Data processing agreement

1.1 This data processing agreement ("DPA") is between Senior Internet Ltd, company number 03901114, registered office Gothic House, Barker Gate, Nottingham, NG1 1JU ("Senior"), and the customer named in the order form ("Customer"). It forms part of the agreement under which Senior provides RiverCPD to the Customer (the "Main Agreement").

1.2 This DPA applies whenever Senior processes Customer Personal Data to provide RiverCPD, wherever that processing takes place.

1.3 If this DPA conflicts with the Main Agreement on a data protection matter, this DPA wins. If the SCCs or the UK Addendum apply and conflict with this DPA, they win.

2.1 In this DPA:

• Customer Personal Data means personal data, personal information or any equivalent term in the Data Protection Laws, that Senior processes on the Customer's behalf under the Main Agreement.
• Data Protection Laws means every law on privacy or personal data that applies to the processing of Customer Personal Data, in any country, as amended or replaced from time to time. It includes the laws named in Schedule 4.
• Controller, Processor, Data Subject, Personal Data Breach and Processing have the meanings given in the UK GDPR, and include the equivalent terms in other Data Protection Laws: for example "business" and "service provider" or "contractor" under US state laws, "APP entity" under Australian law, "agency" under New Zealand law, and "organization" under Canadian law.
• Personnel means the people Senior authorises to access Customer Personal Data, wherever they work: its employees, its individual contractors, and people engaged through an employer of record or similar company.
• Sub-processor means any third party Senior engages that processes Customer Personal Data.
• Restricted Transfer means any transfer of Customer Personal Data, including remote access to it, that the Data Protection Laws allow only with a safeguard because of the country where the recipient is.
• SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, as completed by Schedule 3.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0, as completed by Schedule 3.

3.1 The Customer is the Controller of Customer Personal Data and Senior is its Processor. If the Customer is itself a Processor for another organisation, Senior is its Sub-processor, and the Customer confirms it has that organisation's authority to appoint Senior.

3.2 Senior processes Customer Personal Data only on the Customer's documented instructions. Those instructions are the Main Agreement, this DPA, the way the Customer configures and uses RiverCPD, and any other instruction the parties agree in writing. If a law requires Senior to process Customer Personal Data in any other way, Senior will tell the Customer first, unless that law forbids it.

3.3 Senior will tell the Customer promptly if it believes an instruction breaks the Data Protection Laws.

3.4 Senior does not process Customer Personal Data for its own purposes.

3.5 When a member uses the AI coach, or an auditor uses AuditAssist, Senior sends only what the feature needs, with the member's name and contact details removed. Neither Senior nor any Sub-processor uses Customer Personal Data to train any AI model.

4.1 The Customer is responsible for having a lawful basis for the processing, for giving Data Subjects the information the law requires, and for the accuracy of the Customer Personal Data it provides.

4.2 RiverCPD does not need special category or other sensitive data. If the Customer configures RiverCPD to collect it, the Customer is responsible for meeting any additional legal condition, and will tell Senior so that the parties can agree any extra measures.

4.3 The Customer will not use RiverCPD to store patients', clients' or service users' health records, or data governed by sector-specific laws such as the US Health Insurance Portability and Accountability Act (HIPAA), unless the parties agree it in writing first.

5.1 Senior gives Personnel access to Customer Personal Data only when they need it to provide RiverCPD, for example to answer a support request, fix a fault or investigate a security event.

5.2 Every member of Personnel is bound by a written duty of confidentiality that continues after their work for Senior ends, is trained in data protection and security when they join and at least once a year, and uses a named account protected by multi-factor authentication. Senior removes access promptly when someone leaves or no longer needs it.

5.3 Senior is responsible for its Personnel's acts and omissions as if they were its own, wherever the Personnel work.

6.1 Senior will keep in place the technical and organisational measures in Schedule 2. They are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, with a level of security appropriate to the risk.

6.2 Senior may change those measures as technology and threats change, as long as the overall level of protection does not fall.

7.1 The Customer gives Senior general authorisation to use Sub-processors. Senior's current Sub-processors are listed at rivercpd.com/dpa/sub-processors, which forms Annex III for the purposes of the SCCs.

7.2 Senior will tell the Customer at least 7 days before it adds or replaces a Sub-processor, by updating the list and emailing the Customer's data protection contact. If a change is urgent to protect the security or continuity of RiverCPD, Senior will tell the Customer as soon as it can.

7.3 The Customer may object to a change on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may end the affected part of the Services, and Senior will refund any fees paid in advance for it.

7.4 Senior will put a written contract in place with each Sub-processor that protects Customer Personal Data at least as well as this DPA, including the transfer safeguards in clause 8 where they are needed. Senior remains responsible to the Customer for each Sub-processor's performance.

