Data Processing Agreement

Schedules

• Schedule 1 – Technical and Organisational Measures
• Schedule 2 – Authorised Sub processors
• Schedule 3 – International Transfers

Appendices

• Product Specific Processing Activities
• Appendix 1 – Toucan Giving

Introduction

This Data Processing Agreement (“DPA”) sets out the terms governing the processing of Personal Data by the relevant PAYA Group entity or entities (“PAYA” or “Processor”) on behalf of a customer or other organisation (“Controller”) in connection with the products and services provided by PAYA (“Services”).

PAYA Group comprises a group of companies and businesses operating under the PAYA Group and its associated brands.

The PAYA Group entity responsible for contracting with the Controller and/or providing the relevant Services shall be determined by the applicable agreement, order form, terms and conditions, registration, onboarding process or other contractual arrangement governing the Services (“Agreement”).

This DPA forms part of, and is incorporated into, the Agreement. Where Services are accepted or activated electronically, this DPA may be accepted in accordance with Clause 15.

The specific Services and Processing activities to which this DPA applies are identified in the appendices to this DPA. Each appendix applies only to the products or Services used by the Controller.

Definitions

For the purposes of this DPA:

"Applicable Data Protection Legislation" means all applicable laws and regulations relating to the processing, protection, privacy or security of Personal Data, including, where applicable, the UK GDPR, the Data Protection Act 2018, PIPEDA, Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and any legislation replacing, extending, implementing or amending them.

"Controller" means the customer or other organisation that determines the purposes and means of Processing Personal Data and on whose behalf the Services are provided.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means personal data, personal information or equivalent information protected under Applicable Data Protection Legislation which is processed by PAYA on behalf of the Controller in connection with the Services.

"Processing" or "Process" has the meaning given under Applicable Data Protection Legislation and includes collecting, recording, storing, accessing, using, disclosing, transmitting, making available, deleting or otherwise handling Personal Data.

"Processor" means the relevant PAYA Group entity or entities processing Personal Data on behalf of the Controller.

"PAYA Group" means the group of companies and businesses operating under the PAYA Group and its associated brands, including, where applicable, subsidiaries, affiliates and associated companies and businesses, together with brands operated by or on behalf of such entities.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

"Sub-processor" means a third party or PAYA Group entity appointed or engaged by PAYA to process Personal Data on behalf of the Controller.

Processing of personal data

1. PAYA shall process Personal Data only:
   1. as necessary to provide the Services;
   2. in accordance with this DPA, the Agreement and the Controller's documented instructions;
   3. for the purposes identified in Schedule 1; or
   4. where required or permitted by Applicable Data Protection Legislation.
2. The Controller authorises PAYA to process Personal Data as necessary to provide the Services.
3. The subject matter, duration, nature and purposes of Processing, together with the categories of Data Subjects and Personal Data, are set out in Schedule 1.
4. The Controller remains responsible for determining the purposes and means of Processing Personal Data and for ensuring that it has an appropriate lawful basis, consent or other legal authority for the Processing required under Applicable Data Protection Legislation.
5. The Controller shall ensure that:
   1. Personal Data provided to PAYA has been lawfully collected and may lawfully be processed for the relevant purposes;
   2. appropriate privacy information is provided to Data Subjects where required and consent obtained;
   3. its instructions to PAYA comply with Applicable Data Protection Legislation; and
   4. Personal Data submitted to the Services is appropriate and necessary for the relevant Services.
6. This DPA applies only to Personal Data processed by PAYA on behalf of the Controller. Where another organisation acts as an independent Controller or under its own contractual arrangements, its processing is governed separately.

