Data processing agreement

1. Parties

The controller: the client organisation named on the booking (“you”).
The processor: Innovate Prime Ltd, trading as Innovate Prime Renew, company number 16858556, registered office 66 Surrey Drive, Coventry, CV3 1PL(“we”).

This agreement forms part of our terms of service and applies to every booking you make with us. It is accepted on your behalf by the authorised person named in our records.

2. Details of the processing

• Subject matter: sanitisation or physical destruction of data stored on IT equipment you transfer to us.
• Duration: from collection (or drop-off) until every storage device has been sanitised or destroyed and recorded.
• Nature and purpose: secure transport and storage, erasure using recognised sanitisation methods, verification, physical destruction where required, and record-keeping.
• Types of personal data: any data stored on the equipment. We don't examine it, so it may include any type of personal data, including special category data.
• Data subjects: any individuals whose data is stored on the equipment, such as your staff, customers, pupils or patients.

3. Our obligations

• We process the data only on your documented instructions, which are to sanitise or destroy it as described in this agreement and the booking, unless the law requires otherwise (in which case we'll tell you, unless the law prevents it).
• We don't access, read, copy, keep or use the data for any other purpose.
• Everyone who handles your equipment is bound by confidentiality.
• We take appropriate technical and organisational security measures (section 4).
• We only use another processor with your general authorisation and a written contract giving equivalent protection (section 5).
• We help you respond to requests from individuals exercising their rights, so far as that's possible for data we are destroying.
• We help you meet your security, breach notification and impact assessment obligations.
• When the service ends, the data is destroyed: that is the purpose of the service. We keep only the records described in section 7.
• We give you the information you need to show compliance, and allow reasonable audits on reasonable notice.
• We tell you without undue delay, and within 48 hours of becoming aware, if a personal data breach affects your data.

4. Security measures

• Collection in sealed, numbered containers, with seal numbers and item counts recorded and signed for.
• Equipment stored in secure, access-controlled premises.
• Each device tagged and logged by serial number; every action recorded in an append-only chain-of-custody log.
• Sanitisation matched to the storage technology (overwrite with verification for hard drives; firmware secure erase or sanitize for SSD and NVMe; cryptographic reset for phones and tablets), with the result verified.
• Physical shredding of any drive that fails verification, or on request, with its serial number recorded first.
• No device leaves our care for reuse until its data sanitisation has been recorded.
• Back-office access restricted to named, authorised staff.

5. Other processors

We don't use other processors for the data on your equipment. Equipment we can't reuse goes to an Approved Authorised Treatment Facility only after its storage has been sanitised or destroyed. If we ever need another processor (for example a specialist shredding service), we'll tell you in advance so you can object, and we'll put a written contract in place with them.

6. International transfers

We don't transfer the data on your equipment outside the UK.

7. Records

We keep the chain-of-custody records and certificates (which contain device and drive serial numbers, not the contents of your data) for 6 years, so we can prove how your data was dealt with.

8. Liability and law

Liability under this agreement is governed by our terms of service. This agreement is governed by the law of England and Wales.