Standard Terms and Conditions for the Provision of Services by HR ONE
Download a PDF of these terms and conditions
1. INTERPRETATION
1.1 Definitions. In these Conditions, the following definitions apply:
Agreed Purposes: the provision of the Services during the Term, and for such periods after the Term as are required for compliance with applicable Laws, together with such ancillary processing of Personal Data relating to employees and officers of the Customer, its service providers, service users and/or other third parties as is necessary for the performance of HR ONE's obligations under this Agreement, or the administration of this Agreement.
Business Day: a day (other than a Saturday, Sunday or public holiday) when banks in London are open for business.
Charges: the charges payable by the Customer for the supply of the Services in accordance with clause 5.
Commencement Date: the date specified in the Letter of Engagement or Order.
Conditions: these terms and conditions as amended from time to time in accordance with clause 15.8.
Contract: the contract between HR ONE and the Customer for the supply of Services in accordance with these Conditions, the Letter of Engagement, the Order and the Schedule of Services.
Controller has the meaning given in the Data Protection Legislation.
Customer: the organisation which purchases Services from HR ONE.
Data Discloser: the Party that discloses Shared Personal Data to the other Party.
Data Loss Event: any event that results, or may result, in unauthorised access to Personal Data held by HR ONE under this Agreement, and/or actual or potential loss and/or destruction of Personal Data in breach of this Agreement, including any Personal Data Breach.
Data Processing Operations: the processing of Personal Data relating to employees and officers of the Customer, its service providers, service users and/or other third parties, as necessary for the provision of the Services during the Term, and for such periods after the Term as are required for compliance with applicable Laws, together with such ancillary processing of Personal Data relating to employees and officers of the Customer, its service providers, service users and/or other third parties as is necessary for the performance of HR ONE's obligations under this Agreement, or the administration of this Agreement.
Data Protection Legislation: all applicable data protection and privacy legislation in force from time to time in the UK including the UK GDPR; the DPA 2018 (and regulations made thereunder) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.
Data Protection Impact Assessment: an assessment by the Controller of the impact of the envisaged processing on the protection of Personal Data.
Data Subject has the meaning given in the Data Protection Legislation.
Data Subject Access Request: a request made by, or on behalf of, a Data Subject in accordance with rights granted pursuant to the Data Protection Legislation to access their Personal Data.
Devon Education Services Shop: means the online system used by Devon County Council to enable sales of the Services.
DPA 2018: means the Data Protection Act 2018.
Environmental Information Regulations: the Environmental Information Regulations 2004 (SI 2004/3391) together with any guidance and/or codes of practice issued by the Information Commissioner or relevant government department in relation to such regulations.
Expiry Date: the date specified in the Letter of Engagement or Order.
FOIA: the Freedom of Information Act 2000, and any subordinate legislation made under the Act from time to time, together with any guidance and/or codes of practice issued by the Information Commissioner or relevant government department in relation to such legislation.
HR ONE: that part of Devon County Council which provides the Services.
HR ONE Materials: has the meaning set out in clause 4.1 g).
HR ONE Personnel means all officers and employees of HR ONE engaged in the performance of HR ONE's obligations under this Agreement.
Intellectual Property Rights: all patents, rights to inventions, utility models, copyright and related rights, trade marks, service marks, trade, business and domain names, rights in trade dress or get-up, rights in goodwill or to sue for passing off, unfair competition rights, rights in designs, rights in computer software, database right, topography rights, moral rights, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications for and renewals or extensions of such rights, and all similar or equivalent rights or forms of protection in any part of the world.
Law(s): means the laws of England and Wales and any other laws or regulations, regulatory policies, guidelines or industry codes which apply to the provision of the Services or with which HR ONE is bound to comply.
Letter of Engagement: means, where applicable, the letter signed by the Customer accepting HR One’s offer to provide the Services on the Conditions for the period specified in the letter.
Order: means a purchase order or request for services from the Customer on the Devon Education Services Shop accepting HR One’s offer to provide the Services on the Conditions.
Permitted Recipients: the Parties to this Agreement, the employees of each Party, any third parties engaged to perform obligations in connection with this Agreement.
Personal Data has the meaning given in the Data Protection Legislation.
Personal Data Breach has the meaning given in the Data Protection Legislation.
Processor has the meaning given in the Data Protection Legislation and Process, Processed and Processing shall be construed accordingly.
