Data Processing Agreement

1. Definitions

For the purposes of this Agreement:

• Controller means the Customer who determines the purposes and means of processing personal data.
• Processor means Advanced Asset Management Ltd, trading as Crest Pay.
• Data Subject means an identified or identifiable natural person.
• Personal Data has the meaning given in UK GDPR.
• Processing includes collecting, storing, organising, using, transmitting, deleting or otherwise handling Personal Data.

2. Appointment

The Controller appoints Crest Pay to process Personal Data solely for the purpose of providing the payroll and associated services described in the Payroll Services Agreement.

Crest Pay shall process Personal Data only on documented instructions from the Controller unless required to do otherwise by law.

3. Categories of Personal Data

Crest Pay may process the following categories of Personal Data:

• Employee names
• Home addresses
• Dates of birth
• National Insurance numbers
• Payroll numbers
• Tax codes
• Salary information
• Bank account details
• Statutory payment information
• Contact details
• Employment start and end dates
• Payroll deductions
• HMRC reporting information

The categories processed may vary depending on the services provided.

4. Categories of Data Subjects

Data Subjects may include:

• Employees
• Directors
• Workers
• Contractors
• Company officers
• Authorised representatives of the Customer

5. Nature of Processing

Processing activities may include:

• Payroll calculations
• RTI submissions
• HMRC reporting
• Payroll reporting
• Production of payslips
• Secure storage
• Data transmission
• Secure deletion
• Customer support

6. Processor Obligations

Crest Pay shall:

• process Personal Data lawfully;
• process Personal Data only on documented instructions;
• maintain confidentiality;
• implement appropriate technical and organisational security measures;
• assist the Controller where reasonably requested;
• notify the Controller of any Personal Data Breach without undue delay where legally required;
• ensure authorised personnel are subject to confidentiality obligations.

7. Security Measures

Crest Pay maintains security measures appropriate to the nature of the data processed, including where appropriate:

• encryption in transit;
• secure hosting;
• role-based access controls;
• multi-factor authentication;
• password policies;
• audit logging;
• malware protection;
• regular software updates;
• backup procedures;
• restricted physical access.

Security measures may be updated from time to time to reflect technological developments and identified risks.

8. Sub-processors

The Controller authorises Crest Pay to engage trusted third-party service providers where necessary to provide the Services, including providers of:

• cloud hosting;
• payroll software;
• payment processing;
• document storage;
• secure email;
• identity verification;
• IT support.

Crest Pay will ensure that any appointed sub-processor is subject to contractual obligations that provide a level of protection for Personal Data substantially equivalent to those contained in this Agreement.

9. International Transfers

Where Personal Data is transferred outside the United Kingdom, Crest Pay will ensure that appropriate safeguards are implemented in accordance with UK GDPR, including the use of recognised transfer mechanisms where required.

10. Assistance

Taking into account the nature of the processing, Crest Pay will provide reasonable assistance to the Controller in responding to requests from Data Subjects exercising their rights under UK GDPR, including requests relating to:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objections to processing.

11. Personal Data Breaches

If Crest Pay becomes aware of a Personal Data Breach affecting Personal Data processed on behalf of the Controller, it will notify the Controller without undue delay and provide information reasonably available to assist the Controller in meeting its legal obligations.

12. Audits

Upon reasonable written notice, the Controller may request information demonstrating Crest Pay's compliance with this Agreement.

Where appropriate, this may include providing copies of relevant policies, certifications or audit reports, subject to confidentiality and security requirements.

13. Retention and Deletion

Upon termination of the Payroll Services Agreement, Crest Pay will, at the Controller's written instruction and subject to applicable legal retention obligations:

• securely return Personal Data; or
• securely delete Personal Data.

Where retention is required by law, Crest Pay may retain the relevant Personal Data for the required period before securely deleting it.

14. Confidentiality

Crest Pay shall ensure that all persons authorised to process Personal Data are bound by appropriate confidentiality obligations.

15. Liability

Each party shall remain responsible for its own compliance with applicable data protection legislation.

Nothing in this Agreement limits or excludes liability where such limitation or exclusion would be unlawful.

16. Governing Law

This Agreement shall be governed by the laws of England and Wales.

The courts of England and Wales shall have exclusive jurisdiction over any dispute arising in connection with this Agreement.

Schedule 1 – Processing Summary