1. Parties and Purpose
This Data Processing Agreement (“DPA”) forms part of the agreement between Experity Partners Ltd (trading as Connee) (“Processor”) and the Customer identified in the applicable subscription agreement or service order (“Controller”).
It governs the processing of personal data by Connee on behalf of the customer in connection with Connee’s platform and services.
The Customer is the business or organisation named in the applicable subscription agreement or service order. This standard DPA applies alongside that agreement and any customer-specific processing instructions or schedules. The service configuration, relevant provider locations and specific security arrangements must be documented for the applicable processing before it begins.
2. Roles and Responsibilities
The customer acts as the data controller and is responsible for determining the purposes and lawful basis for processing personal data, providing required privacy information, and ensuring that data supplied to Connee is collected and shared lawfully.
Connee acts as the data processor and will process personal data only on the customer's documented instructions, including those set out in the customer agreement, unless required to do otherwise by law. Connee will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.
3. Confidentiality and Security
Connee will ensure that anyone authorised to process personal data is subject to appropriate confidentiality obligations.
Connee will implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.
These measures will be proportionate to the nature of the data and the risks involved.
4. Sub-processors
The customer authorises Connee to use appropriate third-party service providers to support the delivery of its services.
Connee will ensure that relevant sub-processors are subject to data protection obligations consistent with this DPA and remains responsible for their performance of applicable data protection obligations.
Connee will provide information about relevant sub-processors and give customers advance notice of proposed additions or replacements, with a reasonable opportunity to raise a substantiated data protection objection before the change takes effect. The parties will work in good faith to address an objection and agree an appropriate alternative or exit arrangement where the issue cannot be resolved.
5. Data Subject Requests and Assistance
Taking into account the nature of the processing, Connee will provide reasonable assistance to the customer with requests from individuals exercising their data protection rights.
Connee will also provide reasonable assistance with security obligations, data protection impact assessments and regulatory consultations where required by applicable law.
If Connee receives a data subject request relating to data processed on behalf of the customer, it will refer the request to the customer unless legally required to respond directly.
6. Personal Data Breaches
Connee will notify the customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA.
Connee will provide available information reasonably necessary to help the customer investigate the breach, meet legal obligations and take appropriate remedial action.
7. International Transfers
Connee will not transfer personal data outside the UK in a way that requires additional safeguards unless the applicable legal requirements are met.
Where necessary, appropriate safeguards will be implemented, such as an applicable adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. Data Retention, Return and Deletion
When the services end, Connee will, at the customer's choice, return or securely delete personal data processed on its behalf, unless applicable law requires its retention.
Any retained data will remain protected under this DPA and will be deleted when the retention requirement ends.
Unless a different lawful instruction or written arrangement applies, the Customer has 30 days after the Subscription ends to request an export. Connee retains Customer Data for one further calendar month after that period before deletion or anonymisation, subject to applicable legal retention requirements. Protected backup copies expire through the applicable backup retention cycle. See the Data Retention and Deletion information.
9. Audits and Compliance
Connee will make available information reasonably necessary to demonstrate compliance with this DPA and will support proportionate audits or inspections, subject to reasonable notice, confidentiality and security requirements.
10. Liability and Term
Each party's liability under this DPA will be governed by the applicable customer agreement and relevant law.
This DPA remains in effect for as long as Connee processes personal data on behalf of the customer.
If any provision conflicts with applicable data protection law, the law will prevail to the extent of the conflict.
Schedule 1 – Processing Details
Subject matter: Delivery of Connee's customer experience and insights platform.
Purpose: Collection, storage, analysis and reporting of customer, employee, candidate, prospect or other feedback, as instructed by the customer.
Types of personal data: May include names, contact details, feedback, survey responses, opinions and other information supplied by the customer. Special category data should only be processed where specifically agreed and legally permitted.
Categories of data subjects: Customers, employees, candidates, prospects and other individuals whose information is supplied to the platform.
Duration: For the term of the relevant customer agreement, plus any agreed retention or deletion period.
Service providers: Microsoft 365, Brevo and OpenAI are used across Connee’s services and business operations. Their role as a sub-processor depends on whether they process Customer Data on the Customer’s behalf. Microsoft 365 supports business communications and collaboration; Brevo supports email communications; OpenAI supports AI-assisted functionality where enabled. Only the data necessary for the applicable purpose may be shared. Further information about the providers used for a particular service, processing locations and applicable transfer safeguards is available from [email protected]. No payment provider is identified in this schedule because one has not yet been selected. Any relevant addition must follow the sub-processor notification arrangements in section 4.
Schedule 2 – Security Measures
Connee’s contractual security obligations include maintaining measures appropriate to the processing and its risks, including:
- Access controls and appropriate authentication.
- Encryption where appropriate.
- Secure hosting, backups and recovery procedures.
- Security monitoring and incident management.
- Staff confidentiality and security training.
- Secure deletion and retention controls.
- Supplier and sub-processor security reviews.