Protective Measures:
(a) appropriate technical and organisational measures which may include: pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the such measures adopted by it; and
(b) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
Services: the services supplied by HR ONE to the Customer as set out in the Schedule of Services, the Letter of Engagement and/or the Order.
Schedule of Services: the description of the Services, where applicable, provided in writing by HR ONE to the Customer with the Letter of Engagement.
Shared Personal Data: the Personal Data to be shared between the Parties under Schedule 1 of this Agreement. Shared Personal Data shall be confined to the categories of information relevant to the categories of Data Subject as referred to in the Privacy Notice for the relevant Services or as necessary for the Agreed Purposes:
Devon County Council Privacy Notices
Sub-processor: any third party appointed to process Personal Data on behalf of HR ONE related to this Agreement.
UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.
Union Payroll Data: means the following:
• employer name
• employee payroll number
• employee title
• employee initials
• employee surname
• employee forename
• payment frequency
• pay period
1.2 Construction. In these Conditions, the following rules apply:
a) a person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality);
b) a reference to a party includes its successors or permitted assigns;
c) a reference to a statute or statutory provision is a reference to such statute or statutory provision as amended or re-enacted. A reference to a statute or statutory provision includes any subordinate legislation made under that statute or statutory provision, as amended or re-enacted;
d) any phrase introduced by the terms including, include, in particular or any similar expression, shall be construed as illustrative and shall not limit the sense of the words preceding those terms; and
e) a reference to writing or written includes faxes.
2. BASIS OF CONTRACT
2.1 The Letter of Engagement duly signed or an Order placed by the Customer constitutes acceptance by the Customer to purchase Services in accordance with these Conditions.
2.2 The Contract constitutes the entire agreement between the parties. The Customer acknowledges that it has not relied on any statement, promise or representation made or given by or on behalf of HR ONE which is not set out in the Contract.
2.3 Any descriptive matter or advertising issued by HR ONE, and any descriptions or illustrations contained in the HR ONE's catalogues or brochures or Devon Education Services Shop, are issued or published for the sole purpose of giving an approximate idea of the Services described in them. They shall not form part of the Contract or have any contractual force.
2.4 These Conditions apply to the Contract to the exclusion of any other terms that the Customer seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing.
2.5 In the event of any inconsistency between the Conditions, the Letter of Engagement, the Order and the Schedule of Services, the conflict shall be resolved according to the following descending order of priority:-
2.5.1 the Letter of Engagement;
2.5.2 the Order;
2.5.3 the Conditions; and
2.5.4 the Schedule of
3. SUPPLY OF SERVICES
3.1 HR ONE shall supply the Services to the Customer in accordance with the Schedule of Services or description of the Services as set out in the Letter of Engagement/Order in all material.
3.2 HR ONE shall use all reasonable endeavours to meet any performance dates specified in the Letter of Engagement, but any such dates shall be estimates only and time shall not be of the essence for performance of the Services.
3.3 HR ONE shall have the right to make any changes to the Services which are necessary to comply with any applicable law or safety requirement, or which do not materially affect the nature or quality of the Services, and HR ONE shall notify the Customer in any such event.
3.4 HR ONE warrants to the Customer that the Services will be provided using reasonable care and skill.
4. CUSTOMER'S OBLIGATIONS
4.1 The Customer shall:
a) Ensure that any information it provides in relation to the Services is complete and accurate;
b) co-operate with HR ONE in all matters relating to the Services;
c) provide HR ONE, its employees, agents, consultants and subcontractors, with access to the Customer's premises, office accommodation and other facilities as reasonably required by HR ONE;
d) provide HR ONE with such information and materials as HR ONE may reasonably require in order to supply the Services, and ensure that such information is accurate in all material respects;
e) prepare the Customer's premises for the supply of the Services;
f) obtain and maintain all necessary licences, permissions and consents which may be required before the date on which the Services are to start;
g) keep and maintain all materials, equipment, documents and other property of HR ONE (HR ONE Materials) at the Customer's premises in safe custody at its own risk, maintain HR ONE Materials in good condition until returned to HR ONE, and not dispose of or use the HR ONE Materials other than in accordance with HR ONE's written instructions or authorisation; and
h) to the extent that the Services include payroll services, use its best endeavours to recover any or all overpayments of salaries, expenses or any other sums due to any of its employees or former employees in accordance with section 14 of the Employment Protection Act 1996.
