Common use of Service Personal Data The Personal Clause in Contracts

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-delivery/spend-controls- controls-check-if-you-need-need- approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-G- Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrols-che ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information N/A This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Sub processor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Call- Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrols-check- if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-you-need-approval-to-spend-money-on-a-service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing 7 - Processing, Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account and Data Subjects Subject matter of the view processing: [This should be a high level, short description of what the processing is about ie its subject matter] Duration of the Processorsprocessing: [Clearly set out the duration of the processing including dates] Nature and purposes of the processing: [Please be as specific as possible, however but make sure that you cover all intended purposes. The nature of the final decision processing means any operation such as to the content collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of this Annex shall be with the Buyer at its absolute discretion.data (whether or not by automated means) etc) The purpose might include eg: employment processing, statutory obligation, recruitment assessment etc]

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrols-che ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities f acilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance perf ormance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- controls-check-if-you-need-approval-to-to- spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information – Not Required This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-delivery/spend-controls- controls-check-if-you-need-need- approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-G- Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- controls-check-if-you-need-approval-to-spend-spend- money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Sub processor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information – NOT APPLICABLE This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrolsche ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- https://www.gov.uk/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces Categories of Data Subject Staff (including volunteers, agents, contractors and temporary workers) Plan for return and destruction of the annexes data once the Processing is complete UNLESS requirement under Union or Member State law to preserve that type of data The Supplier shall return or delete all data in accordance with the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off ContractBuyer’s instructions. Annex 12: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.Joint Controller Agreement

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Sub processor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government govemment Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-deliverydeliverv/spendspendcontrols-controls- check-if-you-need-approval-to-spend-money-on-a-service aservice Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. G-Cloud 10 Call-Off Contract RMI 557.10 18-04-2018 https //www.govuWgovernmenVpublications/g-cloud-10-framework-agreement Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s 's servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud CIoud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s 's Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation 0/ariation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. GCbud https ;ltwww Schedule 77 - Processing, Personal Data and Data Subjects Subject matter of the processing: GDPR Information This schedule reproduces Processing activities in performance of the annexes Services as set forth in the Agreement. Duration of the processing: The term of the Call Off Agreement. Nature and purposes of the Processing: Hootsuite processes Customer Content for the purpose of providing the Services set forth in the Agreement. Type of Personal Data: Customer decides and controls, at its sole discretion, what information is uploaded onto or obtained for Customer through the Hootsuite Services (including ail personal data which is collected through social media network/sites APIs in connection with the provision of the Hootsuite Services to the GDPR schedule contained Customer) or otherwise provided by the Customer to Hootsuite. Consequently, Customer determines and controls what information (and, in particular, the specific categories of data which the personal data transferred concerns) is processed by Hootsuite in providing the Hootsuite Services to Customer. This may include personal data of all types including (to the extent that the following includes personal dataO the following categories of data: User generated content (such as messages, posts, comments, pages, profiles, feeds or communications on social media sites/networks. Contact details (such as name, email address, telephone number). Additional individual information (such as age, gender, employer, profession geographic location, education information, financial status, habits and preferences). Communications, data, information or content not described above that is sent or received by Customer through Hootsuite Services. Categories of Data Subject: The personal data transferred concern the following categories of data subjects: Individuals employed by or who work for Customer. Individual employed by or who work for suppliers engaged by ▇▇▇▇▇▇▇▇. Individuals whose personal data is included I social media networks/sites posts, communications, messages or feeds which are processed by Hootsuite on behalf of the Customer, including all individual whose personal data is collected through social media network/sites APIs in connection G-Cloud 10 Call-Off Contract NMI 557.10 18-04-201B ▇▇▇▇▇://▇▇▇▇▇▇.▇▇/govemment/publications!g-cloud-l O-framework-agreement with the provision of the Hootsuite Services to the Customer. Plan for retum or destruction of the data once the Processing is complete UNLESS requirement under union or member state law to preserve that type of data: Upon termination of the Services for which Hootsuite is processing Personal Data, Hootsuite shall, upon Customer's written request received by Hootsuite within 30 days of termination of the Framework Service, and subject to the limitations described in the Agreement and incorporated into this Call-off Contractthe Security Standards, return or delete all Customer Content and copies of such data in its custody or control, unless and only to the extent applicable law prevents it form doing so. Annex 1: Processing If Hootsujte must retain Personal Data This for legal reasons, ▇▇▇▇▇▇▇▇▇ shall be completed agrees to preserve the confidentially of any retained Personal Data and will only actively process such Personal Data after such date in order to comply with the laws it is subject to. Customer understands and agrees that only the Personal Data Hootsuite can delete or return is the Customer's Personal Data it holds within its own or its subprocessors' systems at the time of return or deletion, and does not include Personal Data held by Third-Party Services. For the Controller, who may take account purposes of the view of above paragraph, "Personal Data" means any Customer Content or Mentions (as those terms are defined in the ProcessorsAlternative Clauses) that relate to an identified or identifiable natural person, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretionextent that such information is protected as personal data under applicable Data Protection Laws.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlsche ck-if-you-need-approval-to-spend-money-on-a-a- service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-you-need-approval-to-spend-money-on-a-service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-you-needne ed-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 76A: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement Data Protection - updated Definitions and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.Clauses

