Our legal and compliance policies

This Data Processing Addendum ("DPA") forms part of the Motina Terms of Service or other agreement governing a customer's use of Motina (the "Agreement").

It applies where Yoghurt Pot Limited, trading as Motina ("Motina", "Processor", "we", "us" or "our"), processes Personal Data on behalf of a customer using Motina ("Customer" or "Controller").

Yoghurt Pot Limited is a company registered in England and Wales under company number 12105928, with its registered office at 45 Tameside, Stokesley, TS9 5PE, United Kingdom.

By using Motina in circumstances where Motina processes Personal Data on your behalf, the parties agree to this DPA.

1. Definitions

For this DPA:

Applicable Data Protection Law means privacy and data-protection law applicable to the processing of Customer Personal Data under the Agreement, including, where applicable:

• the UK General Data Protection Regulation ("UK GDPR");
• the Data Protection Act 2018;
• the EU General Data Protection Regulation ("EU GDPR");
• applicable UK or European electronic communications and tracking laws;
• the California Consumer Privacy Act, as amended ("CCPA"); and
• other applicable privacy or data-protection laws.

Customer Personal Data means Personal Data processed by Motina on behalf of Customer in connection with providing the Service.

It does not include Personal Data for which Yoghurt Pot Limited determines the purposes and means of processing in its own capacity as controller, such as information relating to Motina's own merchant relationships, account administration, support, security and business operations.

Data Processing & Security Schedule or Schedule means Motina's then-current Data Processing & Security Schedule, which describes the processing activities, categories of data, Data Subjects, retention periods, locations, Sub-processors and technical and organisational measures applicable to the Service.

Data Subject, Controller, Processor, Processing, Personal Data and Personal Data Breach have the meanings given to them by Applicable Data Protection Law.

Service means the Motina ecommerce analytics and insights service provided under the Agreement.

Sub-processor means another processor engaged by Motina to process Customer Personal Data on behalf of Customer.

2. Incorporation of the Data Processing & Security Schedule

The Data Processing & Security Schedule forms part of this DPA and is incorporated into it by reference.

The Schedule sets out the factual details of the processing performed by Motina, including:

• the subject matter and duration of processing;
• the nature and purposes of processing;
• categories of Personal Data;
• categories of Data Subjects;
• relevant retention and deletion arrangements;
• processing locations;
• authorised Sub-processors; and
• Motina's technical and organisational measures.

Customer instructs Motina to carry out the processing described in the Schedule for the purposes of providing the Service.

Motina may update the Schedule to reflect changes to the Service or its actual processing arrangements, subject to the protections and notification requirements contained in this DPA.

Motina will not use an update to the Schedule to materially expand the purposes for which Customer Personal Data is processed without an appropriate instruction or other lawful basis.

3. Roles of the parties

For Customer Personal Data:

• Customer acts as Controller; and
• Motina acts as Processor.

Where Customer itself acts as a processor on behalf of another controller, Customer appoints Motina as a sub-processor and confirms that it is authorised to do so.

Each party will comply with the obligations applying to it under Applicable Data Protection Law.

Nothing in this DPA changes Yoghurt Pot Limited's role as controller where it processes Personal Data for its own purposes, as described in the Motina Privacy Policy.

4. Customer instructions

Motina will process Customer Personal Data only:

• on Customer's documented instructions;
• as necessary to provide the Service in accordance with the Agreement, this DPA and the Data Processing & Security Schedule; or
• where required by applicable law.

The following constitute Customer's documented instructions:

• the Agreement;
• this DPA;
• the Data Processing & Security Schedule;
• Customer's configuration and authorised use of the Service; and
• any additional written instructions agreed by the parties.

If applicable law requires Motina to process Customer Personal Data other than on Customer's instructions, Motina will inform Customer before carrying out that processing unless the law prohibits us from doing so.

Motina will inform Customer if, in our reasonable opinion, an instruction infringes Applicable Data Protection Law.

Motina is not required to comply with an instruction that would require it to violate applicable law.

5. Customer responsibilities

Customer is responsible for:

• ensuring that Customer Personal Data is collected and disclosed to Motina lawfully;
• determining an appropriate lawful basis for processing;
• providing required privacy information to Data Subjects;
• obtaining consent where consent is required;
• configuring applicable ecommerce-platform privacy and consent settings appropriately;
• ensuring its instructions comply with Applicable Data Protection Law;
• determining whether the Service is appropriate for Customer's processing; and
• responding to Data Subjects in Customer's capacity as Controller.

Motina will make reasonable information available to assist Customer in assessing the processing performed by the Service.

6. Confidentiality

Motina will ensure that people authorised to process Customer Personal Data:

• are subject to appropriate confidentiality obligations; and
• process Customer Personal Data only where required for their authorised responsibilities.

