the Supplier or other users; or
the systems utilised to provide the Products, Deliverables and Services.

Customer’s obligations

Without limiting the Customer’s obligations under any Associated Agreement, the Customer will:

where required to provide data to the Supplier, provide that data in a format suitable for import and otherwise as reasonably requested by the Supplier;
where the Supplier’s personnel will work on site at the Customer’s premises, provide all necessary access to the Customer’s premises, personnel and data, and such office accommodation and other facilities, as may reasonably be required by the Supplier and agreed by the Customer in advance for the purposes of the provision of the Products, Deliverables and Services.
ensure the safety of the Supplier’s personnel while on the Customer’s premises in accordance with all applicable health and safety legislation;
meet all of the Customer’s obligations as specified in these terms and conditions and in each Associated Agreement;
where applicable in light of the services provided under an Associated Agreement, undertake frequent and adequate backups of the Customer’s data, except and to the extent that the Supplier is providing relevant backup services under an Associated Agreement or under another written agreement between the parties. The Customer should ensure that backups are always completed, as well as ensuring the backups are secure and checking that they can be successfully restored;
make available to the Supplier in a timely manner (and in accordance with any timeframes which the Customer has agreed to) all assistance (including availability of relevant personnel), permissions (including permissions from any relevant third parties), information, facilities and access to systems reasonably required by the Supplier;
provide, in a timely manner, such information as the Supplier may request, to provide the Products, Deliverables and Services and ensure that all information the Customer provides is accurate in all material respects; and
follow the Supplier’s reasonable directions.

Pricing and payment

Each Associated Agreement will specify the basis of the Supplier’s charges for the relevant supply of Products, Deliverables and Services and the Supplier will invoice the Customer accordingly. All amounts specified in an Associated Agreement are exclusive of any taxes unless expressly specified otherwise.
Unless otherwise specified in an Associated Agreement, all invoices issued by the Supplier are due for payment by the Customer 14 days after the date of the invoice.
The full Payment Terms Policy is included
All reasonable accommodation, travel and other expenses incurred in providing Products, Deliverables and Services to the Customer will be charged to the Customer provided that such expenses are identified and agreed in advance. Expenses will be invoiced on a monthly basis by the Supplier.
Subject to clause 6.5, the Customer shall pay all invoices in full without set-off or deduction of any kind.
If the Customer wishes to dispute an invoice, it must notify the Supplier in writing within 7 Working Days of the date of the invoice and provide details of the dispute with sufficient detail to allow the Suppler to make a reasonable assessment of the nature and extent of the dispute. The Customer may withhold payment of the disputed part of an invoice only and must pay that part (or any amount subsequently agreed or determined to be the correct amount owing) promptly on resolution of the dispute.
Where notice in accordance with clause 6.5 is not received by the Supplier, all relevant invoices shall be deemed to be accepted by the Customer.
Without limiting any other remedies available to the Supplier for late payment or failure to pay any amount due, if any amount due is not paid by the Customer by the due date, the Supplier may:

charge the Customer interest calculated at 4% per month on the balance of the amount due by the Customer from the due date until payment is received in full by the Supplier; and/or
charge the Customer all collection costs reasonably incurred by the Supplier in collection of the amount outstanding (including solicitor and/or collection agency fees); and/or
on 5 Working Days’ notice in writing, suspend delivery of further Products, Deliverables and Services under the relevant Contract and/or any other Contract and/or may suspend delivery of services or deliverables under any other agreement between the Supplier and the Customer until the outstanding amount is paid in full, including any accrued interest.

Unless otherwise specified in the relevant Associated Agreement:

the Supplier may increase its pricing from time to time but not more often than once every 12 months;
the Supplier will give the Customer one month’s notice in writing of any price increase.

Taxes

In addition to the amounts due under clause 6, the Customer will pay the Supplier amounts equal to any applicable government taxes or duties however designated, based on the relevant Contract (or the Products, Deliverables and/or Services provided under it), paid or payable by the Supplier in respect of the foregoing, exclusive however of taxes based on the Supplier’s income.

Customer Data

Subject to clause 8.2, the Supplier will access the Customer Data only as required in the performance of the relevant Contract.
Without limiting clause 9 or clause 10.2, the Supplier will only access the Customer Data and disclose the Customer Data to law enforcement or government authorities to the extent required by law. If a request for Customer Data is made by a law enforcement agency or government authority, the Supplier will redirect the request to the Customer or if redirection is not permitted or feasible in the available time frame and unless legally prohibited from doing so, the Supplier will notify the Customer of the request as soon as practically possible.
Nothing in a Contract transfers ownership of the Customer Data to the Supplier.