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- contr ols-check-if-you-need-approval-to-to- spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkche ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- controls-check-if-you-need-approval-to-spend-spend- money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spendspend- controls-controls- check-if-you-need-approval-to-spend-money-on-a-a- service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information Annex A – DfE Supplemental Clauses‌ Annex B – RFQ Template‌ Annex C – Monthly Service Report‌ Annex D – Requirement document‌ Framework Agreement‌ RM1557.11-G-Clou d-11-Framew ork-Ag This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: 1 - Processing Personal Data Data‌ This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-ifcontrols-▇▇ ▇▇▇-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information N/A This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the o G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the Supp G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part service thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the permitte Call-Off Contract) and its servants or agents in connection with the provision of pr G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this AnythirdpartyappointedtoprocessPersonalDataonbehalfoftheSupplieru Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the TherepresentativeappointedbytheSupplierfromtimetotimeinrelationtoth Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this serv Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s T Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information Information‌ This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrolsche ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: UK GDPR Information This schedule reproduces the annexes to the UK GDPR schedule contained within the Framework Agreement and incorporated into this Call-off ContractContract and clause and schedule references are to those in the Framework Agreement but references to CCS have been amended. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Not Applicable Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Statement of Works (SOW) The documentation used to specify additional Services and Charges being provided for under this Call-Off contract as introduced through each Change Authorisation Note. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- checkspendcontrolscheck-if-you-need-approval-to-spend-money-money- on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-you-need-approval-to-spend-money-on-a-service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 76: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. The Schedule shall be completed for each Work Package. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion. The contact details of the Buyer’s Data Protection Officer are: REDACTED TEXT under FOIA Section 40, Personal Information.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off CallOff Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-controlscheckif- you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information – Not Used This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-youy ou-need-approval-to-spend-money-on-a-service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7Envelope Id: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call7F2FFFF66CD34098B3435AE11AEC6C39 Status: Completed Subject: CW11204 - G-off Contract. Annex 1Cloud Contract Data Engineering v 1 2.docx Source Envelope: Processing Personal Data This Document Pages: 35 Signatures: 2 Envelope Originator: Supplemental Document Pages: 0 Initials: 0 Readacted Certificate Pages: 5 AutoNav: Enabled EnvelopeId Stamping: Enabled Time Zone: (UTC) Dublin, Edinburgh, Lisbon, London Payments: 0 ▇▇▇ ▇▇▇▇▇▇▇▇▇▇ shall ▇▇▇▇▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇▇▇ Readacted k IP Address: 194.39.128.20 Status: Original 8/1/2017 2:16:38 PM Holder: Readacted Readacted Location: DocuSign Readacted Readacted .com CFO Security Level: Email, Account Authentication (None) Readacted Using IP Address: 5.148.6.178 Sent: 8/1/2017 2:29:04 PM Viewed: 8/1/2017 2:32:48 PM Signed: 8/3/2017 11:52:48 AM Electronic Record and Signature Disclosure: Accepted: 8/1/2017 2:32:48 PM ID: dc59ab53-1e7d-46ec-b4ce-89838cbd9575 Readacted Assistant Director HMRC Security Level: Email, Account Authentication (None) Electronic Record and Signature Disclosure: Not Offered via DocuSign Readacted Using IP Address: 163.171.0.4 Sent: 8/3/2017 11:52:49 AM Viewed: 8/3/2017 11:55:06 AM Signed: 8/3/2017 11:57:34 AM Envelope Sent Hashed/Encrypted 8/3/2017 11:52:49 AM Certified Delivered Security Checked 8/3/2017 11:55:06 AM Signing Complete Security Checked 8/3/2017 11:57:34 AM Completed Security Checked 8/3/2017 11:57:34 AM Electronic Record and Signature Disclosure created on: 4/14/2016 5:17:14 PM Parties agreed to: ▇▇▇▇▇ ▇▇▇▇▇ ELECTRONIC RECORD AND SIGNATURE DISCLOSURE From time to time, HMRC (SAP) (we, us or Company) may be completed required by law to provide to you certain