4.2 If HR ONE's performance of any of its obligations under the Contract is prevented or delayed by any act or omission by the Customer or failure by the Customer to perform any relevant obligation (Customer Default):
a) HR ONE shall without limiting its other rights or remedies have the right to suspend performance of the Services until the Customer remedies the Customer Default, and to rely on the Customer Default to relieve it from the performance of any of its obligations to the extent the Customer Default prevents or delays HR ONE's performance of any of its obligations;
b) HR ONE shall not be liable for any costs or losses sustained or incurred by the Customer arising directly or indirectly from HR ONE's failure or delay to perform any of its obligations as set out in this clause 0; and
c) the Customer shall reimburse HR ONE on written demand for any costs or losses sustained or incurred by HR ONE arising directly or indirectly from the Customer Default.
5. CHARGES AND PAYMENT
5.1 The Charges for the Services shall be calculated in accordance with the HR ONE's standard fee rates, as set out in the Letter of Engagement, the Schedule of Services or the Order as applicable.
5.2 HR ONE reserves the right to increase its standard fee rates, provided that such charges cannot be increased more than once in any 12 month period. HR ONE will give the Customer written notice of any such increase two months before the proposed date of the increase. If such increase is not acceptable to the Customer, it shall notify HR ONE in writing within two weeks of the date of HR ONE's notice and the HR ONE shall have the right without limiting its other rights or remedies to terminate the Contract by giving four weeks' written notice to the Customer.
5.3 The Customer shall pay each invoice submitted by HR ONE:
a) within 30 days of the date of the invoice; and
b) in full and in cleared funds to a bank account nominated in writing by the HR ONE.
5.4 All amounts payable by the Customer under the Contract are exclusive of amounts in respect of value added tax chargeable for the time being (VAT). Where any taxable supply for VAT purposes is made under the Contract by HR ONE to the Customer, the Customer shall, on receipt of a valid VAT invoice from HR ONE, pay to HR ONE such additional amounts in respect of VAT as are chargeable on the supply of the Services at the same time as payment is due for the supply of the Services.
5.5 Without limiting any other right or remedy of HR ONE, if the Customer fails to make any payment due to HR ONE under the Contract by the due date for payment (Due Date), HR ONE shall have the right to charge interest on the overdue amount at the rate of four per cent (4%) per annum above the then current Barclays Bank base rate accruing on a daily basis from the Due Date until the date of actual payment of the overdue amount, whether before or after judgment, and compounding quarterly.
5.6 The Customer shall pay all amounts due under the Contract in full without any deduction or withholding except as required by law and the Customer shall not be entitled to assert any credit, set-off or counterclaim against HR ONE in order to justify withholding payment of any such amount in whole or in part. HR ONE may, without limiting its other rights or remedies, set off any amount owing to it by the Customer against any amount payable by HR ONE to the Customer.
6. INTELLECTUAL PROPERTY RIGHTS
6.1 The parties agree that any Intellectual Property Rights owned by either party before the Commencement Date shall remain the property of that party.
6.2 Where the Customer has provided HR ONE with any of its Intellectual Property Rights for use in connection with the Services, HR ONE shall, on termination of the Contract, immediately cease to use such Intellectual Property Rights.
6.3 All and any Intellectual Property Rights created by HR ONE or any employee, agent or sub-contractor of HR ONE in the course of performing the Services or exclusively for the purposes of performing the Services shall vest in HR ONE on creation.
6.4 The Customer acknowledges that, in respect of any third party Intellectual Property Rights, the Customer's use of any such Intellectual Property Rights is conditional on HR ONE obtaining a written licence from the relevant licensor on such terms as will entitle HR ONE to license such rights to the Customer.
6.5 All HR ONE Materials are the exclusive property of the HR ONE and must not be reproduced, duplicated or shared with any third parties without the prior written agreement of HR ONE.
7. CONFIDENTIALITY
7.1 Subject to clause 7.2, the parties shall keep confidential all matters relating to this Contract and shall use all reasonable endeavours to prevent their employees, agents or sub-contractors from making any disclosure to any person of any matters relating hereto.
7.2 Clause 7.1 shall not apply to any disclosure of information:
a) required by any applicable law, provided that clause 8.1 shall apply to any disclosures required under the FOIA or the Environment Information Regulations;
b) that is reasonably required by persons engaged by a party in the performance of such party's obligations under this Contract;
c) where a party can demonstrate that such information is already generally available and in the public domain otherwise than as a result of a breach of clause 7.1;
d) by either party of any document to which it is a party and which the parties to this agreement have agreed contains no commercially sensitive information;
e) to enable a determination to be made under clause 13 (Dispute Resolution);
f) which is already lawfully in the possession of the receiving party, prior to its disclosure by the disclosing party;
g) by either party to any other department, office or agency of the Government; and
h) by HR ONE relating to this agreement and in respect of which the Customer has given its prior written consent to disclosure.
