Service Agreement

Date: ###DD.MM.YYYY###

Installation date: ###DD.MM.YYYY###

PARTIES

1. PTFS Europe Limited (Registered Number 6416372) whose registered office is at The Court, The Street, Charmouth, Bridport, DT6 6PE (the “Company”)

2. ###CUSTOMER NAME###, ###Customer Address### (the “Customer”)

individually the “Party” and collectively the “Parties”.

The Company has agreed to provide the Customer with certain online hosted services and technical support and servicing in relation to the generation and maintenance of the Customer’s library management and related systems. The systems are known as Koha, Aspen, Knowvation, CORAL, RT, Booked, DSpace, WordPress, Matamo, Metabase and related products which are to be made available to the Customer under the terms and conditions of this Agreement.

OPERATIVE PROVISIONS

Definitions

“Business Hours” means between the hours of 9.00 a.m. and 5.30 p.m. GMT/BST Monday to Friday (excluding English Bank and other Company holidays);

“Commencement Date” means [ the Installation Date ];

“Customer Personal Data” means any personal data of which the Customer is controller and which is processed by the Company under or in connection with this Agreement;

“Customer Data” means any information or data, in whatever form, which is held on, entered into, processed by, or retrievable from computer, communication or other systems or equipment of the Customer including Customer Personal Data;

“controller”, “data subject”, “personal data”, “process” and “processing”, shall have the meaning set out in the "Data Protection Legislation", being any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) which relates to the protection of individuals with regards to the processing of personal data to which a Party is subject, including the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any laws or regulations implementing, the UK General Data Protection Regulation (“UK GDPR”) and any other replacement legislation as may come into force from time to time;

“Fees” means the fees set out in Schedule 1 of this Agreement;

“Hosted Service” means providing the Customer with access to the Software Programs via a data centre run by a third party;

“Initial Term” means the initial term of this Agreement as set out in clause 9.1;

“Installation Date” means the date of installation of the Software Programs;

“Program Documentation” means the manuals and other supporting documentation for the current release of the Software Programs;

“Renewal Period” means each successive 12 month period after the Initial Term for which this Agreement is renewed;

“Response Time” means the response time for Technical Support set out in clause 4.2;

“Restricted Country” means a country, territory or jurisdiction outside of the United Kingdom which is not covered by regulations made the Secretary of State under section 17A (general processing) or section 74A (law enforcement processing) of the Data Protection Act 2018 giving effect to a finding by the Secretary of State that the specified country ensures an ‘adequate’ level of protection of personal data;

“Service Levels” means the levels of service detailed at clause 5;

“Services” means the services described in this Agreement and such other services as the Parties may agree in writing from time to time;

“Software Programs” means the software programs supported by the Company for the Customer under the terms of this Agreement and listed in Schedule 1 of this Agreement;

“Subject Access Request” means an actual or purported subject access request or notice or complaint from (or on behalf of) a data subject exercising his rights under the Data Protection Legislation;

“Supplier Personnel” means any person employed or engaged by the Company or its Sub Contractors in connection with the provision of the Services;

“Sub-Contractor” means a third party directly or indirectly contracted to the Company to perform any of the Company's obligations under this Agreement; and

“Technical Support” means the provision of such categories of technical support in accordance with clause 4 as shall be specified in respect of each of the Software Programs in Schedule 1 of this Agreement.

Provision of Services

The Company in consideration of the fees set out in clause 3 undertakes to the Customer to provide the services upon the terms and conditions of this Agreement.

Fees and Payment Schedule

The Customer shall pay the Fees for the Services as set out at Schedule 1 to this Agreement. The payment schedule is 35% of the total cost following the project kick-off meeting, 35% from the start of training and 30% on live running.

The Fees shall not include Value Added Tax which shall be payable by the Customer in the manner and at the rate from time to time prescribed by law.

The Fee schedule for hosting and support for the first ### X Years ### of this agreement is in the table below. These fees do not include installation costs which are detailed in the quotation in Schedule 1. These fees fall due for payment on each anniversary of the Installation Date, subject to clause 3.5.

Year 1 ##Date1 - Date2##	Year 2 ##Date1 - Date2##	Year 3 ##Date1 - Date2##
##Product##	##Price##	##Price##	##Price##
##Product##	##Price##	##Price##	##Price##
##Product##	##Price##	##Price##	##Price##

After the first ### X Years ### of this agreement and subject to clause 3.5, the Company shall be entitled to vary the Fees not more than once in every successive period of 12 months during the term of this Agreement upon giving not less than 60 days written notice thereof to the Customer expiring at the end of any year of this Agreement and provided also that no percentage increase shall exceed 5%.

Payment shall be made by the Customer to the Company within thirty days from the date of receipt of the Company’s invoice. The Company reserves the right under the Late Payment of Commercial Debts (Interest) Act 1998 to charge additional interest for payments more than 60 days overdue. The rate of late payment interest is 4% above base rate. The base rate is calculated by reference to the Bank of England base rate on 31 December.

