DSAR Services Terms & Conditions

Introduction

These Terms and Conditions explain how we provide our services and calculate our fees. We are committed to delivering expert, cost-effective data protection solutions tailored to your needs.

Once we accept your instructions, we will provide a Client Agreement. Please read these Terms alongside that Agreement, as together they form our contract with you.

Definitions

In these Terms:

Additional Services: Any additional tasks which we may agree on in writing from time to time.
Agreed DSAR Notification Response Service Elements: The agreed DSAR notification response service elements as set out in the Client Agreement.
Agreement: The agreement between us and you, which shall be deemed to incorporate these Terms and the terms of any individual Client Agreement.
Applicable Laws: To the extent applicable, UK Data Protection Laws and EU Data Protection Laws.
Business Day: A day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.
Client Agreement: Our document or other communication to you headed “Client Agreement”, setting out the basis on which we will work with you in relation to our Services.
Client Materials: All documents, information, items and materials in any form, whether owned by you or a third party, which are provided by you to us in connection with the Services and any Additional Services.
Client Personal Data: Any Personal Data processed by us on your behalf pursuant to, or in connection with, the provision of the Services and any Additional Services.
Data Protection Laws: To the extent applicable, UK Data Protection Laws, EU Data Protection Laws and, where relevant, the data protection or privacy laws of any other country.
DSAR: Data Subject Access Request.
EEA: The European Economic Area.
EU Data Protection Laws: The law of the European Union or any member state of the European Union to which you are subject, which relates to the protection of personal data, as amended, replaced or superseded from time to time.
EU GDPR: The General Data Protection Regulation ((EU) 2016/679).
GDPR: The UK GDPR or the EU GDPR, whichever is applicable.
Instructions: The processing activities you are requesting that we provide as part of the Services and/or Additional Services.
Lead DPO: The data protection officer assigned to you by us to act as lead data protection officer in respect of the Services.
Response Officer(s): The person or persons assigned to you by us to assist the Lead DPO in respect of the Services.
Response Rates: The rates applicable to the Services as set out in the Client Agreement.
Response Service Elements: The meaning given in the Client Agreement.
Services: The Data Subject Access Request response services detailed in these Terms and the Client Agreement to be supplied by us, including, for the avoidance of doubt, any Additional Services.
Sub-processor: Any person, other than an employee of us, appointed by us or on our behalf to process Client Personal Data.
UK Data Protection Laws: Any data protection legislation from time to time in force in the UK, including the Data Protection Act 2018, as amended, replaced or superseded from time to time.
UK GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
Us, we, our: True North Data Governance and Compliance Consultancy Ltd, whose primary place of business is Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, and includes, where relevant, our employees, agents, representatives and third-party suppliers.
You, your: You, the client, as detailed in the Client Agreement.

The terms Commission, Controller, Data Subject, Member State, Personal Data, Personal Data Breach, Processing and Supervisory Authority shall have the same meanings as in the GDPR.

Where the UK GDPR is applicable to this Agreement, a reference to “Supervisory Authority” shall mean a reference to “the Commissioner” pursuant to the UK GDPR.

Our Services

When we are instructed to act for you, we will issue a Client Agreement detailing the specific services, deliverables and fees.

The Client Agreement must be read alongside these Terms and, together, they form our complete contract.

In the event of any conflict or inconsistency between these Terms and the specific Client Agreement, the terms of the Client Agreement shall take precedence.

Our Agreement officially begins on the date you provide written confirmation of the details and fees set out in the Client Agreement (the Commencement Date).

We will perform the Services as instructed in our Client Agreement. All quoted prices and schedules are estimates and may be adjusted if the scope of work changes or if additional tasks are requested.

We will always confirm significant variations with you in writing.

Responsibilities

We will carry out the Agreement according to your instructions, noting that all dates and prices are estimates and may change depending on your requests.

To receive assistance, you must send a DSAR Notification and any relevant correspondence to
dsar@tndg.co.uk
or another address we provide to you in writing.

We will contact you within two Business Days of receipt to acknowledge your notification and arrange an initial call to discuss the service requirements.

Our responsibilities

Professional Skill:
We are responsible for delivering Services with reasonable skill and care and in accordance with established professional standards.

Timelines:
While we will agree timescales before starting, dates are generally estimates and “time is not of the essence” unless otherwise agreed in writing.

Regulatory Urgency:
For matters involving Personal Data Breaches, time is of the essence when we are liaising with supervisory authorities such as the Information Commissioner’s Office (ICO).

We provide specialist consultancy, regulatory guidance and guidance on legal frameworks as an unregulated provider.

We are not solicitors and are not regulated by the Solicitors Regulation Authority (SRA). Our Services do not include “reserved legal activities”, as defined by the Legal Services Act 2007, such as the conduct of litigation or the preparation of court documents.

Our professional relationship is that of Consultant and Client. Advice is therefore not subject to legal professional privilege, and there is no client compensation fund or access to the Legal Ombudsman.

Your responsibilities

Support and Cooperation:
You must support us by providing the resources, cooperation and information necessary for the Services. This includes ensuring that all information provided is complete and accurate.

