PoodleCollective

Data Processing Terms

These Data Processing Terms ("Data Processing Terms") apply where Poodle Collective Ltd, company number 16818378 ("PoodleCollective", "we", "us" or "our") processes personal data on behalf of a client in connection with services supplied by PoodleCollective.

They form part of the agreement between PoodleCollective and the client where they are incorporated into, referred to by or accepted in connection with that agreement.

These Data Processing Terms are intended to satisfy the requirements applicable to contracts between controllers and processors under Article 28 of the UK GDPR.

1. Definitions

In these Data Processing Terms:

Agreement means the agreement under which PoodleCollective provides services to the Client, including any applicable service terms, order, proposal, statement of work or other agreed scope.

Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018 and other data protection legislation applicable to the Processing, in each case as amended or replaced from time to time.

Client means the person or organisation purchasing or commissioning the Services.

Client Personal Data means Personal Data processed by PoodleCollective on behalf of the Client in connection with the Services.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Special Category Datahave the meanings given to them under Applicable Data Protection Law.

Services means the services supplied by PoodleCollective under the Agreement.

Sub-processor means another Processor engaged by PoodleCollective to Process Client Personal Data on behalf of the Client.

Sub-processor List means PoodleCollective's current list of Sub-processors involved in Processing Client Personal Data in connection with the Services.

2. Roles of the parties

Where PoodleCollective Processes Client Personal Data on behalf of the Client:

  • the Client is the Controller; and
  • PoodleCollective is the Processor,

unless the circumstances of a particular Processing activity mean that Applicable Data Protection Law requires otherwise.

Nothing in these Data Processing Terms changes the parties' legal roles where those roles are determined differently by Applicable Data Protection Law.

PoodleCollective may also act as a Controller in its own right for separate purposes such as:

  • administering its business relationship with the Client;
  • maintaining business records;
  • invoicing and accounting;
  • fraud prevention;
  • information security;
  • managing enquiries and communications; and
  • complying with legal obligations.

Processing carried out by PoodleCollective as an independent Controller is governed by its Privacy Policy and Applicable Data Protection Law rather than these Data Processing Terms.

3. Processing particulars

The subject matter, duration, nature and purpose of the Processing, the types of Personal Data concerned and the categories of Data Subject are described in Schedule 1.

Where an Agreement, proposal, order or statement of work contains more specific Processing particulars, those particulars supplement Schedule 1 and take priority where they conflict with the general description in Schedule 1.

4. The Client's responsibilities

The Client is responsible for ensuring that its Processing of Personal Data, including its instructions to PoodleCollective, complies with Applicable Data Protection Law.

In particular, the Client is responsible for:

  • determining the purposes and means of the Processing;
  • establishing an appropriate lawful basis for the Processing;
  • providing any privacy information required by law;
  • ensuring that Personal Data supplied or made accessible to PoodleCollective has been collected and disclosed lawfully;
  • issuing lawful, documented instructions;
  • ensuring that the Processing is proportionate to the purposes for which it is required; and
  • informing PoodleCollective where particular security, regulatory or handling requirements apply to Personal Data included within the Services.

The Client must not instruct PoodleCollective to carry out Processing that would breach Applicable Data Protection Law.

5. Documented instructions

PoodleCollective will Process Client Personal Data only:

  • on documented instructions from the Client;
  • as reasonably necessary to provide the Services in accordance with the Agreement; or
  • where required to do so by applicable UK law.

The Agreement, these Data Processing Terms, written instructions supplied by the Client and subsequent instructions recorded in a durable written form, including email or an agreed project or support system, constitute documented instructions.

The Client's instructions include authorisation for PoodleCollective to carry out the types of Processing reasonably necessary to provide the Services described in the Agreement.

Where PoodleCollective is required by law to Process Client Personal Data other than on the Client's instructions, PoodleCollective will inform the Client of that legal requirement before carrying out the Processing unless the relevant law prohibits such notification.

If PoodleCollective believes that an instruction from the Client infringes Applicable Data Protection Law, PoodleCollective will inform the Client promptly and may suspend the affected Processing while the matter is resolved.

PoodleCollective will not use Client Personal Data for its own unrelated commercial purposes.

6. Access to Personal Data

PoodleCollective will limit access to Client Personal Data to those people who reasonably require access to provide, manage or secure the Services.