Technical Support

With effect from the Commencement Date hereof and for the duration of this Agreement the Company shall provide Technical Support to the Customer in respect of each of the Software Programs.

Technical Support shall comprise the following categories:

advice by support portal, telephone or e-mail, whichever is the most appropriate to give a timely response, on the use of the Software Programs

information and advice by support portal, telephone or e-mail, whichever is the most appropriate to give a timely response, on forthcoming new releases of the Software Programs

upon request of the Customer the diagnosis of faults in the Software Programs and the rectification of such faults by the issue of fixes as quickly as possible in respect of the Software Programs

carrying out the installation from time to time of software patches or configuration changes in respect of the Software Programs

carrying out the installation from time to time of new releases of the Software Programs or Program Documentation or both.

carrying out data deletion processes in accordance with our Data Retention Policy. These processes do not in any way negate or interfere with the Company’s obligations under section 8 Data Protection.

If any of the activities arising from clauses 4.2.4 or 4.2.5 involve system down-time or alterations to the Services, then the scheduling of such work shall be mutually agreed between the Parties so as to minimise disruption to the Services. If this work is carried out outside of Business Hours the Company reserves the right to make additional charges for support outside of Business Hours. These charges will be mutually agreed in advance.

Technical Support will be available in UK Business Hours (9am - 5:30pm (GMT), Monday to Friday excluding English and Welsh statutory holidays). The Company reserves the right to make additional charges for support outside of Business Hours. These charges will be mutually agreed in advance.

The Customer shall supply in writing to the Company a detailed description of any faults requiring Technical Support and the circumstances in which it arose as soon as practicable after becoming aware of the same.

The Parties acknowledge that changes in the scope or delivery of the Services may, from time to time, be requested by the Customer (“Modifications”). These requests shall be submitted via the Customer Support Portal. Without always doing so, the Company reserves the right to make reasonable and mutually agreed additional charges to provide the functionality needed to make the requested Modification(s).

Change control requests will be submitted by the Customer via the Customer Support Portal and will be made available for ongoing monitoring by the Customer.

Service levels

The annual availability of the Software Programs will be better than 99.9%.

Faults will be categorised by a process of mutual agreement between the Customer and the Company. These faults will be classified in the following manner and to the following level of service:

Severe: Where the entire system or a complete module is unavailable or unusable. The Company will respond within 2 working hours and will make best endeavours to fix within 6 working hours or recommend an acceptable workaround.

Moderate: Where the system is available but aspects of previously accepted functionality are seriously impaired. The Company will respond within 4 working hours and will make best endeavours to fix within 12 working hours or recommend an acceptable workaround.

Minor or cosmetic: Where aspects of appearance or functionality could be improved without being classified as severe or moderate problems. The Company will respond within 5 working days and make reasonable endeavours to recommend appropriate solutions. These solutions include (but are not limited to) the Company providing a fix, software development or workaround. Without always doing so, the Company reserves the right to make reasonable and mutually agreed additional charges for fixes, software development or enhancements provided for this category of fault. Such additional charges to be agreed with the Customer in advance of any action taken by the Company to rectify the particular fault.

The escalation path for unsatisfactory response to faults will be via the Company’s designated Account Manager, Director of Operations and Managing Director.

Hosted Service

The Hosted Service is provided within the United Kingdom by one or more of these service providers:

iomart Group Plc. Company number: SC204560, VAT number: GB751537235, Address: Lister Pavilion, Kelvin Campus, West of Scotland Science Park, Glasgow, United Kingdom, G20 0SP.

Amazon Web Services EMEA SARL, UK Branch. Registered Office: 1 Principal Place, Worship Street, London, EC2A 2FA Registered in England and Wales UK Establishment No. BR019315, VAT No. GB283644382.

DigitalOcean LLC, 101 Avenue of the Americas, 2nd Floor, New York, NY 10013. Registered in England and Wales UK as DigitalOcean Droplet Limited, Company number 13315180, VAT ID: GB359343377

The provider of the Hosted Service may change from time to time. The Company undertakes to inform the Customer of any change to the Hosted Service. In any event such Hosted Service shall only be provided within the United Kingdom.

The Company undertakes to ensure that the Hosted Service provider and the Hosted Service provider’s sub-contractors are bound by the terms of this Agreement.

The Company will perform daily incremental and weekly full back-ups of the Customer Data which will be stored within the data centre and at an off site location.

Expenses

The Customer shall reimburse the Company for any out of pocket expenses reasonably incurred by the Company in connection with duties performed under this Agreement at the Customer's request which fall outside of the categories of Fees at Schedule 1.

All expenses referred to at clause 7.1 must be agreed by both Parties in writing prior to the Company incurring any such expenses.

