Clinked Data Processing Agreement
Last Updated: 27 October 2026
1. INTRODUCTION AND SCOPE
This Data Processing Agreement (“DPA”) forms part of the agreement between Rabbitsoft Ltd, trading as Clinked (“Processor”), and the Customer (“Controller”) concerning the processing of personal data in connection with the Clinked Service.
This DPA applies where Rabbitsoft processes personal data on behalf of the Customer and the relevant processing is subject to applicable data protection legislation.
Where the Customer acts as a processor on behalf of another controller, the provisions of this DPA apply with appropriate adjustments to the parties’ respective roles.
In the event of a conflict between this DPA and the Terms of Service concerning the processing of Customer Personal Data, this DPA prevails.
2. DEFINITIONS
Applicable Data Protection Laws means applicable privacy and data protection legislation, including the UK GDPR, the Data Protection Act 2018, the EU GDPR and applicable US state privacy laws to the extent relevant to the processing.
Controller means the entity determining the purposes and means of processing personal data.
Processor means the entity processing personal data on behalf of a Controller.
Customer Personal Data means personal data processed by Rabbitsoft on behalf of the Customer through the Service.
Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Subprocessor means a third party engaged by Rabbitsoft to process Customer Personal Data on its behalf.
Standard Contractual Clauses means the applicable contractual clauses approved by the relevant authority for international personal data transfers.
Terms not otherwise defined have the meanings given in applicable data protection legislation.
3. PROCESSING INSTRUCTIONS
3.1 Rabbitsoft shall process Customer Personal Data only on documented instructions from the Customer, unless otherwise required by applicable law.
3.2 Documented instructions include these Terms, the DPA, the applicable Order Form and instructions issued through authorised Service functionality.
3.3 Rabbitsoft shall inform the Customer where legally permissible if an instruction appears to infringe applicable data protection law.
3.4 The Customer is responsible for ensuring that its processing instructions are lawful.
3.5 Rabbitsoft shall not use Customer Personal Data for unrelated advertising, sale or independent commercial exploitation.
4. CONTROLLER RESPONSIBILITIES
4.1 The Customer is responsible for determining the lawful basis for processing Customer Personal Data.
4.2 The Customer is responsible for providing required privacy notices and obtaining any necessary authorisations.
4.3 The Customer is responsible for the accuracy, legality and appropriateness of personal data submitted to the Service.
4.4 The Customer is responsible for configuring access permissions and determining which authorised users may access Customer Personal Data.
4.5 The Customer must not instruct Rabbitsoft to process personal data unlawfully.
5. CONFIDENTIALITY
5.1 Rabbitsoft shall ensure that personnel authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.
5.2 Access shall be limited to personnel who reasonably require it to provide, maintain, secure or support the Service.
5.3 Rabbitsoft shall take reasonable measures to ensure that authorised personnel receive appropriate data protection and security guidance.
6. SECURITY
6.1 Rabbitsoft shall implement appropriate technical and organisational measures to protect Customer Personal Data.
6.2 Measures shall take account of the nature, scope, context and purposes of processing and relevant risks.
6.3 Such measures may include, where appropriate:
(a) Access controls.
(b) Authentication and authorisation mechanisms.
(c) Encryption in transit and at rest.
(d) Logging and monitoring.
(e) Backup and recovery procedures.
(f) Vulnerability management.
(g) Security incident response.
(h) Personnel security measures.
(i) Subprocessor security assessments.
6.4 The specific measures maintained by Rabbitsoft shall be described in the applicable security documentation and Schedule 2.
6.5 Rabbitsoft may update security measures provided that such changes do not materially reduce the overall level of protection.
7. SUBPROCESSORS
7.1 The Customer grants Rabbitsoft general authorisation to engage Subprocessors for the provision of the Service.
7.2 Rabbitsoft shall maintain an up-to-date list of relevant Subprocessors.
7.3 Rabbitsoft shall provide at least ten (10) business days’ advance notice of intended additions or replacements of Subprocessors, unless urgent changes are reasonably necessary for security or continuity.