Where possible, access should be provided using:

  • individual user accounts;
  • temporary accounts;
  • appropriately restricted permissions; and
  • secure methods of credential exchange.

The Client should avoid providing PoodleCollective with access to Personal Data that is not reasonably necessary for the Services.

Passwords and other sensitive credentials should not be sent through ordinary email or standard website forms.

Where credentials are required, the parties should use the secure method specified by PoodleCollective.

7. Confidentiality

PoodleCollective will ensure that persons authorised to Process Client Personal Data:

  • are subject to an appropriate duty of confidentiality;
  • are informed of the confidential nature of the Personal Data where appropriate; and
  • access and Process that Personal Data only as required for the Services.

These confidentiality obligations continue after the relevant person's involvement with the Services ends.

8. Security of Processing

PoodleCollective will implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risk, taking account of:

  • the nature, scope, context and purposes of the Processing;
  • the nature of the Personal Data;
  • the risks to the rights and freedoms of individuals;
  • available technology; and
  • the reasonable costs of implementation.

The measures ordinarily applied by PoodleCollective are described in Schedule 2.

Depending on the nature and risk of the Processing, those measures may include appropriate controls relating to:

  • confidentiality;
  • integrity;
  • availability;
  • resilience;
  • access control;
  • authentication;
  • secure transmission;
  • backups and restoration;
  • vulnerability and software management;
  • incident management; and
  • periodic review of security measures.

Security measures will be proportionate to the Services being provided. For example, measures relating to hosting or backups apply only where PoodleCollective is responsible for those functions.

9. Special Category Data and other sensitive information

The Services do not normally require the Client intentionally to provide Special Category Data or criminal offence data to PoodleCollective.

However, PoodleCollective may incidentally have access to such information where it already exists within a website, database or system to which access is necessary to provide the Services.

Where the Client knows that the Services will require material or systematic Processing of:

  • Special Category Data;
  • criminal offence data;
  • children's data;
  • financial information;
  • health information; or
  • other particularly sensitive Personal Data,

the Client must tell PoodleCollective before that Processing begins so that any additional requirements can be considered.

PoodleCollective does not require full payment card numbers, card security codes or equivalent authentication data in order to provide its normal website support, development or audit services, and the Client must not intentionally provide such information unless expressly agreed as necessary and subject to appropriate safeguards.

10. Sub-processors

The Client gives PoodleCollective general written authorisation to engage Sub-processors in accordance with this clause.

PoodleCollective will maintain a current Sub-processor List identifying the Sub-processors it uses to Process Client Personal Data in connection with the Services.

The Client authorises the Sub-processors identified on the Sub-processor List made available to the Client at or before the relevant Processing begins.

PoodleCollective will ensure that each Sub-processor is bound by a written agreement imposing data protection obligations that provide an equivalent level of protection for Client Personal Data to the obligations imposed on PoodleCollective under these Data Processing Terms, to the extent required by Applicable Data Protection Law.

PoodleCollective remains responsible to the Client for the performance of a Sub-processor's applicable data protection obligations.

Changes to Sub-processors

Where PoodleCollective intends to appoint a new Sub-processor or replace an existing Sub-processor, it will give the Client reasonable advance written notice of the intended change.

Where reasonably practicable, PoodleCollective will provide at least 14 days' notice before the new Sub-processor begins Processing Client Personal Data.

The Client may object during that period where it has reasonable grounds relating specifically to the protection of Client Personal Data.

The parties will work in good faith to resolve a reasonable objection.

Where the parties cannot reasonably resolve the objection, PoodleCollective may:

  • avoid using the proposed Sub-processor for the affected Processing where reasonably practicable;
  • propose an alternative arrangement; or
  • terminate the affected part of the Services where it cannot reasonably provide those Services without the proposed Sub-processor.

Where an urgent change is reasonably necessary to protect the security or continuity of the Services, PoodleCollective may make the change without providing the full advance notice period but will notify the Client as soon as reasonably practicable.

11. International transfers

PoodleCollective will not initiate a restricted transfer of Client Personal Data outside the United Kingdom except:

  • on the Client's documented instructions;
  • as reasonably necessary through an authorised Sub-processor whose relevant location is disclosed to the Client; or
  • where required by law.