All claims made by the Company for expenses under clause 7.1 must be supported by valid receipts failing which the Customer will reject such claims.

Data Protection

The Parties acknowledge that for the purposes of the Data Protection Laws, the Customer is the Controller and the Company is the Processor and that the Processor shall comply with the obligations set out in Schedule 2.

Where the Company also processes Personal Data relating to employees of the Customer otherwise than directly for the purpose of performing its obligations under the Contract, the Company acknowledges that it is likely to be a Data Controller in its own right and that it is solely responsible for its own compliance with the Data Protection Laws in that regard.

The Company shall, at all times during and after the period of the Contract, indemnify and keep indemnified the Customer (and each of its officers and employees) from and against all losses, damages, costs or expenses and other liabilities of any kind (including legal and other professional expenses) incurred by, awarded against or agreed to be paid by the Customer whether arising in tort or delict including negligence, in contract or otherwise as a result of the Company’s breach or alleged breach of their obligations under any applicable Data Protection Law or its obligations under liability for losses arising from breaches of this clause 8.

Term and Termination

This Agreement shall, unless otherwise terminated as provided in this clause 9, commence on the Commencement Date and shall continue for a period of [### X ### ] year(s) (“Initial Term”) and, thereafter, this Agreement shall be renewed for successive periods of 12 months (each a “Renewal Period” unless notice of non-renewal is received by either Party from the other not less than 60 days prior to the end of the Initial Term or Renewal Period in which case this Agreement shall terminate upon the expiry of the applicable Initial Term or Renewal Period. Upon termination the Company will charge reasonable professional fees for the professional time taken to return Customer Data to the Customer.

This Agreement shall be terminated:

forthwith by either Party giving notice if the other commits any material breach of any terms of this Agreement and in the case of a breach capable of remedy has not remedied it with 30 days after receipt of notice in writing requiring it to do so;

forthwith by either Party giving notice if the other shall convene a meeting of its creditors or if a proposal shall be made for a voluntary arrangement within part I of the Insolvency Act 1986 or a proposal for any other composition scheme or arrangement with (or assignment for the benefit of) its creditors or if the other shall be unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986 or if the trustee receiver or Administrative Receiver or similar officer is appointed in respect of all or any part of the business or assets of the other Party or analogous action in any jurisdiction in consequence of debt;

forthwith by either Party without cause upon not less than ninety (90) days’ written notice to the other Party.

Any termination of this Agreement pursuant to this clause 9 shall be without prejudice to any other rights or remedies a Party may be entitled to hereunder or at law and shall not affect any accrued rights or liabilities of either Party nor the coming into or continuance in force of any provision hereof which is expressly or by implication intended to come into or continue in force on or after termination.

Waiver by either Party of a breach or default of any of the provisions of this Agreement by the other Party shall not be construed as a waiver of any succeeding breach of the same or other provisions nor shall any delay or omission on the part of either Party to exercise or avail itself of any rights power or privilege that it has or may have hereunder operate as a waiver of any breach or default by the other Party.

Notices

Any notice request instruction or other document to be given in connection with this agreement shall be in writing and shall be:

delivered or sent by pre-paid first class post or other next Business Day delivery service to the address of the other Party set out in this Agreement or such address as may have been notified in writing; or

sent by email to the following addresses

The Company : [finance@ptfs-europe.com]

The Customer : [### Customer Notices Email Address ###]

Any notice shall be deemed to have been received:

if delivered by hand, at the time the notice is left at the proper address;

if sent by pre-paid first-class post or other next working day delivery service, at 9.00 am on the second Business Day after posting; or

if sent by email, at the time of transmission, or, if this time falls outside business hours in the place of receipt, when business hours resume. In this Clause 10.2(c), business hours means 9.00am to 5.00pm Monday to Friday on a day that is not a public holiday in the place of receipt.

This clause does not apply to the service of any proceedings or any documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

The Company shall notify the Customer without undue delay and in any event no later than 24 hours after becoming aware of a personal data breach, such notice to be sent to [ ### Customer privacy email address ### ].

Invalidity

If any provision of this Agreement shall be found by any court or administrative body or competent jurisdiction to be invalid or unenforceable the invalidity or unenforceability of such provision shall not affect the other provisions of this Agreement and all the provisions not affected by such invalidity or unenforceability shall remain in full force and effect. The Parties hereby agree to attempt to substitute for any invalid or unenforceable provision a valid or enforceable provision which achieves to the greatest extent possible the economic legal and commercial objectives of the invalid or unenforceable provision.

Entire Agreement

This Agreement, and any documents referred to in it, constitute the whole agreement between the Parties and supersede any previous arrangement, understanding or agreement between them relating to the subject matter they cover.

Each of the Parties acknowledges and agrees that in entering into this Agreement it does not rely on any undertaking, promise, assurance, statement, representation, warranty or understanding (whether in writing or not) of any person (whether party to this Agreement or not) relating to the subject matter of this Agreement, other than as expressly set out in this Agreement.