8. FREEDOM OF INFORMATION
8.1 The Customer acknowledges that HR ONE is subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and co-operate with HR ONE (at the Customer's expense) to enable HR ONE to comply with these information disclosure requirements.
9. LIMITATION OF LIABILITY:
9.1 Nothing in these Conditions shall limit or exclude HR ONE's liability for:
a) death or personal injury caused by its negligence, or the negligence of its employees, agents or subcontractors; or
b) fraud or fraudulent misrepresentation.
9.2 Subject to clause 9.1, HR ONE shall under no circumstances whatever be liable to the Customer, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, for any loss of profit, or any direct, indirect or consequential loss arising under or in connection with the Contract.
9.3 This clause 9 shall survive termination of the Contract.
10. TERMINATION
10.1 Without limiting its other rights or remedies, each party may terminate the Contract with immediate effect by giving written notice to the other party if:
a) the other party commits a material breach of the Contract and (if such a breach is remediable) fails to remedy that breach within 14 days of that party being notified in writing of the breach;
b) the other party suspends, or threatens to suspend, payment of its debts or is unable to pay its debts as they fall due or admits inability to pay its debts or (being a company) is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986;
c) the other party commences negotiations with all or any class of its creditors with a view to rescheduling any of its debts, or makes a proposal for or enters into any compromise or arrangement with its creditors other than (where a company) for the sole purpose of a scheme for a solvent amalgamation of that other party with one or more other companies or the solvent reconstruction of that other party;
d) a petition is filed, a notice is given, a resolution is passed, or an order is made, for or in connection with the winding up of that other party (being a company) other than for the sole purpose of a scheme for a solvent amalgamation of that other party with one or more other companies or the solvent reconstruction of that other party;
e) an application is made to court, or an order is made, for the appointment of an administrator or if a notice of intention to appoint an administrator is given or if an administrator is appointed over the other party (being a company);
f) any event occurs or proceeding is taken with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in clause 10.1(b) to clause 10.1(f) (inclusive); or
g) the other party suspends or ceases, or threatens to suspend or cease, to carry on all or a substantial part of its business.
10.2 Without limiting its other rights or remedies, HR ONE may terminate the Contract with immediate effect by giving written notice to the Customer if the Customer fails to pay any amount due under this Contract on the due date for payment.
10.3 Without limiting its other rights or remedies, each party shall have the right to terminate the Contract at any time by giving the other party three months’ notice in writing.
10.4 Without limiting its other rights or remedies, HR ONE shall have the right to suspend provision of the Services under the Contract or any other contract between the Customer and HR ONE if the Customer becomes subject to any of the events listed in clause 10.1(b) to clause 10.1(f) or HR ONE reasonably believes that the Customer is about to become subject to any of them, or if the Customer fails to pay any amount due under this Contract on the due date for payment.
11. CONSEQUENCES OF TERMINATION
On termination of the Contract for any reason:
a) the Customer shall immediately pay to HR ONE all of HR ONE's outstanding unpaid invoices and interest and, in respect of Services supplied but for which no invoice has been submitted, HR ONE shall submit an invoice, which shall be payable by the Customer immediately on receipt;
b) the Customer shall return all of HR ONE Materials which have not been fully paid for. If the Customer fails to do so, then HR ONE may enter the Customer's premises and take possession of them. Until they have been returned, the Customer shall be solely responsible for their safe keeping and will not use them for any purpose not connected with this Contract;
c) the accrued rights, remedies, obligations and liabilities of the parties as at expiry or termination shall not be affected, including the right to claim damages in respect of any breach of the Contract which existed at or before the date of termination or expiry; and
d) clauses which expressly or by implication have effect after termination shall continue in full force and effect.
12. NON-SOLICITATION
12.1 The Customer shall not (except with the prior written consent of HR ONE) directly or indirectly solicit or entice away (or attempt to solicit or entice away) from the employment of HR ONE any person employed or engaged HR ONE in the provision of the Services at any time during the term of the Contract or for a further period of 6 months after the termination of this Contract other than by means of a national advertising campaign open to all comers and not specifically targeted at any of HR ONE’s staff.
