Data Processing Agreement

This agreement is between the business customer identified in the service agreement (the Customer) and Stride World LTD, company number 16865108, trading as Gift on Cue (Gift on Cue). Our registered office is 5th Floor 167-169 Great Portland Street, London, England, W1W 5PF. Our privacy contact is privacy@giftoncue.com.

It applies where Gift on Cue processes personal data solely on the Customer's behalf to provide the agreed service. The Customer is the controller and Gift on Cue is the processor for those activities. Applicable data protection law means the UK GDPR, Data Protection Act 2018 and, where applicable, the EU GDPR and other relevant data protection laws.

An ordinary website purchase, including a business purchase of merchandise delivered to its office, does not itself require this DPA. It applies to the relevant processing activities, such as maintaining a business customer's recipient contacts or carrying out a gifting campaign on its documented instructions. A business purchase alone does not determine the data protection roles.

Where this DPA applies, it may be incorporated into an electronically accepted business service or account agreement. Separate paper signatures are not required merely to satisfy the written-form requirement. The acceptance process must make the DPA available, identify the contracting business and accepted version, and create a binding record before processor work begins. The business service terms incorporate this DPA where it applies. Before covered contact or campaign processing begins, a binding acceptance record must identify the contracting business, authorised user, accepted terms and DPA versions and acceptance time. This requirement also applies to existing customers without a valid acceptance record. There is no separate DPA signature or per-order acceptance step. Publication alone is insufficient to create the binding record.

This agreement does not classify Gift on Cue's own account administration, billing, security, legal records or independently determined intelligence activities as processing on the Customer's behalf. The privacy notice explains our controller activities. If an activity involves joint control, it requires a separate allocation of those responsibilities.

The service agreement identifies the accepted DPA version, Customer, authorised contacts and any additional private processing schedule. This agreement takes priority for processor obligations if the service agreement conflicts with it. Applicable transfer clauses take priority where they require.

The service agreement, this agreement, agreed schedules and authorised account actions document the Customer's instructions. We process Customer personal data only on those instructions, including instructions about transfers, unless applicable law requires otherwise. Where legally permitted, we tell the Customer about that requirement before processing.

We tell the Customer promptly if we believe an instruction infringes applicable data protection law and may pause the affected processing while it is resolved.

The Customer is responsible for lawful instructions, the information it supplies, appropriate notices and its lawful basis for processing. Gift on Cue remains responsible for its own legal duties; Customer instructions do not transfer those duties away from us.

We do not add Customer recipient lists, private delivery details, messages or preferences to Stride's wider business-intelligence database. We do not use recipient details, private messages or artwork to train AI models, and require equivalent protection from providers processing those materials for the service.

We limit access to authorised people and systems needing it for the agreed work. Anyone we authorise to process Customer personal data is subject to appropriate confidentiality duties.

We implement and maintain risk-appropriate technical and organisational measures meeting applicable data protection law. Schedule 2 describes the agreed measures. Changes must not materially reduce the agreed protection.

Taking account of the processing and the information available to us, we help the Customer respond to rights requests and meet its obligations concerning security, breach notification, data protection impact assessments and prior regulatory consultation.

We promptly notify the Customer of a request concerning data we process for it and do not decide the response independently unless the Customer authorises us or the law requires it. We provide the information and assistance reasonably needed for a timely response.

The Customer gives general written authorisation for the verified subprocessors identified in the provider schedule accepted with this agreement. A provider used only for Gift on Cue's own controller activity is not automatically a subprocessor under this agreement.

We will notify affected business customers before adding or replacing a subprocessor and give them a reasonable opportunity to raise data protection concerns before that provider processes their data. We discuss a practical resolution before introducing the disputed provider for that Customer. If none is possible, the Customer may end the affected service before the change and receive a refund of prepaid unused fees for that service.

We impose equivalent applicable processor obligations on subprocessors, check that they provide sufficient protection and remain responsible to the Customer for their performance of those obligations.

We transfer Customer personal data internationally only on documented instructions and in compliance with applicable transfer requirements. Depending on the route, this requires an applicable adequacy arrangement or approved safeguards, including the UK transfer agreement or addendum and EU Standard Contractual Clauses where relevant.

Any required transfer documentation must identify the parties, data, destination, safeguards and supplementary measures. This DPA alone does not replace that documentation. We provide information about applicable safeguards on request, subject to necessary confidentiality protections.

We notify the Customer without undue delay after becoming aware of a personal data breach affecting data we process for it. We do not wait for a complete investigation before sending an initial notice.

We aim to send the initial notice within 24 hours of awareness, while preserving the obligation to notify sooner where needed. This is a notification aim, not permission to delay notification.

We provide available information about the breach, affected data and people, likely consequences, our contact and mitigation. We investigate, take appropriate steps to contain and remedy it, and provide further information as it becomes available so the Customer can meet its own duties.

We make available the information needed to demonstrate compliance with applicable processor obligations and allow and contribute to audits and inspections by the Customer or its appointed auditor.

We may begin with relevant documentation and coordinate reasonable notice, confidentiality and safeguards for other customers' information. Those arrangements must not prevent a necessary inspection, regulatory access or an urgent investigation into a breach or suspected non-compliance.

When the relevant service ends, we return or securely delete Customer personal data at the Customer's choice and delete existing copies unless applicable law requires retention. We agree a practical export and deletion plan; our account-deletion aim is to remove eligible active account information within 30 days of a verified request.

We identify information that must be retained by law and limit its use to that purpose. Where immediate deletion from recovery backups is not practicable, we place it beyond routine use, protect it until the verified deletion cycle completes and prevent restored copies from re-entering normal use without the required deletion controls.

This agreement continues while we process Customer personal data on its behalf, including during permitted retention or deletion. Changes to an accepted version require an agreed contractual process; updating a website page does not silently replace an existing customer's DPA.

The service agreement supplies the commercial terms and applicable governing law, subject to mandatory data protection law. Nothing here limits individuals' legal rights, regulators' powers or duties and liabilities that cannot lawfully be limited. The purchase order-value liability limit does not automatically apply to obligations under this DPA.

A private customer schedule records any additional agreed data or activities and the boundaries between controller and processor work. Data categories requiring additional protection need a specific lawful assessment and agreed safeguards; this schedule does not authorise unrestricted collection.

We maintain safeguards appropriate to the personal information and processing covered by this agreement. Our main application infrastructure uses AWS in Ireland. External providers and their processing are described separately in Schedule 3.

These measures do not constitute a certification or a guaranteed recovery time. We provide further relevant security information through the review and audit process in section 8.

This list applies when a provider handles personal information for the business services covered by this agreement. It does not cover providers used only for our own payments or account administration. Your agreed schedule records the providers and processing locations for your service.

Our main application storage and message-writing assistance use AWS in Ireland. Other processing locations depend on the service and delivery route. Contact privacy@giftoncue.com for details of locations and transfer safeguards.

Any additional gift supplier or packing partner handling information on your behalf must be named in your agreed schedule before receiving it.

We keep the provider list accepted with your DPA. Changes follow section 5.