Personal Data and Data Protection

The Customer consents to the Processing of Personal Data by the Supplier for the purposes of each Contract, in accordance with these terms and conditions including in particular the GDPR Attachment. Before providing Personal Data to the Supplier, Customer will obtain all required consents from third parties (including Customer’s contacts, partners, distributors, administrators, and employees) under applicable Data Protection Laws.
To the extent permitted by applicable law and subject to applicable contractual rights and obligations, including the rights and obligations in the GDPR Attachment, Personal Data collected by the Supplier under these terms and conditions may be transferred, stored and processed in the United Kingdom and/or any other country (or countries) in which the Supplier maintains facilities or any other country in which the Supplier’s contractors or service providers (including for example Microsoft and other third party vendors) maintain facilities.
In the event of any Personal Data Breach, the Supplier will comply with its obligations, including notification obligations, (if any), under applicable Data Protection Laws.

Confidential Information

Each party agrees to:

hold in confidence all Confidential Information disclosed to it by the other party and disclose that information to its directors, employees and contractors only to the extent required in the performance of the Contract;
ensure that all Confidential Information is protected at all times from unauthorised access or use by, or disclosure to, any third party or misuse, damage or destruction by any person.

A party may disclose the other party’s Confidential Information if and to the extent required by law if it first notifies the other party of the obligation to disclose the Confidential Information, provided that a party is not required to notify the other party under this clause if it is not legally permitted to do so or if the timing within which the party is required by law to disclose the Confidential Information does not permit notification to the other party.
Each party reserves all rights in its Confidential Information. No rights or obligations in respect of a party’s Confidential Information other than those expressly stated in this clause are granted to the other party, or to be implied from this Agreement.
On termination (however occurring) of this Agreement, each party shall:

destroy or return to the other party all documents and materials (and any copies) containing, reflecting, incorporating or based on the other party’s Confidential Information;
erase all the other party’s Confidential Information from computer and communications systems and devices used by it, including such systems and data storage services provided by third parties (to the extent technically and legally practicable); and
certify in writing to the other party that it has complied with the requirements of this clause, provided that a recipient party may retain documents and materials containing, reflecting, incorporating or based on the other party’s Confidential Information to the extent required by law or any applicable governmental or regulatory authority. The provisions of this clause shall continue to apply to any such documents and materials retained by a recipient party, subject to clause 13 (Termination).

This clause 10 shall continue to apply after termination of this Agreement.

Intellectual property

The Supplier or its licensors own the Intellectual Property in the means, methods, processes and know-how used by the Supplier to provide the Products, Deliverables and Services and to otherwise perform the Supplier’s obligations under the Associated Agreements.
The provisions relating to Intellectual Property ownership in relation to particular Products, Deliverables and Services are included in the relevant Associated Agreement.
Each party grants to the other an irrevocable, worldwide, royalty free licence to use the other’s Intellectual Property for the purposes of providing the Products, Deliverables and Services under the Associated Agreements. The licences granted under this clause 11 shall immediately terminate upon the termination or expiry of the Associated Agreements, however occurring.

Warranties

Each party warrants that it has all requisite right, power and authority to enter into each Contract.
Except as provided under clause 12.1 and in any express warranties contained in an Associated Agreement, to the extent permitted by law, all warranties, terms and conditions (including without limitation, warranties and conditions as to fitness for purpose and merchantability) implied by legislation or otherwise, are excluded by the Supplier.

Termination of Contracts

Except where a Contract has a fixed term or where otherwise provided under a Contract, upon the expiry of the Term the Agreement shall automatically be extended for a further 12 months, unless at least 90 days before the expiration of the original term the Supplier or the Customer gives notice in writing to terminate the contract at the expiration of the Term.
Either party may terminate a Contract immediately (or with effect from any later date that it may nominate) by written notice to the other party if:

one or more Insolvency Events occurs in relation to that other party. For the purposes of this clause, ‘Insolvency Event’ means, in respect of a party (other than for the purpose of solvent reconstruction or amalgamation):

a receiver, manager or liquidator is appointed over the party’s undertaking or assets or the party enters into any assignment, composition or arrangement with its creditors; or
the party is unable to pay its debts when due or is deemed unable to pay its debts under any law or suspends payment to its creditors.

the other party commits a material breach of any of its obligations under the Contract and fails to remedy that breach within 30 days of prior written notice of such breach. For the purposes of this clause 13.2 (b), non-payment by the Customer for a period of 30 days or more after due date of any undisputed invoice constitutes a material breach by the Customer. For the purposes of this clause, ‘material breach’ shall mean a breach (including an anticipatory breach) that is serious in the widest sense of having a serious effect on the benefit which the terminating party would otherwise derive from a substantial portion of this agreement.