No Partnership or Agency

Nothing in this Agreement is intended to or shall operate to create a partnership between the Parties, or authorise either Party to act as agent for the other, and neither Party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

Successors

This Agreement or all or any of the rights or obligations under it may not be assigned, transferred, charged or sub-contracted in whole or in part by either Party without first obtaining the written consent of the other, such consent shall not be unreasonably withheld or delayed.

Headings

Headings to clauses in this Agreement are for the purpose of information and identification only and shall not be construed as forming part of this Agreement.

Confidentiality

Each of the Parties hereto undertakes to the other to keep confidential all information written or oral concerning the business and affairs of the other that it shall have obtained or received as a result of the discussions leading up to or the entering into this Agreement (“Confidential Information”) save that which is:

required to be disclosed in compliance with a legal requirement of a governmental agency, regulatory authority or otherwise where disclosure is required by operation of law (provided, in the case of a disclosure under the Freedom of Information Act 2000, none of the exceptions to that Act applies to the information disclosed);

already in its possession other than as a result of a breach of confidence;

in the public domain or becomes publicly known other than as a result of a breach of this clause;

independently developed by the receiving party, which independent development can be shown by written evidence; or

lawfully disclosed to the receiving party by a third party without restriction on disclosure.

Each of the Parties undertakes to the other to take all such steps as shall from time to time be necessary to ensure compliance with the provision of this clause 16 by its employees agents and sub-contractors.

The Company acknowledges that the Customer Data is the Confidential Information of the Customer.

The provisions of this clause 16 will survive termination of this Agreement however arising and will continue indefinitely.

Third Party Rights

This Agreement does not confer any rights on any person or party (other than the Parties to this Agreement and, where applicable, their successors and permitted assigns) pursuant to the Contracts (Rights of Third Parties) Act 1999.

Warranty

The Company represents, warrants and covenants that:

the Company, its employees, agents and contractors will use reasonable skill, care and diligence in performing its obligations under this Agreement and will comply at all times with all applicable laws and regulations, and that it will provide the Services in accordance with generally accepted professional standards and that it is and will continue to be adequately financed to meet all financial obligations it may be required to meet under this Agreement; and

the Company, its employees, its agents and contractors will not introduce into the Software Programs any virus and will not, in any way, destroy, damage, corrupt or render inaccessible any software or data on any operating system used by the Customer.

Governing Law and Jurisdiction

This Agreement and any disputes or claims arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with English law and the Parties hereto agree to submit to the exclusive jurisdiction of the English Courts to settle any dispute or claim that arises out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims).

Force Majeure

For the purposes of this Agreement the expression "Force Majeure" shall mean any cause affecting the performance by a Party of its obligations arising from acts, events, omissions, happenings or non-happenings beyond its reasonable control including (but without limiting the generality thereof) governmental regulations, fire, flood, failure of a utility service or transport or telecommunications network, act of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, fire, flood, storm, or any disaster. Any act, event, omission, happening or non-happening will only be considered Force Majeure if it is not attributable to the wilful act, neglect or failure to take reasonable precautions of the affected Party, its agents or employees.

Neither Party shall in any circumstances be liable to the other for any loss of any kind whatsoever including but not limited to any damages or abatement of charges whether directly or indirectly caused to or incurred by the other Party by reason of any failure or delay in the performance of its obligations hereunder which is due to Force Majeure. Notwithstanding the foregoing, each Party shall use all reasonable endeavours to continue to perform, or resume performance of, such obligations hereunder for the duration of such Force Majeure event.

If either of the Parties shall become aware of circumstances of Force Majeure which give rise to or which are likely to give rise to any such failure or delay on its part it shall forthwith notify the other by the most expeditious method then available and shall inform the other of the period which it is estimated that such failure or delay shall continue.

If the Force Majeure event prevents, hinders or delays the Affected Party’s performance of its obligations for a continuous period of more than 4 months the party not affected by the Force Majeure event may terminate this agreement by giving 30 days written notice to the affected party.

Limitation of Liability

The following provisions set out the Parties’ liability (including any liability for the acts and omissions of their employees agents and sub-contractors) to each other in respect of:

any breach of their contractual obligations arising under this Agreement; and

any representation statement or tortious act or omission including negligence arising under or in connection with this Agreement.

Any act or omission on the part of either Party or their employees, agents or sub-contractors falling within clause 21.1 above shall for the purpose of this clause 21 be known as an 'Event of Default'.

The Parties liability to each other for death or injury resulting from its employees' agents' or sub-contractors' negligence or for fraud or fraudulent misrepresentation shall not be limited.

Subject to the limits set out in clause 21.5. below the Company shall accept liability to the Customer in respect of damage to the property of the Customer resulting from the negligence of the Company or its employees agents or sub-contractors.

