This Data Processing Agreement (DPA) applies whenever Saueglobal Limited processes personal data on your behalf in providing Services. It forms part of your Contract under our Customer Agreement and meets the requirements of Article 28 of the UK GDPR.
You can contact us about data protection at support@saueglobal.com.
Key points
- You decide why and how your personal data is used. We only act on your instructions.
- We tell you about a personal data breach within 48 hours of becoming aware of it.
- We use Sub-processors listed in Annex 3 and give you 30 days' notice before adding a new one.
- Extra safeguards apply to special category, criminal offence and children's data, including safeguarding records.
- At the end of the Contract we return or delete your personal data.
1. Scope and roles
1.1 This DPA applies where we process Customer Personal Data as your processor. You are the controller, or a processor acting for another controller.
1.2 It does not apply to personal data we process as a controller, such as account, billing and marketing data. Our Privacy Notice covers that.
1.3 It does not apply to processing by suppliers who contract with you directly. In particular:
- Microsoft processes data in your Microsoft 365, Dynamics 365 and Azure services as your processor under the Microsoft Customer Agreement and Microsoft Products and Services Data Protection Addendum, which you accept when we supply your licences,
- domain registrars and registries (GoDaddy, Namecheap, Nominet and others) process domain registration data as independent controllers under ICANN and registry rules and
- Stripe processes payment data as an independent controller.
We still process data in those services when we administer, support or migrate them for you, and that processing is covered by this DPA.
1.4 Annex 1 describes the processing.
2. Definitions
2.1 Controller, processor, data subject, personal data, personal data breach, processing, special categories of personal data and supervisory authority have the meanings given in the UK GDPR. Other capitalised words have the meanings given in the Customer Agreement.
2.2 In this DPA:
- Customer Personal Data means personal data in Customer Data that we process on your behalf in providing the Services,
- Security Incident means a personal data breach affecting Customer Personal Data while it is in our care or the care of our Sub-processors,
- Sensitive Data means special categories of personal data, criminal offence data and personal data relating to children, including safeguarding records,
- Sub-processor means a third party we engage to process Customer Personal Data and
- UK Transfer Mechanism means UK adequacy regulations, the International Data Transfer Agreement (IDTA) issued by the Information Commissioner or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner.
3. Your responsibilities
3.1 You will:
- make sure you have a lawful basis for the processing and have given data subjects the information the law requires,
- make sure your instructions comply with Data Protection Laws,
- tell us before you ask us to process Sensitive Data, as described in clause 7 and
- tell us if you are a processor acting for another controller, and confirm that controller has authorised our appointment.
4. Our obligations as processor
4.1 Instructions. We will process Customer Personal Data only on your documented instructions, including with regard to transfers of personal data outside the UK, unless the law requires otherwise. If the law requires otherwise, we will tell you before processing unless the law prevents us. Your instructions are the Contract, your use and configuration of the Services and any further written instructions consistent with the Contract.
4.2 We will tell you immediately if we think an instruction breaches Data Protection Laws. We may pause the affected processing until you confirm or change the instruction.
4.3 We will not sell Customer Personal Data or use it for our own purposes, including training AI models, other than models built only for you under an Order.
4.4 Confidentiality. We will make sure everyone we authorise to process Customer Personal Data is bound by a duty of confidence.
4.5 Security. We will put in place and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. These include the measures in Annex 2. We may update them, but we will not reduce the overall level of protection.
4.6 Data subject requests. We will help you, by appropriate technical and organisational measures where possible, to respond to requests from data subjects to exercise their rights. If we receive a request directly, we will pass it to you within 3 Business Days and will not respond ourselves unless you ask us to.
4.7 Other assistance. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the Information Commission under Articles 32 to 36 of the UK GDPR.
4.8 We may charge at our then-current rates for help under clauses 4.6 and 4.7 that goes beyond what is reasonable for the Services you have bought, unless the help is needed because we breached this DPA.
5. Security Incidents
5.1 We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident.
5.2 We will give you, as far as we can at the time, a description of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the steps we have taken or propose to take and a contact for more information. We will update you as we learn more.
5.3 We will take reasonable steps to contain and investigate the incident and reduce its effects, and will cooperate with your investigation.
5.4 We will not notify the Information Commission or data subjects about a Security Incident on your behalf unless you ask us to or the law requires us to.
5.5 Telling you about a Security Incident is not an admission of fault or liability.
6. Sub-processors
6.1 You give us general authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex 3.
6.2 We will give you at least 30 days' notice before adding or replacing a Sub-processor, by email or by updating Annex 3 with a notice to you.
6.3 You may object on reasonable data protection grounds within that 30-day period. We will then discuss your concerns in good faith. If we cannot resolve them, you may end the affected Services by written notice without paying Charges for the period after they end, other than for non-cancellable Third-Party Product commitments.
6.4 We will put a written contract in place with each Sub-processor that imposes data protection obligations no less protective than those in this DPA, including sufficient guarantees to implement appropriate technical and organisational measures, as Article 28(4) of the UK GDPR requires.
6.5 We remain responsible to you for the performance of our Sub-processors' data protection obligations.
7. Sensitive Data and safeguarding records
7.1 Many of our charity, education and public sector customers hold Sensitive Data, including safeguarding records about children and adults at risk. Where you tell us that the Services involve Sensitive Data, we will also:
- limit access to named staff who need it to deliver the Services,
- require multi-factor authentication and privileged access controls for that access,
- not copy Sensitive Data outside your environment unless needed for an agreed task, such as a migration, and delete working copies once the task is complete,
- not process Sensitive Data with AI tools outside your own Microsoft tenant without your written approval,
- keep a record of access by our staff on request and
- apply any further safeguards agreed in the Order, such as background checks for staff with access.
