Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between ImmigrantDesk (Sarker Anisuzzaman, trading as siasolution) as processor and the customer as controller. It meets UK GDPR Article 28 and applies whenever ImmigrantDesk processes personal data for the customer's clients and cases. If this DPA conflicts with the Terms on data protection, this DPA prevails.

1. Instructions

We process customer personal data only on the customer's documented instructions: this DPA, the Terms, and the actions of the customer's authorised users within the platform. Where the law requires other processing, we will tell the customer first unless the law forbids it. We will tell the customer promptly if we believe an instruction breaks data-protection law.

2. Confidentiality

Everyone we allow to process customer personal data is bound by a duty of confidentiality and has access only where their role needs it.

3. Security

We apply the measures in the Security Statement (Annex 2) and keep them appropriate to the risk. We may improve them, but we will not reduce the overall level of protection.

4. Sub-processors

The customer authorises the sub-processors in Annex 3.

• We will give at least 30 days' notice before adding or replacing a sub-processor.
• The customer may object on reasonable data-protection grounds. If we cannot resolve the objection, the customer may end the affected service without penalty.
• Each sub-processor is bound by written terms that give at least the same protection as this DPA. We remain responsible for their performance.

5. International transfers

We transfer customer personal data outside the UK only with a lawful safeguard: UK adequacy regulations, the UK–US data bridge, or the UK International Data Transfer Agreement or Addendum, supported by a transfer risk assessment.

6. Helping the customer

Taking into account the nature of the processing, we will help the customer to:

• answer data-subject requests: the platform provides data search, export and review-before-erasure tools, and we pass on any request we receive within 5 working days;
• carry out data protection impact assessments and any consultation with the ICO; and
• meet its security and breach obligations.

7. Personal-data breaches

We will notify the customer without undue delay, and in any event within 48 hours, of becoming aware of a breach affecting customer personal data. Our notice will state:

1. what happened and when;
2. the categories and approximate number of people and records affected;
3. the likely consequences; and
4. the steps taken or proposed.

We will add further details as they become known; the customer decides whether to notify the ICO and the people affected.

8. Records and audits

We keep a record of the processing we carry out for customers. On request we will provide the information needed to show we comply with this DPA. Where that is not enough, the customer may audit once a year on 30 days' notice, during working hours, under confidentiality, and without access to other customers' data.

9. End of the service

Within 30 days of the end of the service the customer may export its data. We then delete it, unless the law requires us to keep it. Backup copies are overwritten within 7 days. On request we will confirm the deletion in writing.

10. Customer responsibilities

The customer is responsible for having a lawful basis and, where needed, a special-category or criminal-data condition; for giving its clients privacy information; for managing its users' access; and for reviewing AI output before relying on it.

11. Liability

Liability under this DPA follows the liability clause of the Terms (section 13), except where data-protection law does not allow it to be limited.

Annex 1 — Details of the processing

Annex 2 — Security measures

The measures are set out in the Security Statement, published at /security, which forms part of this DPA.

Annex 3 — Authorised sub-processors