8.1 Storage. Senior stores Customer Personal Data in the hosting location in Schedule 1. Senior will not move where Customer Personal Data is stored to another country without giving the Customer at least 90 days' notice. If the Customer objects, it may end the Services and Senior will refund any fees paid in advance for the period after the move.

8.2 Access from other countries. Senior's Personnel and Sub-processors work in several countries. The Customer authorises them to access and process Customer Personal Data from other countries, including countries that the Data Protection Laws do not recognise as giving adequate protection, but only to provide the Services and only under this clause 8.

8.3 Safeguards for Restricted Transfers. For every Restricted Transfer, Senior relies on the first of these that applies:

1. an adequacy decision or regulation, under the Data Protection Laws, covering the country the data goes to;
2. the SCCs, with the UK Addendum for data protected by UK law and the Swiss amendments for data protected by Swiss law, completed as set out in Schedule 3, which the parties enter into by agreeing to this DPA;
3. any other safeguard the Data Protection Laws accept for that transfer, including those set out in Schedule 4.

8.4 Personnel engaged through another company. Some Data Protection Laws do not treat access by a processor's own employees abroad as a Restricted Transfer. Senior applies the measures in clause 8.5 to all Personnel either way. Where Personnel are engaged through a separate company, such as a contractor's company or an employer of record, Senior puts the SCCs (module 3, processor to processor) or another safeguard under clause 8.3 in place with that company before it has access.

8.5 Measures that apply wherever the data is accessed. Wherever Personnel or Sub-processors are:

• Customer Personal Data stays stored in the hosting location in Schedule 1. Access from elsewhere is remote.
• Access is only through named accounts protected by multi-factor authentication, over encrypted connections, from devices that meet Senior's device security policy: encrypted, locked when unattended, and running supported software with security updates applied.
• Personnel do not download, copy, print or keep Customer Personal Data on their own devices, except where a specific support task needs it, and they delete it when the task is done.
• Each person gets only the access their role needs. Their access through RiverCPD is recorded in its audit log, which Senior reviews every month.
• Senior keeps a written transfer risk assessment covering the countries access happens from, reviews it at least once a year and when the law changes, and gives the Customer a summary on request.

8.6 Where Personnel may access data from. Personnel may access Customer Personal Data only from the countries on Senior's permitted-locations list, published at rivercpd.com/dpa/sub-processors. The list never includes a country under comprehensive UK, EU or US sanctions. Senior enforces the list with location-based access controls, and records where each access comes from.

8.7 Adding a country. Senior adds a country to the list only after a documented assessment of the risks of access from it, under clause 8.5. Senior will tell the Customer at least 30 days before a country is added, and the Customer may object as clause 7.3 describes. A member of Personnel travelling to a country that is not on the list may be given access from it for a limited period, only after the same assessment, and Senior records each such approval.

8.8 Reporting. On request, Senior will report the countries from which Customer Personal Data was accessed during the period the Customer asks about, including any temporary approvals under clause 8.7.

8.9 If the law changes. If a safeguard used under clause 8.3 is amended, replaced or ruled invalid, Senior will adopt the replacement, or another lawful safeguard, and may update Schedule 3 by giving the Customer notice, as long as the level of protection does not fall. The Customer will sign any document reasonably needed to put the new safeguard in place.

9.1 RiverCPD lets the Customer handle most requests itself: members can export their records, and the Customer's administrators can correct, export and delete records in the Control Panel.

9.2 If Senior receives a request from a Data Subject about Customer Personal Data, it will pass it to the Customer within 5 working days and will not answer it, except to say it has been passed on, unless the Customer asks it to.

9.3 Senior will give the Customer reasonable help to answer requests it cannot handle itself. Up to 2 hours of help per quarter is included. Beyond that, Senior charges its standard hourly rate of £120 plus VAT. Data Subjects are never charged.

10.1 Taking into account the nature of the processing and the information available to it, Senior will give the Customer reasonable help with data protection impact assessments, consultations with regulators, security obligations and breach notifications.

11.1 Senior will tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

11.2 Senior will give the Customer the information it reasonably needs to meet its own obligations, as it becomes available: what happened, the categories and approximate number of people and records affected, the likely consequences, what Senior has done and will do about it, and a contact for more information.

11.3 Senior will take reasonable steps to contain the breach and reduce its effects, and will cooperate with the Customer's investigation. Senior will not tell a regulator or Data Subject about a breach of Customer Personal Data unless the Customer asks it to or the law requires it.