PAYA's obligations

1. PAYA shall:
   1. process Personal Data only in accordance with this DPA, the Agreement, the Controller's documented instructions and Applicable Data Protection Legislation;
   2. ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations;
   3. implement appropriate technical and organisational measures to protect Personal Data;
   4. ensure the appropriate security controls are in place to restrict access to Personal Data to persons who require it for their duties;
   5. provide reasonable assistance to the Controller in relation to Data Subject rights, Security Incidents, data protection impact assessments, privacy impact assessments and regulatory consultations, having regard to the nature of the Processing and information available to PAYA;
   6. notify the Controller without undue delay after becoming aware of a Security Incident affecting Personal Data processed on the Controller's behalf;
   7. make available information reasonably necessary to demonstrate compliance with applicable processor obligations; and
   8. where Personal Data is subject to Canadian privacy legislation, implement appropriate contractual, technical and organisational safeguards having regard to the sensitivity of the Personal Data and the risks associated with its Processing.
2. PAYA shall notify the Controller where, in its reasonable opinion, an instruction infringes Applicable Data Protection Legislation, to the extent permitted by law.
3. Nothing in this DPA requires PAYA to comply with an instruction that would require it to breach Applicable Data Protection Legislation.

Security and security incidents

1. PAYA shall implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

   The principal measures applicable to the Services are described in Schedule 2.

2. PAYA may update, replace or enhance its security measures where reasonably necessary, provided that such changes do not materially reduce the overall level of protection afforded to Personal Data.

3. Following a Security Incident, PAYA shall, where reasonably practicable, provide the Controller with information concerning:

   1. the nature of the Security Incident;
   2. the categories of Personal Data and Data Subjects affected, where known;
   3. the likely consequences; and
   4. the measures taken or proposed to address and mitigate the Security Incident.

   Where information is not immediately available, PAYA may provide it progressively as it becomes available.

4. PAYA shall provide reasonable assistance in relation to investigation, containment, remediation and regulatory requirements or Data Subject notification requirements arising from a Security Incident.

5. PAYA shall maintain appropriate records of Security Incidents in accordance with its internal procedures and Applicable Data Protection Legislation.

6. PAYA shall periodically review the security measures to ensure that they remain current and complete and shall update same as necessary to ensure ongoing compliance with applicable Data Protection Laws.

Data subject rights and compliance

1. PAYA shall provide reasonable assistance to the Controller in responding to Data Subject requests under Applicable Data Protection Legislation, taking into account the nature of the Processing and information available to PAYA.

2. Where a Data Subject makes a request directly to PAYA concerning Personal Data processed on behalf of the Controller, PAYA shall, where appropriate:

   1. notify the Controller without undue delay; and
   2. not respond except on the Controller's documented instructions or where required by Applicable Data Protection Legislation.

3. PAYA shall make available information reasonably necessary to demonstrate compliance with this DPA and applicable processor obligations.

4. PAYA may satisfy reasonable compliance or audit requests by providing appropriate policies, certifications, audit reports, security documentation, questionnaires, testing summaries or other evidence.

5. Any audit shall:

   1. be conducted on reasonable notice;
   2. take place during normal business hours;
   3. not unreasonably disrupt PAYA's operations or the Services; and
   4. be subject to appropriate confidentiality and security requirements.

   The Controller shall bear its own audit costs unless otherwise agreed in writing.

Sub-processors

1. The Controller provides authorisation for PAYA to appoint Sub-processors in connection with the Services.

2. PAYA shall maintain and make available current information regarding its authorised Sub-processors, including the Sub-processor, relevant Service or activity, nature of Processing and Processing location.

   Current Sub-processor information is made available through PAYA's GDPR Policy.

   The GDPR Policy is referenced solely for the purpose of identifying PAYA's current authorised Sub-processors and does not otherwise form part of this DPA.

3. PAYA may appoint, replace or remove Sub-processors in accordance with this DPA and Applicable Data Protection Legislation and shall provide reasonable notice of material changes where required by law or the Agreement.

4. Where a service provider is selected, specified or mandated by the Controller, including an acquirer, payment service provider or other provider selected by the Controller, PAYA shall engage or use that provider in accordance with the Controller's documented instructions and the Agreement where applicable.

   The Controller shall not have a right to object under this Clause 7 to a provider selected, specified or mandated by the Controller.

5. Where PAYA independently appoints or proposes a Sub-processor, the Controller may object on reasonable data protection grounds where such right is provided under Applicable Data Protection Legislation or the Agreement.

   The parties shall work in good faith to address any reasonable objection and, where reasonably practicable, identify an appropriate alternative solution.

