Data Processing Terms

How we handle personal data when we work inside your systems.

These terms apply where 64TEQ processes personal data on the Customer's behalf under an Order. They are also published at 64teq.com and apply where the Terms of Business say they do. Terms defined in the UK GDPR have the same meaning here. A sub processor is another processor that 64TEQ engages to process personal data on the Customer's behalf.

Schedule 4 of the 64TEQ Services Agreement, version 2026.1, in use from 18 September 2026, reproduced in full. Written against Article 28 of the UK GDPR, with an interpretation paragraph (1.2) so the same terms work under the Terms of Business. Where it refers to "the agreement" it means the main body of the Services Agreement; clause 17 is the liability clause. Our privacy notice, which covers what we do as a controller with our own contacts and this website, is here.

Data Processing Terms

1. Roles and details of processing

1.1The Customer is the controller and 64TEQ is the processor of the personal data 64TEQ processes in performing the Services. The details of the processing are set out below and may be supplemented in an Order.

1.2Where these terms apply under the Terms of Business rather than this agreement, terms defined in the Terms of Business have the meaning given there and: Order and this agreement mean the Contract under the Terms of Business; Services means the supply and support of the Products, including the use of delegated administrative rights; Charges means the price and other sums payable under the Contract; Standard Rates means 64TEQ's rate card for time and materials work current at the time, available on request; a reference to clause 17 of the agreement means the liability clause of the Terms of Business; Working Hours means 9.00 am to 5.30 pm on a Business Day; the reference to an Early Termination Charge in paragraph 5.2 does not apply; and paragraph 5.2 does not allow the Customer to cancel a Cloud Subscription outside the Cancellation Window.

2. The Customer's obligations

2.1The Customer warrants that its instructions are lawful, that it has the right to give 64TEQ the personal data for processing, that it has given data subjects the information the law requires and that it will not instruct 64TEQ to process special category or criminal offence data except as an Order states.

3. 64TEQ's obligations

3.164TEQ will:

1. 3.1.1process the personal data only on the Customer's documented instructions, which include the Order and this agreement, unless the law requires otherwise, in which case 64TEQ will tell the Customer before processing unless the law prevents it;
2. 3.1.2tell the Customer promptly if, in its opinion, an instruction infringes data protection law;
3. 3.1.3ensure that the people it authorises to process the personal data are bound by confidentiality;
4. 3.1.4implement the technical and organisational measures in paragraph 4.1 and any others agreed in an Order;
5. 3.1.5engage sub processors only in accordance with paragraph 5;
6. 3.1.6transfer personal data outside the United Kingdom only in accordance with paragraph 6.1;
7. 3.1.7taking into account the nature of the processing, assist the Customer with appropriate measures to respond to requests from data subjects;
8. 3.1.8assist the Customer in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to 64TEQ;
9. 3.1.9tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the personal data, and give the Customer the information it reasonably needs to meet its own obligations;
10. 3.1.10delete or return the personal data in accordance with paragraph 8.1; and
11. 3.1.11make available to the Customer the information needed to demonstrate compliance with this Schedule and allow for and contribute to audits under paragraph 7.1.

3.2Assistance under this paragraph beyond what 64TEQ can reasonably provide within the Charges is chargeable at the Standard Rates.

4. Security measures

4.164TEQ will maintain measures appropriate to the risk, including: access control based on least privilege, with multi factor authentication on administrative access; unique accounts for its people and logging of administrative activity; encryption of personal data in transit and, where its tools allow, at rest; secure handling and storage of credentials; vetting and security training of its people; endpoint protection and patching of its own systems; documented incident response; and any certification stated in an Order.

5. Sub processors

5.1The Customer gives 64TEQ general authorisation to engage sub processors and authorises the locations shown below. The sub processors engaged at the date of this agreement are:

Two entries in this table, the remote monitoring tool and the service desk tool used by Next2IT, are being confirmed and will be named here. Paragraph 5.2 applies to any change to this list.

Scroll sideways to see the whole table.

5.264TEQ will tell the Customer in writing at least 30 days before it adds or replaces a sub processor. The Customer may object on reasonable grounds relating to data protection within that period. If the parties cannot resolve the objection within a further 30 days, the Customer may end the affected Order by written notice without paying an Early Termination Charge, or 64TEQ may end it on 60 days' written notice if it cannot provide the Services without the new sub processor. 64TEQ will not use the new sub processor for that Customer before the Order ends.

5.364TEQ will impose on each sub processor data protection obligations that are no less protective than those in this Schedule, and remains responsible to the Customer for the sub processor's performance.

6. International transfers

6.164TEQ will not transfer personal data outside the United Kingdom, or allow a sub processor to, unless the Customer has authorised the transfer (the locations in paragraph 5.1 count as authorisation) and one of the following applies: the destination is covered by adequacy regulations under the UK GDPR; the transfer is made under the International Data Transfer Agreement or the Addendum to the EU standard contractual clauses issued by the Information Commissioner; or the transfer is made under another mechanism the UK GDPR allows. In each case 64TEQ will carry out any risk assessment the law requires.

7. Audit

7.1The Customer, or an auditor it appoints who is bound by confidentiality, may audit 64TEQ's compliance with this Schedule once in any 12 month period at 64TEQ's cost, on at least 30 days' written notice, during Working Hours and in a way that does not disrupt 64TEQ's business or expose other customers' data. 64TEQ will first offer a written response, a recent independent audit report or relevant certifications. Where that evidence does not reasonably answer the Customer's concern, 64TEQ will allow an inspection. A further audit in the same 12 month period may be carried out at the Customer's cost, or at 64TEQ's cost where it follows a personal data breach affecting the Customer's personal data.

8. Deletion and return

8.1When an Order ends, 64TEQ will, at the Customer's choice, return or delete the personal data it holds for that Order within 30 days, and will delete remaining copies, unless the law requires it to keep them. Personal data in backups is deleted in the ordinary cycle of backup rotation and is not accessed in the meantime.

9. Liability

9.1Each party's liability under this Schedule is subject to clause 17 of the agreement.

64TEQ Limited is registered in England and Wales under company number 08353020. Registered office: Berkeley Square House, Second Floor, Berkeley Square, London W1J 6BD. VAT number GB 153 7421 19. 64TEQ® is a registered trade mark.