11.4 Telling the Customer about a breach is not an admission of fault.

12.1 Senior keeps records of the processing it carries out for its customers, as the Data Protection Laws require.

12.2 On request, Senior will give the Customer the information reasonably needed to show that it complies with this DPA, including its Cyber Essentials certificate and a summary of its most recent penetration test.

12.3 The Customer may audit Senior's compliance with this DPA, itself or through an independent auditor bound by confidentiality, once in any 12 months, with at least 30 days' notice, during business hours. Audits may be more frequent after a Personal Data Breach or if a regulator requires it. Audits will first use the information in clause 12.2 and must not put other customers' data or confidentiality at risk. Each party pays its own costs, unless the audit finds a material breach of this DPA by Senior, in which case Senior pays the Customer's reasonable costs.

13.1 During the Main Agreement, the Customer can export its data from the Control Panel at any time.

13.2 When the Main Agreement ends, if the Customer asks before the end date or within 30 days after it, Senior will give the Customer a full export of its data, in a standard format, such as CSV, within 30 days.

13.3 Senior will delete Customer Personal Data from its live systems within 30 days of the end date, and it will expire from backups within 90 days, unless a law requires Senior to keep it. Anything Senior must keep stays protected by this DPA. On request, Senior will confirm the deletion in writing.

14.1 If Senior or a Sub-processor receives a legally binding request from a public authority, in any country, to disclose Customer Personal Data, Senior will:

• tell the Customer promptly, unless the law forbids it, and in that case try to get the prohibition lifted;
• ask the authority to go to the Customer directly, where it can;
• check whether the request is lawful, and challenge it where there are reasonable grounds to;
• disclose only the minimum the request requires, and keep a record of what it disclosed.

14.2 Senior has not built any way for an authority to access Customer Personal Data other than through a lawful request of this kind. Senior has not received any such request to date.

15.1 Each party's liability under this DPA is subject to the limits and exclusions in the Main Agreement. This does not limit a Data Subject's rights under the SCCs or the UK Addendum, or any liability that the law does not allow to be limited.

16.1 This DPA lasts for as long as Senior processes Customer Personal Data.

16.2 Senior may update this DPA, including Schedules 3 and 4, to reflect changes in the Data Protection Laws or regulators' guidance, or to add the requirements of another country's law, by giving the Customer at least 30 days' notice, as long as the update does not reduce the protection for Customer Personal Data. Any other change needs both parties' written agreement.

16.3 This DPA is governed by the law that governs the Main Agreement, except where the Data Protection Laws or the SCCs require otherwise. The SCCs are governed by the law chosen in Schedule 3.

16.4 If a court finds any part of this DPA invalid, the rest continues to apply.

This schedule also serves as Annex I to the SCCs.

This schedule also serves as Annex II to the SCCs.

Hosting and separation

• RiverCPD runs on Microsoft Azure in the UK South region. Databases, files and backups are stored in the UK.
• Every customer has its own database, separate from every other customer's.
• Test and development systems do not use real Customer Personal Data.

Encryption

• Data is encrypted in transit using TLS 1.2 or later, and at rest, including backups.

How members and customer staff sign in

• Members sign in through the Customer's own login, using OAuth 2.0 and OpenID Connect. Customer staff sign in with one-time links sent by email. RiverCPD stores no passwords.
• Members, managers, auditors and administrators each see only what their role allows. Suspending a user or organisation stops access at the next request.

How Senior's Personnel get access

• Named accounts with multi-factor authentication, and only the access each role needs.
• Access only from devices that meet Senior's device security policy, under clause 8.5, wherever the person works.
• Personnel access through RiverCPD is recorded in its audit log and reviewed every month, and removed promptly when someone leaves or changes role.
• Written confidentiality duties, and data protection and security training when joining and every year.

Backups and recovery

• Backups every 24 hours: incremental backups kept for 30 days and full backups for 90 days, all in the UK. Restores are tested at least every month.

Keeping systems secure

• Security updates are applied promptly, and software dependencies are checked for known vulnerabilities.
• Senior holds Cyber Essentials certification.
• An independent penetration test at least once a year.
• Security events are logged and monitored. A documented incident response process, including telling customers within 48 hours (clause 11).
• Access to RiverCPD from countries subject to broad UK sanctions (currently Russia, Belarus, Iran and North Korea) is blocked for everyone.

AI features

• Before anything is sent to the AI model, the member's name, email address, membership number, employer and team are removed.
• No Customer Personal Data is used to train any AI model.
• Requests are processed by Amazon Bedrock in the EU. Anthropic, which makes the model, has no access to them. Raw model responses are deleted after 90 days.
• The Customer can switch AI features off for its whole scheme, and each member can switch them off for themselves.

