General Terms and Conditions for ONTRACK Data Recovery Services


1.1 These terms and conditions ("Terms") govern the supply of Data Recovery Services to you by KLDiscovery Ontrack Limited, registered in England and Wales, Company Number 02669766 trading as “Ontrack”).  Please read these Terms carefully before you submit your Order to us. These Terms tell you who we are, how we will provide the Services to you, how you and we may change or end the Contract, what to do if there is a problem and other important information.

1.2 Our Service Description for data recovery services as well as the Data Processing Agreement (DPA), which regulates the processing of personal data within the scope of the provision of our service, is part of these Terms. For more information on the features and limitations of our data recovery service, please read our service description. The DPA governs the processing of personal data provided to Ontrack by the customer for data recovery purposes.

1.3 For information on how we, as the responsible party, collect, process and store personal data, please refer to our privacy policy.

1.4 Terms and conditions of the customer or third parties are explicitly excluded and shall not apply. These Terms and Conditions Service Description and DPA shall also apply to all future business relations, even if they are not expressly agreed again.

1.5 The services are predominantly provided in our laboratory in England. Ontrack has technical facilities and locations in Europe and the USA. If required, you hereby grant Ontrack access to data on storage devices from any Ontrack facility, including the United States of America, in order for Ontrack to provide the services. Please refer to Clause 6.3.



2.1 How to contact us. You can contact us by telephoning our customer service team on +44 (0)1372 741 999, by writing to us at Nexus, 25 Farringdon Street, London, EC4A 4AB or



3.1 In these Terms the following definitions will apply:

(a) "Business Customer" means a customer acting for the purpose of their business, trade or profession including, without limitation, a sole trader, partnership, limited company or public authority;

(b) "Backup Media" means an Ontrack data carrier on which the recovered data is stored in encrypted form. This is usually a USB hard drive.

(c) “Confidential Information” means any information disclosed or communicated by one party to the other party in the course of the business relationship and where the receiving party had a legitimate expectation, based on a marking of the relevant information as confidential or in good faith based on the nature of the information, that the disclosing party had a particular protectable interest in keeping the relevant information confidential;

(d) “Consumer Customer” means a customer that is an individual who is not acting for the purposes of a business, trade or profession (excluding, for the avoidance of doubt, any Business Customer);

(e) “Contract” means as defined in Clause 4.4;

(f) “Customer” means both a business customer and a consumer customer.

(g) "Data" means data in electronic form of any description, including 'personal data' as defined by the General Data Protection Regulation EU 2016/679 and/or the Data Protection Act 2018;

(h) "Equipment" means your Media and, if applicable, mobile phone or tablet;

(i) "Fee" means the fee payable by you for the Services, as set out in the relevant Quotation;

(j) "Media" means storage media such as hard-drives, USB drive, SSD, memory chips, tapes or other data carriers;

(k) "Order" and "Quotation” means as defined in Clauses 4.5 and 4.1;

(l) “Service Descriptions” means the specific processes employed by Ontrack as more described at the following link, which sets out, amongst other matters, service limitations, service levels and expectations;  

(m) "Services" means the data recovery services to be provided by us to you, as described in Clauses 4 (Order Process) and 5 (Services) of these Terms as well as in the Service Description; and

(n) "Website" means our website at or such other website as we use to operate our business from time to time.


4. ORDER PROCESS (Quotation and Order)

4.1 Excluding mobile phones and tablets, for standard data recovery, following an initial telephone consultation, submission of an online form via our Website or email, you will send us your Equipment for our evaluation.  We will use reasonable endeavours to: (a) examine the Equipment to determine: (i) what Data is accessible on the Equipment: (ii) the cause of any damage to the Equipment and/or the Data on the Equipment; and (iii) the amount of Data (if any) likely to be recoverable on the Equipment; ("Evaluation"); (b) report the results of our Evaluation to you.  In most cases, we will provide you with a quotation setting out the scope of Services and applicable Fee broken into two parts: (i) the optional diagnosis; and (ii) the full data recovery. For complex cases, you will be offered a paid diagnosis due to the potential complexity of the data recovery (collectively the "Quotation").  All Services will be provided according to the Service Descriptions.    

4.2 In the Quotation, where the diagnosis is listed as optional, this stage is automatically applied to the Quotation as the diagnosis will provide more detailed information on the success of the data recovery.  If the optional diagnosis is selected, following payment, you will receive a file listing specifying the Data that is likely to be recovered once the full data recovery is completed.  Subject to your cancellation rights set out in section 8 below, both optional and paid diagnosis fees are not refundable once the work has been completed, irrespective of the outcome of the diagnosis.  In some cases, the diagnosis will indicate that a full data recovery is not likely to be successful and only a partial data recovery is expected.  In addition to a Consumer Customer’s statutory cancellation rights (see section 8 below) regarding diagnosis, the optional diagnosis can be cancelled at any time within 24 hours of the Quotation acceptance. 

