This Data Processing Agreement ("Agreement") forms part of the service contract between the parties below for the processing of personal data contained on equipment entrusted to the Processor for secure erasure, destruction and disposal. It supplements the Triset Ltd Terms of Service and is entered into under Article 28 of UK GDPR.

PARTIES

1. SUBJECT MATTER & SCOPE

The Processor agrees to provide secure IT asset disposal services in respect of equipment listed in the Collection Manifest attached to this Agreement, including: secure collection and transport, certified data erasure to recognised UK sanitisation standards, physical destruction of media where erasure is not possible, and WEEE-compliant downstream disposal or recovery.

2. NATURE, PURPOSE & TYPES OF DATA

Nature: collection, secure storage in transit/at processing premises, erasure and/or destruction of data on client-owned equipment, and disposal of equipment.
Purpose: secure end-of-life disposal of the Controller's IT assets in compliance with the Controller's obligations under UK GDPR.
Data types: any and all data resident on the entrusted equipment (personal data, business data, or otherwise). The Processor does not access, read, copy or transfer any data content — all data is destroyed or erased without inspection.
Categories of data subject: as determined by the Controller's business (employees, customers, or third parties whose data resides on the equipment).

3. PROCESSOR OBLIGATIONS

The Processor shall:

• Process data only on the documented instructions of the Controller (this Agreement and the signed Collection Manifest constitute those instructions)
• Maintain chain of custody from collection to final disposal, evidenced by signed documentation
• Ensure erasure is performed using certified software meeting recognised UK data-sanitisation standards, or physically destroy media where erasure is not possible
• Issue Certificates of Erasure or Destruction per device, listing serial numbers, method and date, within 5 working days of processing
• Restrict access to entrusted equipment to authorised personnel only; store equipment securely pending processing
• Never access, read, retain, copy or transfer data content from entrusted equipment
• Transfer equipment for downstream recycling only to authorised treatment facilities (AATFs) via compliant waste documentation
• Notify the Controller without undue delay (and in any case within 48 hours) of any security incident affecting entrusted equipment
• Assist the Controller, on request, with data protection impact assessments or regulatory enquiries relating to the entrusted equipment
• On completion, return or securely dispose of all equipment strictly per the Controller's instructions on the Manifest

4. CONTROLLER OBLIGATIONS & WARRANTIES

The Controller warrants and confirms that:

• It is the lawful owner of the equipment, or holds valid authority to dispose of it, including all necessary internal and data-owner authorisations
• It has complied with its own obligations under UK GDPR prior to transfer (including, where relevant, informing data subjects and completing any required data protection impact assessments)
• All equipment listed on the Manifest is disclosed; the Processor accepts no responsibility for data on equipment not listed
• Any licensed software on the equipment is disclosed where its licence terms affect disposal

5. SUBPROCESSORS

The Processor engages authorised treatment facilities (AATFs) and, where applicable, vetted logistics subcontractors as subprocessors. The Processor shall ensure subprocessors are bound by written obligations no less protective than this Agreement, and remains fully liable for their performance. The current subprocessor list is available on request; the Controller may object to material changes on reasonable data-protection grounds.

6. LIABILITY

Nothing in this Agreement limits liability where limitation is prohibited by law. Subject thereto: the Processor's aggregate liability arising from this Agreement shall not exceed £250,000 per claim or series of connected claims, except where such loss arises from the Processor's failure to perform certified erasure or destruction as documented, in which case liability shall not exceed the proceeds value of the equipment plus £250,000. The Processor is not liable for data resident on equipment not disclosed on the Manifest, or for pre-existing damage to media preventing erasure (in which case destruction is performed and certified).

7. TERM & RECORDS

This Agreement applies to the collection job referenced above and to any further collections under the same commercial arrangement unless superseded by a newer Agreement. Both parties retain executed copies; the Controller retains certificates and waste documentation per its compliance obligations (minimum 2 years for waste records; certificates per the Controller's audit policy).

8. GOVERNING LAW

This Agreement is governed by the laws of England and Wales, under the exclusive jurisdiction of the courts of England and Wales.

SIGNATURES