7.4 Customers may object in writing during the notification period on reasonable data protection grounds.
7.5 Rabbitsoft shall consider reasonable objections and seek commercially reasonable alternatives where practicable.
7.6 Where no reasonable alternative is available, the parties shall discuss appropriate arrangements, including termination of the affected services where necessary.
7.7 Rabbitsoft shall impose appropriate contractual data protection obligations on its Subprocessors.
7.8 Rabbitsoft remains responsible for the performance of its Subprocessors’ relevant data protection obligations as required by applicable law.
8. INTERNATIONAL DATA TRANSFERS
8.1 Rabbitsoft shall ensure that international transfers of Customer Personal Data comply with applicable data protection legislation.
8.2 Where required, appropriate safeguards may include:
(a) EU Standard Contractual Clauses.
(b) The UK International Data Transfer Agreement.
(c) The UK Addendum to EU Standard Contractual Clauses.
(d) Applicable adequacy decisions or regulations.
(e) Other legally recognised mechanisms.
8.3 Where EU Standard Contractual Clauses apply, the parties shall identify the appropriate module and complete the required annexes.
8.4 Where UK transfer instruments apply, the relevant tables, appendices and supplementary information must be completed.
8.5 Rabbitsoft shall implement supplementary measures where required by applicable law and the relevant transfer assessment.
9. DATA SUBJECT RIGHTS
9.1 Rabbitsoft shall provide reasonable assistance to the Customer in responding to data subject requests, taking into account the nature of the processing and information available to Rabbitsoft.
9.2 Where Rabbitsoft receives a request concerning Customer Personal Data, it shall ordinarily refer the requester to the relevant Customer or notify the Customer, unless prohibited by law.
9.3 Rabbitsoft shall not independently determine the merits of requests concerning Customer-controlled personal data except where legally required.
9.4 Reasonable assistance may be subject to agreed charges where permitted by applicable law.
10. PERSONAL DATA BREACHES
10.1 Rabbitsoft shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
10.2 Notification shall include available information reasonably necessary to assist the Customer in assessing its legal obligations.
10.3 Rabbitsoft may provide information in stages as its investigation progresses.
10.4 Rabbitsoft shall take reasonable steps to investigate, contain and remediate incidents within its control.
10.5 Rabbitsoft shall provide reasonable assistance with legally required notifications to supervisory authorities and affected individuals.
10.6 Notification of an incident does not, by itself, constitute an admission of liability.
11. DATA PROTECTION IMPACT ASSESSMENTS
11.1 Rabbitsoft shall provide reasonable assistance with data protection impact assessments and relevant regulatory consultations where required by applicable law.
11.2 Assistance shall take account of the nature of processing and information available to Rabbitsoft.
11.3 Where permitted by law, Rabbitsoft may charge reasonable fees for assistance beyond its standard contractual obligations.
12. AUDITS AND COMPLIANCE INFORMATION
12.1 Rabbitsoft shall make available information reasonably necessary to demonstrate compliance with applicable processor obligations.
12.2 Rabbitsoft may satisfy routine audit requests through relevant security documentation, independent assessments or certifications where sufficient.
12.3 Where additional inspection is legally required, the parties shall agree reasonable arrangements concerning scope, confidentiality, security and timing.
12.4 Audits must not unreasonably interfere with Rabbitsoft’s operations or compromise the security or confidentiality of other customers.
12.5 Audit costs shall be allocated in accordance with applicable law and any separately agreed terms.
13. RETURN AND DELETION OF PERSONAL DATA
13.1 Following termination of the relevant services, Rabbitsoft shall, at the Customer’s choice, return or delete Customer Personal Data in accordance with applicable data protection law.
13.2 Rabbitsoft may retain information where required by applicable law.
13.3 Data contained in backups may remain until deletion under the applicable backup retention schedule, subject to appropriate security protections and restrictions on further processing.
13.4 The Customer is responsible for requesting and completing available data exports within the applicable contractual retrieval period.
13.5 Rabbitsoft shall provide information about its applicable data retrieval and deletion procedures.
14. US STATE PRIVACY REQUIREMENTS
14.1 Where applicable US state privacy laws govern processing under this DPA, Rabbitsoft shall act as a processor or service provider to the extent required by those laws.
