Effective: June 2026 | Applies to all clients receiving managed IT services from IAP UK Ltd
1. Introduction and scope
This Data Processing Addendum (“DPA”) forms part of the agreement between IAP UK Ltd (“IAP”, “we”, “us”) and the client (“you”, “Controller”) for the provision of managed IT services. It applies where IAP processes personal data on your behalf as a data processor under Article 28 of the UK General Data Protection Regulation (UK GDPR).
This DPA supplements our Terms & Conditions and Privacy Policy. In the event of any conflict between this DPA and those documents on matters of data processing, this DPA takes precedence.
2. Definitions
“Controller” means the client who determines the purposes and means of processing personal data.
“Processor” means IAP UK Ltd, acting on the Controller’s instructions.
“Personal Data” has the meaning given in the UK GDPR.
“Processing” has the meaning given in the UK GDPR.
“Sub-processor” means any third party engaged by IAP to process personal data on the Controller’s behalf.
3. Details of processing
The subject matter, nature, purpose, type of personal data and categories of data subjects processed by IAP on your behalf are as follows:
| Subject matter | Details |
|---|---|
| Nature and purpose | Provision of managed IT services including remote monitoring and management, helpdesk support, endpoint protection, Microsoft 365 administration, hosted services, domain and hosting management, telephony, and security awareness training |
| Type of personal data | Names, email addresses, usernames, device identifiers, IP addresses, system logs, call data records, and any personal data incidentally present in systems or communications managed by IAP on your behalf |
| Categories of data subjects | Your employees, contractors, and end-users whose devices, accounts, or data are within scope of the managed services |
| Duration | For the term of the service agreement and for 13 months following termination, unless a shorter period is specified or required by law |
4. IAP’s obligations as processor
IAP shall:
- Only process personal data on your documented instructions, unless required to do so by law (in which case IAP will inform you unless prohibited from doing so)
- Ensure that staff authorised to process personal data are bound by appropriate confidentiality obligations
- Implement appropriate technical and organisational security measures in accordance with Article 32 UK GDPR, having regard to the nature, scope, context and purposes of processing and the risks to individuals
- Not engage any sub-processor without your prior consent (general written consent is given via your acceptance of these terms — see clause 6 for current sub-processors)
- Assist you, where reasonably possible and at your cost, in responding to requests from individuals exercising their rights under UK GDPR
- Assist you in meeting your obligations under Articles 32–36 UK GDPR (security, breach notification, DPIAs, prior consultation)
- At your choice, delete or return all personal data on termination of services, and delete existing copies unless retention is required by law
- Make available to you all information necessary to demonstrate compliance with this DPA and allow for audits conducted by you or an appointed auditor, on reasonable notice and at your cost
- Notify you without undue delay and within 48 hours upon becoming aware of a personal data breach affecting your data
5. Your obligations as controller
You confirm that:
- You have a valid lawful basis under UK GDPR for the personal data you provide to IAP or make accessible to IAP through your systems
- You have provided appropriate privacy notices to your data subjects covering IAP’s processing activities on your behalf
- You will provide IAP with clear documented instructions where specific processing requirements differ from standard service delivery
- You will notify IAP promptly of any changes to your data protection requirements that may affect IAP’s processing activities
6. Sub-processors
By accepting these terms you provide general written consent for IAP to use the following sub-processors in delivering services. IAP will inform you of any intended changes to this list with reasonable notice, giving you the opportunity to object. IAP imposes data protection obligations on all sub-processors equivalent to those in this DPA.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft (via Giacom) | Microsoft 365 cloud services, Azure infrastructure | UK/EU (covered by MCA/DPA) |
| Xcitium / iTarian | Remote monitoring and management (RMM) | US/EU (DPA in place) |
| Avast CloudCare | Endpoint protection | EU/US (DPA in place) |
| 20i | Domain registration and web hosting | UK |
| Xero | Invoicing and financial records | UK/EU |
| usecure | Security awareness training (enrolled clients only) | UK |
| TalkTalk Business | Telephony and call data records | UK |
| VoiceHost | SIP telephony services | UK |
7. International transfers
Where processing of your personal data involves a transfer outside the UK, IAP will ensure that appropriate safeguards are in place in accordance with UK GDPR Chapter V, including reliance on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or standard contractual clauses where applicable.
8. Security measures
IAP maintains appropriate technical and organisational security measures including: access controls and role-based permissions; multi-factor authentication on key systems; encrypted communications; endpoint protection across managed devices; regular security monitoring and review; staff confidentiality obligations and GDPR training; and incident response procedures including breach notification to you within 48 hours of discovery.
9. Data breach notification
If IAP becomes aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours of becoming aware. Notification will include: a description of the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address the breach. You remain responsible for notifying the ICO within 72 hours where required.
10. Governing law
This DPA is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the English courts in relation to any dispute arising under this DPA.
This Data Processing Addendum was last updated in June 2026. A downloadable copy of the full Terms & Conditions including this DPA is available on request from [email protected].