Additional rights of termination that apply to individual Associated Agreements may be included in each of those agreements.

Consequences of termination

On termination of a Contract, in addition to any other consequences of termination included in the relevant Associated Agreement, and unless otherwise agreed in writing in the relevant Associated Agreement, and without limiting either party’s rights or remedies:

each party will, on request, return the other’s Confidential Information in its possession or control in respect of that Contract except for copies that it may be required to hold for compliance, audit or legal reasons;
all amounts owed to the Supplier under the Contract which accrued before termination will be due and payable prior to the termination date;
the Supplier will deliver to the Customer all Deliverables for which the Customer has paid in full.

On any termination of a Contract, all clauses which by their nature survive termination, will survive the termination.

Liability and indemnity

References to ‘liability’ in clause 15.2 shall include every kind of liability arising under or in connection with a Contract including liability in contract, tort (including negligence), misrepresentation, restitution or otherwise.
Subject to clause 15.3, the Supplier’s liability to the Customer under a Contract is limited to direct loss only, of the amount paid to the Supplier under that Contract in the three-month period preceding the event giving rise to the loss, up to a maximum amount of £1,000 in the case.
Nothing in this clause 15 limits the liability of the Supplier to the Customer for:

death or personal injury caused by the Supplier’s negligence;
fraud or fraudulent misrepresentation; or
any other liability which would be unlawful to exclude.

To the extent permitted by law, in no event is the Supplier liable for any indirect loss or for any loss of profits, lost savings, loss of data, business interruption, incidental or special damages, or for any consequential loss. In addition, the Supplier is not liable for any damages claimed by the Customer based on any third party claim, including, but not limited to, any claim in negligence. In no event is the Supplier liable for any damages caused (whether directly or indirectly) by the Customer not accepting or not acting on a recommendation made to the Customer in writing by the Supplier or the Customer’s failure to perform its responsibilities under the Contract.
The Customer shall indemnify the Supplier against any costs (including reasonably incurred legal costs on a solicitor and own client basis, all and any court costs and witness fees and related legal expenses), expenses, claims, demands or liability whether direct, indirect or otherwise, and whether arising in contract, tort (including negligence), equity or otherwise, arising out of, and must at the Supplier’s request and on any reasonable conditions imposed at the Supplier’s discretion, at the Customer’s own cost defend or settle, any claim, action or proceedings brought against the Supplier in connection with:

any software, services, documents or materials issued, provided or made available by the Customer to the Supplier for use or access by the Supplier in the performance by the Supplier of a Contract where that use or access infringes or is alleged to infringe the intellectual property rights of any third party; or
a breach by the Customer of a Contract.

If the Supplier wishes to rely on an indemnity under clause 15.5, the Supplier:

must ensure that the Customer is notified promptly in writing of the relevant claim, action or proceedings (“Claim”) once it becomes aware of the Claim;
will make no admission of liability regarding the Claim nor any offers of settlement regarding the Claim without the Customer’s written approval;
may, at its discretion, grant control of the defence or settlement to the Customer;
will, where the Supplier has granted control of the defence or settlement negotiations to the Customer:

co-operate reasonably with the Customer in defending or settling the Claim and make its employees available to give statements, advice and evidence, as the Customer may reasonably request, all at the expense of the Customer; and

give the Customer sufficient authority and relevant information in its possession or control in order to assist the Customer to conduct the defence of the Claim and all negotiations for its settlement or compromise.

Dispute Resolution

In the event of any dispute arising between the parties in relation to a Contract, no party may commence any proceedings relating to the dispute (except where the party seeks urgent interlocutory relief) unless that party has complied with the procedures in this clause 16.1.
The party initiating the dispute (“the first party”) must provide written notice of the dispute to the other party (“the other party”) and nominate in that notice the first party’s representative for the negotiations. The other party must within fourteen days of receipt of the notice, give written notice to the first party naming its representative for the negotiations (“Other Party’s Notice”). Each nominated representative will have authority to settle or resolve the dispute. The parties will co-operate with each other in good faith and endeavour to resolve the dispute through discussion and negotiation.
If the dispute is not resolved within one month following the date of the Other Party’s Notice (or such longer period as may be agreed upon in writing by the parties), either party may utilise any other legal remedies available to it in seeking to resolve the dispute.