6. PAYA remains responsible for the performance of its obligations under this DPA in respect of Sub-processors it appoints, to the extent required by Applicable Data Protection Legislation.

International transfers and cross-border processing

1. PAYA may process, transfer or permit access to Personal Data outside the jurisdiction in which it was collected, including the United Kingdom, European Economic Area, Canada and other countries or territories from which the Services are provided, where necessary to provide the Services and permitted by Applicable Data Protection Legislation.

2. Where a transfer, disclosure or access outside a relevant jurisdiction requires a specific safeguard, PAYA shall ensure that an appropriate lawful mechanism is in place.

   This may include:

   1. an adequacy decision or regulation;
   2. the UK International Data Transfer Agreement;
   3. the UK Addendum to the EU Standard Contractual Clauses;
   4. contractual safeguards required under applicable Canadian or Quebec privacy legislation; or
   5. another lawful transfer mechanism.

3. Where Personal Data originating in Quebec is communicated or made accessible outside Quebec, the parties shall reasonably cooperate in relation to any privacy impact assessment, contractual safeguards or other requirements imposed by Applicable Data Protection Legislation, having regard to their respective roles and responsibilities.

4. The Provider shall promptly notify the Company if:

   1. the Provider becomes aware of any change in law, governmental access requirement or other circumstance which may adversely affect the level of protection afforded to Company Personal Data in the destination country; or
   2. the Provider can no longer comply with the requirements of any transfer mechanism relied upon for a Restricted Transfer.
   3. Where requested by the Company, the Parties shall promptly execute, update or replace any relevant SCCs or other Transfer Mechanism as required to ensure the lawful transfer of Company Personal Data.
   4. Where the Company reasonably determines that a Restricted Transfer, transfer destination or Transfer Mechanism impacting the Company Personal Data presents an unacceptable risk to the rights and freedoms of Data Subjects or to the Company’s compliance with applicable Data Protection Laws, the Company may require the Provider to suspend the relevant transfer immediately.

Details of material international Processing arrangements may be identified in Schedule 1, Schedule 3 and/or Schedule 4.

Retention, return and deletion

1. PAYA shall retain Personal Data only for as long as necessary to provide the Services or where retention is required by law.
2. Where Personal Data must be retained by law, PAYA shall retain only what is required, protect it in accordance with this DPA and not process it for any other purpose except where required or permitted by law.
3. At any time during the Term and upon Company’s written request, the Provider shall promptly provide the Company with a complete and up-to-date copy of the Company Personal Data, or such part of the Company Personal Data as the Company may specify, in a structured, commonly used and machine-readable format reasonably specified by the Company.
4. Upon termination or expiry of the Principal Agreement for any reason, or at any time upon the Company’s written request, the Provider shall promptly cease processing the Company Personal Data and, at the Company’s option, shall securely return, transfer, delete or destroy all Company Personal Data in its possession or control, including any copies, extracts, backups, archives, test environments and disaster recovery systems, and shall ensure that the same is returned, deleted or destroyed by all Subprocessors and other third parties authorised to process the Company Personal Data.
5. The Provider shall complete the return, deletion or destruction of the Company Personal Data within ten (10) business days of the Company’s request or the termination or expiry of the Principal Agreement, unless a shorter period is required by applicable Data Protection Laws or is specified by the Company.
6. Where the Company requires the return of Company Personal Data, the Provider shall not delete or destroy such Company Personal Data until the Company has confirmed successful receipt of the relevant returned data.
7. If any applicable law, regulation, court, governmental authority or regulatory body requires the Provider to retain any Company Personal Data that would otherwise be returned, deleted or destroyed, the Provider shall promptly notify the Company of such requirement in writing and provide details of:
   1. the Personal Data to be retained;
   2. the legal basis for retention;
   3. the anticipated retention period; and
   4. the measures that will be applied to protect the retained Personal Data.
8. Any Personal Data retained pursuant to clause 9.5 shall remain subject to the confidentiality, security, audit and other applicable provisions of this Agreement and shall not be processed for any purpose other than compliance with the relevant legal obligation requiring its continued retention.
9. The Provider shall, within five (5) business days of completing the return, deletion or destruction process, provide the Company with a written certificate signed by an authorised representative of the Provider confirming that all Company Personal Data has been returned, deleted or destroyed in accordance with this clause, except to the extent retention is required under clause 9.5.