Subject to the provisions of clause 21.3 above, the either Party’s entire liability in respect of any Event of Default to the other shall be limited to damages of an amount not exceeding:

£5,000,000 in the case of an Event of Default falling within clause 21.4 above; and

150% of the value of this Agreement in the case of any other Event of Default.

Subject to Clause 21.3 above neither Party shall be liable to the other in respect of any Event of Default for loss of profits goodwill or any type of special indirect or consequential loss even if such loss was reasonably foreseeable or either Party had advised of the possibility of the other Party incurring the same.

Indemnity and IPR

Notwithstanding clause 21, the Company shall indemnify and hold the Customer harmless from all claims and all direct, indirect or consequential liabilities (including loss of profits, loss of business, depletion of goodwill and similar losses), costs, proceedings, damages and expenses (including legal and other professional fees and expenses) awarded against, or incurred or agreed to be paid by, the Customer as a result of or in connection with:

any alleged or actual infringement, whether or not under English law, of any third party's intellectual property rights or other rights arising out of the use or supply of the Services; or

any claim made against the Customer in respect of any liability, loss, damage, injury, cost or expense sustained by the Customer's employees or agents or by any customer or third party to the extent that such liability, loss, damage, injury, cost or expense was caused by, relates to or arises from the provision of the Services by the Company except to the extent that such liabilities have resulted directly from the Customer’s failure to properly observe its obligations under clause 22.2

The Customer shall:

notify the Company in writing of any IPR Claim;

allow the Company to conduct all negotiations and proceedings and provide the Company with such reasonable assistance as is required by the Company, each at the Company's cost, regarding the IPR Claim; and

not, without prior consultation with the Company, make any admission relating to the IPR Claim or attempt to settle it, provided that the Company considers and defends any IPR Claim diligently, using competent counsel and in such a way as not to bring the reputation of the Customer into disrepute.

If an IPR Claim is made, or the Company anticipates that an IPR Claim might be made, the Company may, at its own expense and sole option, either:

procure for the Customer the right to continue using the part of the material which is subject to the IPR Claim; or

replace or modify, or procure the replacement or modification of, such material, provided that:

i) the performance and functionality of the replaced or modified item is at least equivalent to the performance and functionality of the original item;

ii) the replaced or modified item does not have an adverse effect on any other Services or the Company's System;

iii) there is no additional cost to the Customer; and

iv) the terms of the agreement apply to the replaced or modified Services.

If the Company elects to modify or replace an item pursuant to Clause 22.3(b) or to procure a licence in accordance with Clause 22.3(a), but this has not avoided or resolved the IPR Claim, then the Customer may terminate this agreement by written notice with immediate effect.

The provisions of Clause 22 to Clause 22.4 (inclusive) shall not apply to any IPR Claim in respect of and to the extent that:

any use by or on behalf of the Customer of the Software in combination with any item not supplied pursuant to this agreement gives rise to the IPR Claim; or

the use by or on behalf of the Customer of the Software in a manner not reasonably to be inferred from the specification or requirements of the relevant materials to be provided pursuant to the terms of this agreement gives rise to the IPR Claim.

The provisions of this clause 22 will survive the expiration or earlier termination of this Agreement.

Proprietary Rights

The Customer acknowledges and agrees that the Company and/or its licensors own all intellectual property rights in the Services and the Program Documentation. Except as expressly stated herein, this Agreement does not grant the Customer any rights to, or in, patents, copyright, database right, trade secrets, trade names, trade marks (whether registered or unregistered), or any other rights or licences in respect of the Services or the Program Documentation.

The Company confirms that it has all the rights in relation to the Services and the Program Documentation that are necessary to grant all the rights it purports to grant under, and in accordance with, the terms of this Agreement.

Insurance

The Company will carry appropriate insurance with a reputable insurance company covering property damage, business interruption and general liability insurance to protect its own business interests.

Without prejudice to clause 24.1, the Company shall (from and including the Commencement Date of this Agreement) insure with reputable insurers in respect of its public liability, employer liability and professional indemnity liability arising pursuant to the performance of its obligations and/or liabilities under this Agreement to a minimum value of £10,000,000 in respect of any one event or series of events; and shall provide evidence of its compliance with this clause as the Customer shall reasonably require from time to time.

COUNTERPARTS

This agreement may be executed in any number of counterparts each of which shall constitute a duplicate original but all the counterparts shall together constitute one agreement.

Transmission of an executed counterpart of this agreement (but for the avoidance of doubt not just the signature page) by email (in PDF, JPEG or other agreed format) shall take effect of the transmission of an executed ‘wet-ink’ counterpart of this agreement.

No counterpart shall be effective until each party has delivered to the other at least one executed counterpart.

For and on behalf of:

THE COMPANY BY: NAME: Andrew Auld TITLE: Commercial Director DATE: ### DD.MM.YYY ###	THE CUSTOMER BY: NAME: TITLE: DATE:

PLEASE NOTE

We can accept either electronic signature or hard copy.

