Defined instructions.
Accountable processing.

This Data Protection Addendum is a standard framework to be incorporated into a signed service agreement where USG processes personal data on a customer’s documented instructions. It is not executed merely by visiting the website, opening an account or submitting an enquiry.

The agreement must identify the legal parties, controller and processor roles, service, term, authorised instructions, governing law, signatures and completed processing schedule. USG’s processing as an independent controller, including its own account administration and compliance records, is addressed by the Privacy Policy, not converted into customer-controlled processing by this framework.

The processor will process personal data only on documented instructions from the controller, including for transfers, unless required by applicable law. If legally permitted, the processor will inform the controller of that requirement before processing and will notify the controller if an instruction appears to infringe data-protection law.

Access will be limited to personnel who need it for the service, are subject to confidentiality obligations and receive role-appropriate privacy and security instruction.

Taking account of risk, available technology, implementation cost, context and data, the processor will maintain appropriate technical and organisational measures. The agreed baseline and any service-specific controls will be recorded in the security schedule and the Security & Access Control Policy.

A processor may use a sub-processor only with the controller’s prior specific or general written authorisation. The service schedule identifies the authorised legal entity, function, processing and access locations and applicable transfer safeguards. A general website provider list is not itself customer authorisation.

Where general authorisation applies, the processor must give advance written notice of intended additions or replacements and a genuine opportunity to object on data-protection grounds. The schedule specifies the notice period, objection route and resolution procedure. Where an objection cannot be resolved, the parties must agree a lawful alternative or an exit arrangement for the affected processing; the disputed new processing must not begin without the required authority.

Written sub-processor terms must impose equivalent data-protection obligations. The processor remains responsible to the controller for the sub-processor’s performance as required by the applicable agreement and law.

Taking account of the nature of processing, the processor will provide reasonable assistance with data-subject requests, security, breach notification, impact assessments, prior consultation and information needed to demonstrate compliance. Commercial arrangements for assistance should be stated in the service agreement without preventing legally required support.

The processor will notify the controller without undue delay after becoming aware of a personal data breach affecting the service, provide information reasonably available for assessment and notification, and support containment, investigation, recovery and lessons learned. Notification is not an admission of fault.

At the controller’s choice, personal data will be returned or deleted when the service ends, and existing copies deleted unless law requires retention. The exit schedule specifies the export format, delivery route, deletion time, handling of backup copies and confirmation available. Legally retained data is isolated, protected and used only for the purpose requiring retention.

The processor will provide information necessary to demonstrate compliance and allow and contribute to audits and inspections by the controller or an authorised auditor. Reasonable safeguards protect other customers, confidentiality and security, but must not prevent legally required access, regulator powers or necessary investigation of a serious incident.

The controller is responsible for the lawfulness of its instructions and disclosure of data, the required notices and permissions, data accuracy and minimisation, identification of sensitive processing and timely decisions on data-subject requests. It must communicate relevant restrictions and appoint an authorised instruction contact. These responsibilities do not remove the processor’s direct obligations under applicable law.

The responsible USG service department coordinates the schedule; the Privacy and Compliance functions review data roles, safeguards and material changes. Data-protection enquiries: privacy@universalsustainablegrowth.org. Contract enquiries: legal@universalsustainablegrowth.org.