Confidentiality

PAYA shall ensure that persons authorised to access Personal Data:

1. access it only where necessary to perform their duties; and
2. are subject to appropriate confidentiality obligations.

These obligations shall continue for so long as the relevant information remains confidential.

Changes to this DPA

1. PAYA may update this DPA where reasonably necessary to reflect:
   1. changes in Applicable Data Protection Legislation;
   2. changes to the Services or Processing activities;
   3. changes to PAYA's organisational structure or Sub-processors;
   4. changes necessary to maintain or improve the protection or security of Personal Data; or
   5. regulatory or industry requirements.
2. Where a change materially affects the Controller's rights or obligations, PAYA shall provide reasonable notice where required by the Agreement or Applicable Data Protection Legislation.
3. Changes to Schedule 1 relating solely to the addition, removal or amendment of products or associated Processing activities may be made through the Agreement, order process, onboarding process or other documented mechanism agreed between the parties.
4. The version of this DPA applicable to the Controller shall be the version incorporated into the Agreement or otherwise accepted by the Controller and shall remain applicable until replaced in accordance with this Clause.

Term and termination

1. This Agreement will remain in full force and effect for the Term.
   1. Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the Principal Agreement in order to protect the Company Personal Data will remain in full force and effect.
   2. The Controller’s failure to comply with the terms of this Agreement is a material breach of the Principal Agreement. In such event, the Company may terminate the Principal Agreement or any part of the Principal Agreement involving the processing of the Personal Data effective immediately on written notice to the Provider without further liability or obligation of the Company.
   3. If a change in any Data Protection Laws prevents either Party from fulfilling all or part of its Principal Agreement obligations, the Parties may agree to suspend the processing of the Company Personal Data until that processing complies with the new requirements. If the Parties are unable to bring the Personal Data processing into compliance with the Data Protection Laws within such reasonable period as has been determined between the, (each Party being bound to act reasonably), either Party may terminate the Principal Agreement with immediate effect on written notice to the other Party.
2. This DPA applies from the date the Controller first accepts, becomes subject to or is otherwise incorporated into it and continues for so long as PAYA processes Personal Data on behalf of the Controller.
3. Termination of one Service shall not terminate this DPA where another Service remains active and involves Processing of Personal Data.
4. Termination of all Services shall not affect provisions which by their nature are intended to survive termination, including confidentiality, security, retention, return and deletion obligations.

Order of precedence

1. This DPA forms part of the Agreement between the Controller and the applicable PAYA entity or entities.
2. In the event of a conflict between this DPA and another provision of the Agreement, this DPA shall prevail in relation to the Processing of Personal Data to the extent necessary to comply with Applicable Data Protection Legislation.
3. Schedule 1 may supplement or replace a provision of this DPA only where it expressly states that it does so and the replacement is permitted by Applicable Data Protection Legislation.
4. Where a Canadian or Quebec-specific addendum is incorporated into the Agreement, that addendum shall prevail over this DPA to the extent of any express conflict relating specifically to the relevant Canadian or Quebec Processing.

Third-party rights

Nothing in this DPA shall confer rights on a person who is not a party to the Agreement, except where such rights cannot lawfully be excluded under Applicable Data Protection Legislation.

Electronic acceptance and incorporation

1. This DPA may be incorporated into the Agreement by:
   1. signature;
   2. electronic acceptance during registration, onboarding or account activation;
   3. acceptance through a customer portal or other electronic process;
   4. reference to this DPA in an order form, terms and conditions or other contractual document; or
   5. any other legally effective means.
2. Where this DPA is made available through a publicly accessible website, the applicable version may be incorporated into the Agreement by reference to the relevant web page or document.
3. Electronic acceptance or incorporation by reference shall have the same effect as a written signature to the extent permitted by applicable law.
4. PAYA may retain an appropriate record of the version of this DPA applicable to the Controller.