7.2 You are responsible for classifying and labelling Sensitive Data in your systems and telling us where it is held, so we can apply these safeguards.
8. International transfers
8.1 We will not transfer Customer Personal Data outside the UK, or allow a Sub-processor to do so, unless the transfer is covered by a UK Transfer Mechanism and any transfer risk assessment the law requires.
8.2 Transfers to a US organisation certified under the UK Extension to the EU-US Data Privacy Framework rely on UK adequacy regulations. Other transfers rely on the IDTA or the International Data Transfer Addendum, which we put in place with the Sub-processor.
8.3 Annex 3 shows where each Sub-processor processes data and the transfer mechanism used.
8.4 If the EU GDPR applies to your processing, references in this DPA to the UK GDPR include the EU GDPR, and the parties will put in place the EU Standard Contractual Clauses where the EU GDPR requires them for a transfer.
9. Audits and information
9.1 We will make available the information reasonably needed to show we comply with this DPA. This includes our security certifications, policies and summaries of independent assessments, where available.
9.2 Where that information is not enough to show compliance, or where a supervisory authority requires it, you may audit our compliance once in any 12-month period. You must give at least 30 days' written notice, carry out the audit during normal business hours with minimal disruption and use an auditor bound by confidentiality who is not our competitor.
9.3 Each party bears its own costs of an audit, unless the audit reveals a material breach of this DPA by us, in which case we will pay your reasonable costs.
10. Return and deletion
10.1 If you ask us within 30 days after the Contract ends, we will return Customer Personal Data to you in a commonly used format. We will then delete it, including copies held by Sub-processors, within 60 days after the end of that 30-day period.
10.2 We may keep Customer Personal Data where the law requires it. We will keep it confidential, protect it under this DPA and use it only for the purpose the law requires.
10.3 Data held in backups is deleted as backups expire in the normal cycle, and is protected under this DPA until then.
11. Liability
11.1 Each party's liability under this DPA is subject to clause 19 of the Customer Agreement, including the higher cap for Data Protection Claims in clause 19.5.
11.2 Nothing in this DPA limits the rights of data subjects under Data Protection Laws.
12. General
12.1 This DPA lasts for as long as we process Customer Personal Data on your behalf.
12.2 If this DPA conflicts with the Customer Agreement on anything relating to personal data, this DPA takes priority. If it conflicts with the IDTA, the International Data Transfer Addendum or the EU Standard Contractual Clauses, those documents take priority.
12.3 We may update this DPA under clause 26 of the Customer Agreement. We will not make an update that reduces the protection given to Customer Personal Data, unless the law requires it.
12.4 This DPA is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing the Services described in your Order and the relevant Service Schedules |
| Duration | The term of the Contract and the return and deletion period in clause 10 |
| Nature of processing | Administering, configuring, supporting, monitoring, migrating, backing up, hosting and developing systems that contain Customer Personal Data and building and running AI agents and automations on your instructions |
| Purpose | To provide the Services under the Contract |
| Data subjects | Your staff, contractors, volunteers, trustees, customers, clients, service users, beneficiaries, donors, members, pupils and students, parents and carers, suppliers and website visitors, depending on the Services and your use of them |
| Personal data | Names, contact details, job and organisation details, user account and login data, device and usage data, the content of emails, files, chats, calendars, records and databases and website and form data |
| Sensitive Data | Any Sensitive Data contained in your content and records, which may include health, ethnicity, religion, sexual orientation, criminal offence and safeguarding data and data about children. Clause 7 applies where you tell us Sensitive Data is involved |
| Location | The UK and the locations of Sub-processors listed in Annex 3 |
Annex 2: Security measures
We maintain at least the following measures.
| Area | Measures |
|---|---|
| Governance | A named person responsible for information security. Security policies reviewed at least once a year |
| People | Confidentiality obligations for all staff and contractors. Data protection and security training on joining and every year after. Access removed promptly when someone leaves |
| Access control | Multi-factor authentication on all accounts with access to customer systems. Least privilege and time-limited administrative access, using Microsoft granular delegated admin privileges where available. Unique accounts, never shared |
| Devices | Staff devices managed centrally, encrypted, protected by anti-malware and kept up to date with security patches |
| Encryption | Data encrypted in transit using TLS 1.2 or higher. Data at rest encrypted using the encryption provided by the hosting platform |
| Monitoring | Security and audit logging on our own systems. Alerts reviewed and acted on |
| Vulnerabilities | Critical and high-risk security patches applied to systems we manage within 14 days of release, where the system allows |
| Backups | Backups and restore testing for Services that include backup, as described in the Service Schedule |
| Incidents | A documented incident response process, including the 48-hour notification in clause 5 |
| Suppliers | Due diligence on Sub-processors before use and written data protection terms with each one |
| Deletion | Secure deletion of Customer Personal Data in line with clause 10 |
Annex 3: Sub-processors
| Sub-processor | Service | Processing location | Transfer mechanism |
|---|---|---|---|
| Microsoft Ireland Operations Limited and its affiliates | Our own Microsoft 365 environment, including Dynamics 365 and Power Apps, used for support tickets, client records, email, documents and collaboration with you | UK and EEA, with limited access from other locations | UK adequacy regulations for the EEA. IDTA, the International Data Transfer Addendum or the UK Extension to the Data Privacy Framework, for other locations |
Domain registration data is processed by registrars and registries as independent controllers, not as our Sub-processors. See clause 1.3.