written notices or disclosures. Described below are the terms and conditions for providing to you such notices and disclosures electronically through your DocuSign, Inc. (DocuSign) Express user account. Please read the information below carefully and thoroughly, and if you can access this information electronically to your satisfaction and agree to these terms and conditions, please confirm your agreement by clicking the 'I agree' button at the bottom of this document. Getting paper copies At any time, you may request from us a paper copy of any record provided or made available electronically to you by us. For such copies, as long as you are an authorized user of the DocuSign system you will have the ability to download and print any documents we send to you through your DocuSign user account for a limited period of time (usually 30 days) after such documents are first sent to you. After such time, if you wish for us to send you paper copies of any such documents from our office to you, you will be charged a $0.00 per-page fee. You may request delivery of such paper copies from us by following the procedure described below. Withdrawing your consent If you decide to receive notices and disclosures from us electronically, you may at any time change your mind and tell us that thereafter you want to receive required notices and disclosures only in paper format. How you must inform us of your decision to receive future notices and disclosure in paper format and withdraw your consent to receive notices and disclosures electronically is described below. Consequences of changing your mind If you elect to receive required notices and disclosures only in paper format, it will slow the speed at which we can complete certain steps in transactions with you and delivering services to you because we will need first to send the required notices or disclosures to you in paper format, and then wait until we receive back from you your acknowledgment of your receipt of such paper notices or disclosures. To indicate to us that you are changing your mind, you must withdraw your consent using the DocuSign 'Withdraw Consent' form on the signing page of your DocuSign account. This will indicate to us that you have withdrawn your consent to receive required notices and disclosures electronically from us and you will no longer be able to use your DocuSign Express user account to receive required notices and consents electronically from us or to sign electronically documents from us. All notices and disclosures will be sent to you electronically Unless you tell us otherwise in accordance with the procedures described herein, we will provide electronically to you through your DocuSign user account all required notices, disclosures, authorizations, acknowledgements, and other documents that are required to be provided or made available to you during the course of our relationship with you. To reduce the chance of you inadvertently not receiving any notice or disclosure, we prefer to provide all of the required notices and disclosures to you by the Controllersame method and to the same address that you have given us. Thus, who may take account you can receive all the disclosures and notices electronically or in paper format through the paper mail delivery system. If you do not agree with this process, please let us know as described below. Please also see the paragraph immediately above that describes the consequences of your electing not to receive delivery of the view notices and disclosures electronically from us. You may contact us to let us know of your changes as to how we may contact you electronically, to request paper copies of certain information from us, and to withdraw your prior consent to receive notices and disclosures electronically as follows: To contact us by email send messages to: ▇▇▇▇▇.▇▇▇▇▇▇@▇▇▇▇.▇▇▇.▇▇▇.▇▇ To advise HMRC (SAP) of your new e-mail address To let us know of a change in your e-mail address where we should send notices and disclosures electronically to you, you must send an email message to us at ▇▇▇▇▇.▇▇▇▇▇▇@▇▇▇▇.▇▇▇.▇▇▇.▇▇ and in the body of such request you must state: your previous e-mail address, your new e-mail address. We do not require any other information from you to change your email address.. In addition, you must notify DocuSign, Inc to arrange for your new email address to be reflected in your DocuSign account by following the process for changing e-mail in DocuSign. To request paper copies from HMRC (SAP) To request delivery from us of paper copies of the Processorsnotices and disclosures previously provided by us to you electronically, however you must send us an e-mail to ▇▇▇▇▇.▇▇▇▇▇▇@▇▇▇▇.▇▇▇.▇▇▇.▇▇ and in the final decision as body of such request you must state your e-mail address, full name, US Postal address, and telephone number. We will bill you for any fees at that time, if any. To withdraw your consent with HMRC (SAP) To inform us that you no longer want to the content of this Annex shall be with the Buyer at its absolute discretion.receive future notices and disclosures in electronic format you may:

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- checkcontrolsche ck-if-you-need-approval-to-spend-spend- money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. 82 Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier (and Buyer, if necessary to comply with applicable Laws) and a subcontractor in which the subcontractor agrees to provide to the Supplier (and Buyer, if necessary to comply with applicable Laws) the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier (and Buyer, if necessary to comply with applicable Laws) under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term/Call-Off Contract Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance perf ormance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Workspace Owner A single individual, organisation or legal entity accountable for the ownership, content and administration of a workspace on the FutureNHS platform. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrolsche ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the UK GDPR schedule contained within the Framework Agreement and incorporated into this Call-off ContractContract and clause and schedule references are to those in the Framework Agreement but references to CCS have been amended. This Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkc heck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance perf ormance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule Schedule reproduces the annexes to the GDPR schedule as contained within the Framework Agreement and duly incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces deleted automatically based on the annexes specified retention period, or there is a manual option for the controller i.e. the user on Defra (Authority/Buyer) side (with the correct permissions) to remove the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contractdata from cloud folder. Annex 12: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.Joint Controller Agreement – Not Applicable

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology servicesServices, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services Services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.. The contact details of the Buyer’s Data Protection Officer are: XXXXXXXXXXXX

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-delivery/spend-controls- controls-check-if-you-need-approval-to-spend-spend- money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-G- Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-delivery/spend-controls- controls-check-if-you-need-approval-to-spend-money-money- on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-G- Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spendspend- controls-controls- check-if-you-need-approval-to-spend-money-on-a-a- service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information Annex A – DfE Supplemental Clauses‌ Annex B – RFQ Template‌ Annex C – Monthly Service Report‌ Annex D – Requirement document‌‌‌ Framework Agreement‌ RM1557.11-G-Clou d-11-Framew ork-Ag This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: 1 - Processing Personal Data Data‌ This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- 4 delivery/spend-controls- controls-check-if-you-need-approval-to-spend-spend- money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls Controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-you-needyouneed-approval-to-spend-money-on-a-service Start date Date The Start start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor Subcontractor in which the subcontractor Subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract Subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff Staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors Subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Annex A – DfE Supplemental Clauses DfE Supplemental Clauses.docx Annex B – RFQ Template RFQ Template v 7.0 Blank (002).docx Annex C – Monthly Service Report Monthly Service Report.xlsx Annex D - Requirement document Requirements doc.docx Annex E - Framework Agreement g-cloud-11-framew ork-agreement.pdf Schedule 7: 7 - GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: 1 - Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. No personal data is to be collected or processed during the completion of this contract Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion. The contact details of the Buyer’s Data Protection Officer are: Jackie ▇▇▇▇▇▇▇▇▇@▇▇▇.▇▇▇.▇▇ The contact details of the Supplier’s Data Protection Officer are: Jackie ▇▇▇▇▇▇▇▇▇@▇▇▇.▇▇▇.▇▇ The Processor shall comply with any further written instructions with respect to Processing by the Controller. Any such further instructions shall be incorporated into this Annex. The Supplier shall comply with any further written instructions with respect to processing by the Customer. Any such further instructions shall be incorporated into this Schedule. The Supplier is required to provide personal support and social care assistance to an individual employee of the Customer; both in the employee’s home and Customer premises. The Supplier will also provide administrative support to the employee when performing work duties. The provision of this service will necessitate access by the Supplier to sensitive personal information of the employee, such as private address and medical information, and sensitive personal information pertaining to the employee’s work role, such as details of victims and witnesses to criminal activity. Duration of the processing Approved as the period:

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities f acilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance perf ormance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Statement of Work Shall be the document as provided by the Supplier to the Buyer and as agreed between the Parties from time to time in order t deliver the Services. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend- controlshttps://▇▇▇.▇▇▇.▇▇/▇▇▇▇▇▇▇-▇▇▇▇▇▇/▇▇▇▇▇- delivery/spend-controls- controls-check-if-you-need-approval-to-spend- money-on-a-servicecheck-if-you-need-approval-to-spend-money-money- on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-https://www.gov.uk/service-manual/agile- delivery/spend-controls- check-if-you-need-approval-to-to- spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal ● Related Person and their organisation Data This ▇▇▇▇▇ shall be completed by the Controller○ Registered GP (name, who may take account professional identifiers) ○ Medical Centre (name, address, telephone numbers) ○ NHS Organisations (name, address) with whom patient data is exchanged in support of healthcare provision ● Patient Clinical Data ○ Patient Medical Records (clinical coded and free text data, documents, images, and other multi-media) Duration of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.Processing From 5/12/21 – 4/12/23

