Data sharing and data processing agreement

Greatbatch Limited trading as Letterbox Distribution
Company Number: 3046611

1. Purpose

This Data Sharing and Data Processing Agreement sets out the terms under which Greatbatch Limited trading as Letterbox Distribution (“the Company”) processes and, where applicable, shares personal data on behalf of its clients.

This Agreement forms part of, and should be read in conjunction with, the Company’s Master Terms and Conditions and any applicable Schedule or Order.

2. Definitions

For the purposes of this Agreement:

• Client means the organisation engaging the Company to provide services.
• Personal Data has the meaning given in the UK General Data Protection Regulation (UK GDPR).
• Processing has the meaning given in the UK GDPR.
• Controller means the organisation that determines the purposes and means of processing Personal Data.
• Processor means the organisation that processes Personal Data on behalf of the Controller.
• Data Protection Legislation means the UK GDPR, the Data Protection Act 2018 and any applicable successor legislation.

3. Roles of the parties

3.1 In most circumstances relating to print, fulfilment, postal and door to door distribution services, the Client acts as the Data Controller and the Company acts as the Data Processor.

3.2 Where both parties determine the purposes and means of processing, the parties may act as Joint Controllers and will document responsibilities accordingly.

3.3 Nothing in this Agreement transfers ownership of Personal Data.

4. Purpose and scope of processing

4.1 The Company shall process Personal Data solely for the purpose of delivering the Services agreed with the Client, including but not limited to:

• Address verification and mapping
• Print and fulfilment
• Postal and tracked delivery services
• Data cleansing and formatting
• Campaign reporting and audit verification

4.2 The categories of Personal Data may include:

• Names
• Postal addresses
• Email addresses
• UPRN or similar property reference identifiers
• Delivery tracking information

4.3 The Company shall not process Personal Data for any purpose other than that instructed by the Client unless required by law.

5. Lawful basis

5.1 The Client is responsible for ensuring that it has a lawful basis for processing and sharing Personal Data with the Company.

5.2 The Company shall rely on the lawful basis identified by the Client and shall not independently determine an alternative basis unless acting as a Controller.

6. Security measures

6.1 The Company shall implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction or damage.

6.2 Such measures may include:

• Restricted system access controls
• Password protected and encrypted data storage
• Secure warehouse facilities
• Controlled access to print and fulfilment areas
• Staff confidentiality agreements
• Regular software updates and system monitoring

6.3 The Company shall ensure that all personnel processing Personal Data are subject to appropriate confidentiality obligations.

7. Sub processors

7.1 The Company may appoint sub processors where necessary to deliver the Services, including but not limited to postal operators, print partners and technology providers.

7.2 The Company shall ensure that any appointed sub processor is subject to contractual obligations that provide a level of data protection equivalent to this Agreement.

7.3 The Company remains responsible for the acts and omissions of its sub processors.

8. International transfers

8.1 The Company shall not transfer Personal Data outside the United Kingdom unless:

• The transfer is required for the provision of Services; and
• Appropriate safeguards are in place in accordance with Data Protection Legislation.

9. Data retention and deletion

9.1 Personal Data shall only be retained for as long as necessary to fulfil the purpose for which it was provided, unless otherwise required by law.

9.2 Upon completion of the Services, the Company shall, at the Client’s written request, securely delete or return Personal Data, subject to any legal or regulatory retention requirements.

10. Data subject rights

10.1 Where the Company receives a request from a data subject relating to Personal Data processed on behalf of the Client, the Company shall promptly notify the Client.

10.2 The Client shall be responsible for responding to such requests unless otherwise agreed.

11. Personal data breach

11.1 The Company shall notify the Client without undue delay upon becoming aware of a Personal Data breach affecting data processed on the Client’s behalf.

11.2 The notification shall include sufficient information to allow the Client to meet its reporting obligations under Data Protection Legislation.

12. Audit and compliance

12.1 The Company shall maintain records of processing activities where required.

12.2 The Client may request reasonable evidence of compliance with this Agreement, subject to reasonable notice and confidentiality obligations.

13. Liability

13.1 Each party shall be responsible for its own compliance with Data Protection Legislation.

13.2 Liability shall be subject to the limitations set out in the Master Terms and Conditions unless otherwise agreed in writing.

14. Duration

14.1 This Agreement shall remain in force for the duration of the Services and shall continue for as long as the Company processes Personal Data on behalf of the Client.