Where PoodleCollective is responsible under Applicable Data Protection Law for a restricted transfer, PoodleCollective will ensure that the transfer is made using a lawful transfer mechanism.

This may include, where applicable:

  • UK adequacy regulations;
  • an approved or recognised appropriate safeguard;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to relevant standard contractual clauses; or
  • another mechanism permitted by Applicable Data Protection Law.

Where Applicable Data Protection Law requires a transfer risk assessment or other assessment in connection with an appropriate safeguard, PoodleCollective will carry out or assist with that assessment to the extent required of it.

12. Data Subject rights

Taking into account the nature of the Processing, PoodleCollective will provide reasonable assistance to the Client through appropriate technical and organisational measures, insofar as reasonably possible, to enable the Client to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

This may include requests relating to:

  • access;
  • rectification;
  • erasure;
  • restriction;
  • objection;
  • portability; or
  • other applicable Data Subject rights.

If PoodleCollective receives a request directly from a Data Subject relating to Client Personal Data, PoodleCollective will, where reasonably identifiable:

  • notify or refer the request to the Client without undue delay; and
  • not respond substantively on the Client's behalf unless authorised by the Client or required by law.

The Client remains responsible for deciding how to respond to the request.

13. Personal Data Breaches

PoodleCollective will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

The notification will provide, insofar as the relevant information is reasonably available to PoodleCollective:

  • a description of the nature of the Personal Data Breach;
  • the categories and approximate number of affected Data Subjects, where known;
  • the categories and approximate number of affected Personal Data records, where known;
  • the likely consequences of the Personal Data Breach, where known;
  • measures taken or proposed to address the breach; and
  • available information reasonably required to assist the Client with its own breach assessment and notification obligations.

Where all relevant information is not immediately available, PoodleCollective may provide information in stages as it becomes available.

PoodleCollective will take reasonable steps within its control to:

  • contain the Personal Data Breach;
  • mitigate its effects; and
  • assist the Client in complying with applicable breach obligations.

Notification of a Personal Data Breach does not of itself constitute an admission of fault or liability.

The Client remains responsible for determining whether notification to the Information Commissioner's Office, affected Data Subjects or any other authority is legally required unless Applicable Data Protection Law places that responsibility directly upon PoodleCollective.

14. Assistance with compliance obligations

Taking into account the nature of the Processing and the information available to PoodleCollective, PoodleCollective will provide reasonable assistance to the Client with its obligations relating to:

  • security of Processing;
  • Personal Data Breaches;
  • notification of affected Data Subjects;
  • data protection impact assessments;
  • prior consultation with the Information Commissioner's Office where required; and
  • other obligations for which Processor assistance is required by Applicable Data Protection Law.

PoodleCollective will provide information reasonably available to it concerning the Services and Processing for these purposes.

Responsibility for determining whether a data protection impact assessment or regulatory consultation is required remains with the Client in its capacity as Controller.

15. Records and regulatory cooperation

PoodleCollective will maintain records of Processing activities where and to the extent required by Applicable Data Protection Law.

PoodleCollective will cooperate with the Information Commissioner's Office or another competent supervisory authority where required by law in relation to Processing for which it is responsible.

16. Demonstrating compliance

PoodleCollective will make available to the Client information reasonably necessary to demonstrate compliance with the Processor obligations contained in Article 28 of the UK GDPR.

Where reasonable documentary information is sufficient to demonstrate compliance, the parties should ordinarily use that information before requiring an on-site audit.

17. Audits and inspections

PoodleCollective will allow for and contribute to audits and inspections by the Client or an independent auditor appointed by the Client where reasonably necessary to demonstrate compliance with the obligations applicable to PoodleCollective under Article 28 of the UK GDPR.

Unless an urgent audit is reasonably required because of:

  • a Personal Data Breach;
  • a request from a supervisory authority;
  • credible evidence of material non-compliance; or
  • another material data protection risk,

the Client will:

  • give reasonable advance written notice;
  • arrange the audit during normal business hours;
  • keep the scope proportionate to the Processing and identified risk;
  • take reasonable steps to avoid unnecessary disruption to PoodleCollective's business; and
  • ensure that the auditor is subject to appropriate confidentiality obligations.

An auditor must not be a direct competitor of PoodleCollective where that would create an unreasonable risk to PoodleCollective's confidential information.