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrols-che ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes SAP SAP SE is a German multinational software corporation based in Walldorf, Baden-Württemberg, that develops enterprise software to manage business operations and customer relations. SRM The SRM Training System is intended to take your training and racing to the GDPR schedule contained within next level by incorporating power based training into your routine. SAP Netweaver SAP NetWeaver is a software stack for many of SAP SE's applications. The SAP NetWeaver Application Server, sometimes referred to as WebAS, is the Framework Agreement runtime environment for the SAP applications and incorporated all of the mySAP Business Suite runs on SAP WebAS: supplier relationship management (SRM), customer relationship management (CRM), supply chain management (SCM), product lifecycle management (PLM), enterprise resource planning (ERP), transportation management system (TMS). SAP Fiori SAP Fiori is a design language and user experience approach developed by SAP for use by SAP, its customers and its partners in business applications. SAP Ariba SAP Ariba enables companies to facilitate and improve the procurement process, which was paper-based, labor-intensive, and inefficient for large corporations. SAP HR SAP HR software allows you to automate record-keeping processes. It is an ideal framework for the HR department to take advantage of the administration and payroll documents. SAP ECC SAP ERP Central Component (ECC) is one of the most recognized assets that SAP owns. SAP4Hana SAP S/4HANA is SAP's ERP for large enterprises. It is the successor of SAP R/3 and SAP ERP and is optimized for SAP's in-memory database SAP HANA. SAP SuccessFactors SAP SuccessFactors is developing technology and partnerships to help advance the UN Sustainable Development Goals related to workforce sustainability. SAP Concur SAP Concur solutions connect all your expense, travel, and vendor invoice spending in one system, providing a single way to manage spending from end-to-end, gain greater visibility into this Call-off Contracttransactions, improve compliance, and simplify the process for everyone. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed SAP PI 7.5 SAP PI supports B2B as well as A2A exchanges, supports synchronous and asynchronous message exchange and includes a built in engine for designing and executing Integration Processes. SAP Payroll SAP Payroll system manages the gross and net pay, which also includes the payments and deductions calculated, while processing payroll for an employee. SAP Launchpad The SAP Fiori launchpad is a shell that hosts SAP Fiori apps, and provides the apps with services such as navigation, personalization, embedded support, and application configuration. SAP HCM SAP HCM (SAP Human Capital Management) is a human resources management system. As the successor to SAP HR, it contains all functions that are relevant for personnel administration, payroll, applicant management, and personnel development. SAP UAT User Acceptance Testing (UAT) is a type of testing performed by the Controller, who may take account of end user or the view of client to verify/accept the Processors, however software system before moving the final decision as software application to the content production environment. AWS Amazon Web Services is a subsidiary of this Annex shall be with the Buyer at its absolute discretionAmazon providing on-demand cloud computing platforms and APIs to individuals, companies, and governments, on a metered pay-as-you-go basis.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing - Processing, Personal Data This ▇▇▇▇▇ shall be completed by and Data Subjects The TruValidate UK service is used via API where the Controller, who may take account following of the view applicant are captured. These details include:- Name Address/Postcode Date of Birth Bank Account/Sort Code. The input data is used to provide ID and Bank Account verification as part of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretionDWP ‘Get Your State Pension’ Service.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the ProcessorsProces- sors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute abso- lute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed engaged by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-deliveryagiledelivery/spend-controls- checkspendcontrolsche ck-if-you-need-need- approval-to-spend-moneyspendmoney-on-a-service aservice Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: UK GDPR Information This schedule reproduces the annexes to the UK GDPR schedule contained within the Framework Agreement and incorporated into this Call-off ContractContract and clause and schedule references are to those in the Framework Agreement but references to CCS have been amended. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information As work is being Commissioned under Work Packages this annex has been incorporated into the Work Package Template and will be completed for each piece of commissioned work. This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkcontrols-che ck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s 's servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s 's Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ Annex shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information – Not Applicable This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7Annex 2: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Joint Controller Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.N/A

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Statement of Works (SOW) The documentation used to specify additional Services and Charges being provided for under this Call-Off contract as introduced through each RFQ. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data Redacted under FOIA Section 40, Personal Information This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- checkspend- controlscheck-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Descriptions Details Identity of Controller for each Category of Personal Data The Buyer is Controller and the Supplier is Processor The Parties acknowledge that in accordance with paragraph 2-15 Framework Agreement Schedule 4 (Where the Party is a Controller and the other Party is Processor) and for the purposes of the Data Protection Legislation, the Buyer is the Controller and the Supplier is the Processor of the following Personal Data: ● contact information - subject email addresses, subject name, subject title and related attributes required to send or personalise emailed newsletters ● location information - subject location and function, required to target employee newsletters or newsletter content on the basis of location or function ● email content - the Buyer’s corporate information included in the emailed newsletters (which may include employee names, updates on employee promotions or role changes, or other information which may identify a person) ● reporting information - analytics and other reporting data which provides Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information Not Applicable This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-delivery/spend-controls- controls-check-if-you-need-need- approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-G- Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Call- Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-/service- manual/agile-delivery/spend-controls- controls-check-if-you-need-approval-to-spend-spend- money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-G- Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-you-you- need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the ofthe use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- controls-check-if-if- you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants itsservants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier theSupplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to relationto the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, ,agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms Terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Termsand Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and WalesandWales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the UK GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by Off Contract and clause and schedule references are to those in the Controller, who may take account of the view of the Processors, however the final decision as Framework Agreement but references to the content of this Annex shall be with the Buyer at its absolute discretionCCS have been amended.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off ContractNOT USED. Annex 1A – Statement of Requirements The following table contains the services required to provide MooD Managed Services (Enable): Enable Consultant 209 Days (excluding weekends and bank holidays) - Consultant’s Working Day – 8 hours exclusive of travel and lunch - Working Week – Monday to Friday excluding national holidays - Office Hours - 9am to 5pm Monday to Friday £900 per day Total Value: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.£188,100.00 (ex VAT)

