1. ROLES AND SCOPE

These terms apply where Remapped processes Personal Data contained in Your Data on your behalf. You are the controller and Remapped is the processor. They form part of the Assessment Terms. Your Data may include outputs generated by Remapped's Rapid Discovery and other Discovery Tools, together with other technical and operational data provided for the assessment.

You confirm that you have a lawful basis and the necessary rights and authority for the processing of Personal Data contemplated by these terms, including the deployment of the Discovery Tools and the provision of the resulting data to Remapped, and that you have provided any notices required by applicable law.

2. OUR INSTRUCTIONS

We process Personal Data only on your documented instructions, which include the Assessment Terms, these terms and any other documented instructions agreed for the assessment, unless required otherwise by law. Where the law requires processing, we will tell you first unless the law prohibits that. We will inform you without undue delay if, in our opinion, an instruction infringes applicable data protection law. We will not determine the purposes or means of processing Personal Data on your behalf.

3. CONFIDENTIALITY

We ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations.

4. SECURITY

We implement appropriate technical and organizational measures under Article 32, as described in Annex 2.

5. SUB-PROCESSORS

You give general written authorization for our use of the sub-processors listed in Annex 3, which include our group companies and our hosting provider.

We will give at least [30] days' notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds. We remain responsible for our sub-processors' performance.

6. ASSISTANCE WITH DATA SUBJECT RIGHTS

Taking account of the nature of the processing, we will assist you by appropriate technical and organizational measures in responding to requests from individuals exercising their rights.

7. PERSONAL DATA BREACH

We will notify you without undue delay and in any event within forty-eight (48) hours after becoming aware of a Personal Data Breach affecting Personal Data processed under these terms. We will provide the information reasonably available to us, including the nature and likely impact of the breach and mitigation measures, and will cooperate with you in remediation and in meeting your obligations under applicable data protection law.

8. ASSISTANCE WITH ARTICLES 32 TO 36

We will assist you, taking account of the nature of processing and the information available to us, with security, breach notification, data protection impact assessments and prior consultation.

9. DELETION OR RETURN

On termination or completion of the relevant processing, or on your earlier written request, and in any event within 30 days of the applicable request or termination, at your choice we will return the Personal Data or securely delete or render it unreadable, unless applicable law requires retention. Copies held in routine backup systems will be deleted in accordance with the ordinary backup cycle and remain protected under these terms until deleted.

This clause does not apply to Personal Data that Remapped processes as an independent controller, including platform account, access, usage and authorization records described in our Privacy Notice.

10. INFORMATION AND AUDITS

We make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits or inspections by you or your appointed auditor, no more than once in any twelve (12) month period (except following a Personal Data Breach or where required by a supervisory authority), on at least thirty (30) days' written notice, during business hours, at your cost and subject to appropriate confidentiality obligations. We may satisfy an audit request by providing current relevant third-party certifications or audit reports where these reasonably address the requested information.

11. INTERNATIONAL TRANSFERS

Personal data is hosted in the United States and may be accessed by our personnel and sub-processors in the countries listed in Annex 3.

Where Personal Data is transferred out of the United Kingdom or the European Economic Area to a jurisdiction that does not provide an adequate level of protection, the transfer will be made under an approved transfer mechanism. Where required, the European Commission's Standard Contractual Clauses apply using Module 2 (Controller-to-Processor), with you as data exporter and Remapped as data importer, together with the UK International Data Transfer Addendum for restricted transfers from the United Kingdom and a transfer risk assessment where required. The Standard Contractual Clauses are incorporated by reference into these terms. For Clause 17 of the Standard Contractual Clauses, the laws of Ireland apply and, for Clause 18, the courts of Ireland have jurisdiction. The UK Addendum is governed by the laws of England and Wales.

12. GOVERNMENT ACCESS AND ADDITIONAL SAFEGUARDS

We maintain procedures to handle governmental, regulatory and law-enforcement requests for access to Personal Data. Where legally permitted, we will notify you promptly; assess the legality of and challenge unlawful or disproportionate requests; disclose only the minimum Personal Data necessary; remove identifying elements where reasonably possible; cooperate with you to contest or limit the request; maintain applicable confidentiality and security protections; and not disclose encryption keys or otherwise weaken security protections.

We will minimize the amount of Personal Data processed, apply pseudonymization where feasible, and suspend affected processing where compliance with applicable data protection law cannot be ensured. You may require the affected processing to cease where compliance cannot be restored within a reasonable period.

13. ORDER OF PRECEDENCE

In the event of any conflict between these Data Processing Terms and the Assessment Terms, these Data Processing Terms prevail to the extent of the conflict in relation to the processing of Personal Data.

14. GOVERNING LAW

These Data Processing Terms are governed by the law and subject to the jurisdiction specified in the Assessment Terms, except that the Standard Contractual Clauses and UK International Data Transfer Addendum are governed as set out in clause 11 above.