An audit must not require PoodleCollective to disclose:

  • another client's Personal Data;
  • information that would compromise another client's security;
  • privileged legal material; or
  • confidential information unrelated to the Client's Processing,

except to the extent disclosure is legally required.

PoodleCollective may satisfy reasonable audit requests through relevant documentation, records, questionnaires, certifications or other compliance evidence where these provide the information reasonably required.

Nothing in this clause prevents an audit or inspection required by Applicable Data Protection Law or a competent supervisory authority.

18. Return and deletion of Client Personal Data

When Processing on behalf of the Client ends, the Client may instruct PoodleCollective to:

  • return the relevant Client Personal Data; or
  • securely delete it,

unless applicable UK law requires PoodleCollective to retain the Personal Data.

PoodleCollective will delete remaining copies under its control once they are no longer reasonably required to provide the Services or comply with a lawful retention obligation.

Where the Client does not provide a contrary instruction within 30 days after termination of the relevant Services, PoodleCollective may securely delete Client Personal Data that it no longer needs to retain.

Where Client Personal Data exists in routine backups or archives and immediate deletion is not reasonably practicable, PoodleCollective may retain the relevant backup copies until they are overwritten or deleted through the normal backup lifecycle, provided that:

  • the Personal Data is put beyond ordinary operational use;
  • it remains appropriately protected; and
  • it is not restored or otherwise Processed except where reasonably necessary for recovery, security or legal purposes.

If a backup containing Client Personal Data is restored, the relevant deletion requirements will be reapplied where appropriate.

19. Data minimisation and testing

PoodleCollective will take reasonable steps to avoid creating unnecessary copies of Client Personal Data.

Where development or testing requires data from a live environment, PoodleCollective will, where reasonably practicable and appropriate to the work:

  • use non-production data;
  • minimise the amount of production data copied;
  • restrict access to copied data; or
  • pseudonymise or otherwise reduce identifying information.

The precise approach will depend on the technical requirements and risks associated with the Services.

20. Client systems and third-party environments

PoodleCollective may access Client Personal Data within systems, hosting environments or services selected or controlled by the Client.

PoodleCollective is not responsible for the general security or compliance of a Client-selected third-party system solely because PoodleCollective accesses that system in order to provide the Services.

Where PoodleCollective identifies a material security concern relevant to its Processing and reasonably apparent during the Services, it will bring that concern to the Client's attention where appropriate.

21. Costs of additional assistance

Routine assistance reasonably required for PoodleCollective to meet its obligations under Applicable Data Protection Law is included as part of its obligations under these Data Processing Terms.

Where the Client requests substantial additional work which:

  • is beyond the ordinary assistance reasonably contemplated by the Services;
  • is not required because of a breach by PoodleCollective of these Data Processing Terms or Applicable Data Protection Law; and
  • requires significant additional technical or administrative work,

PoodleCollective may charge a reasonable fee for that additional work.

Where reasonably practicable, any such fee will be agreed before the additional chargeable work is carried out.

Nothing in this clause permits PoodleCollective to charge for performing a legal obligation in a manner that would unlawfully restrict the Client's rights under Applicable Data Protection Law.

22. Liability

Liability arising under or in connection with these Data Processing Terms is subject to the liability provisions of the Agreement to the extent permitted by law.

Nothing in the Agreement or these Data Processing Terms:

  • limits or excludes liability that cannot lawfully be limited or excluded;
  • restricts the statutory rights of a Data Subject;
  • limits the lawful powers of the Information Commissioner's Office or another competent supervisory authority; or
  • relieves either party of obligations imposed directly upon it by Applicable Data Protection Law.

23. Duration

These Data Processing Terms apply for as long as PoodleCollective Processes Client Personal Data on behalf of the Client.

Provisions which by their nature are intended to continue after Processing ends, including confidentiality, deletion, audit in respect of historic Processing and applicable liability provisions, continue for as long as reasonably necessary to give them effect.

24. Order of priority

These Data Processing Terms form part of the Agreement.

If there is a conflict concerning the Processing of Client Personal Data between:

  • a specific written data processing arrangement agreed between the parties;
  • these Data Processing Terms; and
  • another provision of the Agreement,

the documents will take priority in that order in relation to the Processing of Client Personal Data.

The commercial provisions of the Agreement, including payment, termination and liability provisions, continue to apply except where they conflict with a mandatory requirement of Applicable Data Protection Law.