4.3 For mobile phones and tablets, you will be provided with a fixed price quotation following Ontrack’s receipt of details from you.  Mobiles and tablets do not require an evaluation by Ontrack’s engineers.  For mobiles and tablets, Ontrack will provide you with a free diagnosis report outlining the likely recovery of your Data.  You will then be able to choose to proceed with the data recovery process at the price specified in the Quotation.    

4.4 For other Services, such as remote data recovery (“RDR”) where you do not submit any Equipment to us, or degaussing, the Quotation shall consist of the work expected to be required by Ontrack to perform the Services.

4.5 Following receipt of our Quotation, you may at your option either: (i) accept and sign the service request or statement of work to submit an order for our Services ("Order"); (ii) submit a request for us to return your Equipment (if applicable), the delivery cost of which you agree to pay; or (iii) submit a request for us to destroy your Equipment, in which case we will be permitted to immediately destroy your Equipment.  If we do not receive an Order or request to return your Equipment within 90 (ninety) calendar days of the date of the Quotation, we will dispose of your Equipment in line with applicable law.

4.6 Our acceptance of your Order will take place when we send you an email confirmation of our acceptance, at which point a legally binding contract will come into existence between you and us, governed by these Terms ("Contract"), including the Service Description and DPA.  We will assign an order number to your Order. It will help us if you can tell us the order number whenever you contact us.



5.1 You have the following options to provide us with your devices: (i) you may drop off your Storage Media in person at our business premises during opening hours (prior notice required); (ii) you may arrange for a courier service of your choice at your own expense, and, if this option is chosen, Ontrack will provide you with packaging instructions for your Devices.  Alternatively, Ontrack offers a third-party pick-up service by selecting the "Pick-up and Delivery" option during the order process.  Ontrack will send you a shipping label for your package along with packing instructions and inform you of the location where you can drop off your media for collection by the third-party courier.

5.2 All storage media should be packed in accordance with the instructions at at as Ontrack will not be liable for any damage to your equipment during transit if the packages are incorrectly packed.

5.3 Following the diagnosis or restoration (see section 6), we will send your Backup Media to your address by means of a recognised courier service. Please contact Ontrack before completing the order if you do not want Ontrack to return your backup media by courier.  You can also use a courier service of your choice at your own expense, for example, or collect the backup media in person from our business premises during opening hours (by prior appointment).

5.4 The costs for returning your equipment are based on the information in the respective offer.  You will be informed of the exact costs during the ordering process.



6.1 In return for your payment of the Fee, we will perform provide the Services with reasonable care and skill. For a detailed description of the services, please refer to our Service Description. The Service Description is part of these Terms. We will use reasonable endeavours to: (i) restore your Data and provide you with the restored Data on an encrypted Backup Media; or (ii) perform any other Services that we have agreed with you in writing to provide, such as erasing the Data from the storage media.

6.2 When examining the Devices, we will take reasonable precautions to determine: (i) what data on the Devices is accessible and recoverable; (ii) what damage to the Devices and/or data structures may be identified; (iii) how much data (if any) on the Devices is likely to be recoverable; and (iv) to advise you of the expected results of recovering data from the Devices. Our data recovery services may include data recovery of data in the laboratory, through the provision of software solutions and, for business customers, by means of remote data recovery. 

6.3 We provide most of our services at the premises of KLDiscovery Ontrack Limited at Nexus, 25 Farringdon Street, London, EC4A 4AB, England, United Kingdom of Great Britain and Ireland. However, we may also send your device to a sister company located in the European Economic Area. In line with Clause 1.5 we may also be required to access your data remotely from outside the United Kingdom or European Economic Area to provide the Services.

6.4 Mobile Phone Repair.  The primary service we offer will be the recovery of the Data from the mobile phone and we do not offer a standalone mobile phone repair.  In some cases, the work required for a data recovery may result in the partial or temporary repair of the mobile phone.  In such cases, this may result in the restoration of functionality to the mobile phone so that you are able to use it in normal usage conditions but Ontrack does not offer any guarantee or warranty with respect to such repairs.

6.5. Degaussing.  Ontrack will place your Equipment into a degaussing unit which is a machine which effectively and securely scrambles the magnetic data held on the Equipment.  Following the degaussing process, the Data is no longer readable and will have been securely destroyed.

