Parties, scope and priority
This addendum forms part of the Platform Terms between Crown Technology Limited and the business customer identified in the account or agreed order. It applies when we process personal data on your behalf to provide Crown Partners 360. It takes priority over conflicting Platform Terms for that processing. UK GDPR and the Data Protection Act 2018, as amended, and other applicable data-protection law apply. Controller, processor, personal data, processing and personal data breach have their statutory meanings.
You are the controller, or a processor authorised by your controller to appoint us as a further processor. We are your processor or further processor. Processing for our own account administration, security, billing and legal purposes as controller is explained separately in the Privacy Notice.
Processing particulars
Subject matter: the customer’s use of the Crown Partners business procurement-preparation workspace. Duration: the service period and the limited period needed to return or delete information at its end, subject to legally required retention. Nature and purpose: receiving, storing, organising, retrieving, analysing, generating drafts from, displaying, exporting and deleting information to provide the features and support you request. Processing is ongoing during use, with individual AI, export and support operations when requested or authorised.
Data subjects may include your users, employees, contractors, customers, suppliers, advisers and buyer contacts. Data types may include business contact details, roles, professional experience and qualifications, correspondence, and personal information in answers, evidence, tender material and workspace documents. You control the content and must minimise personal information. The service does not require special-category or criminal-offence data; do not provide it unless necessary, lawfully authorised and covered by appropriate instructions and safeguards.
Your obligations and rights include choosing lawful purposes, providing required notices, establishing a lawful basis, minimising data, managing user permissions, issuing lawful instructions, and requesting assistance, return, deletion and compliance information as set out here.
Documented instructions
We will process personal data only on your documented instructions, including instructions about international transfers, unless applicable UK law requires otherwise. In that case we will tell you about the legal requirement before processing unless the law prohibits this on important public-interest grounds. Your agreement, feature selections, permissions and authorised support requests are documented instructions. Additional instructions may be agreed in writing.
We will immediately inform you if, in our opinion, an instruction infringes applicable data-protection law and may pause the affected processing while it is resolved. We will not use personal data entrusted to us as processor for independent advertising or to train our own general-purpose AI model.
Confidentiality and security
We will ensure people authorised to process personal data are bound by confidentiality commitments or an appropriate statutory duty. Access will be limited to what is necessary for their role.
We will implement technical and organisational measures appropriate to the risk as required by Article 32, taking account of the nature of the data, processing, state of the art and implementation costs. Measures include access control and company separation, authentication controls, protected transmission, private-file controls, audit records, backup and recovery arrangements, and procedures to assess and address security risks. The linked Security Overview describes the service controls and their scope. We will maintain appropriate measures as the service changes.
Subprocessors
You give general written authorisation to use the subprocessors identified on the linked Subprocessors and International Transfers page for the listed purposes. Before a new or replacement subprocessor processes your data, we will notify the account owner in writing at least 30 days in advance, giving an opportunity to object on reasonable data-protection grounds. Tell us your objection within that notice period.
We will work with you to address a reasonable objection, including considering an alternative. If it cannot be resolved, you may stop the affected processing or terminate the affected service before the change, with a proportionate refund of unused prepaid fees for that service. A supplier page update alone does not replace the required advance notification.
We will impose on subprocessors contractual data-protection obligations providing the protection required by Article 28, including sufficient security guarantees. We remain responsible to you for the performance of their obligations. Suppliers acting as independent controllers for their own payment or legal purposes are identified separately and are not treated as processors for those purposes.
International transfers
We will make restricted transfers only on your documented instructions and with safeguards required by applicable data-protection law. Depending on the destination, these include UK adequacy regulations or an appropriate transfer agreement, such as the UK IDTA or UK Addendum to standard contractual clauses, together with required transfer assessment and supplementary measures. The linked supplier page describes international processing and provides access to supplier terms. We will provide relevant safeguard information on request, with proportionate redaction to protect confidential information.
Assistance and individual rights
Taking account of the nature of processing, we will assist you through appropriate technical and organisational measures, insofar as possible, to respond to data subjects exercising their rights. If we receive a request concerning data you control, we will notify you promptly and will not respond substantively without your instructions unless law requires it.
Taking account of the processing and information available to us, we will assist with your obligations under Articles 32 to 36, including security, breach response, data-protection impact assessments and prior consultation with a supervisory authority. You remain responsible for decisions and submissions required of you as controller. We will agree any reasonable charges for exceptional assistance in advance; charges will not prevent performance of mandatory duties, and we will not charge for assistance required to remedy our own breach.
Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting data processed on your behalf. We will provide the nature of the breach, affected categories and approximate numbers where known, a contact point, likely consequences, and measures taken or proposed to address and mitigate it. Information may be provided in phases as it becomes available.
We will take reasonable steps to contain and remedy the breach, preserve relevant evidence and cooperate with your response. You decide on notifications to affected individuals and authorities as controller, unless law independently requires us to notify. Notification does not itself constitute an admission of liability.
Return and deletion
At the end of the processing services, at your choice we will return personal data in an available export format or delete it, and delete remaining copies unless UK law requires retention. You can instruct us through the owner’s account controls or enquiries@crownpartners.co.uk. The normal service wind-down and export windows are described in the Data Retention Schedule; these do not remove your right to instruct return or deletion.
Deleted information remaining in protected backups will be put beyond ordinary use and removed through backup replacement or expiry. If a backup is restored, applicable deletion instructions must be reapplied. Any legally retained information will be restricted to the lawful retention purpose and deleted when that requirement ends. We will provide confirmation of completion on request.
Compliance information and audits
We will make available information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by you or an auditor you mandate. Start with a request for relevant documentation. Where further audit is necessary, we will agree reasonable notice, scope and confidentiality arrangements, taking account of urgency and regulatory requirements.
Audits must protect other customers’ information and the security of the service. These arrangements will not obstruct statutory audit rights or a supervisory authority. We will inform you immediately if an audit-related instruction, in our opinion, infringes applicable data-protection law.
Contact and contractual effect
Send processing instructions, breach contacts and compliance requests to enquiries@crownpartners.co.uk. Keep your account owner and incident contact details current. The Platform Terms govern fees, liability and disputes except where this addendum takes priority or law requires otherwise. Nothing here restricts data subjects’ statutory rights or a supervisory authority’s powers.
Organisation details
Crown Technology Limited is a private limited company registered in England and Wales. Company number 17393089. Registered office: 9 Redwood Gardens, Thornton-Cleveleys, England, FY5 5NT. Email: enquiries@crownpartners.co.uk.