Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement (“Agreement”) between the customer (“Customer”) and Cyberstaff Ltd (“Cyberstaff”) where Cyberstaff processes personal data on Customer's behalf.

“Applicable Data Protection Law” means applicable data protection and privacy law, including where relevant the UK GDPR, Data Protection Act 2018 and EU GDPR. Terms such as Controller, Processor, Personal Data, Processing and Data Subject have the meanings given to them under Applicable Data Protection Law.

1. Scope and Roles

For Personal Data processed by Cyberstaff on Customer's behalf (“Customer Personal Data”), Customer is the Controller and Cyberstaff is the Processor. Where Customer acts as a Processor for another Controller, Cyberstaff acts as Customer's Subprocessor.

Cyberstaff will process Customer Personal Data only on Customer's documented instructions, including those arising from the Agreement and Customer's use and configuration of the Services, unless otherwise required by applicable law.

Processing for which Cyberstaff independently determines the purposes and means falls outside this DPA and is governed by applicable law and Cyberstaff's Privacy Policy.

2. Customer Obligations

Customer is responsible for complying with obligations applicable to it under Applicable Data Protection Law and for ensuring that its instructions and use of the Services are lawful.

This includes establishing any required lawful basis and providing notices or obtaining consents, permissions or other authorisations where required for Personal Data and communications processed through the Services.

Customer authorises Cyberstaff to process Customer Personal Data as necessary to provide the Services and carry out Customer's instructions.

3. Cyberstaff Obligations

Cyberstaff will process Customer Personal Data only on Customer's documented instructions unless otherwise required by law, ensure that persons authorised to process it are subject to appropriate confidentiality obligations, maintain appropriate technical and organisational security measures, and provide the assistance reasonably required of a Processor under Applicable Data Protection Law, taking into account the nature of the processing and information available to Cyberstaff. Cyberstaff will immediately inform Customer if, in Cyberstaff’s opinion, an instruction infringes Applicable Data Protection Law.

4. Security

Cyberstaff will maintain technical and organisational measures appropriate to the nature of the processing and relevant risks and may update those measures as its Services, technology and risks evolve, provided that the overall level of protection is not materially reduced.

5. Subprocessors

Customer gives Cyberstaff general written authorisation to engage Subprocessors in connection with the Services.

Information about Cyberstaff's current Subprocessors is available through our Trust Center. Access to some information may require reasonable verification or a request for access.

Cyberstaff will impose appropriate data protection obligations on Subprocessors and remains responsible for their performance to the extent required by Applicable Data Protection Law.

Cyberstaff will make information concerning intended material changes to its Subprocessors available through its compliance materials or another written notification mechanism where required by Applicable Data Protection Law. Customer may object within 14 days on reasonable and documented data protection grounds. The parties will work reasonably to address a valid objection.

6. International Transfers

Customer authorises Cyberstaff and its Subprocessors to process Customer Personal Data in countries in which they operate, subject to Applicable Data Protection Law.

Where an international transfer requires additional safeguards, the parties will rely on an applicable lawful transfer mechanism, which may include adequacy arrangements, applicable Standard Contractual Clauses, the UK International Data Transfer Addendum or another mechanism permitted by law.

7. Assistance and Security Incidents

Taking into account the nature of the processing and information available to Cyberstaff, Cyberstaff will provide reasonable assistance to Customer with Data Subject requests and Customer's applicable obligations concerning security, personal data breaches, data protection impact assessments and regulatory consultations.

Cyberstaff will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and will provide reasonably available information necessary to assist Customer in meeting its applicable obligations.

If Cyberstaff receives a request directly from a Data Subject concerning Customer Personal Data, Cyberstaff may direct that person to Customer unless required by law to respond directly.

8. Return and Deletion

At the end of the relevant Services, Cyberstaff will delete or return Customer Personal Data in accordance with Customer's instructions and Cyberstaff's standard retention and deletion processes, unless continued retention is required by law.

Customer authorises retention in backups and other systems where immediate deletion is not reasonably practicable, provided the information remains appropriately protected.

This section does not apply to information Cyberstaff processes independently as a Controller or information that is no longer Personal Data.

9. Compliance Information

Cyberstaff will make information reasonably necessary to demonstrate compliance with this DPA available to Customer and will permit audits where required by Applicable Data Protection Law.

Customer will first use available certifications, assessments, reports and other compliance information where reasonably sufficient. Any additional audit must be reasonable, proportionate, subject to appropriate confidentiality requirements and designed to minimise disruption to Cyberstaff.

Unless required by a supervisory authority, following a relevant security incident or where available information is insufficient for Customer to meet its legal obligations, audits may not occur more than once in any twelve-month period and will be at Customer's cost.

10. Processing Details

Subject matter and purpose: Processing Customer Personal Data as necessary to provide, operate, secure and support the Services in accordance with the Agreement and Customer's instructions.

Duration: For the duration of the Agreement and any period for which processing is reasonably required afterwards in accordance with the Agreement or applicable law.

Nature of processing: Collection, storage, access, use, transmission, analysis, generation, modification, retrieval, deletion and other processing necessary to provide the Services.

Personal Data: Personal Data relating to Customer's use of the Services, including communications and other information submitted to, collected through or otherwise processed using the Services, as determined by Customer.

Data Subjects: Individuals whose Personal Data Customer submits to or processes using the Services, which may include Customer's personnel, customers, prospective customers and other contacts.

11. General

Cyberstaff may update this DPA where reasonably necessary to reflect changes in Applicable Data Protection Law or the Services, provided that an update does not materially reduce the protection of Customer Personal Data.

If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA prevails.

This DPA applies for as long as Cyberstaff processes Customer Personal Data on Customer's behalf.

Last updated: 8 October 2026