6.6 Remote Data Recovery – applicable only to business customers. With Remote Data Recovery (RDR), the above Terms will apply. Ontrack will require the customer to connect to the customer's internal network. No devices will be submitted to Ontrack’s lab, unless requested. For remote data recovery, you must download and install the Ontrack RDR customer software from the link provided by Ontrack. Once installed, the RDR customer allows the user to connect to Ontrack via an encrypted internet connection. The RDR connection is used by Ontrack solely to run the Ontrack recovery tools directly on the customer's computer. Ontrack uses the RDR connection to store the Ontrack Recovery Tools on the customer's computer in a protected folder.  Your data will not be transmitted to Ontrack during this process. Once the RDR is complete, the Ontrack Recovery Tools are deleted from the customer's computer. Ontrack warrants that the RDR Customer Software, (a) is free of program code or program instructions intentionally designed to interrupt, disable, damage, interfere with or otherwise adversely affect computer programs, files or operations; and (b) does not contain other malicious or harmful code typically referred to as viruses or described by similar terms including Trojan horse, worm or backdoor.

6.7 At the time of entering the Contract, we can only estimate the time when your data recovery is likely to be completed. It is not possible to provide a specific date for a completed Data Recovery due to the nature of the Services. However, you will be informed of the estimated completion date during the provision of the service. When you receive your backup media containing your recovered data from Ontrack, we ask that you immediately check the backup media (USB hard drive or other storage device) for technical functionality. Ontrack can only reproduce your recovered data in the event of a failure of the backup media within our data retention period for your recovered personal data as set out in Ontrack's Data Processing Agreement. The costs of returning the Equipment will be as set out on the relevant Quotation. 

6.8 For some Services, we may need certain information from you such as user names, passwords and/or access codes.   If you do not provide this information within a reasonable time of our request, or if you provide incomplete or incorrect information, we may make an additional charge of a reasonable sum to compensate us for any extra work that is required as a result. We will not be responsible for supplying the Services late or not supplying any part of them if this is caused by you not giving us the information we need.

 6.9 We may have to suspend the supply of Services to: (i) deal with technical problems or make technical changes; (ii) update the Services to reflect changes in relevant laws and regulatory requirements; (iii) make changes to the Services as requested by you.  We may also suspend supply of the Services if you do not pay after giving you notice.

6.10 While we use approved original equipment manufacturer repairs, we offer no guarantee that the Services will be consistent with any warranty offered by the original equipment manufacturer.  Our performance of the Services should, under no circumstances, be taken as a guarantee that the Services will be successful, that all or any of your Data is recoverable or will be useable, that the Mobile Phone will be capable of being used or that we will achieve any other particular result. No success is owed within the scope of our service provision.

6.11 Please note that we may not accept all Apple products for data recovery. Our data recovery services do not usually include data recovery from iPhones/iPads after a factory reset. In cases where data is lost from an iMac, in most cases we will require the storage device to be removed from the iMac prior to sending in to our Ontrack facility. Please contact our customer service team before sending in Apple products as an Ontrack representative will be able to provide you instructions or recommendations for your case.



7.1 Your Equipment and Data shall at all times remain your property, and we shall have no right, title or interest in or to them (except the right to possession and use of your Equipment and Data to perform the Services).  You retain all intellectual property rights you have in your data.

7.2 All intellectual property rights related to the provision of the Services shall remain with Ontrack, including the development, creation and provision of the Services, inventions, copyrighted works, methods, processes and know-how used to develop or comprise the Services, together with any hardware, firmware, platforms, software and any modifications, enhancements, new features or functionality created or used by Ontrack as part of the Services ("KLD-IP").



8.1 This Clause 8 applies solely to our Contracts with Consumer Customers.  Following an Order, you have a legal right to change your mind.  These rights, under The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, are explained in more detail below.

8.2 During the Free Evaluation, you can cancel at any time.  If you place an Order including any diagnosis, you can cancel within 14 (fourteen) days after the day we email you to confirm we accept your Order. However, once we have completed the Services, you cannot change your mind, even if the period is still running. By placing an Order, you expressly authorise us to commence the Services immediately.  If you cancel after we have started the Services, you must pay us for the Services provided up until the time you tell us that you have changed your mind.  We will tell you what this Fee will be following the cancellation request.

8.3 To cancel the Order, you can do so through one of the following methods of communication by providing your Order number, name, address and cancellation request:

(a) Phone or email. Call customer services on +44 (0)1372 741 999 or email us at;

(b) By post. write to us at Nexus, 25 Farringdon Street, London, EC4A 4AB ; or

(c) By Cancellation Form: complete and send to us a cancellation form in the format of the Model Cancellation Form included as a Schedule to these Terms.