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- controls-check-if-you-need-approval-to-to- spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- G-Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.. The contact details of the Buyer’s Data Protection Officer are: REDACTED: FOI Section 40

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Not applicable Annex shall be with the Buyer at its absolute discretion.2: Joint Controller Agreement

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers suppliers, and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion. The contact details of the Buyer’s Data Protection Officer are: XXXXXX redacted under FOIA section 40 The contact details of the Supplier’s Data Protection Officer are: ▇▇▇▇▇://▇▇▇▇▇▇▇.▇▇▇.▇▇▇▇▇▇.▇▇▇/support/home The Processor shall comply with any further written instructions with respect to Processing by the Controller. Any such further instructions shall be incorporated into this Annex. Descriptions Details Identity of Controller for each Category of Personal Data The Buyer is Controller and the Supplier is Processor The Parties acknowledge that in accordance with paragraph 2-15 Framework Agreement Schedule 4 (Where the Party is a Controller and the other Party is Processor) and for the purposes of the Data Protection Legislation, the Buyer is the Controller and the Supplier is the Processor of the following Personal Data: Duration of the Processing The Supplier will Process the data on behalf of the Buyer for the duration of the contract which will renew on the 01st April 2021 – and expire on the 31st March 2024. Nature and purposes of the Processing Under the AWS shared responsibility model, the Buyer also has a responsibility to ensure the protection of its own Buyer Data. Supplier provides tools and service offerings to assist Buyers with the protection of Buyer Data. Supplier strongly recommends that Buyers use AWS Services such as CloudTrail, Security Hub and GuardDuty to ensure that the Buyer is in compliance with Data Protection Legislation. Buyer acknowledges that Supplier achieves compliance with its notification and security requirements under this Call-Off Contract by making such services available provided that the Supplier provides such services with all reasonable skill and care and meets the technical standards the Supplier is required to comply with as set out in Clause 13.5 of the Call-Off Contract and in the ‘Technical standards’ section of the Order Form. Supplier is not in a position to determine whether Documented Instructions infringe the GDPR given the automated nature of the Supplier’s Services. However, in the unlikely event that Supplier does form an opinion that such instructions infringe the GDPR, it shall immediately inform ▇▇▇▇▇ of such an opinion, in which case Buyer is entitled to withdraw or modify its processing instructions and may terminate this Call-Off Contract in accordance with its terms. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include: employment Processing, statutory obligation, recruitment assessment etc] Type of Personal Data The types of Personal Data uploaded by the Buyer and hosted by the Supplier may vary depending on the nature and purposes of Processing however may include, but is not limited to the following: Customer Name Customer Date of birth Customer NI Number Customer Addresses Customer Email address Customer Phone number/s Customer VRM (Vehicle Registration Mark) Customer DLN (Driving Licence Number) Customer Driving Entitlements & Endorsements Foreign Customer Details Bank/Payment Details Medical Information DVLA Staff Name DVLA Staff Email Address DVLA Contractor Name DVLA Contractor Email Address Motor Dealer Name Motor Dealer Address Motor Dealer Email Address Motor Dealer Phone Number Categories of Data Subject Customers (Driving Licence Holders, Vehicle Details and Keepers, Vocational Drivers, Fleet/Business Vehicle Keepers) Members of the public Motor Dealers DVLA Staff DVLA Contractors Suppliers Plan for return and destruction of the data once the Processing is complete UNLESS requirement under Union or Member State law to preserve that type of data Refer to Offboarding Section of this Call off Contract. Joint Controller Status and Allocation of Responsibilities With respect to Personal Data under Joint Control of the Parties, the Parties envisage that they shall each be a Data Controller in respect of that Personal Data in accordance with the terms of this Annex 2 (Joint Controller Agreement) in replacement of paragraphs 2 to 15 of Schedule 4 of the Framework Agreement (Where one Party is Controller and the other Party is Processor) and paragraphs 17-27 of Schedule 4 (Independent Controllers of Personal Data). Accordingly, the Parties each undertake to comply with the applicable Data Protection Legislation in respect of their Processing of such Personal Data as Data Controllers. The Parties agree that the [delete as appropriate Supplier/Buyer]: is the exclusive point of contact for Data Subjects and is responsible for all steps necessary to comply with the GDPR regarding the exercise by Data Subjects of their rights under the GDPR; shall direct Data Subjects to its Data Protection Officer or suitable alternative in connection with the exercise of their rights as Data Subjects and for any enquiries concerning their Personal Data or privacy; is solely responsible for the Parties’ compliance with all duties to provide information to Data Subjects under Articles 13 and 14 of the GDPR; is responsible for obtaining the informed consent of Data Subjects, in accordance with the GDPR, for Processing in connection with the Services where consent is the relevant legal basis for that Processing; and shall make available to Data Subjects the essence of this Annex (and notify them of any changes to it) concerning the allocation of responsibilities as Joint Controller and its role as exclusive point of contact, the Parties having used their best endeavours to agree the terms of that essence. This must be outlined in the [Supplier’s/Buyer’s] privacy policy (which must be readily available by hyperlink or otherwise on all of its public facing services and marketing). Notwithstanding the terms of clause 1.2, the Parties acknowledge that a data subject has the right to exercise their legal rights under the Data Protection Legislation as against the relevant Party as Controller. Undertakings of both Parties The Supplier and the Buyer each undertake that they shall: report to the other Party every [enter number] months on: the volume of Data Subject Request (or purported Data Subject Requests) from Data Subjects (or third parties on their behalf); the volume of requests from Data Subjects (or third parties on their behalf) to rectify, block or erase any Personal Data; any other requests, complaints or communications from Data Subjects (or third parties on their behalf) relating to the other Party’s obligations under applicable Data Protection Legislation; any communications from the Information Commissioner or any other regulatory authority