Data Processing Addendum

The Customer is controller and the Supplier is processor for personal data submitted to the service by or for the Customer. Each party remains independently responsible for personal data it controls. Defined terms have their UK data-protection-law meanings.

Subject: hosting and operating funeral-management workflows. Duration: the subscription plus agreed return/deletion period. Nature: collection, organisation, storage, retrieval, use, transmission on instruction, restriction, export and deletion. Purpose: provide, secure, maintain and support Funeral OS.

People: deceased persons where relevant to linked living people; family members; clients; employees; contractors; officiants; suppliers; service contacts and other individuals recorded by the Customer. Data: identity, contact, case, funeral, health, religious, location, workforce, availability, vehicle, communication, financial, document, consent and audit information.

The Supplier will process personal data only on documented Customer instructions, including the agreement and use of configured features, unless UK law requires otherwise. It will inform the Customer before legally required processing unless prohibited. The Supplier will promptly notify the Customer if it believes an instruction infringes applicable data-protection law.

People authorised to process data are bound to confidentiality. The Supplier will maintain measures appropriate to risk, including access control, tenant isolation, authentication, auditability, secure development, vulnerability management, encryption in transit, backup and recovery controls, incident handling and provider due diligence.

The Customer gives general authorisation for subprocessors needed to provide the service. Before commercial launch, the Supplier must maintain a current list stating provider, purpose and location and give contracted Customers reasonable advance notice of material additions, with a documented objection process. Each subprocessor must be bound to materially equivalent protection. The Supplier remains responsible for its subprocessors’ processing under this addendum.

The Supplier will not transfer Customer personal data outside the UK unless a lawful mechanism and required safeguards are in place. On request it will provide relevant information about adequacy, the UK IDTA/Addendum and supplementary measures, subject to confidentiality and security limits.

Taking account of the processing and information available, the Supplier will reasonably assist the Customer with data-subject requests, security, breach notification, data protection impact assessments and regulator consultation. The Supplier will not respond to a request about Customer Data except on instruction or where law requires.

The Supplier will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data and provide available information needed for the Customer’s assessment and notifications. Notification is not an admission of fault. Incident reports should be sent to privacy@funeralassistance.uk.

At the Customer’s choice and subject to agreed export functionality, the Supplier will return or delete Customer personal data after services end and delete copies, unless law requires retention. Backup copies may remain isolated until overwritten under the backup cycle and will remain protected and unavailable for ordinary use.

The Supplier will make information reasonably necessary to demonstrate Article 28 compliance available to the Customer. Audits should first use current certifications, summaries and remote evidence. If those are insufficient, the Customer may conduct a proportionate audit on reasonable notice, subject to confidentiality, security, non-disruption and reasonable cost rules.

If this addendum conflicts with the service terms on processing Customer personal data, this addendum prevails. The order form must identify the legal parties, effective date, approved subprocessors or list location, retention/exit period, security schedule and any commercial audit terms before production processing begins.