Non-Solicitation

Neither party will, without the written consent of the other party, solicit, employ, or otherwise engage the services of, the other party’s personnel (including employees and contractors). This clause will apply from commencement of the first Contract between the parties and will continue until there has been no Contract between the parties for a continuous period of six months (and if there is subsequently a Contract between the parties the non-solicitation period will re-commence).
A party may as a condition of granting its consent under clause 17.1 above, require the other party to pay to it a fee of 25% of the person’s gross annual remuneration to cover the cost of replacing the employee or contractor.

Notices

Any notice or other communication in connection with a Contract must be:

marked for the attention of the primary contact person and delivered or sent to the address of the other party by prepaid post or email, as set out in the relevant Associated Agreement.

Notices or other communications are deemed received:

if delivered by hand, on delivery;
if delivered by post:

on the fifth Working Day following posting if sent and received within Mainland United Kingdom; and
on the tenth day following posting if posted internationally; or

if sent by email, on sending the email provided that no email is successfully sent if the sender receives any type of delivery notification failure and provided further that the onus is on the sender to ensure that the email has been successfully received by the recipient.

Force majeure

Either party may suspend its obligations to perform under a Contract if it is unable to perform as a direct result of a Force Majeure Event. Any such suspension of performance must be limited to the period during which the Force Majeure Event continues.
Where a party’s obligations have been suspended pursuant to clause 19.1 for a period of 30 days or more, the other party may immediately terminate the Contract by giving notice in writing to the other party.

General

Assignment:

Subject to clause 20.1(b), neither the Customer nor the Supplier may assign its rights under a Contract without the prior written consent of the other party.
The Supplier may, without the consent of the Customer, assign it rights under a Contract to an assignee that it reasonably considers has the personnel, skills, experience and resources to perform the Contract. The Supplier will notify the Customer of any assignment made pursuant to this clause 20.1(b) prior to the assignment unless it is not permitted to do so in which case it will notify the Customer as soon as practical following the assignment.

Contractors: The Supplier may perform its obligations under a Contract by the use of the Supplier-selected independent contractors.
Other agreements: Subject to clauses 10 and 11, nothing in these terms and conditions prevents the Supplier from entering into similar agreements with others that are the same or similar to any Contract entered into with the Customer or from providing products, deliverables or services which are the same or similar to the Products, Deliverables or Services provided under a Contract.
Entire agreement: Each Contract constitutes the complete and exclusive statement of the agreement between the parties, superseding all proposals or prior agreements, oral or written, and all other communications between the parties relating to the subject matter of that Contract.
Further assurances: The parties must each do all such further acts (and sign any documents), as may be necessary or desirable for effecting the transactions contemplated by the Contract.
Amendments: Except as specifically provided in a Contract, no amendment to a Contract will be effective unless:

the amendment is in writing and signed by both parties (if the relevant Associated Agreement was signed by both parties); or
the amendment is in writing and signed by the Customer (if the relevant Associated Agreement was such that only the Customer needed to sign the Associated Agreement; or
the amendment is in writing and accepted in the same manner that, in accordance with the Associated Agreement, the Associated Agreement was made.

Waiver: No exercise or failure to exercise or delay in exercising any right or remedy by a party will constitute a waiver by that party of that or any other available right or remedy.
Partial invalidity: If any provision of a Contract or its application to any party or circumstance is or becomes invalid or unenforceable to any extent, the remainder of the Contract and its application will not be affected and will remain enforceable to the greatest extent permitted by law.
Relationship of the Parties: The parties agree that the Supplier is an independent contractor to the Customer and that nothing in these terms and conditions or any Contract constitutes a partnership, joint venture or relationship of employer and employee between the parties. Neither party may:

act or hold itself out as an agent or representative of the other party; or
assume or create any obligations on behalf of the other party.

Governing Law

Each Contract is governed by the laws of England and Wales. The parties hereby submit to the exclusive jurisdiction of the courts of England & Wales.

GDPR attachment

Under each Contract, the Customer engages the Supplier to provide the Services and in providing the Services, the Supplier will or may be required to Process Personal Data on behalf of the Customer. To the extent of that Processing of Personal Data and for the purposes of these terms and conditions, the Customer is a ‘Controller’ and the Supplier is a ‘Processor’ for the purposes of the GDPR. As such, Article 28 of the GDPR requires that the details in this attachment are included in the contract between the Customer and the Supplier.

The parties must set out the subject matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and categories of data subjects – see appendix 1 to this attachment. If the Supplier determines the purposes and means of Processing, the Supplier is considered a ‘Controller’ in respect of that Processing in which case the Supplier needs to consider and address the different and additional provisions of the GDPR that apply.