If sending by hard copy the address is:

Finance Department

PTFS Europe

The Court, The Street

Charmouth

Dorset

DT6 6PE

UK

Schedule 1 - pricing

Schedule 2 – Data Protection

This Schedule forms part of the Agreement between the Company and the Customer and unless otherwise stated herein is subject to all terms of that Agreement.

Interpretation

In this Schedule the following definitions will apply (unless the context other requires):

"Customer Personal Data" means any personal data of which the Customer is controller and which is processed by the Company under or in connection with the Agreement, including the information more particularly described in Paragraph 3.1 of this Schedule;

"Customer Data" means any information or data, in whatever form, which is held on, entered into, processed by, or retrievable from computer, communication or other systems or equipment of the Customer including Customer Personal Data;

"controller", "data subject", "personal data", "process" and "processing", shall have the meaning set out in the "Data Protection Legislation", being any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) which relates to the protection of individuals with regards to the processing of personal data to which a Party is subject, including the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any laws or regulations implementing, the UK General Data Protection Regulation (“UK GDPR”) and any other replacement legislation as may come into force from time to time;

"Restricted Country" means a country, territory or jurisdiction outside of the United Kingdom which is not covered by regulations made the Secretary of State under section 17A (general processing) or section 74A (law enforcement processing) of the Data Protection Act 2018 giving effect to a finding by the Secretary of State that the specified country ensures an ‘adequate’ level of protection of personal data;

"Services" means the services described in the Agreement and such other services as the Parties may agree in writing from time to time;

"Subject Access Request" means an actual or purported subject access request or notice or complaint from (or on behalf of) a data subject exercising his rights under the Data Protection Legislation;

"Supplier Personnel" means any person employed or engaged by the Company or its Sub-Contractors in connection with the provision of the Services;

"Sub-Contractor" means a third party directly or indirectly contracted to the Company to perform any of the Company's obligations under the Agreement.

In this Schedule (except where the context otherwise requires): (i) any phrase introduced by the terms "including", "include", "in particular" or any similar expression shall be construed as illustrative and the words following any of those terms shall not limit the sense of the words preceding those terms; (ii) use of the singular includes the plural and vice versa; (iii) the words "in writing" and "written" mean "in documented form" whether electronic or hard copy, unless otherwise stated; and (iv) any references to a Party or the Parties are to that party or the parties to the Agreement and include their permitted successors and assigns.

Data protection

The Company acknowledges that for the purposes of the Agreement each Party shall comply with its respective obligations under the Data Protection Legislation. The Parties agree that the Customer shall determine the purposes for which and the manner in which Customer Personal Data shall be processed by the Company on behalf of the Customer.

The contact details of the Customer’s Data Protection Officer are: ### Customer DPO email and telephone number ###

1.2 The contact details of the Company’s Data Protection Officer are: Steven Raith. E: steven.raith@ptfs-europe.com T: 01483 378728 Extn: 1001

The Company shall:

process the Customer Personal Data only to the extent and in such a manner as is necessary for the performance, and duration, of its obligations under the Agreement and in accordance with the written instructions of the Customer, and shall not process the Customer Personal Data for any other purpose save to the extent UK law requires it to process the Customer Personal Data for another purpose;

only allow access to Customer Personal Data to those Supplier Personnel who: (i) are required to assist it in performing its obligations under this Agreement; (ii) have been subject to adequate pre-employment checks; (iii) have undergone appropriate training in the law of data protection; and (iv) are bound (by contract or enactment) by appropriate confidentiality undertakings;

implement and maintain at its cost and expense appropriate technical and organisational measures in relation to the processing of the Customer Personal Data: (i) such that the processing will meet the requirements regarding security set out in the Data Protection Legislation (including, in particular, the measures set out in Article 32(1) of the UK GDPR taking due account of the matters described in Article 32(2) of the UK GDPR), all relevant Customer policies and this Agreement;

not disclose Customer Personal Data to any third party (including a Sub-Contractor) in any circumstances except as required or permitted by this Agreement or with the Customer's prior written consent and provided always that (i) the Company has a contract with such third party on terms which are substantially the same as, and no less onerous than, the terms set out in this Schedule and (ii) notwithstanding any such consent the Company shall remain primarily liable to the Customer for the acts, errors and omissions of such third party and shall be responsible to the Customer for such acts, errors and omissions as if they were the Company's own;

not (and shall not instruct or permit a third party to) transfer the Customer Personal Data to, access the Customer Personal Data from, and/ or process the Customer Personal Data within, a jurisdiction or territory that is a Restricted Country unless it: (i) has first obtained the Customer's prior written consent; and (ii) has put in place measures to ensure the Customer’s compliance with Data Protection Legislation, including entering into, or procuring that the applicable Sub-Contractors enter into, a data transfer agreement with the Customer on terms which provide adequate protection under Data Protection Legislation;

