Data Processing Addendum

1. Introduction

This DPA is incorporated into the Master Services Agreement and any Order Form between Yezda and the Customer. It governs Yezda's processing of personal data as Processor.

2. Definitions

"Controller", "Processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the UK GDPR. "Applicable Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, PECR, and any binding guidance issued by the ICO.

3. Roles of the parties

For the screening services, the Customer is Controller and Yezda is Processor, save that Yezda is independent Controller for: (a) account administration of the Customer's users; (b) financial records and audit logs; (c) anonymised aggregate analytics.

4. Scope & details of processing

The subject matter, duration, nature and purpose of processing, and the categories of personal data and data subjects, are described in Annex A.

5. Customer instructions

Yezda will process personal data only on the Customer's documented instructions, including those set out in the agreement, the Customer's portal configuration, and any further written instructions agreed in writing. Yezda will inform the Customer if it considers an instruction infringes Applicable Data Protection Laws (without obligation to perform a legal review).

6. Security measures

Yezda will implement and maintain the technical and organisational measures set out in Annex B, designed to ensure a level of security appropriate to the risk in accordance with Article 32 UK GDPR. Yezda aligns its security programme to the NCSC Cyber Assessment Framework.

7. Personnel & confidentiality

Yezda will ensure all personnel authorised to process personal data are bound by written confidentiality obligations and receive annual data-protection and security training. Access is granted on a least-privilege basis and reviewed quarterly.

8. Sub-processors

The Customer authorises Yezda's use of sub-processors listed in Annex C. Yezda will give the Customer at least 30 days' notice before adding or replacing a sub-processor. The Customer may object on reasonable grounds related to data protection, in which case the parties will work in good faith to resolve the objection; if not resolved, the Customer may terminate the affected services without penalty.

Yezda will impose data-protection terms on each sub-processor that are no less protective than those in this DPA, and remains liable for the acts and omissions of its sub-processors.

9. International transfers

Personal data is hosted in the United Kingdom. Where any transfer outside the UK occurs, Yezda will rely on (a) a UK adequacy decision; (b) the UK International Data Transfer Agreement (IDTA); or (c) the UK Addendum to the EU SCCs, in each case supported by a transfer risk assessment.

10. Data subject rights

Yezda will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil its obligations to respond to data subject rights requests under Articles 15–22 UK GDPR. Where a request is received directly by Yezda, Yezda will forward it to the Customer without undue delay and will not respond to the data subject (other than to acknowledge receipt) without the Customer's instruction.

11. Personal data breach

Yezda will notify the Customer without undue delay (and in any event within 48 hours) on becoming aware of a personal data breach affecting the Customer's data, providing the information required under Article 33(3) UK GDPR to the extent then known, with updates as further information becomes available. Yezda will assist the Customer with its breach-notification obligations to the ICO and to data subjects.

12. DPIA & prior consultation

Yezda will provide reasonable assistance with data protection impact assessments and prior consultations under Articles 35–36 UK GDPR.

13. Audit rights

Yezda will make available to the Customer all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. Audits will (a) be carried out on at least 30 days' written notice; (b) be limited to once per 12-month period (save where required by law or following a breach); (c) be subject to confidentiality and reasonable security restrictions; and (d) where Yezda's then-current SOC 2 Type II report or equivalent third-party assurance covers the audit scope, that report will be made available in lieu of an on-site audit.

14. Return or deletion

On termination of the agreement, Yezda will, at the Customer's election, return or securely delete personal data within 90 days, save to the extent retention is required by law (in which case Yezda will continue to protect the data and process it solely for that purpose). Audit logs and anonymised data may be retained.

15. Liability

The parties' liability under or in connection with this DPA is subject to the limitation and exclusion of liability provisions of the Master Services Agreement.

16. Order of precedence

If there is a conflict between this DPA and the Master Services Agreement on data-protection matters, this DPA prevails. If there is a conflict between this DPA and any UK transfer mechanism (IDTA / Addendum), that mechanism prevails.

Annex A — Processing details

Annex B — Technical & organisational measures

• Encryption. TLS 1.3 in transit; AES-256 at rest; envelope encryption for document objects.
• Access control. Role-based access; mandatory MFA; quarterly access reviews; audit logging on every read of a candidate file.
• Resilience. Multi-AZ UK hosting; tested DR runbooks; RTO 4h, RPO 15m for production data.
• Testing. Annual independent CREST penetration test; continuous SAST/DAST in CI; quarterly internal audit.
• Personnel. All Yezda staff are themselves screened to BS7858; mandatory annual GDPR + Modern Slavery + InfoSec training.
• Operational. Documented change management; segregated production access; secrets vaulted; backups encrypted and integrity-tested.
• Sub-processor governance. Pre-engagement security review; contractual data-protection terms; periodic reassessment.

Annex C — Approved sub-processors