in connection with Personal Data; and any requests from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law, that it has received in relation to the subject matter of the Contract during that period; notify each other immediately if it receives any request, complaint or communication made as referred to in Clauses 2.1(a)(i) to (v); provide the other Party with full cooperation and assistance in relation to any request, complaint or communication made as referred to in Clauses 2.1(a)(iii) to (v) to enable the other Party to comply with the relevant timescales set out in the Data Protection Legislation; not disclose or transfer the Personal Data to any third party unless necessary for the provision of the Services and, for any disclosure or transfer of Personal Data to any third party, (save where such disclosure or transfer is specifically authorised under the Contract or is required by Law) ensure consent has been obtained from the Data Subject prior to disclosing or transferring the Personal Data to the third party. For the avoidance of doubt the third party to which Personal Data is transferred must be subject to equivalent obligations which are no less onerous than those set out in this Annex; request from the Data Subject only the minimum information necessary to provide the Services and treat such extracted information as Confidential Information; ensure that at all times it has in place appropriate Protective Measures to guard against unauthorised or unlawful Processing of the Personal Data and/or accidental loss, destruction or damage to the Personal Data and unauthorised or unlawful disclosure of or access to the Personal Data; take all reasonable steps to ensure the reliability and integrity of any of its personnel who have access to the Personal Data and ensure that its personnel: are aware of and comply with their ’s duties under this Annex 2 (Joint Controller Agreement) and those in respect of Confidential Information are informed of the confidential nature of the Personal Data, are subject to appropriate obligations of confidentiality and do not publish, disclose or divulge any of the Personal Data to any third party where the that Party would not be permitted to do so; have undergone adequate training in the use, care, protection and handling of Personal Data as required by the applicable Data Protection Legislation; ensure that it has in place Protective Measures as appropriate to protect against a Data Loss Event having taken account of the: nature of the data to be protected; harm that might result from a Data Loss Event; state of technological development; and cost of implementing any measures; ensure that it has the capability (whether technological or otherwise), to the extent required by Data Protection Legislation, to provide or correct or delete at the request of a Data Subject all the Personal Data relating to that Data Subject that the Supplier holds; and ensure that it notifies the other Party as soon as it becomes aware of a Data Loss Event. Each Joint Controller shall use its reasonable endeavours to assist the other Controller to comply with any obligations under applicable Data Protection Legislation and shall not perform its obligations under this Annex in such a way as to cause the other Joint Controller to breach any of its obligations under applicable Data Protection Legislation to the extent it is aware, or ought reasonably to have been aware, that the same would be a breach of such obligations Data Protection Breach Without prejudice to Paragraph 3.2, each Party shall notify the other Party promptly and without undue delay, and in any event within 48 hours, upon becoming aware of any Personal Data Breach or circumstances that are likely to give rise to a Personal Data Breach, providing the other Party and its advisors with: sufficient information and in a timescale which allows the other Party to meet any obligations to report a Personal Data Breach under the Data Protection Legislation; all reasonable assistance, including: co-operation with the other Party and the Information Commissioner investigating the Personal Data Breach and its cause, containing and recovering the compromised Personal Data and compliance with the applicable guidance; co-operation with the other Party including taking such reasonable steps as are directed by the other Party to assist in the investigation, mitigation and remediation of a Personal Data Breach; co-ordination with the other Party regarding the management of public relations and public statements relating to the Personal Data Breach; and/or providing the other Party and to the extent instructed by the other Party to do so, and/or the Information Commissioner investigating the Personal Data Breach, with complete information relating to the Personal Data Breach, including, without limitation, the information set out in Clause 3.2. Each Party shall take all steps to restore, re-constitute and/or reconstruct any Personal Data where it has lost, damaged, destroyed, altered or corrupted as a result of a Personal Data Breach as it was that Party’s own data at its own cost with all possible speed and shall provide the other Party with all reasonable assistance in respect of any such Personal Data Breach, including providing the other Party, as soon as possible and within 48 hours of the Personal Data Breach relating to the Personal Data Breach, in particular: the nature of the Personal Data Breach; the nature of Personal Data affected; the categories and number of Data Subjects concerned; the name and contact details of the Supplier’s Data Protection Officer or other relevant contact from whom more information may be obtained; measures taken or proposed to be taken to address the Personal Data Breach; and describe the likely consequences of the Personal Data Breach. Audit The Supplier shall permit: the Buyer, or a third-party auditor acting under the Buyer’s direction, to conduct, at the Buyer’s cost, data privacy and security audits, assessments and inspections concerning the Supplier’s data security and privacy procedures relating to Personal Data, its compliance with this Annex 2 and the Data Protection Legislation; and/or the Buyer, or a third-party auditor acting under the Buyer’s direction, access to premises at which the Personal Data is accessible or at which it is able to inspect any relevant records, including the record maintained under Article 30 GDPR by the Supplier so far as relevant to the contract, and procedures, including premises under the control of any third party appointed by the Supplier to assist in the provision of the Services. The Buyer may, in its sole discretion, require the Supplier to provide evidence of the Supplier’s compliance with Clause 4.1 in lieu of conducting such an audit, assessment or inspection. Impact Assessments The Parties shall: provide all reasonable assistance to the each other to prepare any data protection impact assessment as may be required (including provision of detailed information and assessments in relation to Processing operations, risks and me

