Terms and Conditions (Identity Verification Service)

These Terms and Conditions (the “ID&V Terms”) apply to the subscription and use of the identity verification services (the “ID&V Services”) purchased by you as the Customer and provided by Willo Technologies Limited, a company incorporated in Scotland with company number SC601085 and having its registered office address at 20-23 Woodside Place, Glasgow, Scotland, G3 7QL (the “Supplier”).

The ID&V Services are provided in conjunction with our service partner, Yoti Ltd, a company incorporated in England and Wales with company number 08998951 and having its registered address at 6th Floor, 107 Leadenhall Street, London, England, EC3A 4AF (“Yoti”).

By placing an Order for or making use of the ID&V Services, you as the Customer agree to comply with and be bound by these ID&V Terms.

1. Definitions and interpretation
   1. In these ID&V Terms, the following words and expressions have the following meanings:

“App” means the dashboard and associated application software and user interface for the ID&V Services accessible through the Website or such other medium as the Supplier may make the ID&V Services available on from time to time;

“Applicable Laws” means all applicable laws, legislation, statutory instruments, regulations and governmental guidance having binding force whether local or national or international in any relevant jurisdiction;

“Candidate” means a person who is referred by the Customer to use the ID&V Services to complete an ID&V Check;

“Confidential Information” means all information of a confidential nature in whatever form which is received or acquired by a party in connection with the Contract or the ID&V Services including:

1. any know-how, trade secrets, plans, developments, financial, commercial, technical, tactical, strategic, marketing, operations, customer, product, or personnel information of any kind;
2. all information produced, developed or derived from information disclosed pursuant to the Contract;
3. all information agreed to be, or marked as, confidential; and
4. any information a party knows, or could reasonably be expected to know, is confidential; 

"Contract" means the agreement between the Supplier and the Customer for the supply and purchase of ID&V Services incorporating these ID&V Terms and the Order and including all their respective schedules, attachments, annexures and statements of work;

“Controller” has the meaning given in Data Protection Laws;

"Customer" means the named party in the Contract which has agreed to purchase the ID&V Services from the Supplier and whose details are set out in the Order, or the company which has signed up for the ID&V Services on the Website;

“Data Processing Addendum” means the data protection addendum annexed to these ID&V Terms at Appendix 1;

“Data Protection Laws” means, as binding on either party or the ID&V Services:

1. the GDPR, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or of a part of the United Kingdom from time to time);
2. the Data Protection Act 2018;
3. any laws which implement or supplement any such laws; and
4. any laws that replace, extend, re-enact, consolidate or amend any of the foregoing;

“GDPR” means the General Data Protection Regulation ((EU) 2017/679);

“ID&V Check” means an identify verification, right to work check and/or other pre-employment check to be performed on a Candidate through the ID&V Services;

“Initial Term” means the initial term of the Customer’s subscription to the ID&V Services as set out in the Order;

"Intellectual Property Rights" means copyright, patents, know-how, trade secrets, trade marks, trade names, design rights, rights in get-up, rights in goodwill, rights in software, rights in Confidential Information, rights to invention, rights to sue for passing off, domain names and all other intellectual property rights and similar rights and, in each case:

1. whether registered or not;
2. including any applications to protect or register such rights;
3. including all renewals and extensions of such rights or applications;
4. whether vested, contingent or future;
5. to which the relevant party is or may be entitled, and
6. in whichever part of the world existing;

"Order" means the order for the ID&V Services from the Supplier placed by the Customer in substantially the same form as set out in the Customer’s order form, or as selected by the Customer from the Supplier's Website or through the App;

“Price” means the price payable by the Customer for the ID&V Services, as stated in the Order;

“process” has the meaning given in Data Protection Laws and “processing”, “processed” and similar terms shall be interpreted accordingly;

“Processor” has the meaning given in Data Protection Laws;

“Renewed Term” has the meaning given in clause 4.3;

