Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between GRC Ready Limited ("Processor", "we", "us"), trading as GRC Ready, and the customer organisation ("Controller", "you") that uses the Service. It governs the processing of personal data we carry out on your behalf, in accordance with UK GDPR and the Data Protection Act 2018.

1. Roles of the Parties

For personal data that you submit to the Service relating to your organisation, employees, or third parties, you act as the Controller and we act as the Processor. We process such data only on your documented instructions, as set out in this DPA and the Terms of Service.

2. Subject Matter and Details of Processing

Item	Details
Subject matter	Provision of the GRC Ready compliance assessment platform
Duration	For the term of your use of the Service plus any retention period
Nature & purpose	Hosting, storing, and processing assessment data to generate compliance reports
Types of personal data	Names, email addresses, company details, and any data entered into assessments
Categories of data subjects	Your authorised users, employees, and personnel

3. Our Obligations as Processor

We shall:

• Process personal data only on your documented instructions, unless required by law;
• Ensure persons authorised to process the data are bound by confidentiality;
• Implement appropriate technical and organisational security measures (see Section 6);
• Respect the conditions for engaging sub-processors (see Section 4);
• Assist you, where reasonably possible, in responding to data subject rights requests;
• Assist you with data protection impact assessments and breach notifications;
• Delete or return all personal data at the end of the engagement, as you choose;
• Make available information necessary to demonstrate compliance and allow for audits.

4. Sub-Processors

You provide general authorisation for us to engage sub-processors (such as cloud hosting and infrastructure providers) to deliver the Service. We will:

• Maintain a list of sub-processors, available on request;
• Impose data protection obligations on each sub-processor equivalent to those in this DPA;
• Remain liable for the performance of each sub-processor's obligations;
• Notify you of intended changes to sub-processors, giving you the opportunity to object.

5. International Transfers

Where personal data is transferred outside the UK, we will ensure an appropriate transfer mechanism is in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

6. Security Measures

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit and at rest;
• Access controls and authentication, ensuring data is only accessible to authorised users;
• Row-level data isolation between organisations;
• Regular review of security practices;
• Measures to restore availability and access to data in the event of an incident.

7. Personal Data Breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide reasonable information to help you meet your own notification obligations to the ICO and affected individuals.

8. Data Subject Rights

Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures, insofar as possible, to fulfil your obligation to respond to requests from data subjects exercising their rights.

9. Deletion and Return of Data

On termination of the Service, we will, at your choice, delete or return all personal data and delete existing copies, unless retention is required by law.

10. Audit

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice and confidentiality.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

12. Contact

To request our sub-processor list, raise a data protection query, or execute a signed copy of this DPA, contact:
GRC Ready Limited
Email: info@grcready.co.uk