Access to Customer Personal Data will be restricted to personnel and authorised providers who reasonably require access to provide, maintain, secure or support the Service.

7. Security

Motina will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful:

• destruction;
• loss;
• alteration;
• unauthorised disclosure; or
• unauthorised access.

Motina's current technical and organisational measures are described in the Data Processing & Security Schedule.

Motina may modify or replace individual controls as the Service and technology change, provided that the overall level of protection is not materially reduced.

8. Sub-processors

8.1 General authorisation

Customer gives Motina general written authorisation to engage the Sub-processors identified in the Data Processing & Security Schedule.

8.2 Sub-processor obligations

Before permitting a Sub-processor to process Customer Personal Data, Motina will enter into an agreement requiring the Sub-processor to provide data-protection safeguards appropriate to the relevant processing and meeting Applicable Data Protection Law.

Motina remains responsible to Customer for the performance of its Sub-processors' applicable data-protection obligations to the extent required by law.

8.3 Changes to Sub-processors

Motina may add or replace Sub-processors.

Where required by Applicable Data Protection Law, Motina will provide advance notice of an intended material new Sub-processor before that provider begins processing Customer Personal Data.

Customer may object on reasonable grounds specifically relating to the protection of Customer Personal Data.

The parties will work in good faith to address a reasonable objection.

If the objection cannot reasonably be resolved, Motina may:

• make available a reasonable alternative where practicable; or
• permit Customer to discontinue the affected Service.

Where an urgent replacement is reasonably necessary for security, availability, legal or regulatory reasons, Motina may make the change before giving advance notice and will provide information about the change as soon as reasonably practicable.

9. Data Subject requests

Taking into account the nature of the processing, Motina will provide reasonable technical and organisational assistance to help Customer respond to Data Subjects exercising applicable rights.

These may include rights relating to:

• access;
• correction;
• deletion;
• restriction;
• objection; and
• portability.

Where a Data Subject contacts Motina directly concerning Customer Personal Data, Motina will not ordinarily respond to the substantive request independently unless Customer authorises us or applicable law requires us to do so.

Where reasonably possible, Motina will direct the request to Customer or inform Customer of it.

Motina supports the applicable privacy-request mechanisms described in the Data Processing & Security Schedule.

10. Personal Data Breaches

Motina will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

To the extent reasonably available, the notification will contain information necessary to help Customer understand:

• the nature of the breach;
• the categories of Personal Data and Data Subjects affected;
• the likely consequences of the breach; and
• measures taken or proposed to contain, investigate or remediate it.

Information may be provided in stages where it is not all available at the same time.

Motina will take reasonable measures to contain, investigate and remediate Personal Data Breaches within its control.

Notification of a Personal Data Breach does not constitute an admission of fault or liability.

Customer remains responsible for determining whether it must notify a supervisory authority or affected Data Subjects, except where Motina has a separate obligation imposed directly by law.

11. Assistance with compliance

Taking into account the nature of the processing and information available to Motina, we will provide reasonable assistance to Customer with applicable obligations concerning:

• security of processing;
• Personal Data Breach assessment and notification;
• Data Subject rights;
• data-protection impact assessments; and
• prior consultation with a supervisory authority where required.

Customer remains responsible for determining whether those obligations apply to its processing.

Where a request requires substantial bespoke work outside the ordinary operation of the Service, the parties may agree reasonable charges for that assistance where permitted by law.

12. Return and deletion

At the end of the processing relationship, Motina will, at Customer's choice, delete or return Customer Personal Data, unless applicable law requires continued storage.

Where Customer does not provide an alternative instruction before Motina's ordinary deletion process begins, Customer instructs Motina to delete the relevant Customer Personal Data in accordance with that process.

The current deletion process, retention periods and treatment of backup copies are described in the Data Processing & Security Schedule.

Personal Data retained because of a legal requirement will remain protected and will not be processed for unrelated purposes.

13. International transfers

Customer authorises Motina to process Customer Personal Data in the countries identified in the Data Processing & Security Schedule and in other jurisdictions used by authorised Sub-processors, subject to this section.

Motina will ensure that a restricted international transfer initiated by Motina is made using a mechanism permitted by Applicable Data Protection Law.

Depending on the relevant jurisdiction, such mechanisms may include:

• an applicable adequacy decision or adequacy regulation;
• the European Commission Standard Contractual Clauses;
• the UK Addendum to the European Commission Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• an applicable recognised privacy framework or certification mechanism; or
• another permitted transfer mechanism.

Where a transfer mechanism requires an associated transfer assessment or supplementary safeguards, Motina will undertake or obtain those measures as required for transfers initiated by Motina.

Where an applicable adequacy decision ceases to cover a relevant transfer, the parties will cooperate in good faith to put an appropriate replacement mechanism in place where required.

14. Audits and compliance information

Motina will make available information reasonably necessary to demonstrate compliance with its applicable processor obligations.

