BRACE Terms of Business Agreement

1. Parties to this agreement

1.1. This agreement is between Business Risk and Compliance Experts Ltd ("BRACE"), a business registered in England and Wales under registration number 14028577 at 1 Union Street, Long Eaton, Nottingham. NG10 1HH that supplies business, risk and compliance services, including data protection representative services, and;

1.2. any organisation that subscribes to any of the BRACE Services offered and supplied by BRACE (the "Client").

2. Commencement

2.1. This agreement shall begin when an organisation completes and sends the registration form and makes at least the first payment for the service required.

3. Interpretation and Definitions

3.1. In this Agreement:

3.1.1. “BRACE” means "Business Risk and Compliance Experts Ltd".

3.1.2. ‘Client” means the person, body, or organisation that subscribes to a data representation service offered to them by BRACE.

3.1.3. "Agreement" means this agreement.

3.1.4. "Base Amount" means fees for services.

3.1.5. "Business Day" means a weekday other than a public holiday.

3.1.6. "Effective Date" means the commencement date.

3.1.7. "Term" means the term of this Agreement, beginning and ending per the “Term” Clause in this agreement.

3.1.8. “Initial period” means the minimum duration of this agreement, namely 12 (twelve) months from the date of commencement of the services.

3.1.9. "Data Controller", "Data Processor", "Data Subject", "Personal Data", "Personal  Data  Breach", "Supervisory  Authority", and "Processing" shall have the same meanings as in the Data Protection Legislation and "Processed" and "Process" shall be construed per the definition of "Processing".

3.1.10. “Service” and “Services” means the Services offered by BRACE and accepted by the client as part of this agreement.

3.1.11. “Record of Processing Activity” means a record holding details of personal data that the client processes, together with the purpose and lawfulness of that processing.

4. Provision of the services

4.1. Subject to the terms and conditions of this agreement and subject to payment for those services to BRACE by the Client, BRACE undertakes to supply the services selected on the registration form to the client for the duration of this agreement.

4.2. Where applicable, BRACE will provide documentation to the Client so that the Client may be able to show compliance with data protection laws requiring the appointment of a Data Protection representative within the territory required.

4.3. During the agreement, BRACE shall carry out the services specified in the relevant package to the best of their ability and in a proper loyal and efficient manner.

4.4. Where a consultant’s time forms part of the service, nothing in this Agreement requires the Consultant to devote his whole time and attention to the client or implies that the relationship between the Client Consultant is that of employer and employee.

4.5. Where applicable, BRACE agrees to maintain an operation and contact details within the required territory representation is required and to inform the client of any changes to those details before any change takes place.

4.6. where applicable and unless the client objects to such service in writing, BRACE shall become the point of contact for supervisory authorities across the territories where the client has appointed them as their representative.

4.7. where applicable and unless the client objects to such service in writing, BRACE Shall become the point of contact for Data Subjects across the territories where the client has appointed them as their representative.

4.8. In cases where a supervisory authority brings about enforcement proceedings against a client, BRACE shall represent the client in those proceedings, but this will not affect the client’s ultimate liability to any such enforcement.

5. Obligations of the client

5.1. The client agrees and undertakes that it will promptly, upon the due date, pay all amounts invoiced by BRACE in respect of the services provided to the client.

5.2. The client agrees and undertakes that on termination of this agreement for any reason whatsoever by either party, it will cease to use and return any certificates, documents, tools, or other resources provided to them by BRACE as part of the service.

5.3. The client must send, in writing on request, all name/s of the person or persons who shall be the client’s duly authorised representative for the carrying out of the functions referred to in this agreement.

5.4. Where BRACE supplies representative services to the client, the client shall submit a Record Of Processing Activities in writing to BRACE that contains details of the type of personal data and categories of a data subject that will be processed together with the lawful basis of processing and details about the origin, security and retention.

6. Compliance with Data Protection Law

6.1. The client agrees and undertakes that it will abide by all applicable data protection laws and accepts that it is its responsibility to do so regardless of this agreement.

6.2. The client agrees and undertakes that it will abide by all reasonable procedures, requirements, and stipulations of BRACE relating to data protection compliance.

