Appendix to letter: Terms & Conditions of engagement

Data Protection Agreement (DPA)

We are committed to ensuring the protection of the privacy and security of any personal data which we process. Your attention is drawn to these terms of business which detail how we treat personal data received by us in the provision of our services during our engagement with you. By signing this engagement letter, you confirm that you have read and understood the Data Protection clauses and any privacy notice referred to therein.

  1. Definitions & Interpretation

    • In this DPA, the following definitions apply:
      • Alternative Adequate Level of Protection means (i) the country where the Firm or a Sub-processor is located is recognised by the European Union to have a similar or adequate level of protection of Personal Data as described in Data Protection Laws, or (ii) the Firm or the Sub-processor has fully implemented binding corporate rules which provide adequate safeguards as required by the Data Protection Laws, or has any other similar program that is recognised as providing an adequate level of protection.
      • Appropriate Security Measures means appropriate security measures required by Data Protection Laws to protect against unauthorised access to, alteration, disclosure or destruction of data and against their accidental loss or destruction and, in particular, where the processing involves the transmission of data over a network, it shall mean having regard to the state of technological development and the cost of implementing the measures, and ensuring that the measures provide a level of security appropriate to:
        • the harm that might result from unauthorised or unlawful processing, accidental or unlawful destruction or accidental loss of or damage to the data concerned, and
        • the nature of the data;
      • Client means the Client entity (as identified on the cover page of this letter of engagement) that is a party to the DPA and who is the Data Controller of the Client Personal Data.
      • Client Group means all companies that are part of the Client ownership group.
      • Client Personal Data means personal data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the Client and that is provided to the Firm (being the accounting firm providing the services set out in this engagement letter) or collected by the Firm from the Client for the purpose of the Firm rendering Services to the
      • Data Controller means the Client who, either alone or with others (known as a ‘joint controller’ in Article 21 of the GDPR), controls the contents and use of personal data. Both the Firm and the Client shall each also be considered an independent data controller, and/or joint controllers, in certain circumstances, in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.
      • Data Processor means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller but does not include an employee of the Data Controller who processes such data in the course of his employment.
      • Data Protection Laws means all legislation and regulations relating to the protection of personal data including (without limitation) the Data Protection Acts 1988 to 2018 of Ireland, the General Data Protection Regulation (‘GDPR’) (General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of The Council of 27 April 2016),including the ‘PECR’ and all other industry guidelines (whether statutory or non-statutory) or codes of practice or guidance issued by the Data Protection Commission or relevant Irish Supervisory Authority (as defined in the GDPR) relating to the processing of personal data or privacy or any amendments and re-enactments thereof.
      • Data Subject means the individual who is identified or an identifiable natural person whose Client Personal Data is, or is to be, Processed.
      • The Firm means the Firm entity (as identified below) that is a party to this DPA and who is the Data Processor of the Client Personal Data.
      • The Firm Group means all companies that are part of the Firm company
      • EEA means European Economic Area.
      • Firm means the incorporated or unincorporated accountancy firm that is the processor of the client data. In some circumstances the Firm will also be a data controller and will handle client data in accordance with Data Protection Laws.
      • Loss includes any demand, claim, proceeding, suit, judgement, loss, liability, cost, expense, fee, penalty or fine.
      • Permitted Purpose means the purpose required by the Client from the performance of the Services by the Firm or any Specific Request.
      • ‘PECR’ means the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (SI 336 of 2011).
      • Privacy Statement means the Firm privacy statement located at candor.ie updated from time to time.
      • Process or Processing means any operation or set of operations which is performed upon Client Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. Any derivative of the word Process has a corresponding meaning.
      • Specific Request means any instruction, in email or other form, to the Firm stating the specific services that the Client requires and containing the information required by the Firm to perform those specific Services.
      • Standard Contractual Clauses means the Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in non-adequate countries, as defined under Data Protection Laws.
      • Sub-processor means any Data Processor engaged by the Firm to perform Services.
      • Application of DPA: The provisions of this DPA shall apply to Client Personal Data to which the Firm had access on any date prior to the date of this DPA (the “Prior Date”) as if this DPA had been executed and come into force on the Prior Date and all Client Personal Data to which the Firm has had access since the Prior Date.