“Service Credit” means a credit on the Customer’s account to be redeemed by Users to perform an ID&V Check;

“Supporting Documentation” means identity documentation, proof of address documentation, qualifications and any other content or materials made available by a Candidate in relation to an ID&V Check;

“Subscription Term” means the Initial Term and any Renewed Term;

“User” means an individual end user of the ID&V Services being an employee, director, officer or subcontractor of the Customer who uses the ID&V Services through the Customer’s account;

“Website” means https://www.willo.video, https://app.willotalent.com  and any other web domain owned by the Supplier through which the ID&V Services are provided from time to time;

“Yoti Terms” means Yoti’s terms and conditions for organisations making use of their services accessed at https://www.yoti.com/terms/organisations/; 

2. In these ID&V Terms, unless the context requires otherwise:
   1. a reference to the Contract includes these ID&V Terms, the Order, the Data Processing Addendum and their respective schedules, appendices and annexes (if any);
   2. any clause, schedule or other headings in these ID&V Terms is included for convenience only and shall have no effect on the interpretation of the ID&V Terms;
   3. a reference to a ‘party’ includes that party’s personal representatives, successors and permitted assigns;
   4. a reference to a ‘person’ includes a natural person, corporate or unincorporated body (in each case whether or not having separate legal personality) and that person’s personal representatives, successors and permitted assigns;
   5. a reference to a ‘company’ includes any company, corporation or other body corporate, wherever and however incorporated or established;
   6. a reference to a gender includes each other gender;
   7. words in the singular include the plural and vice versa;
   8. any words that follow ‘include’, ‘includes’, ‘including’, ‘in particular’ or any similar words and expressions shall be construed as illustrative only and shall not limit the sense of any word, phrase, term, definition or description preceding those words;
   9. a reference to ‘writing’ or ‘written’ includes any method of reproducing words in a legible and non-transitory form;
   10. a reference to legislation is a reference to that legislation as amended, extended, re-enacted or consolidated from time to time except to the extent that any such amendment, extension or re-enactment would increase or alter the liability of a party under the Contract; and
   11. a reference to legislation includes all subordinate legislation made from time to time under that legislation.
3. Application of these ID&V Terms
   1. These ID&V Terms apply to and form part of the Contract between the Supplier and the Customer.  They apply to the Customer’s purchase of and the Customer and its Users’ use of the ID&V Services.
   2. No terms or conditions endorsed on, delivered with, or contained in the Customer’s purchase conditions, order, confirmation of order, specification or other document shall form part of the Contract except to the extent that the Supplier otherwise agrees in writing.
4. The ID&V Services
   1. The purpose of the ID&V Services are to enable the Customer to perform ID&V Checks on Candidates as part of an employment or pre-employment screening process.
   2. Subject to the Customer paying the Price and its compliance with these ID&V Terms, the Supplier grants to the Customer a non-exclusive, non-transferable licence to permit the Customer and its Users to use the ID&V Services during the Subscription Term.
   3. The ID&V Services are accessed through the App.  By making use of the ID&V Services the Customer and its Users agree to comply with these ID&V Terms.
   4. Subject to clause 3.5, the Supplier warrants:
      1. that the ID&V Services will be performed with reasonable care and skill;
      2. that it shall use commercially reasonable endeavours to ensure that the ID&V Services are available 24 hours a day, 7 days a week.