within twenty-four (24) hours, notify the Customer about any actual or suspected breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data, provide the Customer with full assistance in investigating and reporting such breach, and at the Company's cost, implement any measures necessary to restore the security of compromised Customer Data;

assist the Customer to comply with Data Protection Legislation and other applicable law, including promptly forwarding to the Customer any (i) Subject Access Request and (ii) requests for information in relation to the processing of Customer Personal Data from the clients and regulators of the Customer and providing full assistance in complying with such requests; and

without prejudice to the generality of Paragraph 2.2.3 comply with and perform the obligations set out in the Security Schedule at Schedule 3.

The Company shall within thirty (30) calendar days of a request from the Customer, allow its data processing facilities, procedures and documentation to be submitted for scrutiny and inspection by the Customer (and/ or its representatives) in order to ascertain compliance with the terms of this Schedule, and provide reasonable information, assistance and co-operation to the Customer, including access to relevant Supplier Personnel and/ or, on the request of the Customer, provide the Customer with written evidence of its compliance with the requirements of this Schedule.

In the event of a breach by the Company or its Sub-Contractors of this Schedule and/ or their respective obligations under Data Protection Legislation, the Company shall be liable to the Customer for all or any losses incurred by the Customer, or for which the Customer may become liable, in each case to the extent arising as a result of such breach and nothing in the Agreement shall exclude or limit liability under this Paragraph 3.

On expiry or termination of the Agreement for any reason the Company shall immediately cease processing the Customer Personal Data and (at the Customer's option) arrange for the prompt and safe return and/or destruction of all Customer Personal Data.

Notwithstanding anything in the Agreement to the contrary, this Schedule shall continue in full force and effect for so long as the Company processes any Customer Personal Data.

Data to be processed

Subject matter:	eg Provision of Library Management System Catalogue
Duration:	For the life of the provision of the service
Nature and Purpose:	eg Processing of information for data collection, recording, retrieval and storage in the library management system. This will enable library users to have a borrower account so they can borrow books or other items from the library catalogue. The name, staff number, and contact details are essential for libraries to get the right item to the right person who has requested it. Job title and DG are very helpful especially for internal library reporting or statistics, which help libraries monitor their services. Personal data will not be shared with third parties. All data in transit should be carried out in encrypted form and backups should be made to prevent loss of data. Once a library user leaves the Customer, their account will be deleted. If historical connections to loans, holds etc. need to be kept for statistical purposes, they will be anonymized. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include: employment Processing, statutory obligation, recruitment assessment etc]
Types of Personal Data:	eg name, staff number, job title, work address, work email, work telephone number
Sensitive Personal Data:	None
Categories of data subjects:	eg Company staff, temporary staff, student placements

Schedule 3 - Security Schedule

Introduction

The purpose of this schedule is to set out the Company's information security obligations.

The Customer requires that the Company is ISO27001 certified and as a result of this the Company must provide the Services in a manner that is compliant with this standard and enables the Customer to maintain its compliance with this standard.

The Company shall provide:

if ISO27001 certified, a copy of its ISO27001 statement of applicability; or

if not ISO27001 certified, details of how it complies with the information security obligations set out below

within ten (10) Business Days of Customer's request from time to time.

In the event that Paragraph 1.3.1 applies, the Company warrants that it has and shall maintain ISO27001 certification for the duration of this Agreement.

The Customer reserves the right to audit the Company's compliance with ISO27001 on reasonable notice; this may include, subject to appropriate arrangements being in place to ensure confidentiality, instructing a third party to carry out such an audit on the Customer's behalf.

For the purposes of this Schedule, "Data" means Customer Data in paper and/or electronic form which the Company obtains, uses or processes under or in connection with this Agreement and/or any such Customer Data which is held on the systems or equipment of the Company, and "process" includes anything the Company does with the Data, such as storing, deleting or handling it in any way.

Words or expressions defined in the GDPR Schedule shall have the same meaning where used in this Schedule.

Information security policy

The Company shall have a written formal information security policy in place that is applicable to its processing of the Data.

The Company shall supply the Customer with evidence of the information security policy referred to in Paragraph 2.1 above and detail how it applies to the Data.

Human resources

The Company shall ensure that all Supplier Personnel involved in processing Data have been trained on information security and data protection and have signed relevant confidentiality agreements before processing the Data. The Company shall provide the Customer with evidence reasonably required by the Customer to demonstrate compliance with this paragraph.

The Company shall:

take all reasonable steps to ensure reliability of all Supplier Personnel authorised to access the Data, including carrying out appropriate background checks;

include information security responsibilities in the contracts of employment or engagement with all Supplier Personnel;

have in place on-going screening, vetting and security training for all Supplier Personnel; and

remove access rights to the Data and ensure all Customer Data and other assets are returned to the Company on the exit or termination of employment or engagement of any Supplier Personnel.