Schedules

• Schedule 1 – Technical and organisational measures
• Schedule 2 – Authorised sub-processors
• Schedule 3 – International transfers

Schedule 1

Technical and organisational measures

PAYA shall maintain technical and organisational measures appropriate to the nature and risks of the Processing.

These measures may include:

• access controls and least-privilege principles;
• appropriate authentication and multi-factor authentication where appropriate;
• access reviews and joiner, mover and leaver processes;
• encryption of Personal Data in transit and, where appropriate, at rest;
• secure communication protocols and API controls;
• network security, system hardening and vulnerability management;
• security patching and malware protection where appropriate;
• logging, monitoring and security testing;
• confidentiality obligations, security awareness and appropriate training;
• incident identification, escalation, containment, investigation, remediation and recovery;
• business continuity, disaster recovery and backup arrangements;
• data minimisation; and
• appropriate security due diligence when selecting and managing suppliers.

PAYA may update or enhance these measures from time to time provided that the overall level of protection is not materially reduced.

Schedule 2

Authorised sub-processors

The Controller provides general authorisation for PAYA to appoint Sub-processors in accordance with Clause 7.

PAYA shall maintain and make available current Sub-processor information through its GDPR Policy, including the relevant Sub-processor, Service or activity, nature of Processing and Processing location.

The GDPR Policy is referenced solely for the purpose of identifying PAYA's current authorised Sub-processors and does not otherwise form part of this DPA.

Updates to the Sub-processor information shall be managed in accordance with Clause 7 and shall not constitute a variation of the substantive terms of this DPA.

Schedule 3

International transfers

Where a Service involves Processing, transfer or remote access to Personal Data outside the jurisdiction in which it was collected, PAYA shall ensure that the Processing is carried out in accordance with Applicable Data Protection Legislation.

Where required, appropriate transfer safeguards shall be used, including adequacy arrangements, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, applicable Canadian or Quebec safeguards or another lawful transfer mechanism.

Where Personal Data originating in Quebec is communicated or made accessible outside Quebec, the parties shall reasonably cooperate in relation to applicable privacy impact assessments, contractual safeguards and other requirements, having regard to their respective roles and responsibilities.

PAYA data protection contact

PAYA Group

• Data Protection Contact: Andy Tully
• Email: dpo@payagroup.co.uk
• Privacy Information: PAYA Group Privacy Policy
• Data Protection Information: PAYA Group GDPR Policy

Appendix 1
Toucan Giving products and processing activities

General

This Schedule identifies the products and Services to which this DPA applies and the Processing undertaken in connection with them. The products or Services applicable to a Controller shall be those identified in the relevant Agreement, order form, registration, onboarding process, account documentation or other applicable product documentation. Where a Controller uses more than one product or Service, the relevant product entries apply collectively. The Services described in this Schedule are not designed to provide a mechanism for the submission, collection or Processing of Special Category Data or the Personal Data of children or minors. Special Category Data and Personal Data relating to children or minors are therefore not included within the categories of Personal Data intended to be processed through the Services.

Duration

Processing shall take place for the period during which the relevant product or Service is provided to or used by the Controller, together with any subsequent period during which Personal Data is retained in accordance with Clause 9 or Applicable Data Protection Legislation.

Toucan JustGiving

Service

Toucan JustGiving is a mobile fundraising application that enables charities and fundraisers to accept contactless donations using a compatible smartphone. The Service uses tap-to-pay technology for payment processing, with donations and associated transaction information settled through JustGiving.

Purposes

Processing may include:

• enabling and administering contactless donations;
• facilitating payment processing and settlement;
• recording and managing donation and transaction information;
• administering charity and fundraiser accounts;
• reporting and reconciliation;
• providing customer and technical support;
• maintaining and securing the Service;
• detecting and preventing fraud and misuse; and
• complying with applicable legal and regulatory requirements.

Data subjects

Donors, fundraisers, charity users, authorised representatives, account administrators and other individuals whose Personal Data is submitted to or processed through the Service.

Personal data

May include:

• Donors: name, email address, postal address, postcode, donation amount, date and time of donation, Gift Aid information and declarations, donation and transaction references and associated donation information.
• Fundraisers: name, email address, telephone or mobile number, fundraising information, account and registration information, authentication information, roles and permissions.
• Charity Users: name, email address, telephone or mobile number, user and account information, authentication information, roles and permissions.

