Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", "Controller") and Zoo Holdings Ltd ("Koala 360", "Processor") for use of the Koala 360 platform. It applies when we process personal data on your behalf as a processor under UK GDPR and/or EU GDPR.

Need a countersigned copy? Email [email protected] with your company name, signatory details, and "DPA request" in the subject line.

1. Definitions

In this DPA: "Data Protection Laws" means UK GDPR, EU GDPR (where applicable), and related national implementing legislation; "Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Supervisory Authority" have the meanings given in applicable Data Protection Laws; "Customer Personal Data" means Personal Data processed by Processor on behalf of Customer through the Service; "Service" means the Koala 360 hosted virtual-tour platform and related support.

2. Roles of the parties

Customer is the Controller of Customer Personal Data. Zoo Holdings Ltd (company number 15868646), trading as Koala 360, is the Processor. Processor will process Customer Personal Data only on documented instructions from Customer, including as set out in this DPA, the applicable subscription terms, and Customer's use of the Service configuration (for example, tour passwords, publishing settings, and uploaded content).

3. Details of processing (Annex 1)

4. Processor obligations

Processor shall:

• Process Customer Personal Data only on Customer's documented instructions, unless required by law (and will inform Customer of that legal requirement unless prohibited)
• Ensure persons authorised to process Customer Personal Data are bound by confidentiality
• Implement appropriate technical and organisational measures to protect Customer Personal Data, including encryption in transit (TLS) and encryption at rest via subprocessors
• Not engage another processor ("Subprocessor") without informing Customer, maintaining an up-to-date subprocessor list, and ensuring Subprocessors are bound by data protection obligations no less protective than this DPA
• Assist Customer, taking into account the nature of processing, with Data Subject requests and Customer's obligations regarding security, breach notification, data protection impact assessments, and consultations with Supervisory Authorities, where applicable and reasonable
• Notify Customer without undue delay (and in any event within 72 hours of becoming aware) of a Personal Data breach affecting Customer Personal Data, providing information reasonably available to allow Customer to meet its breach reporting obligations
• At Customer's choice, delete or return Customer Personal Data after termination of the Service, subject to backup retention cycles and legal retention requirements
• Make available information reasonably necessary to demonstrate compliance and allow audits upon reasonable written notice, no more than once per year, during normal business hours, unless a Supervisory Authority requires otherwise

5. Subprocessors (Annex 2)

Customer authorises Processor to use the following Subprocessors to deliver the Service. Processor remains responsible for their performance.

Processor will notify Customer of intended changes to Subprocessors (for example, by updating this page). Customer may object on reasonable data-protection grounds within 14 days. If the parties cannot resolve the objection, Customer may terminate the affected Service.

6. International transfers

Customer Personal Data may be transferred to and processed in countries outside the UK and EEA, including the United States. Processor will ensure appropriate safeguards are in place as required by Data Protection Laws, which may include the UK International Data Transfer Agreement, EU Standard Contractual Clauses (2021), and/or Subprocessors' equivalent transfer tools.

7. Security measures

Processor maintains measures including: access controls; encrypted connections (HTTPS/TLS); encrypted storage at rest via cloud providers; logical separation of customer environments; and regular backups managed by subprocessors. Details of specific datacentres and backup retention are available on request.

8. Customer obligations

Customer shall: (a) comply with Data Protection Laws in its use of the Service; (b) provide lawful instructions; (c) have appropriate privacy notices and lawful bases for any Personal Data it uploads or collects through tours; (d) not upload Personal Data it is not permitted to share; and (e) configure tour privacy settings (such as passwords) appropriately.

9. Liability and order of precedence

Each party's liability under this DPA is subject to the limitation of liability in the main agreement between the parties. If there is a conflict between this DPA and the main terms, this DPA prevails with respect to data protection.

10. Term

This DPA remains in effect for as long as Processor processes Customer Personal Data on behalf of Customer.

11. Parties

Processor
Zoo Holdings Ltd (trading as Koala 360)
Company number: 15868646
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: [email protected]

Customer
[Company name]
[Registered address]
[Email]

By using the Koala 360 Service for business purposes that involve personal data, Customer acknowledges this DPA. Enterprise customers may request a separately countersigned version.