12.2 If the Customer commits any breach of clause 12.1, the Customer shall, on demand, pay to HR ONE the sum £3,000 plus the recruitment costs incurred by HR ONE in replacing such person.
13. DISPUTE RESOLUTION
13.1 Any dispute arising out of or in connection with the Contract will in the first instance be referred to the nominated contact for each party for discussion and If the dispute is not resolved the dispute will be referred to the second management level who must meet within 7 working days of the reference to attempt to resolve that dispute.
13.2 Each party will use all reasonable endeavours to reach a negotiated resolution through the above dispute resolution procedure. The specific format for such resolution will be left to the reasonable discretion of the relevant management level, but may include the preparation and submission of statements of fact or of position
13.3 If the dispute is not resolved at the meeting of the second management level then either party may agree to refer the dispute to mediation or arbitration
14 DATA PROTECTION
14.1 Both Parties will comply with all applicable requirements of the Data Protection Legislation. This Clause 14 is in addition to, and does not relieve, remove or replace, a Party’s obligations or rights under the Data Protection Legislation.
(Non-Payroll Services Only)
14.2 Where HR One is providing non-payroll Services to the Customer, the provisions of Schedule 1 shall apply to this Agreement.
(Payroll Services Only)
14.3 Where HR One is providing payroll Services to the Customer, the provisions of Schedule 2 shall apply to this Agreement.
14.4 Where HR One is providing Services to the Customer which include payroll and such payroll services include making third party contributions (including deduction of contributions at source), then the Customer acknowledges that HR One shall be entitled to deduct an administration fee (as agreed between HR One and the third party) from the third party contributions. Furthermore, the Customer:
14.4.1 warrants (on a continuing basis) that it has obtained the explicit consent of each of its staff who are trade union members that, each payroll cycle, the Customer may transfer their Union Payroll Data to any trade union for the purposes of deducting trade union subscriptions and enabling the trade union to verify the accuracy of such data; and
14.4.2 will promptly, and in any event, within two Business Days, provide written notification to HR One if any of its staff revoke such consent, providing such details as HR One may reasonably require.
14.5 The Customer shall indemnify HR One against all liabilities, costs, expenses, damages and direct losses and all other reasonable professional costs and expenses suffered or incurred by HR One arising out of or in connection with any breach of the warranty by the Customer contained in clause 14.15.1 or the Customer’s failure to comply with clause 14.15.2.
15. GENERAL
15.1 Force majeure:
a) For the purposes of this Contract, Force Majeure Event means an event beyond the reasonable control of HR ONE including but not limited to strikes, lock-outs or other industrial disputes (whether involving the workforce of HR ONE or any other party), failure of a utility service or transport network, act of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of HR ONEs or subcontractors.
b) HR ONE shall not be liable to the Customer as a result of any delay or failure to perform its obligations under this Contract as a result of a Force Majeure Event.
c) If the Force Majeure Event prevents HR ONE from providing any of the Services for more than four weeks, HR ONE shall, without limiting its other rights or remedies, have the right to terminate this Contract immediately by giving written notice to the Customer.
15.2 Assignment and subcontracting:
a) HR ONE may at any time assign, transfer, charge, subcontract or deal in any other manner with all or any of its rights under the Contract and may subcontract or delegate in any manner any or all of its obligations under the Contract to any third party or agent.
b) The Customer shall not, without the prior written consent of HR ONE, assign, transfer, charge, subcontract or deal in any other manner with all or any of its rights or obligations under the Contract.
15.3 Notices:
a) Any notice or other communication required to be given to a party under or in connection with this Contract shall be in writing and shall be delivered to the other party personally or sent by prepaid first-class post, recorded delivery or by commercial courier, at its registered office (if a company) or (in any other case) its principal place of business.
b) Any notice or other communication shall be deemed to have been duly received if delivered personally, when left at the address referred to above or, if sent by pre-paid first-class post or recorded delivery, at 9.00 am on the second Business Day after posting, or if delivered by commercial courier, on the date and at the time that the courier's delivery receipt is signed.
c) This clause 15.3 shall not apply to the service of any proceedings or other documents in any legal action. For the purposes of this clause, "writing" shall not include e-mails and for the avoidance of doubt notice given under this Contract shall not be validly served if sent by e-mail.