6.3. Where BRACE offers advice or support to the client as part of this agreement, it is the responsibility of the client to ensure that they put proper measures in place that take that advice or support into account.

6.4. The client is always responsible for paying for any penalties and adhering to any instructions or notices handed to them by any regulator.

6.5. The client shall be liable for any fines or other penalties issued to the BRACE if the penalty or other action is a result of the Client’s negligence or non-compliance with any data protection law, guidance, advice, or instruction.

7. Fees for services

7.1. The client shall pay the first payment before the commencement of the services; thereafter, the client shall pay BRACE fees for services as per any invoice sent to them within 14 (fourteen) days from the date of that invoice. 

7.2. Payments made to BRACE in respect of the service shall be free of any deductions, commissions, set-offs or exchanges.

7.3. All payments and charges to BRACE shall be due and owing within 14 (fourteen) days from the date of invoice to the client.

7.4. Where payment is not made within the required timescale, BRACE reserves the right to charge a £25 fee for late payment, together with interest at the prime rate charged by HSBC bank operating in England calculated from the date payment was due until the actual date of payment thereof.

7.5. BRACE reserves the right to increase fees for services on an annual basis.

7.6. All fees will still apply if the service is suspended.

7.7. In the event of cancellation due to non-payment, a cancellation charge equivalent to 3 months fee shall apply.

7.8. Services will be suspended if payment, including the charge for overdue payment, is not made by 14 days after the due date, and a late payment fee of £25 shall apply.

7.9. Services will be cancelled if payment, including the charge for overdue payment, is not made by 30 days after the due date, and a cancellation fee of the equivalent of 3 months’ fees will be applied, which will itself become payable within 30 days.

7.10. Where applicable, when services are cancelled because of non-payment, relevant third parties, including data protection authorities, will be notified that BRACE no longer acts on behalf of the client.

8. General

8.1. Where applicable, because representative services have been selected on the registration form, this agreement forms the written agreement required to comply with GDPR Article 27.

8.2. Where applicable, because representative services have been selected on the registration form, from the commencement date, the client appoints BRACE as their Data Protection Representative in the selected territory.

8.3. No breach of any provision of this Agreement shall be waived except with the express written consent of the party not in breach.

8.4. No variation or modification of this agreement shall be of any force or effect unless the same shall be confirmed in writing and signed by all parties, and then such variation or modification shall be effective only in the specific instance and for the purpose and to the extent for which made or given.

8.5. The clause headings in this agreement have been inserted for convenience only and shall not be considered in its interpretation.

8.6. This agreement, together with the registration form and invoiced line items, constitutes the whole and the entire agreement between the parties concerning the subject matter hereof.  All other warranties and representations not contained herein are excluded.

8.7. No waiver by a party of any breach, failure, or default in performance by the other party, and no failure, refusal or neglect by a party to exercise any right in terms of this agreement or to insist on strict compliance with or performance of any of the other party’s obligations under this agreement shall constitute a waiver of the provisions of this agreement.

8.8. The client shall not be entitled to set off any amounts that may be owed to him by BRACE against any amount he owes or may owe BRACE in terms of this agreement.

8.9. All prices and charges set out in this agreement and any new price list are exclusive of value-added tax. 

8.10. Where applicable, The Client shall be liable for and shall pay the amount of value-added tax in respect of this agreement or any other form of tax that may be imposed and be payable in place of such value-added tax or besides thereto.

8.11. The Agreement shall be governed by and construed and take effect per English law.

8.12. The courts of England and Wales shall have exclusive jurisdiction over any disputes arising out of or in connection with this Agreement.

8.13. Both parties warrant that they have the legal right and authority to enter into this Agreement and to perform their obligations under this Agreement.

8.14. The Client acknowledges that BRACE does not act exclusively for them. 

8.15. When data is shared, the receiving party will treat and keep all confidential information of the disclosing party as confidential

8.16. All intellectual property rights belonging to a party before this agreement shall remain vested.  None of the intellectual property rights, trademarks and brands shall be used by the other party without their written consent.

8.17. The client’s liability to BRACE for any regulatory losses, fines, expenses, or other losses arising from a breach of any law or regulation is not excluded or limited by this agreement.

