A clear framework for responsible data processing.

This mock Data Processing Agreement describes how Valueleaf Limited may process personal data on behalf of a customer when delivering workforce, technology or related services.

It is intended as a product-review draft. Final commercial terms, service schedules and applicable legal wording should be agreed before use.

The customer is the controller and Valueleaf acts as the processor for the customer data covered by the agreed service. Each party will follow applicable data protection law.

Personal data, processing, data subject, subprocessor and security incident have the meanings given to them under applicable data protection legislation.

Valueleaf will process personal data only to provide the agreed services, follow documented customer instructions and support the customer relationship.

Valueleaf will promptly tell the customer if an instruction appears to conflict with applicable data protection requirements and will not use the data for unrelated purposes.

The categories of data and data subjects depend on the service selected by the customer. The examples below are mock data for this page and should be replaced with the relevant service schedule.

Valueleaf will maintain reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

People authorised to process personal data will be bound by confidentiality obligations and receive appropriate privacy and security guidance.

Valueleaf may use carefully selected subprocessors to support hosting, communications, analytics, support or other parts of the service. Subprocessors will be subject to written obligations appropriate to their role.

Where personal data is transferred internationally, Valueleaf will use a lawful transfer mechanism and appropriate safeguards required by applicable law.

Valueleaf will provide reasonable assistance to help the customer respond to data subject requests, regulatory enquiries and privacy impact assessments relating to the agreed processing.

Valueleaf will notify the customer of a confirmed personal data breach without undue delay after becoming aware of it, with available details about the incident and response actions.

At the end of the applicable service, Valueleaf will return or delete customer personal data according to the customer instruction, unless retention is required by law or necessary for the establishment, exercise or defence of legal claims.

The customer can contact the privacy team to discuss this mock agreement, request an approved service schedule or confirm the applicable processing details.