   5. It is acknowledged by the Customer that the ID&V Services are subject to certain services provided by Yoti and that the Supplier is only obligated to provide the ID&V Services to the extent it is able to comply with any conditions or restrictions placed on the Supplier as specified in the Yoti Terms.
   6. The ID&V Services or App may be unavailable during periods of scheduled or emergency maintenance or for reasons outside of the Supplier’s or Yoti’s reasonable control.  The Supplier will endeavour to give the Customer advance notice of any downtime for periods of scheduled maintenance but for the avoidance of doubt any downtime of the ID&V Services will not entitle the Customer to terminate the Contract.
5. Registration and use of the ID&V Services
   1. The Customer will be required to create an account to use the ID&V Services.  When registering to use the ID&V Services, the Customer will be required to set up an account and login details for the App and provide a payment card for processing their subscription.  Each User making use of the ID&V Services on the Customer’s account will be required to set up login credentials to access the ID&V Services.  The Customer is responsible for ensuring that its Users maintain the security and confidentiality of their login credentials and the Customer shall be responsible for all actions taken on its account.
   2. If the Customer believes that there has been unauthorised access or use of its own or any of its Users’ login credentials, it shall notify the Supplier without delay.
   3. The Supplier may suspend the Customer’s or any User’s login credentials where it knows or reasonably suspects there has been unauthorised use of the Customer’s account.
   4. The Customer will have access to the ID&V Services for the duration of the Initial Term stated in the Order.  When the Initial Term expires, the subscription will be renewed for consecutive periods each of equal length with the Initial Term (each a “Renewed Term”) at the Supplier’s then-current rate for the relevant subscription package.
   5. The Customer agrees that it shall
      1. not permit any User to make use of the Customer’s account through any other User’s login credentials, unless the login has been reassigned to another User, in which case the prior User shall not have any right to access or make use of the Customer’s account or the ID&V Services;
      2. ensure its login details and those of its Users are kept secure and confidential;
      3. ensure that it and its Users use the ID&V Service and undertake ID&V Checks only for purposes for which it is lawfully permitted to do so, including but not limited to:
         1. verifying a Candidate’s right to work in the territory in which the Candidate’s application relates;
         2. verifying Candidate identification strictly for employment-related purposes;
         3. performing background checks on a Candidate as necessary and relevant to the Candidate’s role;
         4. request Supporting Documentation from Candidates as required in order to undertake the required ID&V Check;
      4. not itself or through any third party attempt to circumvent, disable or otherwise disrupt any security measures used on the Website, the App or the ID&V Services;
      5. not itself or through any third party use the Website, the App or the ID&V Services to distribute viruses or malware or other similar harmful code; and
      6. not attempt to reverse engineer, decompile or derive the source code used in the Website, the App or the ID&V Services.
6. ID&V Checks
   1. The Customer can submit a request to undertake an ID&V Check by issuing a request to a Candidate through the App.  The Customer is responsible for ensuring that the Candidate’s details are correct when issuing a request.
   2. Each ID&V Check shall be undertaken by redeeming Service Credits against the relevant ID&V Check(s) to be undertaken on the Candidate.  The Service Credit cost for the type of ID&V Check shall be as stated on the Website from time to time.  If the Customer runs out of Service Credits, it will need to purchase additional Service Credits in order to continue to undertake ID&V Checks.