Access to Data:
You must provide timely access, at no charge to us, to your Personal Data, processing operations, premises and facilities where reasonably required.

Administrative Duties:
You are responsible for making payments within the stated terms and arriving on time for all planned meetings or events.

Mitigation of Delay:
If our performance is delayed or prevented by your actions, or those of your agents or suppliers, we are not liable for any resulting costs or losses.

Confidential Information

During this Agreement, we may share confidential information with each other. This could include technical details, business plans or personal information relating to customers, suppliers or employees.

Both parties agree to keep this information confidential, not disclose it to third parties, and use it only to carry out their responsibilities under this Agreement, unless disclosure is required by law or by a court.

Information will not be treated as confidential if it is already publicly available, becomes public through no fault of the receiving party, or is lawfully received from another party without any duty of confidentiality.

We may refer to the fact that we are working together and the general type of Services being provided, but only with each other’s permission.

We will comply with all applicable Data Protection Laws when storing and processing any Personal Data you provide to us.

Fees and Charges

Our fees for Data Subject Access Request (DSAR) response Services are calculated according to the rates specified in your Client Agreement.

External costs are excluded unless otherwise agreed and will be invoiced separately at cost.

We maintain a digital record of all time spent managing your DSARs and reserve the right to charge for reasonable, evidenced expenses incurred while fulfilling our obligations, such as secure data transfer charges or postage.

These expenses will be approved by you in writing in advance unless urgent circumstances prevent us from obtaining prior approval despite reasonable efforts.

You will receive at least 90 days’ written notice before any increase to our standard rates takes effect.

If a DSAR response is delayed by you or one of your third-party suppliers – for example, because of a delay in extracting or providing the raw data required for redaction – we reserve the right to charge for additional time required to manage rescheduling and any necessary regulatory deadline communications, regardless of any initial fixed estimate.

All fees are subject to applicable UK taxation. VAT will only be charged if our turnover exceeds the applicable VAT registration threshold.

Cancellation and Rescheduling

We reserve specific time in our schedule to deliver your consultancy services. If you need to cancel or postpone a scheduled session, the following provisions apply:

Virtual or Remote Meetings:
No fee will be charged if written notice is received at least 2 Business Days before the scheduled time.
On-site or Full-Day Sessions:
No fee will be charged if written notice is received at least 5 Business Days before the scheduled time.
Late Cancellation:
If notice is received later than the periods stated above, we reserve the right to charge 50% of the scheduled fee.

Where possible, we will endeavour to use the allocated time to progress other tasks on your behalf in order to minimise any loss to your project.

Billing and Payment Terms

To ensure consistent service delivery, we apply the following payment structures based on the total value of the Client Agreement:

Projects up to £2,500

A fee equal to 100% of the total cost will be invoiced upon signing the Client Agreement. Work will commence once payment is received.

Projects from £2,501 to £7,500

Payment is due in two stages. 50% of the total fee is invoiced upon signing and is payable immediately.

The remaining 50% is due upon completion of the project or 6 months from the Commencement Date, whichever is sooner.

Projects over £7,501

Payment is due in three stages:

40% upon signing the Client Agreement;
30% at the project midpoint; and
30% upon completion.

Standard Terms:
Unless otherwise agreed in the Client Agreement, our standard payment terms are 14 days from the date of invoice.

Payment Method:
Payments should be made by direct bank transfer to the account details shown on our invoices.

Project Stalls:
Where we have submitted work for your comment or approval, we request a response within 14 days. After this period, we reserve the right to invoice any remaining balance due for that stage of work.

Late Payment:
In accordance with the Late Payment of Commercial Debts (Interest) Act 1998, we reserve the right to charge interest on overdue amounts and suspend all Services until the account is settled.

Invoice Queries:
Any queries regarding an invoice must be submitted in writing within 7 days of the invoice date.

Notices

All important communications relating to this Agreement must be in writing. They may be delivered by hand, email or first-class post using the contact details provided by each party.

A notice will be considered received:

By hand: when it is delivered.
By email: when it is sent, unless the sender receives an error message.
By post: two working days after posting within the UK, or five working days after posting internationally.

If a notice arrives after 5:00 pm, it will be treated as received on the next working day.

If either party changes its contact details, it must notify the other party in writing. The new details will take effect on the date stated in the notice or, if no date is given, five working days after the notice is sent.

Intellectual Property

You may use the materials we create for you for the purpose for which they were prepared.

We retain ownership of all copyright and intellectual property rights in documents, reports, advice and other materials we provide, unless otherwise agreed in writing.

If you wish to use those materials for a different purpose, you will require our written permission.

Any content we create specifically for you and which relates solely to your business will belong to you once it has been delivered.

You retain ownership of all intellectual property rights in materials you provide to us. You grant us permission to use those materials while working with you solely for the purpose of providing the agreed Services.

Personal Data and Data Protection

If we process Personal Data on your behalf as part of our Services, we will comply with all applicable Data Protection Laws, including the UK GDPR.

We will only process Personal Data in accordance with your instructions and as necessary to provide the agreed Services.

You confirm that you have a lawful basis for sharing Personal Data with us and that the information provided is accurate and up to date.