Age

The Service is subject to applicable age restrictions imposed through the relevant app stores and/or product terms.

Payment card data

PAYA does not intentionally collect or retain raw payment card details through the application. Payment processing may be carried out by another organisation.

Toucan Collect

Service

Toucan Collect is a mobile fundraising application that enables charities and fundraisers to accept contactless donations using a compatible smartphone. The Service uses tap-to-pay technology for payment processing, with donations and associated transaction information settled through the Controller's Stripe account.

Purposes

Processing may include:

• enabling and administering contactless donations;
• facilitating payment processing and settlement;
• recording and managing donation and transaction information;
• administering charity and fundraiser accounts;
• reporting and reconciliation;
• providing customer and technical support;
• maintaining and securing the Service;
• detecting and preventing fraud and misuse; and
• complying with applicable legal and regulatory requirements.

Data subjects

Donors, fundraisers, charity users, authorised representatives and other individuals whose Personal Data is submitted to or processed through the Service.

Personal data

May include:

• name;
• email address;
• telephone or mobile number;
• donation amount;
• donation and transaction information;
• Gift Aid information;
• fundraising information;
• account and registration information;
• device information;
• application identifiers;
• authentication information;
• reporting and reconciliation information; and
• transaction or Service references.

Age

The Service is subject to applicable age restrictions imposed through the relevant app stores and/or product terms.

Payment card data

PAYA does not intentionally collect or retain raw payment card details through the Service. Payment card processing is performed through the applicable payment infrastructure and providers, including Adyen where applicable.

Toucan Tap

Service

Card payment terminals and associated software enabling charities and organisations to accept card payments.

Purposes

Processing may include recording transactions, processing transaction information, recording and administering Gift Aid information, reporting and reconciliation, terminal administration, monitoring, customer support, Service maintenance and security and fraud prevention.

Data subjects

Donors, charity users, authorised representatives and other individuals whose Personal Data is processed through the Service.

Personal data

May include transaction amount, transaction date and time, transaction references, Gift Aid information and declarations, charity and account information, terminal information and Service and reporting information.

Payment card data

PAYA does not intentionally collect or retain raw payment card details through the Service.

Toucan Cash

Service

Functionality relating to cash deposits, settlements and associated reporting and administration.

Purposes

Processing may include cash deposits, settlement, reporting and reconciliation, account administration, customer support, monitoring and security and fraud prevention.

Data subjects

Charity users, authorised representatives, fundraisers and other individuals whose Personal Data is submitted or processed through the Service.

Personal data

May include name, email address, telephone or mobile number, account information, transaction information, deposit information, settlement information, transaction references and Service administration information.

Merchant Portal

Service

Account, Service, terminal, reporting and administrative functionality.

Purposes

Processing may include account and user management, authentication and access management, reporting, terminal administration, transaction and donation reporting, customer support, audit and Service administration, monitoring and security and fraud prevention.

Data subjects

Users, administrators, authorised representatives and other individuals whose Personal Data is submitted or processed through the Merchant Portal.

Personal data

May include name, email address, telephone or mobile number, account information, authentication information, roles and permissions, terminal information, transaction and donation information, reporting information, audit information and Service administration information.

Toucan Giving Hub

Service

A dedicated portal through which donors who have established recurring donations using Toucan Collect may manage those recurring donations.

Purposes

Processing may include:

• identifying and authenticating donors;
• displaying recurring donation information;
• enabling donors to authorise, amend or cancel recurring donations;
• managing recurring donation instructions;
• maintaining donation and account records;
• reporting and reconciliation;
• customer and technical support;
• Service administration and maintenance; and
• security and fraud prevention.

Data subjects

Donors.

Personal data

May include name, email address, telephone or mobile number, donor account information, authentication information, recurring donation information, donation amount and frequency, recurring donation status, payment or transaction references, donation and account identifiers, records of amendments, authorisations and cancellations and Service administration information.

Payment card data

PAYA does not intentionally collect or retain raw payment card details through the Service. Payment processing is performed through the applicable payment infrastructure and providers.