15.4 Waiver:
a) A waiver of any right under the Contract is only effective if it is in writing and shall not be deemed to be a waiver of any subsequent breach or default. No failure or delay by a party in exercising any right or remedy under the Contract or by law shall constitute a waiver of that or any other right or remedy, nor preclude or restrict its further exercise. No single or partial exercise of such right or remedy shall preclude or restrict the further exercise of that or any other right or remedy.
b) Unless specifically provided otherwise, rights arising under the Contract are cumulative and do not exclude rights provided by law.
15.5 Severance:
a) If a court or any other competent authority finds that any provision of the Contract (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision shall, to the extent required, be deemed deleted, and the validity and enforceability of the other provisions of the Contract shall not be affected.
b) If any invalid, unenforceable or illegal provision of the Contract would be valid, enforceable and legal if some part of it were deleted, the provision shall apply with the minimum modification necessary to make it legal, valid and enforceable.
15.6 No partnership: Nothing in the Contract is intended to, or shall be deemed to, constitute a partnership or joint venture of any kind between any of the parties, nor constitute any party the agent of another party for any purpose. No party shall have authority to act as agent for, or to bind, the other party in any way.
15.7 Third parties: A person who is not a party to the Contract shall not have any rights under or in connection with it.
15.8 Variation: Except as set out in these Conditions, any variation, including the introduction of any additional terms and conditions, to the Contract, shall only be binding when agreed in writing and signed by HR ONE.
15.9 Supersedes prior agreements: This Contract supersedes any prior agreement between the Parties whether written or oral and any such prior agreements are cancelled as at the Commencement Date but without prejudice to any rights which have already accrued to either of the parties.
15.10 Governing law and jurisdiction: This Contract, and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims), shall be governed by, and construed in accordance with, English law, and the parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales.
Schedule 1
Data Protection – Controller to Controller
Non-Payroll Services
1.1. Shared Personal Data. This Schedule sets out the framework for the sharing of Personal Data between the Parties as Controllers. Each Party acknowledges that the other Party (referred to in this paragraph as the Data Discloser) will regularly disclose to the other Party Shared Personal Data collected by the Data Discloser for the Agreed Purposes.
1.2. Effect of non-compliance with Data Protection Legislation. Each Party shall comply with all the obligations imposed on a Controller under the Data Protection Legislation, and any material breach of the Data Protection Legislation by one Party shall, if not remedied within 30 days of written notice from the other Party, give grounds to the other Party to terminate this Agreement with immediate effect.
1.3. Particular obligations relating to data sharing. Each Party shall:
(a) ensure that it has all necessary notices and consents and lawful bases in place to enable lawful transfer of the Shared Personal Data to the Permitted Recipients for the Agreed Purposes;
(b) give full information as required under article 13 and article 14 of the UK GDPR to any Data Subject whose Personal Data may be processed under this Agreement of the nature of such Processing. This includes giving notice that, on the termination of this Agreement, Personal Data relating to them may be retained by or, as the case may be, transferred to one or more of the Permitted Recipients, their successors and assignees;
(c) process the Shared Personal Data only for the Agreed Purposes;
(d) not disclose or allow access to the Shared Personal Data to anyone other than the Permitted Recipients;
(e) ensure that all Permitted Recipients are subject to written contractual obligations concerning the Shared Personal Data (including obligations of confidentiality) and use reasonable endeavours to ensure these are no less onerous than those imposed by this Agreement;
(f) ensure that it has in place appropriate Protective Measures, reviewed and approved by the other party if required, to protect against unauthorised or unlawful Processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data and shall provide written notice to the other if it becomes aware of a Personal Data Breach involving Shared Personal Data.
(g) not transfer any Personal Data received from the Data Discloser outside the UK unless the transferor ensures that (i) the transfer is to a country approved under the applicable Data Protection Legislation as providing adequate protection; or (ii) there are appropriate safeguards or binding corporate rules in place pursuant to the applicable Data Protection Legislation; or (iii) the transferor otherwise complies with its obligations under the applicable Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred; or (iv) one of the derogations for specific situations in the applicable Data Protection Legislation applies to the transfer.
