Data Processing Agreement (UK GDPR)
Last updated: January 2, 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Master Services Agreement ("Agreement") between:
Valuenova Ltd, a company incorporated in England and Wales (company number 16936135) with its registered office at 4, Cromwell Court, New St, Aylesbury HP20 2PB ("Valuenova" or the "Processor"), and
the customer identified in the Agreement (the "Customer" or the "Controller").
This DPA reflects the requirements of the UK GDPR and the Data Protection Act 2018.
1. Definitions
Capitalised terms not defined in this DPA have the meanings given in the Agreement.
- "UK GDPR" means the UK General Data Protection Regulation.
- "Personal Data", "Processing", "Controller", and "Processor" have the meanings given in the UK GDPR.
- "Sub-processor" means any third party appointed by Valuenova to process Personal Data on behalf of the Customer.
2. Scope and roles
2.1 The Customer acts as the Controller of Personal Data.
2.2 Valuenova acts as the Processor and shall process Personal Data only on documented instructions from the Customer, unless required by law.
3. Processing details
3.1 Subject matter: Provision of the Software and Services.
3.2 Duration: For the term of the Agreement.
3.3 Nature and purpose: Hosting, processing, and support of Customer data in connection with the Services.
3.4 Categories of data subjects: Customer personnel, users, and other individuals whose data is submitted to the Software.
3.5 Types of Personal Data: Business contact details, usage data, and any Personal Data uploaded by the Customer.
4. Processor obligations
Valuenova shall:
- process Personal Data only on documented instructions from the Customer;
- ensure that persons authorised to process Personal Data are bound by confidentiality obligations;
- implement appropriate technical and organisational measures to protect Personal Data;
- assist the Customer in responding to data subject requests where reasonably required;
- notify the Customer without undue delay after becoming aware of a Personal Data breach;
- at the Customer's choice, delete or return Personal Data on termination of the Agreement, subject to legal requirements.
5. Sub-processors
5.1 The Customer authorises Valuenova to engage Sub-processors.
5.2 Valuenova shall:
- impose data protection obligations on Sub-processors equivalent to those in this DPA; and
- remain responsible for the acts and omissions of Sub-processors.
5.3 Valuenova shall maintain a list of Sub-processors and make it available to the Customer on request.
6. International transfers
6.1 Valuenova shall not transfer Personal Data outside the UK unless appropriate safeguards are in place, such as standard contractual clauses.
7. Security measures
7.1 Valuenova shall implement appropriate technical and organisational security measures, taking into account the nature of the data and the risks involved.
7.2 Such measures may include access controls, encryption where appropriate, and regular security reviews.
8. Audits and compliance
8.1 Upon reasonable written notice, the Customer may audit Valuenova's compliance with this DPA, subject to reasonable confidentiality and security restrictions.
8.2 Audits shall be limited in scope and frequency and conducted in a manner that minimises disruption to Valuenova's business.
9. Liability
The liability provisions set out in the Agreement apply to this DPA.
10. Governing law
This DPA is governed by the laws of England and Wales.
11. Order of precedence
In the event of a conflict between this DPA and the Agreement, this DPA shall prevail in relation to data protection matters.