  1. Status of the Parties

    • Status: The parties acknowledge that, in relation to Client Personal Data, and for the purposes of the Data Protection law, the Firm is a Data Processor. Both the Firm and the Client shall each also be considered an independent data controller, in certain circumstances, in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.
    • Cooperation: Upon the reasonable request of the other, we shall each co-operate with the other and take such reasonable commercial steps or provide such information as is necessary to enable each of us to comply with the data protection legislation in respect of the services provided to you in accordance with our engagement letter with you in relation to those services;
    • Ownership: As between the Client (the Data Controller) and the Firm (the Data Processor), all Client Personal Data shall at all times be the property of the Client and/or the Client’s Authorised Users, except in the case of audit working papers created by the Firm, while acting as principal, in which case the data is the property of the Firm.

  2. Document Retention

    • It is our policy to retain engagement documentation for a period of seven years, after which time we will commence the process of destroying the contents of our engagement files. To the extent we accumulate any of your original records during the engagement, those documents will be returned to you promptly upon completion of the engagement, and you will provide us with a receipt for the return of such records.
    • The balance of our engagement file, other than the compiled financial statements and corporation tax return submitted, which we will provide to you at the conclusion of the engagement, is our property, and we will provide copies of such documents at our discretion and if compensated for any time and costs associated with the
    • In the event we are required to respond to a subpoena, court order or other legal process for the production of documents and/or testimony relative to information we obtained and/or prepared during the course of this engagement, you agree to compensate us at our standard hourly rates then existing for the time we spend in connection with such response, and to reimburse us for all of our out-of-pocket costs incurred in that
    • In the event that we are or may be obliged to pay any cost, settlement, judgment, fine, penalty, or similar award or sanction as a result of a claim, investigation, or other proceeding instituted by any third party, and if such obligation is or may be a direct or indirect result of any inaccurate or incomplete information that you provide to us during the course of this engagement, you agree to indemnify us, defend us, and hold us harmless as against such

  3. Provision of Client Personal Data

    • The Client will provide Client Personal Data to the Firm or the Firm will collect Client Personal Data from the Client and/or the Client’s Authorised Users pursuant to this DPA for the purpose of the Firm rendering Services to the Client, or any other members of the Client Group, and the Firm will have access to the Client Personal Data provided by the Client in the course of rendering the Services.
    • When the Firm receives the completed and signed Letter of Engagement including this DPA, this DPA becomes a legally binding agreement.

  4. Use of Client Personal Data

    • In providing the Services to the Client pursuant to the letter of engagement, the Firm may Process Client Personal Data on behalf of the The Firm will comply with the provision of this DPA, with respect to the Processing of Personal Data provided or collected by and/or on behalf of the Client using the Services.
    • The Firm shall, as instructed by Client, correct, delete or block the data being Processed under the letter of engagement. If an individual should request the correction or deletion of their data, the Firm shall immediately pass this request to the Such instruction shall not impact the delivery of the agreed services, and delivery failures caused by such instructions will be the Client’s responsibility.

  5. Rights and Obligations of Client

    • The Client is the Data Controller of the Client Personal Data and is responsible for the legitimacy of the Processing of Client Personal Data and any transfer of Client Personal Data to a third party. Data Protection Laws determine the rights and obligations of the Client as a Data Controller as described in this DPA.
    • You shall only disclose client personal data to us where:
      • you have provided the necessary information to the relevant data subjects (your employees) regarding its use (and you may use or refer to our privacy notice available at www.candor.ie;
      • you have a lawful basis upon which to do so, which, in the absence of any other lawful basis, shall be with the relevant data subject’s consent; and
      • you have complied with the necessary requirements under the data protection legislation to enable you to do so.

Should you require any further details regarding our treatment of personal data, please get in touch with your main point of contact in our Firm.

  • As the Data Controller, the Client shall use its right to issue instructions to the Firm, as the Data Processor, on the method of Processing Client Personal Data as well as the services performed by the Firm. The Client’s submission of Personal Data to the Firm and instructions for Processing of Personal Data will comply with Data Protection Laws.
  • The Client has the right, in relation to Client Personal Data, to review:
    • the security measures taken by the Firm;
    • the compliance with Data Protection Laws by the Firm; and
    • the compliance with this Data Processing Agreement by the Firm, at any time during normal working days and normal working hours, subject to notice given in advance with a reasonable notice perio The review may take place at the Firm’s place of business by inspecting the stored Client Personal Data in a storage facility or data centre and the Processing activities taking place at the premises of the Firm in accordance with the Firm’s security and access policies.
  • Data is handled exclusively in accordance with the agreed provisions and in accordance with the Client’s instructions. Any alterations to the data being Processed and the procedures employed will be discussed, agreed and recorded. The Firm may supply information to third parties or individuals only if the Client has given prior written consen
  • The Firm will not use Client Personal Data for any other purposes, in particular, providing such data to third parties. No copies or duplicates of Client Personal Data will be made without the Client’s knowledge and agreement, except when copies must be made for security purposes to ensure that data can be preserved in order to comply with legal requirements.