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend- controlshttps://▇▇▇.▇▇▇.▇▇/▇▇▇▇▇▇▇-▇▇▇▇▇▇/▇▇▇▇▇- delivery/spend-controls- controls-check-if-you-need-approval-to-spend- money-on-a-servicecheck-if-you-need-approval-to-spend-money-money- on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-agile- delivery/spend-controls- checkspendcontrolscheck-if-you-need-approval-to-spend-money-money- on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. OFFICIAL-SENSITIVE COMMERCIAL 76 Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud GCloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. OFFICIAL-SENSITIVE COMMERCIAL 77 Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information (NOT USED) This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces Data Flows and Data Sharing The newborn outcomes system automates referral of infants that screen positive for sickle cell disease and thalassaemia and supports the annexes collection and reporting of data. It replaces existing data flows used to support the newborn outcomes project previously run by KCL and currently held by NCARDRS, PHE and includes the same data set. The referral is created in the screening laboratory and shared with clinical centre(s) depending on local pathway. Data is added to the GDPR schedule contained within record by clinical teams. Removing the Framework Agreement need for clinicians to enter the same data twice (e.g. demographics, screening results, etc.) is one of the key requirements for the project. To enable integration with the NHR people who already have a user account on the NHR, will access the SCT Newborn Outcomes system through an interface in the NHR rather than logging in to a separate system. The interface in the NHR matches the main SCT Newborn Outcomes System, and incorporated into is provided as a 'view' onto the system for NHR users. Screening is a direct care service, newborn blood spot screening is recommended but it is not compulsory. Parental agreement is needed for children to be screened and this Call-off Contractpermission can be verbal; there is no need to separately obtain parental agreement for data to be used for QA and programme management purposes. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed PHE is party to the S7A agreement with NHS England that covers the provision of screening services by the Controller, who may take account NHS. The lawful basis for PHE to process personal data in the Newborn Outcomes System (points 1 and 2) is provided by General Data Protection Regulations (GDPR): • article 6(1)(e) - for the performance of a task carried out in the view public interest or in the exercise of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.official authority and;

Service Personal Data The Personal. Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion. ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