The terms used in this attachment have the meanings given to them in the main definition section of these terms and conditions or in clause 13 of this attachment, or in the GDPR if not defined in these terms and conditions or in this attachment.

Processing of Personal Data

The Supplier will:

Instructions from Customer: in providing Services under a Contract, Process Personal Data only on the Customer’s documented instructions (as provided in clause 2 and in appendix 1 to this attachment or otherwise in writing) unless required to do so by the Data Protection Laws in which case the Supplier will inform the Customer of that legal requirement before Processing unless the Supplier is prohibited from informing the Customer by that law;
Confidentiality: ensure that the Supplier’s personnel who are authorised to Process the Personal Data have obligations of confidentiality to the Supplier (including as required in clause 3 below) in respect of the Personal Data or are under an appropriate statutory obligation of confidentiality;
Security: comply with the security obligations in clause 4 below;
Subprocessors: comply with the provisions relating to Subprocessors in clause 5 below;
Data subjects’ rights: provide assistance to the Customer with responding to data subjects’ rights in accordance with clause 6 below;
Assist Customer: comply with its obligations to assist the Customer in relation to security of Personal Data and data protection impact assessments and prior consultation in accordance with clause 7 below;
Deleting and retuning data: after the provision of Services related to Processing of Personal Data has ended, at the choice of the Customer either delete or return to the Customer all of that Personal Data and delete existing copies unless the Data Protection Laws require storage of Personal Data in accordance with clause 8 below; and
Compliance and audits: make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits including inspections conducted by the Customer or another auditor mandated from time to time, in accordance with clause 9 below. The Supplier will immediately inform the Customer if, in its opinion, an instruction received from the Customer infringes the Data Protection Laws.

Instructions from Customer

The Customer instructs the Supplier (and authorises the Supplier to instruct each Subprocessor) to:

Process Personal Data; and
in particular, transfer Personal Data to any country or territory,

as reasonably necessary for the provision of the Services and consistent with and in compliance with the relevant Contract.

The Customer warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in clause 2.1 on behalf of the Customer.

Confidentiality

The Supplier will take reasonable steps to ensure the reliability of its employees, agents or contractors who may have access to Personal Data, ensuring in each case that access is limited to those individuals who need to know or need to access the relevant Personal Data, as necessary for the purposes of the relevant Contract, and to comply with applicable laws in the context of that individual’s duties to the Supplier, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Security

Subject to clause 4.2 below, the Supplier will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including amongst other things as appropriate:

the pseudonymisation and encryption of Personal Data;
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing.

In assessing the appropriate level of security for clause 4.1 above, the Supplier will take account in particular of the risks of a Personal Data Breach that are presented by the Processing to be undertaken under the relevant Contract.

The Supplier will in relation to Personal Data:

implement and maintain appropriate information security to protect Personal Data against:

a Personal Data Breach;
all other unauthorised or unlawful forms of Processing; and
any breach of the Supplier’s information security obligations in this attachment. The Supplier will (and will ensure that its Sub-processors) provide full cooperation and assistance to the Customer in ensuring that the individuals´ rights under the Data Protection Laws are timely and appropriately addressed for the fulfilment of the Customer’s obligation to respond without undue delay to requests by such individuals as required by Data Privacy Laws, including the rights of subject access, rectification, erasure, and portability, and the right to restrict or object to certain Processing;

take reasonable steps to inform its staff, and any other person acting under its supervision, of the responsibilities of any Data Privacy Laws due to the incidental access to Personal Data, and ensure the reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to and Process, such Personal Data.

Subprocessors

The Customer authorises the Supplier to appoint Subprocessors (and permits each Subprocessor appointed in accordance with this clause 5 to appoint Subprocessors) in accordance with this clause 5 and any restrictions in these terms and conditions.

The Supplier will give the Customer prior written notice of the appointment of any new Subprocessor, including full details of the Processing to be undertaken by the Subprocessor. If, within two weeks of receipt of that notice, the Customer notifies the Supplier in writing of any objections (on reasonable grounds) to the proposed appointment, the Supplier will not appoint (nor disclose any Personal Data to) the proposed Subprocessor unless and until it obtains the prior written consent of the Customer.

With respect to each Subprocessor, the Supplier will:

enter into an agreement with the Subprocessor which includes the same data protection obligations as set out in this attachment (and Appendix 1) and in particular includes sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. If the Subprocessor fails to fulfil its data protection obligations, the Supplier will remain fully liable to the Customer for the performance of that Subprocessor’s obligations;
if the Processing by the Subprocessor will involve a Restricted Transfer, ensure that the Standard Contractual Clauses are at all relevant times incorporated into the agreement between the Supplier and the Subprocessor; and
provide to the Customer for review, copies of the Supplier’s agreements with Subprocessors (confidential commercial information that is not relevant to the requirements of this attachment may be blacked out) as the Customer may request from time to time.

