Premely Data Processing Agreement

This Data Processing Agreement forms part of the Premely Terms of Service between the customer and Adaptive Labs, the parent company and owner of Premely. Where a customer uses Premely to process personal data, the customer acts as controller and Adaptive Labs acts as processor for that processing, unless applicable law assigns a different role.

The agreement applies for as long as Premely processes customer personal data to provide the service.

Premely processes customer personal data only on documented instructions, including the Terms, customer configuration and authorised support requests. Premely will inform the customer if an instruction appears to conflict with applicable data-protection law and may pause the affected processing while the issue is resolved.

People authorised to process customer personal data must be subject to appropriate confidentiality duties. Premely maintains technical and organisational measures designed for the nature of the service and the risks to individuals, including tenant-scoped access, protected credentials, transport encryption, data minimisation and controlled exports.

The customer gives general authorisation for the providers listed in the current Subprocessor List. Premely requires relevant providers to protect customer personal data and remains responsible for their processing obligations to the extent required by applicable law and this agreement.

Taking account of the processing and information available, Premely will reasonably assist the customer with data-subject requests, security obligations, breach assessment, impact assessments and regulator consultations that relate to the service.

Premely will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. Information may be provided in stages as the investigation develops. A notification is not an admission of fault.

Customers can use available export and deletion controls during the service. When the service ends, Premely will delete or return customer personal data as required by the customer's valid instruction, unless law requires retention. Restricted backup copies are removed through the applicable backup cycle.

Premely will not make a restricted transfer without an available legal mechanism. Depending on the transfer, this may include an adequacy decision, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses or another lawful safeguard.

Premely will make available information reasonably necessary to demonstrate compliance with this agreement. The parties should first use current documentation, reports and questionnaires where those materials provide sufficient assurance. Any further audit must be proportionate, confidential and designed to minimise disruption.