   3. Service Credits remain valid for 12 months from the date of purchase, after which time they will expire automatically, unless the Customer’s subscription is terminated earlier in accordance with these ID&V Terms.  No refund will be provided for any unused Service Credits at the time these expire or the ID&V Services are terminated.
   4. If an ID&V Check fails due to a technical error connected with or under the control of the Supplier or the ID&V Services, the Customer will be given a Service Credit free of charge for the failed ID&V check.  If an ID&V Check fails due to any other reason including User or Customer error, no refund or extra Service Credit will be provided.
   5. The Candidate will be invited to upload the Supporting Documentation required to enable the Supplier to undertake the relevant ID&V Check.  Once the ID&V Check is completed, the results will be output for the Customer and its Users to access on the App.  The results will be retained on the App for the Customers and its Users to download for a period of 2 years, unless a longer retention period is otherwise agreed to in writing by the Supplier (subject to any additional fees for extended storage agreed to by the Supplier), after which time it will be removed.  The Supplier will not be responsible or liable to the Customer or any Candidate for the removal of the ID&V Check results after the agreed retention period expires.
   6. The results of an ID&V Check (including any Supporting Documentation) are made available to the Customer and its Users on the App.  Where this output is downloaded by the Customer or its Users, the Customer is wholly responsible for ensuring the security and integrity of the same.  The Supplier is not responsible or liable to any person for any use of such output or any Supporting Documentation retained therein (whether in whole or in part) by the Customer or any User for the purpose for which it was not provided.
   7. The Supplier will use best endeavours to ensure that that the results of all ID&V Checks are accurate, complete, and up-to date but for the avoidance of doubt does not guarantee or warrant the same.  The ID&V Checks are subject to limitations inherent in the facial recognition and identity verification technology and the databases used to verify Candidate information and Supporting Documentation.  The Customer acknowledges that ID&V Checks may not be incapable of circumvention, manipulation or tampering by end users or immune to any manipulation, forgery or editing of Supporting Documentation. 
7. Price
   1. The price for the Initial Term of the Customer’s subscription shall be charged at the applicable rate for the ID&V Services package the Customer has chosen as set out in the Order, or where no such provision is made, as advised in writing by the Supplier from time to time.  For any Renewed Term, the Price payable shall be the Supplier’s standard rate for the chosen subscription package at the time of renewal.
   2. The Price is exclusive of VAT or equivalent applicable sales tax or duties.
   3. The Supplier may increase the Price or the cost for purchasing Service Credits at any time by giving the Customer not less than 15 days’ notice in writing of any increases.
8. Payment
   1. Prior to the provision of the ID&V Services, the Customer will be required to pay the Price for the first month of the Initial Term whether the Customer has ordered a monthly or annual subscription.  Thereafter, the Customer shall be required to pay monthly in advance for the ID&V Services.
   2. Invoices for purchase of Service Credits shall be issued within 5 days of a request for Service Credits and are payable by the due date stated on the invoice. 
   3. If any payments go overdue past the due date for payment stated on the invoice, the Supplier reserves the right to:
      1. charge interest on the unpaid sums at a rate of 4% above the base rate of the Bank of Scotland, accruing daily from the date on which the sums go overdue until the date of payment in full, whether before or after judgment; 
      2. suspend Customer and User access to the ID&V Services until such time as the overdue sums are paid in full.
9. Intellectual Property