1.4. Mutual assistance. Each Party shall assist the other in complying with all applicable requirements of the Data Protection Legislation. In particular, each Party shall:
(a) consult with the other Party about any notices given to Data Subjects in relation to the Shared Personal Data;
(b) promptly inform the other Party about the receipt of any Data Subject rights request;
(c) provide the other Party with reasonable assistance in complying with any Data Subject rights request;
(d) not disclose, release, amend, delete or block any Shared Personal Data in response to a Data Subject rights request without first consulting the other Party wherever possible;
(e) assist the other Party, at the cost of the other Party, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, Personal Data Breach notifications, Data Protection Impact Assessments and consultations with the Information Commissioner or other regulators;
(f) notify the other Party without undue delay on becoming aware of any breach of the Data Protection Legislation;
(g) at the written direction of the Data Discloser, delete or return Shared Personal Data and copies thereof to the Data Discloser on termination of this Agreement unless required by law to store the Shared Personal Data;
(h) use compatible technology for the processing of Shared Personal Data to ensure that there is no lack of accuracy resulting from Personal Data transfers;
(i) maintain complete and accurate records and information to demonstrate its compliance with this paragraph 1.4 and allow for audits by the other Party or the other Party's designated auditor; and
(j) provide the other Party with contact details of at least one employee as point of contact and responsible manager for all issues arising out of the Data Protection Legislation, including the joint training of relevant staff, the procedures to be followed in the event of a Personal Data Breach, and the regular review of the Parties' compliance with the Data Protection Legislation.
1.5. In order to provide the Services to the Customer, HR One use systems from third party organisations to store, hold and manage records in order to enable the Customer and HR One to undertake activities within the Schedule of Services. These activities include, but are not limited to:
• Reporting of accidents via an online system to support the H&S provision – Schedule 3 of the Schedule of Services
• Making payments to staff – Schedule 2 of the Schedule of Services
• Printing pay related documentation – Schedule 2 of the Schedule of Services
• Recording
HR One, in contracting with these providers, have ensured that all data held by third parties are held in accordance with UK GDPR principles.
The providers contracted by HR One at the date of this Agreement are:
Health & Safety
Oshens software - Ideagen Limited
Payroll and HR
iTrent software - MHR International UK Limited
HR Customer Relationship Manager (CRM)
Microsoft Dynamics
Learning and Development
DEL (Devon Learning) software - Learning Pool Limited
Occupational Health
Heales software - Heales Health Services Ltd
Schedule 2
Data Protection – Controller to Processor
Payroll Services
1.1. The Parties acknowledge that for the purpose of the Data Protection Legislation, the Customer is the Controller and HR ONE is the Processor. Unless otherwise agreed in writing, the Data Processing Operations is the only processing that HR ONE is authorised to do by the Customer.
1.2. HR ONE shall notify the Customer immediately if it considers that any of the Customer's instructions infringe the Data Protection Legislation.
1.3. HR ONE shall provide all reasonable assistance to the Customer in the preparation of any Data Protection Impact Assessment prior to commencing any processing. Such assistance may, at the discretion of the Customer, include:
1.3.1. a systematic description of the envisaged processing operations and the purpose of the processing;
1.3.2. an assessment of the necessity and proportionality of the processing operations in relation to the Services;
1.3.3. an assessment of the risks to the rights and freedoms of Data Subjects; and
1.3.4. the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.
1.4. HR ONE shall, in relation to any Personal Data processed in connection with its obligations under this Agreement:
1.4.1. process that Personal Data only in accordance with the Data Processing Operations, unless HR ONE is required to do otherwise by Law. If it is so required HR ONE shall promptly notify the Customer before processing the Personal Data unless prohibited by Law;
1.4.2. ensure that it has in place Protective Measures, which have been reviewed and approved by the Customer if requested, as appropriate to protect against a Data Loss Event having taken account of the:
(a) nature of the data to be protected;
(b) harm that might result from a Data Loss Event;
(c) state of technological development; and
(d) cost of implementing any measures;
1.4.3. ensure that:
(a) HR ONE Personnel do not process Personal Data except in accordance with this Agreement (and in particular the Data Processing Operations);
(b) it takes all reasonable steps to ensure the reliability and integrity of any HR ONE Personnel who have access to the Personal Data and ensure that they:
(i) are aware of and comply with HR ONE’s duties under this paragraph;
(ii) are subject to appropriate confidentiality undertakings with HR ONE or any Sub-processor;
(iii) are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third Party unless directed in writing to do so by the Customer or as otherwise permitted by this Agreement; and
(iv) have undergone adequate training in the use, care, protection and handling of Personal Data; and
1.4.4. not transfer Personal Data outside of the UK unless the prior written consent of the Customer has been obtained and the following conditions are fulfilled:
(a) the Customer or HR ONE has provided appropriate safeguards in relation to the transfer as determined by the Customer;
(b) the Data Subject has enforceable rights and effective legal remedies;
(c) HR ONE complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred (or, if it is not so bound, uses its best endeavours to assist the Customer in meeting its obligations); and
(d) HR ONE complies with any reasonable instructions notified to it in advance by the Customer with respect to the processing of the Personal Data;
1.4.5. at the written direction of the Customer, delete or return Personal Data (and any copies of it) to the Customer on termination of the Agreement unless HR ONE is required by Law to retain the Personal Data.
