Data processing agreement

This agreement forms part of the terms and conditions between LMN Couriers Ltd. ("Adhoc") and each depot that uses the Adhoc platform ("the Depot"). It meets the requirements of Article 28 of the UK GDPR.

1. Roles

Adhoc and the Depot are each independent controllers of the data they need to arrange and pay for jobs, such as courier verification and payment records; that data is covered by our privacy policy.

This agreement covers the personal data Adhoc processes only on the Depot's behalf, for which the Depot is the controller and Adhoc the processor: the names, addresses, phone numbers and delivery instructions of the Depot's recipients, and the proof of delivery (signatures and photographs) captured against them.

2. Details of the processing

• Subject matter and purpose: giving couriers what they need to deliver the Depot's parcels, and recording that they did.
• Duration: for as long as the Depot uses Adhoc, and then until the data is deleted or returned under section 9.
• Data subjects: the Depot's parcel recipients.
• Types of personal data: name, delivery address, phone number, delivery instructions, signatures and photographs taken as proof of delivery.
• Special category data: none. The Depot must not upload any.

3. Adhoc's obligations

Adhoc will:

• process the data only on the Depot's documented instructions, which are these terms and the Depot's use of the platform, unless the law requires otherwise, in which case Adhoc will tell the Depot first unless the law forbids it;
• tell the Depot if it believes an instruction breaks data protection law;
• make sure everyone who processes the data, couriers included, is bound to keep it confidential and sees only what a job needs;
• keep the data secure with appropriate technical and organisational measures, including encryption in transit and at rest, access controls and regular testing;
• help the Depot, as far as reasonably possible, to respond to data subjects exercising their rights, and to meet its obligations on security, breach notification, impact assessments and consulting the ICO;
• make available what the Depot reasonably needs to show compliance with this agreement, and allow audits on reasonable notice, no more than once a year unless there has been a breach.

4. Sub-processors

The Depot authorises Adhoc to use sub-processors to host the platform and to send messages. Adhoc keeps a current list, available on request from marian.nestorov@gmail.com, and will give the Depot at least 30 days' notice of a new one, during which the Depot may object on reasonable grounds. Each sub-processor is bound by a written contract with data protection terms no less protective than these, and Adhoc remains liable for it.

5. Couriers

Couriers see a recipient's details only for jobs they have accepted, and only until the job is complete. They are bound by Adhoc's terms to use the details only to deliver, and not to copy or keep them.

6. International transfers

Adhoc will not transfer the data outside the UK unless it is covered by UK adequacy regulations or by the ICO's International Data Transfer Agreement or Addendum.

7. Personal data breaches

Adhoc will tell the Depot without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Depot's data, with what it knows about the breach and what it is doing about it, so that the Depot can meet its 72-hour duty to the ICO.

8. The Depot's obligations

The Depot is responsible for having a lawful basis to share its recipients' data with Adhoc, for telling recipients that it does, and for the accuracy of what it uploads.

9. At the end

When the Depot stops using Adhoc, Adhoc will, at the Depot's choice, return or delete the data within 30 days, unless the law requires it to keep a copy. Proof of delivery is otherwise kept for 12 months after each delivery and then deleted.

10. Liability and precedence

Liability under this agreement is subject to the limits in the terms and conditions. Where this agreement and the terms conflict about personal data, this agreement wins.

Contact

Questions about this agreement, and requests for the sub-processor list or a signed copy, go to marian.nestorov@gmail.com.