Data Processing Addendum (DPA)

1. Background

This Data Processing Addendum ("DPA") forms part of the agreement between Inclusive IT Solutions Ltd ("Processor", "we") and the Customer ("Controller", "you"). That agreement is for services that involve processing personal data, within the meaning of the UK GDPR and the Data Protection Act 2018.

When we provide our Microsoft 365 cost audit, cloud usage analysis or licensing management services, we act as a data processor for you, and you are the data controller.

2. Subject matter, nature and purpose of processing

We process personal data only to provide the services you have asked for. We:

• read licence assignment, sign-in activity and group membership from your Microsoft 365 tenant (audit service)
• read billing and cost data from your connected Microsoft Azure, Google Cloud or Amazon Web Services accounts (cloud usage service)
• store portal user accounts, support tickets and invoice records (portal service)

Processing lasts for the term of the underlying agreement, plus the retention period in section 10.

3. Categories of data subjects and personal data

Data subjects: your employees, contractors and end users whose accounts exist in systems you connect to our services.

Categories of personal data: work email address, display name, last sign-in date, licence assignment and cost-centre tags.

We do not process special-category data (Article 9 UK GDPR) in any circumstances.

4. Sub-processors

We use the sub-processors below. We will give you 30 days' notice of any change.

Sub-processor	Service	Region
Amazon Web Services EMEA SARL	Hosting, storage, identity, email, observability	UK (eu-west-2)
Microsoft Ireland Operations Limited	Authentication, Microsoft 365 audit telemetry	EU/UK
Xero (UK) Limited	Invoicing	UK / Australia
Amazon SES (within AWS EMEA SARL)	Outbound transactional email	UK (eu-west-2)

5. Processor obligations

We will:

• process personal data only on your documented instructions, including instructions about international transfers (Article 28(3)(a))
• make sure everyone authorised to process the personal data is bound by confidentiality (Article 28(3)(b))
• put in place the technical and organisational measures listed in section 6 (Article 32)
• engage sub-processors only with your prior general written authorisation, which you give by accepting this DPA (Article 28(2) and 28(4))
• help you respond to data subjects' requests for access, rectification, erasure, restriction, portability and objection (Article 28(3)(e))
• help you meet your obligations under Articles 32 to 36 (security, breach notification and data protection impact assessments)
• return or delete all personal data at the end of the agreement, unless the law requires us to keep it (Article 28(3)(g))
• make available all the information needed to show that we comply, and contribute to audits (Article 28(3)(h))

6. Technical and organisational measures (Article 32)

Our infrastructure runs in AWS eu-west-2 (London). Our measures:

• All customer data is encrypted in transit (TLS 1.2 or later) and at rest (AES-256).
• Only a small set of authorised engineers can access production. They sign in with AWS SSO and multi-factor authentication (MFA).
• Authentication is backed by Cognito with adaptive risk scoring. Sessions expire after 30 minutes of inactivity.
• We run AWS GuardDuty and Security Hub for threat detection.
• We run CloudTrail for audit logging, with 365-day retention.
• We run AWS Backup for RDS and EBS, with 30-day retention.
• Code changes pass branch protection, dependency scanning and CI gates before deployment.
• Our portal database uses Postgres row-level security to enforce tenant isolation at the database layer.

7. Personal data breach notification

We will tell you about any personal data breach affecting your data without undue delay, and in any event within 48 hours of becoming aware of it.

Our notification will include:

• the nature of the breach
• the categories and approximate number of data subjects and records affected
• the likely consequences
• the measures taken or proposed to deal with it

8. International transfers

We host personal data in the UK (AWS eu-west-2). Some of the sub-processors in section 4 process personal data outside the UK:

• Microsoft Ireland Operations Limited: the EU and the UK
• Xero (UK) Limited: the UK and Australia

Every transfer of personal data outside the UK, by a current or future sub-processor, is protected by one of these safeguards:

• UK adequacy regulations, where the destination country has them. These cover transfers to the European Economic Area, which includes the EU.
• the UK International Data Transfer Agreement (IDTA)
• the EU Standard Contractual Clauses (SCCs), supplemented by the UK Addendum

9. Audit rights

You may audit our compliance with this DPA once a year at most, giving us 30 days' written notice.

To keep disruption low, we may meet this obligation by providing relevant certifications and a written response to a reasonable security questionnaire. Examples of relevant certifications are ISO 27001 from our hosting provider, and SOC 2 Type II reports where available.

On-site audits are at your expense, at times we both agree.

10. Retention and deletion

On termination of the underlying agreement, we will delete all personal data within 30 days, unless the law requires us to keep it. For example, HMRC rules require us to keep financial records for 6 years.

Before deletion, you may ask for a copy in a machine-readable format.

11. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the underlying agreement. The exception is liability arising from a wilful or grossly negligent breach of this DPA, which cannot be excluded.

12. Order of precedence

If this DPA and the underlying agreement conflict on any matter about the processing of personal data, this DPA prevails.

13. Signing

This DPA is incorporated into your customer agreement by reference. When you accept the customer agreement, whether by online click-through, signature or use of the services, you also accept this DPA on behalf of the entity you represent.

If you need a countersigned copy for your records, email dpa@inclusiveitsolutions.co.uk with your company name and registered address. We will send you a PDF within 5 working days.