All Intellectual Property Rights in the ID&V Services belong to the Supplier or, where applicable, to Yoti and/or their respective third party licensors, in each case subject to any Intellectual Property Rights in the ID&V Services which are licensed to either the Supplier or Yoti by their applicable third party licensors.  The Customer and its Users shall not gain any right in or to the Intellectual Property Rights in the ID&V Services other than an as expressly stated in these ID&V Terms.

9. Confidentiality
   1. Confidential Information shall not include any information which:
      1. is, or was already known or available to the receiving party, otherwise than pursuant to or through breach of any confidentiality obligation owed to the disclosing party (including any third party obligation);
      2. is or becomes in the public domain other than through breach of the Contract (other than publicly available information which is compiled in a form which is not in the public domain);
      3. is disclosed to the receiving party without any obligation of confidence to the disclosing party by a third party that is not itself under any obligation of confidentiality;
      4. is developed by or on behalf of the receiving party in circumstances where the developing party has not had direct or indirect access to the information disclosed, subject to the receiving party providing satisfactory evidence of the same to the disclosing party; or
      5. the disclosing party agrees in writing does not constitute Confidential Information.
   2. Each party undertakes not to disclose any Confidential Information of the other party received under the Contract or through the provision or use of the ID&V Services to any third party other than that party’s employees, affiliates, professional advisors and/or third party service providers who need to know such Confidential Information for the purpose of fulfilling the Contract PROVIDED THAT where such Confidential Information is disclosed pursuant to this clause the relevant recipient is made aware of the confidential nature of such information and agrees to treat it as confidential in accordance with this clause 9.
   3. A receiving party may disclose Confidential Information which its is required to disclose by law, any court, any governmental, regulatory or supervisory authority or any other authority of competent jurisdiction.
   4. This clause 9 shall bind the parties during the term of the Contract and for a period of 5 years following its termination or expiry.  Personal data shall remain confidential for as long as it retained by a party.
10. Data Protection
    1. The parties agree that:
       1. with regard to personal data made available through the ID&V Services by Candidates for the purposes of conducting ID&V Checks, the Supplier is the Controller and the Customer is a Processor of that personal data; and
       2. with regard to personal data received by the Supplier from the Customer relating to its Users or persons connected with the Customer’s organisation, the Customer is the Controller and the Supplier is the Processor of such personal data.
    2. The Supplier and the Customer each acknowledge and agree to comply with the Data Processing Addendum and to treat personal data received under the Contract as Confidential Information.
    3. By using the ID&V Services, the Customer and its Users consent to the sharing of Supporting Documentation and personal data gathered from Candidates and Users making use of the ID&V Services with Yoti strictly for the purposes of conducting ID&V Checks and services ancillary to the ID&V Checks.  The Supplier shall not be responsible or liable to the Customer, its Users or any Candidate for any handling or use of personal data by Yoti which is not in accordance with Data Protection Laws.
    4. The Customer warrants and represents that at all times:
       1. the processing of Candidate personal data shall comply in all respects with Data Protection Laws or equivalent laws applicable to the Customer including in terms of its collection, use and storage; and
       2. that any use of Candidate personal data received in connection with the ID&V Services shall be strictly for the purposes for which it is provided.
    5. The Customer shall indemnify and keep indemnified the Supplier for and against all losses arising out of or in connection with the Customer’s failure to process Candidate personal data in accordance with Data Protection Laws or equivalent laws applicable to the Customer in its local jurisdiction.
11. Termination
    1. The Customer may terminate its subscription to the ID&V Services by informing the Supplier in writing.  In the event of termination pursuant to this clause 11.1, the Customer shall be entitled to continue using the ID&V Services up to the end of its current Subscription Term and no refund of the Price or for any unexpired Service Credits purchased but not used at the time of termination shall be given to the Customer.  These ID&V Terms shall continue to apply to the Customer and its Users until termination takes effect.
    2. The Supplier shall not be liable to the Customer, its User or any Candidate for any loss incurred as a result of the termination of the Contract. 
    3. Termination of the Contract shall be without prejudice to any accrued rights or liabilities of either party.
12. Limitation of liability
    1. The extent of the parties’ liability under the Contract shall be as stated in this clause 12.
    2. Either party’s maximum liability under the Contract shall be limited to the lesser of:
       1. the Price paid or payable in the 12 months preceding the event giving rise to such liability; or
       2. £10,000.
    3. Subject to clause 12.5, neither party shall be liable to the other for indirect or consequential losses arising out of or in connection with the Contract or the ID&V Services.
    4. Subject to clause 12.5, neither party shall be liable to the other under the Contract whether in contract, delict, for breach of statutory duty or otherwise arising out of or in connection with the Contract or the ID&V Services for:
       1. loss of profit;
       2. loss of contract;
       3. loss of revenue;
       4. loss of or damage to reputation or goodwill.
    5. Notwithstanding any other provision of the Contract, the liability of a party shall not be limited in any way in respect of:
       1. death or personal injury caused by negligence;
       2. fraud or fraudulent misrepresentation; or
       3. any other losses which cannot be excluded by applicable laws.
    6. The limitations of liability set out in this clause 12 do not apply to any indemnity given by a party under the Contract.
    7. Other than as expressly stated in these ID&V Terms, all representations, warranties, undertakings, conditions and other terms which might otherwise be implied are excluded to the fullest extent permitted by law.
13. Variation

The Supplier reserves the right to make changes to these ID&V Terms by notifying the Customer of any upcoming changes and posting the updated ID&V Terms on the Website or making them available through the App at least 14 days before they become effective.  By continuing to use the ID&V Services after the updated ID&V Terms become effective, the Customer agrees to be bound by the updated ID&V Terms. 