1. Transfers from the Customer to Senior

1.1 Senior is established in the United Kingdom and stores Customer Personal Data there. Where the Customer's own law recognises the UK as adequate, as EU and Swiss law currently do, no further safeguard is needed for the Customer to send Customer Personal Data to Senior.

1.2 If that recognition ends, or the Customer's law requires a safeguard for sending data to the UK, the SCCs apply between the Customer (as data exporter) and Senior (as data importer) from that moment, completed as in paragraph 3, without either party needing to sign anything further.

2. Onward transfers by Senior

2.1 Where Senior's Sub-processors, or companies through which Personnel are engaged, receive or access Customer Personal Data in a country without an adequacy decision, Senior puts in place with them, before they have access:

• the SCCs, module 3 (processor to processor);
• for data protected by UK law, the UK Addendum or the UK International Data Transfer Agreement;
• for data protected by Swiss law, the SCCs with the Swiss amendments in paragraph 5;
• or, where the recipient is certified under a framework the relevant law recognises, such as the UK Extension to the EU-US Data Privacy Framework, that certification.

3. How the SCCs are completed

4. How the UK Addendum is completed

5. Switzerland

For data protected by the Swiss Federal Act on Data Protection (FADP), the SCCs apply with these changes: references to the GDPR mean the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and "Member State" does not stop Data Subjects in Switzerland from bringing claims where they usually live.

6. Other safeguards

Where another country's law requires a different transfer safeguard, Senior will put it in place under clauses 8.9 and 16.2.

Each part applies when Customer Personal Data is protected by that country's law. The core clauses of this DPA apply in every case.

A. United Kingdom and European Economic Area

This DPA contains the terms required by Article 28 of the UK GDPR and of the EU General Data Protection Regulation.

B. Australia

For Customer Personal Data protected by the Privacy Act 1988 (Cth), Senior will:

1. handle it in a way that is consistent with the Australian Privacy Principles, as if Senior were an APP entity, including keeping it secure and destroying or de-identifying it when it is no longer needed (APP 11);
2. not use or disclose it for any purpose other than providing the Services, including for direct marketing;
3. tell the Customer about any suspected eligible data breach within the time in clause 11, with the information the Customer needs to complete its assessment within 30 days and to notify the Office of the Australian Information Commissioner and affected individuals where required.

These commitments are the reasonable steps the Customer takes under APP 8.1 for any disclosure to Senior outside Australia. Clause 8.6 gives the Customer the information it needs to tell individuals where recipients are likely to be.

C. New Zealand

For Customer Personal Data protected by the Privacy Act 2020, Senior holds it only as the Customer's agent, for the Customer's purposes and not its own, and will not use or disclose it for any other purpose. Senior will tell the Customer about any privacy breach within the time in clause 11, so the Customer can notify the Privacy Commissioner and affected people as soon as practicable where the Act requires.

D. United States

1. For personal information protected by the California Consumer Privacy Act, as amended (CCPA), Senior is a service provider or contractor. The Customer discloses personal information to Senior only for the limited and specified business purposes in Schedule 1. Senior:
   1. will not sell or share it, as the CCPA defines those terms;
   2. will not retain, use or disclose it for any purpose other than those business purposes, or outside the direct business relationship with the Customer, except as the CCPA permits;
   3. will not combine it with personal information it receives from anyone else or collects itself, except as the CCPA permits;
   4. will comply with the CCPA and give it the same level of privacy protection the CCPA requires of businesses;
   5. will tell the Customer if it can no longer meet these obligations;
   6. allows the Customer to take reasonable and appropriate steps to make sure Senior uses the information in line with the Customer's obligations, and to stop and remedy any unauthorised use, including under clauses 11 and 12;
   7. certifies that it understands and will comply with these restrictions.
2. For personal data protected by the consumer privacy laws of other US states, Senior is a processor, and this DPA provides the terms those laws require: processing on instructions (clause 3), confidentiality (clause 5), sub-processor contracts and notice (clause 7), information and assessments (clause 12), and deletion or return (clause 13).
3. Senior is not a business associate under HIPAA (clause 4.3).

E. Canada

For personal information protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) or a substantially similar provincial law, including Quebec's private-sector privacy law, this DPA gives it a level of protection comparable to the Customer's own. Senior will tell the Customer about any breach within the time in clause 11, so the Customer can meet its reporting duties. Senior will give the Customer the information it needs for any assessment its law requires before personal information is communicated outside its province or Canada.

F. Anywhere else

If Customer Personal Data is protected by the law of any other country, Senior will process it only on the Customer's instructions and for the purposes in Schedule 1, and will apply every protection in this DPA. If that law places further requirements on processors, service providers or agents, the Customer will tell Senior, Senior will meet them, and the parties will add them to this schedule under clause 16.2.