Appendix 1 to this attachment sets out certain information regarding the Supplier’s Processing of Personal Data, as required by article 28(3) of the GDPR. The Customer may make reasonable amendments to Appendix 1 by written notice to the Supplier from time to time as the Customer reasonably considers necessary to meet those requirements.

Data Subjects’ Rights

Taking into account the nature of the Processing, the Supplier will, by implementing appropriate technical and organisational measures to the extent described in clause 4, assist the Customer to respond to requests to exercise Data Subject rights under the Data Protection Laws.

The Supplier will:

promptly notify the Customer if the Supplier or any Subprocessor receives a request from a Data Subject under any Data Protection Law in respect of Personal Data; and
ensure that the Supplier or relevant Subprocessor does not respond to that request except on the documented instructions of the Customer or as required by Applicable Laws to which they are subject, in which case the Supplier will to the extent permitted by Applicable Laws inform the Customer of that legal requirement before the Supplier or relevant Subprocessor responds to the request.

Assist Customer

Assist Customer with Security of Processing:

The Supplier will assist the Customer in respect of the Customer’s obligations to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, by complying with the Supplier’s obligations under clause 4 of this attachment.

Assist Customer with notifications of Personal Data Breach

The Supplier will notify the Customer without undue delay if the Supplier or any Subprocessor becomes aware of a Personal Data Breach, providing the Customer with sufficient information to allow the Customer to meet any obligations to report the Personal Data Breach to the relevant Supervisory Authority under the Data Protection Laws (noting that the Customer is required, where feasible, to notify applicable Personal Data breaches to the relevant Supervisory Authority within 72 hours after having become aware of the breach).
The Supplier will co-operate with the Customer and take such reasonable commercial steps as are directed by the Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

Assist Customer with communication of Personal Data breach to Data Subject

Where a Personal Data Breach is likely to result in a high risk to the rights and freedoms of natural persons:

such that the Customer is required to communicate the Personal Data Breach to the Data Subject (including where, despite the conditions referenced in clause 7.3(a)(ii) below being met, the Supervisory Authority has required the Customer to communicate the Personal Data Breach to the Data Subject), the Supplier will assist the Customer in doing so by providing all relevant information as may be reasonably required by the Customer;

but despite that high risk, the Customer is not required to communicate the Personal Data Breach to the Data Subject due to certain conditions being met (such as that the Personal Data is encrypted and so unintelligible to any person not authorised to access it), the Supplier will assist the Customer by providing all relevant information as may be reasonably required by the Customer.

Assist Customer with Data Protection Impact Assessments

The Supplier will provide reasonable assistance to the Customer with any data protection impact assessments which the Customer reasonably considers to be required of the Customer by Article 35 of the GDPR or equivalent provisions of related Data Protection Laws. The Supplier’s obligations under this clause 7.4(a) are solely in relation to Processing of Personal Data by the Supplier and taking into account the nature of the Processing and information available to the Supplier.

Assist Customer with Prior Consultation with Supervisory Authority

The Supplier will provide reasonable assistance to the Customer with prior consultations with Supervising Authorities or other competent data privacy authorities, which the Customer reasonably considers to be required of the Customer by Article 36 of the GDPR or equivalent provisions of related Data Protection Laws. The Supplier’s obligations under this clause 7.5(a) are solely in relation to Processing of Personal Data by the Supplier and taking into account the nature of the Processing and information available to the Supplier.

Deletion or return of Personal Data

Subject to clauses 8.2 and 8.3, the Supplier will, within two weeks of the date of expiration or termination of Services involving the Processing of Personal Data (the “End of Processing Date”), delete and procure the deletion of all copies of the Personal Data.

Subject to clause 8.3, the Customer may in its absolute discretion by written notice to the Supplier within two weeks of the End of Processing Date require the Supplier to:

return a complete copy of all Personal Data to the Customer by secure file transfer in such format as is reasonably notified by the Customer to the Supplier; and
delete and procure the deletion of all other copies of Personal Data Processed by the Supplier. The Supplier will comply with any such written request within two weeks of the End of Processing Date.

The Supplier may retain Personal Data to the extent required by Applicable Laws and only to the extent and for such period as required by Applicable Laws and always provided that the Supplier will:

ensure the confidentiality of all such Personal Data;
ensure that such Personal Data is only processed as necessary for the purpose(s) specified in the Applicable Laws requiring its storage and for no other purpose.