8.18. BRACE’s liability to the Client shall not exceed the amount paid to BRACE by the client in the preceding 12 months.  Nothing in this agreement shall limit BRACE’s liability for losses incurred by the client because of BRACE’s wilful default or negligence.

8.19. Neither party to this agreement shall not cede, assign, transfer, encumber or delegate any of its rights and obligations in terms of this agreement to any third party without the prior written consent of the other, and that consent shall not be unreasonably withheld.

8.20. Neither party shall be in breach of this agreement nor liable for delay in performing, or failure to perform, any of its obligations under this agreement if such delay or failure results from events, circumstances or causes beyond its reasonable control (Force Majeure Event).

8.21. If a Force Majeure Event affects BRACE’s performance of the services, the charges for the services shall be subject to reasonable modification.

9. Processing of personal data 

9.1. To the extent that either party processes personal data in connection with the performance of its obligations under this agreement, each party will comply with the requirements of all data protection regulations.

9.2. Under the terms of this agreement, the client will act as a data controller to clients for the purposes and duration of the agreement, and BRACE will act as a data processor on behalf of the Client.

9.3. When acting as a controller, the client shall document the lawful basis for processing, inform data subjects of all the required detail required by data protection regulations and gain any required consents.

9.4. Each party may use carefully selected sub-processors to assist with processing.  When this is the case, it shall be done under the protection of a written agreement, and the sub-processor should be held to the same exacting standards of security.

9.5. Each party will assist the other in responding to data subjects who wish to exercise their rights of access, erasure, and restriction by notifying you of any such requests in a reasonable time

9.6. Each party may continue to be a data controller in their own right for their purposes and not in such a way that determination and means of data processing would be shared or joint.  Where this is the case, each party remains responsible for its obligations to comply with all data protection regulations.

9.7. Each party shall deploy appropriate technical and organisational measures to protect any personal data against any unauthorised or unlawful processing and accidental loss, destruction, or damage.  Such measures shall include:

9.7.1. taking reasonable steps to ensure the reliability of employees and third parties which have access to the personal data. 

9.7.2. acting only per the terms of this agreement.

9.8. Each party shall notify the other party immediately upon becoming aware of any actual, suspected, or alleged breach of data protection regulations.

10. How BRACE uses personal information about the Client

10.1. We will use your information to manage our relationship, provide our services for assessment and analysis, meet our obligations to any relevant regulatory authority, develop and improve our services to you and our clients and protect our interests. 

10.2. By 'your information’, we mean any information about you or your firm that you or third parties provide to us.

10.3. Where you provide personal and financial information relating to others (e.g. colleagues, partners, directors), you confirm that you have their consent or are otherwise entitled to provide this information to us.

10.4. We will retain information collected about you for as long as permitted for legitimate business purposes.

10.5. You can view our privacy notice on our website. 

11. Term and termination

11.1. This agreement shall commence on the date of commencement in clause 2 of this agreement and shall continue for 12 months, at which time there will be 1 month where either party may serve notice of termination in writing, giving no less than 1 month’s notice. After that month, the contract shall renew for a further 12 months, and that pattern shall repeat on an annual basis until either party serves such notice.

11.2. BRACE may, without prejudice to our other rights or remedies, end this Agreement if the client is in breach of it or any regulation.

11.3. At their sole discretion, BRACE may decide to void this agreement from its start if the client is in breach or infringement of any law.  Where this is the case, BRACE will return any fees paid by the Client to the Client and inform all relevant third parties, including regulatory authorities, that the agreement has been made void.

11.4. Services will be suspended if payment, including the charge for overdue payment, is not made by 14 days after the due date.

11.5. Services will be cancelled if payment, including the charge for overdue payment, is not made by 30 days after the due date, and a cancellation fee of the equivalent of 3 month’s fees will be applied, which will itself become payable within 30 days.

12. Confirmation of Agreement

12.1. BRACE confirms its acceptance of this Agreement by offering the service that the client has accepted.

12.2. The Client confirms their acceptance of this Agreement when they complete the registration form and submit it to BRACE.

12.3. By accepting this agreement, the client confirms that they are complying with all applicable data protection laws and regulations without the need for any more support and advice from BRACE than that which is included in the representative service and that they will keep BRACE up to date with a record of processing activities at all times.