14. Assignation
    1. The Supplier may assign its rights and obligations under the Contract without notice to the Customer to any person to which the Supplier transfers its business, provided that the assignee undertakes in writing to be bound by the Supplier’s obligations under the Contract.
    2. The Customer may not assign any of its rights or obligations under the Contract without the prior written consent of the Supplier, such consent not to be unreasonably withheld or delayed.
15. General
    1. The Contract constitutes the entire agreement between the parties and supersedes all previous agreements, understandings ad arrangements between them in respect of its subject matter.
    2. Nothing in the Contract constitutes or shall be deemed to constitute a partnership between the parties or make any party an agent of the other.
    3. If any provision or any part of any provision of these ID&V Terms, the Data processing Addendum or the Contract becomes illegal, invalid or unenforceable, the legality, validity and enforceability of any other provision shall be unaffected.
    4. No failure, delay or omission by the Supplier in exercising any right power or remedy provided to it by law or under the Contract shall operate as a waiver of that right, power or remedy, nor shall it preclude or restrict any future exercise of that or any other right or remedy.  No single or partial exercise of any right, power or remedy provided by law or under the Contract shall prevent nay future exercise of it or the exercise of any other right, power or remedy. 
    5. No one other than the Customer or the Supplier shall have any rights to enforce any of its provisions.
    6. These ID&V Terms, the Data Processing Addendum and the Contract are governed by and shall be construed in accordance with the laws of Scotland.  Any action, claim or proceeding (including those of a non-contractual nature) arising out of or in connection with the Contract or these ID&V Terms shall be subject to the exclusive jurisdiction of the courts of Scotland.

Appendix 1

Data Processing Addendum

This Data Processing Addendum applies to the extent that the Supplier processes personal data on behalf of the Customer, and forms part of the Contract between the Supplier and the Customer.

This Data Processing Addendum imposes an obligation on the Supplier in regards to the personal data processes and shall survive the termination of the Contract and/or the ID&V Services.

1. Definitions
   1. In this Data Processing Addendum, the following words and expressions have the following meanings:

“Authorised Sub-Processors” means those persons identified as such in this Data Processing Addendum;

“Contract” has the meaning given in the ID&V Terms;

“Controller” has the meaning given in Data Protection Laws;

“Customer” has the meaning given in the ID&V Terms;

“Data Protection Laws” means, as binding on either party or the ID&V Services:

1. the GDPR, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (including as further amended or modified by the laws of the United Kingdom or of a part of the United Kingdom from time to time);
2. the Data Protection Act 2018;
3. any laws which implement or supplement any such laws; and
4. any laws that replace, extend, re-enact, consolidate or amend any of the foregoing;

“Data Subject” has the meaning given in Data Protection Laws;

“GDPR” means the General Data Protection Regulation ((EU) 2017/679);

“ID&V Services” has the meaning given in the ID&V Terms;

“ID&V Terms” means the terms and conditions to which this Data Processing Addendum is annexed and forms a part of;

“personal data” has the meaning given in Data Protection Laws;

“process” has the meaning given in Data Protection Laws and associated terms such as “processing” and “processed” shall be interpreted accordingly;

“Processor” has the meaning given in Data Protection Laws;

“Protected Data” means personal data received from or on behalf of the Customer in connection with the Supplier’s performance of its obligations under the Contract;

“Sub-Processor” means any data processor appointed by the Supplier to process personal data on behalf of the Customer in connection with the ID&V Services;

“User” has the meaning given in the ID&V Terms;