  1. Rights and Obligations of The Firm

    • The Firm shall only Process Client Personal Data to the extent necessary pursuant to the Client’s instructions and as set forth in the letter of engagement. The Client instructs the Firm to Process Client Personal Data:
      • in accordance with the letter of engagement;
      • as part of any Processing initiated by the Client in its use of the services outlined in this letter; and
      • to comply with the Client’s reasonable instructions to the extent they are consistent with the terms of the letter of engagement.
    • The Firm will conduct the Processing in compliance with Data Protection Laws.
    • The Firm will keep Client Personal Data confidential and ensure Appropriate Security Measures are in place and take appropriate technical, physical and organisational security measures as described in the Privacy Statement to protect Client Personal Data against unauthorised or unlawful Processing, accidental loss or damage or destruction.
    • For the purpose of providing our services to you, pursuant to our engagement letter, we may disclose the client personal data to our regulatory bodies or other third parties (for example, our professional advisors or service providers). [The third parties to whom we disclose such personal data may be located outside of the European Economic Area (EEA).] We will only disclose client personal data to a third party (including a third party outside of the EEA), provided that the transfer is undertaken in compliance with the data protection legislation.
    • The Firm is obliged to provide information and cooperate when the Client conducts a review as described in Section4; however, the Firm shall not be required to disclose any commercial or trade secrets (including, without limitation, algorithms, source codes, etc.). The Firm also will reasonably assist the Client (at the Client’s expense) in the event of data protection checks or audits by a data protection authority, to the extent that such checks or audits relate to the Processing under this DPA.
    • All persons under the Firm’s employ or control who can access Client Personal Data during performing their duties for the Firm must understand the obligations to keep the data confidential and must be bound by an appropriate non-disclosure agreemen The Firm and the Client must instruct their respective employees on their particular data protection obligations arising from this DPA and the existence of their duty to act as directed or for the purpose stipulated.
    • The Firm will promptly inform the Client of any actual or suspected security breach involving Client Personal Da The Firm must take adequate remedial measures immediately and must promptly provide the Client with all the relevant information and assistance as reasonably requested by the Client regarding the actual or suspected security breach.
    • The Firm shall inform the Client as soon as reasonably possible if:
      • a formally designated authority demands the access to Client Personal Data, or
      • a formally designated authority has taken measures against the Firm, unless the Firm is by law prohibited from informing the Client about the request of such authority or the measures taken.
    • The Firm agrees with the Client that for the duration of the provision of the Services it shall only process, use and disclose the Client Personal Data for the Permitted Purpose and strictly in accordance with the instructions of the Data Controller as set out in a Specific Request from time to time and in accordance with the terms of this DPA;
    • The Firm agrees with the Client that for the duration of the provision of the Services it shall not sell, transfer, disclose or allow access to any Client Personal Data to any other party other than those of its officers, employees, agents and contractors to whom, and to the extent to which, such disclosure is necessary for the Permitted Purpose or in accordance with the express approval of the Client;
    • The Firm agrees with the Client that for the duration of the provision of the Services it shall take reasonable steps to ensure that the Client Personal Data is accurately recorded and kept up to date; and
    • The Firm agrees with the Client that for the duration of the provision of the Services it shall not perform the Services in such a way as to cause the Client to breach any of its obligations under the Data Protection Laws.

  2. Additional Requirements for Transfer of Personal Data Outside the EEA

    • The Client acknowledges and agrees that the performance of the Services involves from time to time a transfer of Client Personal Data from the Firm to Sub-Processors located outside the EEA. In respect of such transfers and where no Alternative Level of Protection applies, the Firm shall ensure that in addition to the requirements described in Section 6 of this DPA, certain additional requirements shall be m
    • The additional requirements which must be met pursuant to Section 1 above are incorporated in Standard Contractual Clauses which, where required, must be entered between the Firm and a Sub-Processor.