14.2 Rabbitsoft shall process Customer Personal Data for the limited business purposes described in the agreement.
14.3 Rabbitsoft shall not sell Customer Personal Data or share it for cross-context behavioural advertising in its capacity as a processor or service provider.
14.4 Rabbitsoft shall not retain, use or disclose Customer Personal Data outside the permitted purposes except as authorised by applicable law.
14.5 Rabbitsoft shall provide reasonable assistance with applicable consumer rights requests and compliance obligations.
14.6 Where a particular US state requires additional contractual provisions, the parties shall incorporate an appropriate state-specific addendum.
15. LIABILITY
15.1 Liability arising under this DPA is subject to Section 18 (Limitation of Liability) of the Clinked Terms of Service, except where prohibited by applicable law.
15.2 Subject to liabilities that cannot lawfully be limited or excluded, Rabbitsoft’s aggregate contractual liability arising under or in connection with this DPA, together with all other claims arising under or in connection with the applicable Customer agreement, shall be subject to the single aggregate liability cap of one thousand pounds sterling (£1,000) set out in Section 18.3 of the Terms of Service.
15.3 The liability cap shall not operate separately for this DPA and the Terms of Service. Claims under both documents shall be aggregated for the purposes of the applicable cap.
15.4 Where Rabbitsoft and an Enterprise Customer have expressly agreed to a different liability cap or liability arrangement in a written Enterprise Order Form, Master Services Agreement or other individually negotiated agreement signed by authorised representatives of both parties, that alternative arrangement shall apply to the extent expressly stated.
15.5 Nothing in this DPA excludes or restricts liability that cannot lawfully be excluded or restricted.
15.6 The parties acknowledge that statutory responsibilities to supervisory authorities and data subjects may apply independently of contractual liability limitations.
16. TERM AND TERMINATION
16.1 This DPA remains effective for as long as Rabbitsoft processes Customer Personal Data on behalf of the Customer.
16.2 Obligations relating to confidentiality, deletion, retained information and other matters intended to survive termination shall continue for the applicable period.
SCHEDULE 1 — DETAILS OF PROCESSING
Subject Matter: Provision of the Clinked platform and associated services.
Duration: During the relevant subscription and any applicable post-termination processing period.
Nature of Processing: Collection, storage, organisation, retrieval, transmission, access management, modification and deletion.
Purposes: Providing and supporting the Service according to Customer instructions.
Categories of Data Subjects: Customer personnel, authorised users, clients, contractors, business contacts and other individuals whose data the Customer uploads.
Categories of Personal Data: Names, contact information, account details, business information, uploaded documents, communications, identifiers, metadata and other information determined by the Customer.
Special Category Data: May be processed where uploaded by the Customer, subject to applicable law and the Customer’s responsibilities.
SCHEDULE 2 — TECHNICAL AND ORGANISATIONAL MEASURES
Rabbitsoft shall maintain technical and organisational security measures appropriate to the Service and relevant risks.
The measures shall address, as applicable:
(a) Access management and authentication.
(b) Encryption.
(c) Infrastructure and network security.
(d) Logging and monitoring.
(e) Backup and recovery.
(f) Vulnerability management.
(g) Incident response.
(h) Personnel security.
(i) Subprocessor oversight.
(j) Business continuity.
The detailed technical and organisational measures applicable to the Service shall be documented and maintained by Rabbitsoft and made available as required under applicable data protection law and this DPA.
SCHEDULE 3 — SUBPROCESSORS
Rabbitsoft shall maintain a current list of authorised Subprocessors.
The list shall identify, where applicable:
(a) Subprocessor name.
(b) Processing location.
(c) Services provided.
(d) Categories of personal data processed.
(e) Applicable international transfer safeguards.
Rabbitsoft shall make the current list available to Customers through an appropriate published or contractual mechanism.
SCHEDULE 4 — INTERNATIONAL TRANSFER INSTRUMENTS
Where required by applicable data protection law, the relevant completed EU Standard Contractual Clauses, UK Addendum or UK International Data Transfer Agreement shall be incorporated into this DPA.
The applicable instruments shall identify the relevant parties, processing activities, transfer arrangements and technical and organisational measures.
The parties shall complete any required annexes, tables or supplementary information before relying on the relevant instrument as a transfer mechanism.