The Supplier will provide written certification to the Customer that it has fully complied with this clause 8 within two weeks following the End of Processing Date.

Audit rights

Subject to clauses 9.2 to 9.4, the Supplier will make available to the Customer on request all information necessary to demonstrate compliance with this attachment, and will allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer in relation to the Processing of Personal Data by the Supplier.

Information and audit rights of the Customer only arise under clause 9.1 to the extent that a Contract does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Laws (including, where applicable, article 28(3)(h) of the GDPR).

The Supplier may, on reasonable grounds, object to the proposed auditor in which case the Customer will propose an alternate auditor.

The Customer will give the Supplier reasonable notice of any audit or inspection to be conducted under clause 9.1 and will make (and ensure that its auditor makes) reasonable endeavours to avoid causing any damage, injury or disruption to the Supplier’s premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection. The Supplier need not give access to its premises for the purposes of such an audit or inspection for the purposes of more than one audit or inspection in any calendar year, except for any additional audits or inspections which:

the Customer reasonably considers necessary because of genuine concerns as to the Supplier’s compliance with this attachment; or
the Customer is required or requested to carry out by Data Protection Law, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Data Protection Laws in any country or territory,

where the Customer has identified its concerns or the relevant requirement or request in its notice to the Supplier of the audit or inspection.

Restricted Transfers

Subject to clause 10.3, where the Services involve a ‘Restricted Transfer’ as between the Customer and the Supplier, the Customer (as “data exporter”) and the Supplier (as “data importer”) each agrees to the Standard Contractual Clauses in respect of that Restricted Transfer.

The Standard Contractual Clauses will come into effect under clause 10.1 on the later of:

the data exporter becoming a party to them;
the data importer becoming a party to them; and
commencement of the relevant Restricted Transfer.

There is no requirement for the Supplier and Customer to agree to the Standard Contractual Clauses (or to include the Standard Contractual Clauses in these terms and conditions) where the transfer of Personal Data is to a country within the EEA or to an Approved Jurisdiction.

Order of precedence

Nothing in this attachment reduces the Supplier’s obligations under a Contract in relation to the protection of Personal Data or permits the Supplier to Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Contract. In the event of any conflict or inconsistency between this attachment and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.

Subject to clause 11.1, in the event of inconsistencies between the provisions of this attachment and the other parts of these terms and conditions or any Associated Agreement, the provisions of this attachment will prevail.

Changes in Data Protection Laws

The Customer may by at least 30 calendar days’ written notice to the Supplier:

vary the Standard Contractual Clauses (if applicable), as they apply to Restricted Transfers which are subject to non-UK data protection laws, as required as a result of any change in, or decision of a competent authority under, that data protection law, to allow those Restricted Transfers to be made (or continue to be made) without breach of that data protection law; and
propose any other variations to this attachment which the Customer reasonably considers to be necessary to address the requirements of any data protection law.

If the Customer gives notice under clause 12.1(a):

the Supplier will promptly co-operate (and require affected Subprocessors to promptly co-operate) to ensure that equivalent variations are made to the agreements made under clause 5.3; and
the Customer will not unreasonably withhold or delay agreement to any consequential variations to this attachment proposed by the Supplier to protect the Supplier against additional risks associated with the variations made under this clause 12.2.

If the Customer gives notice under clause 12.1(b), the parties will promptly discuss the proposed variations and negotiate in good faith with a view to agreeing and implementing those or alternative variations designed to address the requirements identified in the Customer’s notice as soon as is reasonably practicable.

Definitions

In this attachment:

“Adequacy Decision” means a country (or territory or specified sector within it) or an international organisation which the European Commission has decided, under Article 45(3) of the GDPR, ensures an adequate level of data protection;

“Approved Jurisdiction” means the countries in the EEA and jurisdictions for which an Adequacy Decision has been made and any other countries or territories for which there are UK adequacy regulations;

“Contracted Processor” means the Supplier or a Subprocessor;

“Data Subject” means an identified or identifiable natural person, or any updated definition of this term from time to time in the GDPR;

“EEA” means the European Economic Area;

“Information Security Obligations” means commercially reasonable and appropriate physical, technical and organisational security measures (determined with regard to risks associated with the Processing of Personal Data as part of the Services), including the measures set out in this GDPR attachment and in particular in the Standard Contractual Clauses (where applicable).