Access

The Company shall ensure that Supplier Personnel have access only to Data that is necessary for performance of their respective jobs and that access to Data is strictly controlled. The Company shall review such access rights to Data at least twice annually.

The Company shall keep a complete an up to date list of all Supplier Personnel who have access to the Data (the "Access List"). The Customer may request to view the Access List at any time.

The Company shall ensure that where third parties have access to its systems, for the purposes of carrying out essential maintenance, they never have access to any of the Data.

Confidentiality

All Data relating to the Customer's clients, staff and business is confidential, unless it has expressly been designated by the Customer not to be.

Paper-based and electronic Data must be treated with equal care and must not be disclosed to any third party other than in accordance with the confidentiality provisions of the Agreement.

Data transfer

The method of sending and receiving Data between the Parties or between the Company and any third party, if not provided for elsewhere in the Agreement, must be specifically agreed in writing with the Customer in advance.

Once the method of transfer has been agreed for electronic Data in accordance with Paragraph 6.1 (whether that method is email, storage on portable media or any other method) the Data must be encrypted before being transferred outside the Company's organisation. This must be at least 128bit AES encryption or similar.

Data in paper form which is sensitive, confidential or includes Personal Data must be sent by hand or by special delivery 'signed for' post, unless specifically agreed in writing with the Customer in advance.

On termination or expiry of this Agreement the Company shall (at the Customer's option) arrange for the prompt and safe return and/or destruction of all Data.

Physical and environmental security

At the Company's premises

The Company shall ensure that all servers holding Data are kept in secure rooms (the "Secure Environment") with strictly controlled access.

The Company shall ensure that:

all documents and equipment containing the Data are locked in the Secure Environment when the area is unattended;

only authorised Supplier Personnel are entitled to access the Secure Environment;

no Data is available for casual viewing or inspection;

all electronic Data is backed up in case of data loss in accordance with good industry practice or as otherwise provided elsewhere in this Agreement;

Data is printed out only as necessary, retrieved from printers immediately and stored or destroyed in an appropriate manner;

no unauthorised third party has access to the Data or Secure Environment; and

all unused workstations are switched off outside working hours.

Where the provision of any services under the Agreement requires the Company to process Data on the Customer's premises it must never be taken off the premises without the Customer's specific written authorisation. Where the Agreement requires the Company to process the Data on its premises, it must not be taken off those premises without the Customer's specific written authorisation.

At a third party data centre

Where the Data is kept at a third party data centre, the Company shall ensure that the third party has appropriate security provisions in place that replicate those set out in this Schedule.

Controls

The Company shall have in place, in accordance with good industry practice, up-to-date operational and network management controls which are appropriate to the nature of the Data being processed and the harm which might result from unauthorised or unlawful processing or accidental loss, destruction or damage to the Data.

The controls mentioned in Paragraph 8.1 must cover logical access, vulnerability analysis, firewall controls, lifestyle devices controls and remote working.

In addition, the Supplier shall have in place a hierarchy of logical access control mechanisms, which control access to those operations, systems and applications which contain the Data.

All equipment used by the Supplier to access or process the Data must be password protected. The password should be at least nine characters in length, alphanumeric, changed at least every ninety (90) days and unique to each individual.

Incident Management

If the Supplier knows or suspects that there has been a security incident (including but not limited to unauthorised access, denial of service, loss of information or data corruption) which may affect the Data, then the Supplier shall:

inform the Customer immediately;

investigate the cause of the incident; and

remedy the incident as soon as possible.

Business Continuity Management

The Supplier shall provide the Customer with full details of its business continuity policy, including but not limited to the procedures which would protect the Data in the event of a major incident or disaster.

The Supplier shall test its business continuity policy at least once every six months and shall provide the Customer with the results of such testing if requested by the Customer.

Obligations on Supplier Personnel

All Supplier Personnel with access to the Customer Systems must agree to the Customer's Information Security Policy as applicable from time to time (and relevant also to all Customer staff).

The Supplier shall ensure that all Supplier Personnel:

keep passwords secret, do not share them with anyone or keep them where others might find them;

who receive Data intended for another person return it immediately and/or notify the sender. They must not make use of the Data or disclose it to anyone else;

do not store any Data on peripheral devices/portable media (e.g. digital cameras or mobile phones);

do not use their own personal computers for work related activities;

screen-lock their computer prior to leaving it unattended;

logout of their computer when they leave their workstation for any length of time;

switch off their workstation at the end of each working day;

carry laptops and other portable devices as hand luggage when travelling;

do not leave laptops and other portable devices containing Data: unattended in public places; in sight in cars, on public transport or in hotels; on desks overnight; or in vehicles overnight; and

store laptops and other portable devices in locked cupboards/drawers when not in the office or take them home.