2. Processing of personal data
   1. The parties agree that:
      1. with regard to personal data made available through the ID&V Services by Candidates for the purposes of conducting ID&V Checks, the Supplier is the Controller and the Customer is a Processor of that personal data; and
      2. with regard to personal data received by the Supplier from the Customer relating to its Users or persons connected with the Customer’s organisation, the Customer is the Controller and the Supplier is the Processor of such personal data.
   2. Where the Customer downloads any Candidate personal data for storage or use outside of the Website or App, it shall be the Controller of that personal data and shall comply in all respects with applicable Data Protection Laws in regards to the handling and use of such personal data.
   3. Each party undertakes to comply at all times with Data Protection Laws or equivalent applicable laws in relation to the processing of personal data.
   4. The Customer shall ensure all instructions given by it to the Supplier in respect of Protected Data shall at all times be in accordance with all Data Protection Laws.  Nothing in this Data Processing Addendum relieves the Customer of any responsibilities or liabilities under Data protection Laws or applicable laws in the Customer’s territory.
   5. The Supplier shall only process Protected Data relating to the data subjects for the purposes of performing its obligations under the Contract and shall not process, transfer, modify, amend or alter the Protected Data or disclose or permit the disclosure of the Protected Data other than in accordance with the Customer’s documented instructions or as required by applicable Data Protection Laws.
3. Scope and nature of processing
   1. The scope and nature of the Supplier’s processing of Protected Data shall be as set out in this clause 3.1 of this Data processing Addendum:

2. If the Supplier knows or reasonably believes that processing of Protected Data pursuant to the Contract infringes Data Protection Laws, it shall have the right to refuse to process such personal data without liability to the Customer until such time as the Customer provides updated or amended processing instructions which are in compliance with Data protection Laws as applicable to the Supplier.
3. The Customer warrants and undertakes to the Supplier that
   1. the Customer is entitled to disclose the Protected Data to the Supplier; 
   2. the Customer has and will maintain for the term of the Contract a valid lawful basis to process and share the Protected Data with the Supplier;
   3. all data subjects of the Protected Data have been or will be provided with appropriate privacy notices and information as required under Data Protection Laws or equivalent applicable laws; 
   4. where the legal basis for processing relied on is consent or explicit consent, all consents have been obtained in accordance with Data Protection Laws or equivalent applicable laws to establish and maintain for the duration of the processing the necessary legal grounds for the transfer of the Protected Data to the Supplier to enable the Supplier to process the personal data in accordance with this Data Processing Addendum and the Contract.
4. Security of processing
   1. The Supplier shall treat all Protected Data as strictly confidential and shall inform all its employees, agents, contractors and/or authorised sub-processors engaged in processing the Protected Data of its confidential nature.
   2. The Supplier shall take reasonable steps to ensure the reliability, integrity, and trustworthiness of any employee, agent, contractor and/or authorised sub-processor who may have access to the Protected Data and that in each case access to the Protected Data is limited to those persons or parties who need to access the relevant Protected Data, as necessary for the performance of the Supplier’s obligations under the Contract.
   3. The Supplier shall ensure that all such persons or parties involved in the processing of Protected Data are subject to:
      1. confidentiality undertakings or are under an appropriate statutory obligation of confidentiality;
      2. have undertaken training relating to handling personal data and how it applies to their particular duties in respect of the Protected Data; and
      3. are aware both of the Customer’s duties and their personal duties and obligations under Data Protection Laws.
5. Sub-processing
   1. The following service providers shall be deemed Authorised Sub-Processors for processing the Protected Data under the Contract:

2. The Supplier shall not engage any Sub-Processor to process personal data other than with the prior specific or general written authorisation of the Customer. As at the date of the Contract, the Customer hereby authorises the Supplier to engage those Sub-Processors set out at clause 5.1 above.
3. The Supplier shall inform the Customer of any intended changes concerning the addition or replacement of other processors with 10 working days’ notice, thereby giving the Customer the opportunity to object to such changes.
4. Survival

This Data processing Addendum shall survive the termination or expiry of the Contract and continue until no Protected Data remains in the possession or control of the Supplier or any Sub-Processor.