  3. Sub-Processors

    • The Client acknowledges and expressly agrees that the Firm is entitled to retain any member of the Firm Group (“the Firm Affiliates”) as further sub-processors for the Firm and that the Firm or the Firm Affiliates respectively may engage third-party service providers as sub-processors that may provide Client support, including processing of Client Personal Data, in connection with the Services.
    • Sub-processors. The Firm shall make available to the Client for the Client’s approval a current list of sub-processors for the Services with the identities of those Sub-processors (“Sub-processor List”) (such approval not to be unreasonably delayed or withheld). This shall be done prior to the Firm authorising those sub-contractors to Process Personal Data supplied by the Client.
    • Objection Right for new Sub-processors. If the Client has a reasonable basis to object to the Firm’s use of a new Sub-processor, the Client shall notify the Firm promptly in writing within 10 business days after receipt of the Firm’s notice. In the event the Client objects to a new Sub-processor(s) and that objection is not unreasonable, the Firm will use reasonable efforts to make available to the Client a change in the affected Services or recommend a commercially reasonable change to the Client’s configuration or use of the affected Services to avoid processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If the Firm is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, the Client may terminate the applicable Service(s) in respect only to those Services which cannot be provided by the Firm without the use of the objected-to new Sub-processor, by providing written notice to the Client. The Client shall receive a refund of any prepaid fees for the period following the effective date of termination in respect of such terminated Services.
    • All Sub-processors will be subject to data protection obligations at least equivalent to those contained in this DPA under a written agreement, and such sub-processors shall be obliged to comply with applicable Data Protection Laws. Where the Sub-processor fails to fulfil its data protection obligations under such written agreement The Firm shall remain fully liable to the Client for the performance of the sub- processor’s obligations under such agreemen
    • The Firm shall audit third-party sub-processors that are not the Firm Affiliates at least once per year to ensure they have appropriate physical, technical, organisational, and administrative controls in plac Upon the Client’s reasonable request at reasonable intervals, the Firm shall provide the Client with an executive summary of the most recent audits of such third-party sub-processors.
    • Upon the Client’s request, the Firm agrees to promptly make available to the Client a copy of an applicable sub-processor data processing agreement executed in relation to this DPA, provided that the Firm may remove any commercial information contained in such agreeme The Client may make available a summary of the agreement, or the agreement if required, to the Client provided that such summary, or the agreement if required, is treated as Confidential Information, including that the Client has entered into a non-disclosure agreement containing confidentiality provisions substantially similar to those set forth in the letter of engagement to protect the Firm’s Confidential Information.

  4. Security

    • The Firm shall implement Appropriate Security Measures with a view to preventing accidental or unauthorised, loss, destruction, damage, alteration, disclosure or unlawful or unauthorised access to any Client Personal Data in the custody of the Firm, and the Firm shall ensure that its personnel are aware of and comply with those measures. This will include but is not limited to maintaining commercially reasonable and appropriate security measures, including administrative, physical and technical safeguards, to protect against unauthorised or unlawful processing of the client personal data and against accidental loss or destruction of, or damage to, the client personal data.

  5. Breach

    • Notice: The Firm shall notify all incidents of loss of control of Client Personal Data to the Client, as soon as it becomes aware of the incident and in any event no later than 72 hours after so becoming aware.
    • Remedy: In the event of any such breach, the Firm shall:
      • take prompt action at its own expense on the instruction of the Client to remedy the cause of the breach;
      • bear the costs of investigation into said breach; and
      • promptly, and at its own expense provide the Client on request with all information required by the Client to fulfil its obligations, as data controller, under all applicable laws, regulations and codes of practice.

  1.  Data Subject Requests

    • The Firm shall promptly notify the Client of each request from a data subject for access to Client Personal Data relating to him or her. The Firm shall not accede to any such request for access except on the instructions of the Client.

  2. Indemnity

    • The Client shall indemnify the Firm on demand from time to time from and against all Losses suffered or incurred by the Firm arising out of or in connection with the breach by the Client of its obligations under this DPA. The provision of this Clause shall continue in force and effect without limit in time after the termination of the provision of the Services.

  3. Duration

    • This DPA will enter into effect on the Effective Date and will remain effective notwithstanding termination of the letter of engagement. Where Client Personal Data is no longer required by the Firm for the performance of the Services, the Firm will either return such data immediately after termination of the letter of engagement or destroy it if requested to do so by the At such time when Client Personal Data is either returned or destroyed, this DPA will expire automatically.
    • To the extent required by applicable Data Protection Laws, this DPA shall be governed by the applicable law of the applicable jurisdiction. In other cases, this DPA will be governed by the laws of the same jurisdiction in the letter of engagement.

  4. Conflicting Provisions

    • The DPA supersedes any conflicting terms in the letter of engagement. Notwithstanding the foregoing, the letter of engagement and the terms of this DPA apply only between the parties and do not confer any rights to any third-party Data Subjects.
    • This DPA does not replace any additional rights or obligations related to processing of Client Data in the letter of engagement.

  5. Notices

    • The parties will send any communications or notices required under this DPA in writing, which includes by e-mail, to the address of the Firm shown on the covering letter attached to this agreement.
Download Privacy/Data Protection Agreement (DPA) .PDF