25. Changes to these Data Processing Terms

PoodleCollective may update these Data Processing Terms for future agreements.

The version applying to an existing Agreement will ordinarily remain the version incorporated when that Agreement was formed.

Where a change is reasonably necessary because of:

  • a change in Applicable Data Protection Law;
  • binding regulatory requirements; or
  • a change required to maintain lawful Processing,

PoodleCollective may update the applicable terms and will give the Client reasonable notice where practicable.

Any such update will be limited to what is reasonably necessary and will not intentionally reduce the level of protection afforded to Client Personal Data contrary to Applicable Data Protection Law.

26. Governing law and jurisdiction

These Data Processing Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of England and Wales.

The courts of England and Wales will have exclusive jurisdiction in relation to any dispute or claim arising out of or in connection with these Data Processing Terms, subject to any mandatory rights or powers arising under Applicable Data Protection Law.

Schedule 1 — Processing Details

This Schedule describes the Processing generally expected in connection with PoodleCollective services.

The applicable Agreement, proposal, order or statement of work may supplement or narrow these details.

1. Subject matter of the Processing

Access to and Processing of Personal Data contained within or associated with the Client's websites, applications, ecommerce systems, content management systems, hosting environments, databases, integrations and related services, where reasonably necessary to provide the Services.

2. Duration of the Processing

Processing will take place for the duration of the Services and for any limited period afterwards reasonably necessary to:

  • complete agreed work;
  • return or securely delete Client Personal Data;
  • allow routine backups to expire;
  • deal with legitimate security matters; or
  • comply with applicable legal obligations.

3. Nature of the Processing

Depending on the Services, Processing may include:

  • accessing;
  • viewing;
  • retrieving;
  • consulting;
  • analysing;
  • organising;
  • querying;
  • recording;
  • temporarily storing;
  • transmitting;
  • troubleshooting;
  • testing;
  • modifying where instructed;
  • backing up or restoring where included within the Services;
  • exporting;
  • migrating; and
  • deleting

Client Personal Data.

Not every Processing activity listed above will apply to every Service.

4. Purpose of the Processing

Processing is carried out only as reasonably necessary to provide the Services, which may include:

  • website audits and technical reviews;
  • WordPress and WooCommerce support;
  • website maintenance;
  • troubleshooting and fault diagnosis;
  • security review and remediation;
  • performance optimisation;
  • website and application development;
  • custom development;
  • testing and deployment;
  • ecommerce development;
  • integration work;
  • data migration;
  • backup or recovery work;
  • incident investigation;
  • technical support;
  • monitoring where included in the Services; and
  • related technical administration.

5. Categories of Personal Data

Depending on the Client's systems and Services, Client Personal Data may include:

  • names;
  • email addresses;
  • telephone numbers;
  • postal or billing addresses;
  • usernames;
  • user IDs;
  • account information;
  • customer or membership information;
  • order information;
  • purchase history;
  • subscription information;
  • transaction metadata;
  • support enquiries;
  • website form submissions;
  • communications;
  • profile information;
  • user-generated content;
  • IP addresses;
  • browser and device information;
  • access and system logs;
  • analytics identifiers;
  • technical identifiers;
  • authentication or account metadata;
  • information stored within website databases; and
  • other Personal Data present within systems to which PoodleCollective is given access.

The Services do not ordinarily require PoodleCollective to receive full payment card numbers or card security codes.

6. Special Category Data and criminal offence data

No routine Processing of Special Category Data or criminal offence data is intended unless:

  • such information is already contained within a Client system to which PoodleCollective requires access; or
  • the Processing has been expressly identified and agreed as part of the Services.

Where systematic Processing of such information is required, the parties should record any additional Processing particulars and safeguards appropriate to that work.

7. Categories of Data Subject

Depending on the Client's business and systems, Data Subjects may include:

  • Client employees;
  • directors;
  • contractors;
  • website administrators;
  • customers;
  • prospective customers;
  • members;
  • subscribers;
  • account holders;
  • website visitors;
  • users of applications or platforms;
  • suppliers;
  • business contacts;
  • contributors; and
  • other individuals whose Personal Data is stored in the Client's systems.

8. Frequency of Processing

Processing may occur on an occasional, periodic or ongoing basis depending on the Services.

For ongoing support or monitoring services, access may continue throughout the term of the Agreement.