1.5. Subject to paragraph 1.6, HR ONE shall provide written notice to the Customer immediately if it:
1.5.1. receives a Data Subject Access Request (or purported Data Subject Access Request);
1.5.2. receives a request to rectify, block or erase any Personal Data;
1.5.3. receives any other request, complaint or communication relating to either Party's obligations under the Data Protection Legislation;
1.5.4. receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Agreement;
1.5.5. receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or
1.5.6. becomes aware of a Data Loss Event.
1.6. HR ONE’s obligation to notify under paragraph 1.5 shall include the provision of further information to the Customer in phases, as details become available.
1.7. Taking into account the nature of the processing, HR ONE shall provide the Customer with full assistance in relation to either Party's obligations under Data Protection Legislation and any complaint, communication or request made under paragraph 1.5 (and insofar as possible within the timescales reasonably required by the Customer) including by promptly providing:
1.7.1. the Customer with full details and copies of the complaint, communication or request;
1.7.2. such assistance as is reasonably requested by the Customer to enable the Customer to comply with a Data Subject Access Request within the relevant timescales set out in the Data Protection Legislation;
1.7.3. the Customer, at its request, with any Personal Data it holds in relation to a Data Subject;
1.7.4. assistance as requested by the Customer following any Data Loss Event;
1.7.5. assistance as requested by the Customer with respect to any request from the Information Commissioner’s Office, or any consultation by the Customer with the Information Commissioner's Office.
1.8. HR ONE shall maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where HR ONE employs fewer than 250 staff, unless:
1.8.1. the Customer determines that the processing is not occasional;
1.8.2. the Customer determines the processing includes special category data as referred to in Article 9(1) of the UK GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the UK GDPR; and
1.8.3. the Customer determines that the processing is likely to result in a risk to the rights and freedoms of Data Subjects.
1.9. HR ONE shall allow for audits of its Data Processing activity by the Customer or the Customer’s designated auditor.
1.10. Before allowing any Sub-processor to process any Personal Data related to this Agreement (other than those notified at paragraph 1.14 below who the Customer is deemed to have consented to in writing by entering into this Agreement), HR ONE must:
1.10.1. notify the Customer in writing of the intended Sub-processor and processing;
1.10.2. obtain the written consent of the Customer;
1.10.3. enter into a written agreement with the Sub-processor which give effect (so far as reasonably practicable) to the terms set out in this Schedule 2 such that they apply to the Sub-processor; and
1.10.4. provide the Customer with such information regarding the Sub-processor as the Customer may reasonably require.
1.11. HR ONE shall remain fully liable for all acts or omissions of any Sub-processor.
1.12. Either Party may, at any time on not less than 30 Business Days’ notice to the other Party, revise this Schedule by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when incorporated by attachment to this Agreement).
1.13. The Parties agree to take account of any guidance issued by the Information Commissioner’s Office. Either Party may on not less than 30 Business Days’ notice to the other Party amend this Agreement to ensure that it complies with any guidance issued by the Information Commissioner’s Office.
1.14. In order to provide a service to the Customer, HR One use systems from third party organisations to store, hold and manage records in order to enable the Customer and HR One to undertake activities within the Schedule of Services. These activities include, but are not limited to:
• Reporting of accidents via an online system to support the H&S provision – Schedule 3 of the Schedule of Services
• Making payments to staff – Schedule 2 of the Schedule of Services
• Printing pay related documentation – Schedule 2 of the Schedule for Services
• Recording
HR One, in contracting with these providers, have ensured that all data held by third parties are held in accordance with UK GDPR principles.
The providers contracted by HR One at the date of this Agreement are:
Health & Safety
Oshens software - Ideagen Limited
Payroll and HR
iTrent software - MHR International UK Limited
HR Customer Relationship Manager (CRM)
Microsoft Dynamics
Learning and Development
DEL (Devon Learning) software - Learning Pool Limited
Occupational Health
Heales software - Heales Health Services Ltd