We will keep Personal Data secure and confidential and will only share it with trusted third parties, including subcontractors, where necessary to provide the Services.

Where we appoint such third parties, we will ensure that they are subject to appropriate data protection obligations.

We will not transfer Personal Data outside the UK or EEA unless appropriate safeguards are in place.

If there is a Personal Data Breach affecting Personal Data processed by us on your behalf, we will notify you promptly and work with you to address it.

You remain responsible for informing individuals about how their Personal Data will be used and for responding to requests from those individuals. We will provide reasonable assistance where required.

For further information about how we handle Personal Data, please see our Privacy Notice.

Document Storage and Retention

We may store your documents electronically.

You should retain all documents relating to the work we undertake for you, including emails and other electronic data.

If this Agreement ends while amounts remain outstanding, we may retain your documents until payment is received.

We will retain our files for at least six years after the Agreement ends, or for a longer period if we notify you in writing. After this period, files may be securely destroyed without further notice.

Termination of this Agreement

This Agreement starts on the Commencement Date and will continue until the Services have been completed, the Agreement is terminated in accordance with these Terms, or any applicable drawdown arrangement expires.

You may end this Agreement at any time by providing written notice.

If you do so, all outstanding payments, including payment relating to unused contracted time, will become immediately payable and we will have no further obligation to provide Services.

Either party may terminate this Agreement immediately by written notice if the other party commits a serious breach and fails to remedy that breach within 30 days of being requested to do so.

We may also terminate this Agreement immediately if you:

cease or threaten to cease trading;
become insolvent;
make arrangements with creditors; or
persistently breach this Agreement.

The Agreement may also be terminated at any time by mutual written consent.

If we are unable to complete the Services for reasons caused by you and this continues for more than three months after we notify you, we may terminate the Agreement.

In that case, all outstanding payments, including unused contracted time, will become immediately payable.

When this Agreement ends, our obligations to provide Services will cease. You must return any property or documents belonging to us on request or by the termination date, unless the law requires you to retain them.

Limitation of Liability

Neither party shall be liable to the other for any indirect or consequential loss or damage, including but not limited to:

loss of profits;
loss of contracts;
loss of reputation or goodwill;
increased costs of working; or
claims made by third parties.

To the fullest extent permitted by law, and except as expressly stated in this Agreement, we shall not be liable, whether in contract, tort (including negligence) or otherwise, for any loss arising from any person acting or failing to act in reliance on advice, information or materials provided as part of the Services or Additional Services, whether given orally or in writing.

We shall also not be liable for loss resulting from any failure to ensure that a document or form generated from the Services is appropriate or complete for its intended purpose.

Nothing in this Agreement shall limit or exclude liability for death or personal injury caused by negligence.

Subject to this, the total liability of either party under this Agreement shall not exceed the total fees paid under this Agreement or £10,000, whichever is lower.

Force Majeure

If an event occurs that is outside either party’s reasonable control, including war, fire, pandemic, epidemic, industrial disputes or civil unrest, the affected party must notify the other.

While the event continues, the affected party’s obligations under this Agreement will be suspended until it notifies the other party that the event has ended.

Dispute Resolution

If there is any disagreement concerning the meaning or effect of this Agreement, or any dispute connected with it, both parties will first attempt to resolve the matter through discussion and negotiation.

This does not apply to payments which are due under the Agreement.

Where a dispute arises, both parties agree to make reasonable efforts to resolve it amicably before considering legal proceedings, including consideration of mediation where appropriate.

Legal Status

Our relationship is that of independent contractor and client, not employer and employee.

This Agreement is non-exclusive and either party may work with other businesses.

Nothing in this Agreement creates a partnership or joint venture and neither party may make commitments or enter into agreements on behalf of the other unless expressly permitted by this Agreement.

General

This Agreement constitutes the entire agreement between us and overrides any other terms contained in your documents.

If any provision is found by a court to be invalid or unenforceable, the remaining provisions will continue in effect.

The Agreement may only be amended in writing and signed by both parties.

If either party does not enforce a provision at any particular time, this does not constitute a waiver of its right to enforce that provision later.

You may not transfer this Agreement or your rights under it without our prior written consent.

No person other than you and us shall have any rights under this Agreement pursuant to the Contracts (Rights of Third Parties) Act 1999.

Applicable Law and Jurisdiction

Our relationship with you will be governed by English law and shall be subject to the exclusive jurisdiction of the English courts.

Acceptance of Terms

To confirm that you wish us to proceed and that you accept these Terms and Conditions, please print, sign and date a copy of the Client Agreement and return it to us.

This confirms the agreed fees and limits your right to challenge the agreed terms or rates at a later date.

If you do not return the signed Agreement within 5 Business Days but we begin work, you will be treated as having accepted these Terms and Conditions unless you terminate the Agreement in writing or we cease acting for you.

If anything in this Agreement is unclear, please contact us.

Company Details

True North Data Governance and Compliance Consultancy Ltd
Lytchett House
13 Freeland Park
Wareham Road
Poole
Dorset
BH16 6FA

Terms & Conditions – DSARs