“Restricted Transfer” means transferring Personal Data outside of the United Kingdom, whether this is:

a transfer of Personal Data from the Customer to the Supplier or to a Subprocessor; or
an onward transfer of Personal Data from one Contracted Processor to another Contracted Processor, or between two establishments of a Contracted Processor,

in each case, where such transfer means would be prohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws), in the absence of the Standard Contractual Clauses;

“Services” means, for the purposes of this GDPR Attachment, the products, services and/or deliverables (as applicable) and any related services supplied to or carried out by or on behalf of the Supplier for the Customer under a Contract;

“Subprocessor” means any person (including any third party, but excluding an employee of the Supplier or any of its sub-contractors) appointed by or on behalf of the Supplier to Process Personal Data on behalf of the Customer in connection with a Contract;

“Standard Contractual Clauses” means the standard contractual clauses issued by the European Commission (EU controller to non-EU or EEA processor), varied as permitted for the UK context, which:

if applicable as between the Supplier and the Customer, are in Appendix 2 to this attachment (and if not applicable, there is no Appendix 2);
if applicable as between the Supplier and any other processor or subprocessor in relation to the Services provided by the Supplier under a Contract, will be included in the agreement between the Supplier and the processor / subprocessor.

The term “Supervisory Authority” has the meaning given to that term in the GDPR.

Appendix to GDPR Attachment

Details of Processing of Personal Data

This Appendix 1 includes certain details of the Processing of Personal Data as required by Article 28(3) GDPR.

Subject matter and duration of the Processing of Personal Data:

For the performance of IT Management and Support Services, the duration will be the term of the contract (s), plus twelve months and for such further time as required

The nature and purpose of the Processing of Personal Data:

IT Equipment, Applications, Software, Cloud Services, and other access as deemed appropriate under the contract, to provide services under the contract (s)

The types of Personal Data to be Processed:

Name; home and work addresses; email addresses; phone numbers; passwords; IP address

The categories of Data Subject to whom Personal Data relates:

Customers, their employees and agents

The obligations and rights of the Customer:

The obligations and rights of the Customer are set out in each Contract (including this attachment).

PAYMENT TERMS POLICY ATTACHMENT

For the avoidance of doubt, this policy applies to all Contracts, unless written alteration or amendment has been obtained from a Director of the Supplier.

Support services are billed one month in advance of the start of the support contract;
Payment terms are strictly 14 days from date of invoice, payable by Direct Debit:
Where a Customer declines to enter into a Direct Debit agreement, a surcharge of 5% will be applied to each invoice at the point of creation; payment terms remain at 14 days from date of invoice;
Alternative payment terms can only be approved by a Director of the Supplier and must be done so, in writing, in advance of the invoice date;
The Supplier reserves the right to check each Customer’s credit worthiness from time to time and apply a recommended credit limit to the account. Customers breaching the approved credit limit may be required to settle their account in full, at the discretion of Supplier;
The Supplier will not commence any services, under any contract, until a Direct Debit Mandate has been received. For the avoidance of doubt, this will include, but not limited to, the processing of licences, subscriptions, provision of support, installation or the purchase of any hardware or 3^rd party services;
In accordance with clause 6.8 (a) of the Master Terms and Conditions, the Supplier may charge the Customer interest on any amounts that are not paid by the due date:
The Process for overdue accounts is:

Failed Direct Debit collection

The customer will receive a notification that services may be suspended, due to failure of payment;
The Direct Debit will be submitted for a second time. Should the collection fail again, the Customer will receive a notification that all services, with the exception of 365 licences, are to be halted immediately. This means support will be withheld, along with work on any current or planned Projects, until the overdue amount is received, via a BACS payment;
365 licences will be the subject of an investigation, but may be suspended if the account is not paid within 5 working days, via a BACS payment;
If payment is not received within 5 working days, a Letter Before Action (LBA) will be sent to the Customer and all services, including 365 licencing will be suspended and; the result will be that Customers have no access to their email accounts or data therein;
Should trading resume, all future transactions will be referred to a Supplier Director and the Customer may be required to pay in advance for all services.

Overdue BACS accounts

Payment reminders are sent to the Supplier on a regular basis;
When an account is 7 days overdue, a Letter Before Action (LBA) will be sent to the Customer, and all services will be suspended until a BACS payment is received for the overdue amount;
Before services can recommence, the Customer will be required to complete a Direct Debit Mandate.

Get Expert IT Assistance Now.

Slow computers or network issues? Rabb-IT provides expert IT solutions to increase productivity and protect your data. Schedule a free consultation today!



Telephone

+44 (0) 333 241 2277



Email

[email protected]



Address

Rabb-IT
Ground Floor Unit 4
The Scribbling House
Holly Park Mills
Woodhall Road
Leeds LS28 5QS

"*" indicates required fields

ⓘ We respect your privacy. Your information will only be used to respond to your enquiry.