For audits, projects and one-off work, Processing will ordinarily be limited to the period reasonably required to complete the work and deal with return or deletion afterwards.

9. Controller rights and obligations

The Client retains control over the purposes of the Processing and its instructions to PoodleCollective.

The Client has the rights and obligations of a Controller under Applicable Data Protection Law, including the rights to:

  • issue documented instructions;
  • receive information concerning Processing;
  • object to proposed Sub-processor changes on reasonable data protection grounds;
  • request assistance required under these Data Processing Terms;
  • require return or deletion of Client Personal Data at the end of Processing; and
  • exercise appropriate audit and inspection rights.

Schedule 2 — Technical and Organisational Measures

PoodleCollective will maintain technical and organisational measures appropriate to the nature and risks of the Processing.

The measures applicable to a particular Service may include the following.

1. Access control

  • Limiting access to people who reasonably require it.
  • Using individual accounts where reasonably practicable.
  • Applying least-privilege principles where appropriate.
  • Removing or revoking access when it is no longer required.
  • Avoiding unnecessary sharing of administrator accounts.

2. Authentication and credentials

  • Using strong authentication practices.
  • Using multi-factor authentication where appropriate and supported by the relevant system.
  • Using secure methods for exchanging or storing credentials.
  • Avoiding transmission of sensitive credentials through ordinary email or website forms.
  • Using temporary or restricted credentials where reasonably practicable.

3. Device and system security

  • Maintaining reasonable security controls on devices used to access Client Personal Data.
  • Applying appropriate operating system and software security updates.
  • Using protections against malicious software where appropriate.
  • Restricting unauthorised access to systems and devices.

4. Transmission and storage

  • Using appropriately secure encrypted connections for transmission where supported and appropriate.
  • Avoiding unnecessary local storage of Client Personal Data.
  • Protecting temporary copies of Client Personal Data against unauthorised access.
  • Securely deleting temporary data when it is no longer required.

5. Development and testing

  • Limiting use of production Personal Data in development and testing where reasonably practicable.
  • Using test or reduced datasets where appropriate.
  • Restricting access to development and staging environments.
  • Avoiding publication of production Personal Data in publicly accessible development systems.
  • Applying appropriate change and deployment practices.

6. Backup and recovery

Where backup or recovery forms part of the Services:

  • maintaining backup arrangements appropriate to the agreed service;
  • restricting access to backups;
  • taking reasonable measures to protect backup confidentiality and integrity; and
  • maintaining reasonable restoration procedures appropriate to the service.

This section does not make PoodleCollective responsible for backups where backup services are not included in the Agreement.

7. Security and vulnerability management

Where relevant to the Services:

  • applying security updates and patches for systems within PoodleCollective's responsibility;
  • monitoring relevant vulnerabilities where appropriate to the agreed service;
  • reviewing security concerns identified during technical work; and
  • escalating material security issues where reasonably necessary.

8. Incident management

  • Maintaining procedures for identifying and responding to suspected security incidents.
  • Taking reasonable steps to contain confirmed Personal Data Breaches.
  • Preserving information reasonably necessary to investigate an incident.
  • Notifying affected Clients in accordance with these Data Processing Terms.

9. Confidentiality and personnel

  • Limiting Personal Data access to authorised persons.
  • Applying confidentiality obligations.
  • Providing appropriate awareness of data protection and security responsibilities to persons handling Client Personal Data.

10. Sub-processor management

  • Considering relevant data protection and security factors when appointing Sub-processors.
  • Maintaining appropriate written contractual obligations.
  • Maintaining a Sub-processor List.
  • Reviewing Sub-processor arrangements where reasonably appropriate.

11. Data minimisation and disposal

  • Accessing only Personal Data reasonably required for the Services.
  • Avoiding unnecessary duplication.
  • Removing temporary working copies when no longer required.
  • Returning or deleting Client Personal Data following termination in accordance with these Data Processing Terms.
  • Keeping backup copies beyond active use until expiry through applicable deletion cycles where immediate deletion is not reasonably practicable.

12. Review of measures

PoodleCollective will review and adjust its technical and organisational measures where reasonably necessary having regard to:

  • changes in the Services;
  • identified security risks;
  • changes in relevant technology;
  • material security incidents; and
  • changes in Applicable Data Protection Law.