Instructions, safeguards and subprocessors
P1. This agreement applies when ModelProp Ltd (“Processor”) processes personal data on behalf of the agency customer (“Controller”) under a completed order. It does not relabel independently controlled processing. If either party determines a new purpose or the parties jointly determine it, document the proper role and required arrangement before that processing starts.
P2. The Controller determines its lawful purposes, instructions, data accuracy, lawful basis and notices, and selects appropriate service access. The Processor processes only on documented instructions, including for transfers, unless UK law requires otherwise. It will inform the Controller before legally required processing unless prohibited, and immediately flag an instruction it considers unlawful.
P3. Processing covers provision and support of the selected services for the agreement’s duration and the agreed return/deletion period. Annex 1 must specify the subject matter, duration, nature, purposes, data subjects, data types, instructions, retention, recipients, systems and approved transfers before access is enabled. Do not submit unnecessary sensitive data.
P4. The Processor will bind authorised personnel to confidentiality, limit access to trained people who need it, and implement technical and organisational measures appropriate to risk under Article 32. The security section of Annex 1 records the actual measures, including tenant isolation, role-based access, authentication, secure transmission/storage, backup, vulnerability management, logging and incident response. The measures must be appropriate to the agreed processing.
P5. The Controller gives general authorisation for only the subprocessors identified in the completed register. Give at least 30 days’ prior notice of an intended addition or replacement where practicable, with equivalent information and an opportunity to object on reasonable data-protection grounds. If an objection cannot be resolved, offer a workable alternative or termination of the affected processing with a proportionate refund of undelivered prepaid service. Do not send data to an unapproved replacement while an unresolved objection prevents lawful use.
P6. Impose equivalent relevant data-protection obligations on each subprocessor and remain responsible to the Controller for its performance. Identify the legal entity, function, countries, data and onward providers; a vendor brand name or privacy-policy link alone is insufficient.
P7. Restricted international transfers require the Controller’s instructions and an applicable transfer mechanism, such as adequacy or executed UK IDTA/Addendum, with required risk assessment and supplementary measures. A US headquarters, EU server or supplier certification alone does not establish the full transfer analysis.
Assistance, incidents and exit
P8. Taking account of the processing, assist the Controller with rights requests through appropriate technical and organisational measures. Promptly forward requests relating to its data; do not respond substantively except on instructions or as law requires. Agree secure export, correction, deletion and search methods. Assistance must not obstruct the Controller’s statutory deadlines.
P9. Notify the Controller without undue delay after becoming aware of a personal-data breach affecting its data. We will provide an initial notice as soon as reasonably possible and update it as further information becomes available. Provide known facts, affected systems/data/people, consequences, mitigation and a contact, without waiting for a complete investigation. Preserve evidence and cooperate. The Controller determines regulator/data-subject notification for its processing, without preventing either party’s own legal obligations.
P10. Assist with security obligations, DPIAs and prior consultation under Articles 32–36, taking account of the information available. Do not begin a materially higher-risk or newly scoped activity without the Controller’s instructions and the required safeguards. Any charge for optional additional assistance must be reasonable and agreed, and cannot excuse mandatory assistance.
P11. At the Controller’s choice, return or delete personal data and copies when the service ends, except where law requires retention. Annex 1 states the export period, live-system deletion timing and restricted-backup expiry. Any legally retained data remains protected, used only for that purpose, and deleted when no longer required. Restore backups only with deletion restrictions reapplied; do not recreate erased data in live services.
P12. Make information available to demonstrate compliance and allow/contribute to audits and inspections by the Controller or its mandated auditor. Reasonable scheduling, confidentiality and measures to protect other customers are permitted, but cannot remove these rights or delay urgent incident/regulatory access. Certifications and reports may reduce duplication, not replace a necessary audit.
P13. Do not use Controller data for an unrelated customer, advertising, general-purpose model training or discretionary secondary purposes. Genuinely anonymous statistics may be used only where anonymisation is effective and lawful; pseudonymous transcripts, voices, room images or embeddings are not automatically anonymous.
P14. This DPA prevails for processor data. Commercial liability arrangements do not remove either party’s direct statutory duties, an individual’s rights, or regulator powers. Each party remains responsible for its legally required records, contracts and fee obligations. The parties’ authorised acceptance of a completed order also accepts the incorporated completed DPA.
Processing particulars incorporated in the order
The order or an attached processing record must identify the actual controller, selected services, purposes, data and people involved, authorised recipients and suppliers, processing locations and transfer safeguards, retention and return/deletion arrangements, security measures and incident contacts. These particulars may be updated only through documented authorised instructions and the applicable change procedure. Publishing this agreement does not authorise a new provider or a new processing purpose.