Instructions only: We will only process your data on your documented instructions. We will inform you if we believe an instruction breaches GDPR.

Confidentiality: All staff and contractors with access to your data are bound by written confidentiality obligations.

Security: We implement appropriate technical and organisational measures in accordance with Article 32 GDPR to ensure a level of security appropriate to the risk. These measures include: encryption of personal data at rest and in transit; role-based access controls and the principle of least privilege; multi-factor authentication for platform access; ongoing confidentiality, integrity, availability, and resilience of processing systems; regular testing and evaluation of the effectiveness of technical and organisational measures; and the ability to restore access to personal data in a timely manner in the event of a physical or technical incident.

Sub-processors: We will notify you at least 30 days before engaging a new sub-processor. Our current sub-processors are listed in Schedule A. You may object to the addition of a new sub-processor within the notice period by contacting privacy@synergyup.com.

Data subject rights: We will assist you in responding to requests from individuals exercising their GDPR rights within required timeframes.

Breach notification: We will notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your data. Our notification will include, to the extent available at the time: a description of the nature of the breach; the categories and approximate number of individuals and personal data records affected; the likely consequences of the breach; and the measures taken or proposed to address it, including steps to mitigate its effects. Where full information is not available within 72 hours, we will provide an initial notification and follow up with further detail as the investigation progresses.

DPIAs: We will assist you with Data Protection Impact Assessments where our processing is relevant.

Deletion or return: At the end of your contract we will securely delete all your personal data within 30 days. Where you request it before deletion takes place, we will return your data to you in a portable format, in accordance with Section 7.

Audit rights: You have the right to request evidence of our compliance with this agreement once per year on at least 30 days' written notice. We will respond in the first instance by providing available compliance documentation, third-party audit reports, or certifications. Where that does not satisfy your reasonable requirements, we will facilitate an on-site or third-party audit at your cost, subject to agreed scope and confidentiality terms.

Compliance evidence: We will make available all information necessary to demonstrate compliance with Article 28 GDPR on request.