Customer may request relevant information concerning Motina's data-protection and security practices.

Where information reasonably available through:

• this DPA;
• the Data Processing & Security Schedule;
• Motina's privacy or compliance documentation;
• reasonable security questionnaires; or
• relevant third-party reports

is sufficient to demonstrate compliance, the parties will use that information before requiring a separate audit.

Where an audit remains reasonably necessary, Customer may conduct an audit itself or through an independent auditor, subject to:

• reasonable advance written notice;
• appropriate confidentiality obligations;
• reasonable safeguards protecting Motina and other customers;
• avoiding unnecessary disruption to the Service; and
• using a reasonable method that does not require unrestricted access to production systems where compliance can be demonstrated another way.

Unless required by a competent supervisory authority, following a material Personal Data Breach, or reasonably necessary because of evidence of material non-compliance, Customer will not request more than one audit in a twelve-month period.

Customer will bear its reasonable costs of an audit unless the audit identifies material non-compliance by Motina with this DPA.

Nothing in this section restricts the lawful powers of a competent supervisory authority.

15. Records and regulatory cooperation

Motina will maintain records of processing activities where required by Applicable Data Protection Law.

Motina will cooperate with competent supervisory authorities where required by law.

If Motina receives a binding request from a public authority for Customer Personal Data, we will, unless prohibited by law:

• review the request;
• disclose only information lawfully required; and
• notify Customer where legally permitted and reasonably practicable.

16. Sensitive data

Motina is not designed to require special category, criminal-offence or similarly sensitive Personal Data about individual shoppers.

Customer should not intentionally use Motina to provide such information unless:

• the processing is necessary for Customer's lawful use of the Service;
• Customer has established that the processing is lawful; and
• required additional safeguards are in place.

Ordinary ecommerce information may in some circumstances indirectly reveal sensitive information based on products or services purchased. Such information remains subject to the protections in this DPA.

17. California and US state privacy laws

To the extent Motina processes Customer Personal Data as a service provider or contractor under the CCPA, Motina will:

• process Personal Data only for the limited and specified business purposes described in the Agreement and Data Processing & Security Schedule;
• not sell or share Customer Personal Data as those terms are defined by the CCPA;
• not retain, use or disclose Customer Personal Data for purposes outside those permitted by the Agreement, this DPA or applicable law;
• not retain, use or disclose Customer Personal Data outside the direct business relationship with Customer except as permitted by applicable law;
• provide the level of privacy protection required of service providers or contractors;
• assist Customer with applicable consumer-rights requests;
• notify Customer if Motina determines that it can no longer meet its applicable obligations; and
• permit Customer to take reasonable and appropriate steps to help ensure Customer Personal Data is processed consistently with applicable requirements.

Motina will not use Customer Personal Data received from one Customer to provide targeted advertising or marketing on behalf of another Customer.

Where another applicable US state privacy law imposes materially equivalent processor or service-provider obligations, the parties intend this DPA to satisfy those requirements to the extent applicable.

18. Liability

This DPA forms part of the Agreement.

Except where Applicable Data Protection Law requires otherwise, the exclusions and limitations of liability contained in the Agreement apply to liability arising under or in connection with this DPA.

Nothing in this DPA limits:

• rights available to Data Subjects under applicable law;
• the lawful powers of a supervisory authority; or
• liability that cannot lawfully be limited or excluded.

19. Order of precedence

If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA will prevail to the extent of that conflict.

If there is a conflict between this DPA and the Data Processing & Security Schedule, this DPA will prevail as to the parties' legal obligations, while the Schedule will govern the factual description of the Service's current processing arrangements.

If a mandatory international-transfer instrument applies and conflicts with this DPA, that instrument will prevail to the extent of the conflict.

20. Duration

This DPA applies from the time Motina first processes Customer Personal Data on Customer's behalf and continues for as long as Motina processes that Customer Personal Data.

Obligations which by their nature continue after termination, including applicable confidentiality, security and deletion obligations, will continue while Motina retains Customer Personal Data.

21. Changes to this DPA

Motina may update this DPA where reasonably necessary to:

• comply with changes in law;
• reflect changes to applicable regulatory requirements;
• update international-transfer mechanisms;
• clarify or improve its data-protection provisions.

Motina will not materially reduce the protections applying to Customer Personal Data without reasonable notice unless a change is required by law.

Operational changes to the Service, including changes to processing activities, providers, retention periods or infrastructure locations, may instead be reflected in the Data Processing & Security Schedule in accordance with this DPA.

The current version and effective date of this DPA will be published on the Motina website.

22. Contact

Data-protection enquiries relating to this DPA may be sent to:

Yoghurt Pot Limited Company number: 12105928 Registered in England and Wales 45 Tameside Stokesley TS9 5PE United Kingdom

Email: privacy@motina.co.uk Website: motina.co.uk