8.4 The optional diagnosis can be cancelled within 24 hours of the Quotation using the same cancellation methods set out above. 



9.1 This Clause 9 applies solely to our Contracts with Business Customers. Following an Order, you shall not be able to terminate the Services unless set out in clause 10 below.



10.1 Without affecting any other right or remedy available to either Party, each Party may terminate the Contract with immediate effect by giving written notice if:

(a) Either Party commits a material breach of any term of the Contract which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 7 (seven) days after being notified in writing to do so or repeatedly breach these Terms.  A failure to pay the Fee shall constitute a material breach; or

(b) either Party ceases (or threatens to cease) to trade all or part of its business, has a liquidator, receiver or administrative receiver appointed to it or over any part of its undertaking or assets or passes a resolution for its winding up (otherwise than for the purpose of a bona fide scheme of solvent amalgamation or reconstruction where the resulting entity shall assume all of the liabilities of it) or a court of competent jurisdiction makes an administration order or liquidation order or similar order, or enters into any voluntary arrangement with its creditors, or is unable to pay its debts as they fall due, or, if an individual, becomes bankrupt; and/or

(c) (Ontrack's right of termination): the Customer fails to pay the remuneration for the Data Recovery Services when due.

10.2 We may terminate the Contract if, by performing the Contract, we may breach applicable export and sanctions laws relating to dealings with certain companies and individuals set by the European Commission or other national authorities, including the United States.  You agree to provide, upon our request, proof of identity for the purpose of verifying the applicability of applicable export and sanctions law You agree to provide, upon our request, proof of identity for the purpose of verifying the applicability of applicable export and sanctions laws.          10.3 If the termination is for a reason for which Ontrack is not responsible, the Customer is obliged to pay the agreed remuneration for all data recovery services provided by Ontrack until the termination takes effect. 



11.1 You hereby acknowledge and warrant to us that: (i) you are legally capable of entering into binding contracts; (ii) you have full authority, power and capacity to agree to these Terms and if you are a Business Customer have the appropriate legal authority to conclude the Contract; (iii) all the information that you provide to us in connection with your Order is true, accurate, complete and not misleading; (iv) you are the owner of the Equipment and/or have the permission from the owner of the Equipment for us to perform the Services;  (v) your supply of your Equipment and/or Data to us will not breach any obligations or rights of any third parties; (vi) your supply of your Equipment and/or Data to us will not breach any applicable law; (vii) you are legally permitted to grant access to the Data; (viii) your Equipment does not contain any material (including without limitation any Data) which may infringe the Intellectual Property Rights of any third party; and (ix) your Equipment does not contain any material which will breach applicable law. 

11.2 We reserve the right (and you hereby acknowledge that we have the right) to request documentary evidence of your ownership, permission or legal right to authorise the Services and to suspend or not commence the Services without receipt of such evidence. You agree to provide us with documentary evidence of identity upon request to enable us to verify the applicability of any applicable export and sanctions regulations in accordance with Clause 11.2.

11.3 You hereby acknowledge that your Equipment and/or Data may already be damaged prior to our receipt of them, and that our efforts to complete the Services may result in the destruction of, or any further damage to, your Equipment and/or Data. We will take reasonable care in performing the Services, but will not, save as specified in section 13 of these Terms, bear any responsibility for existing or additional damage that may occur to your Equipment and/or Data during our performance of the Services. This does not affect the provisions of clause 14.



12.1 The price of the Services will be the fee as set out in the relevant Quotation. VAT shall be added at the statutory rate and, if applicable, is payable by the Customer. Payment may be made by cash, bank transfer or credit card, or for business customers also by order on account (order number).

12.2 In the case of cash payments, advance bank transfer, or credit card payment, the fee is generally payable prior to the commencement of the Services (prepayment) or, if applicable, at the time specified in the payment agreement made separately with Ontrack. If you fail to pay any amount due to us under the Agreement, we may retain the Equipment and Data until payment is made in full. In the event of a cancelled, late or non-payment, you will receive a first reminder (text form) after payment is due. If payment is not received after the first reminder, you will receive another reminder before we reserve the right to hand the claim over to our collection agency. We further reserve the right to claim default interest or issue further claims.

12.3 If you pay by credit/debit card, Ontrack will send you a payment link to a secure 3rd party payment platform to to authorise the payment and complete the payment process once the work is completed but before the backup media is sent to you.

12.4 Business customers will receive an invoice. If you do not pay the invoice in full within the agreed payment period, we will send you a reminder (text form). If payment is not received after the first reminder, you will receive another reminder before we hand the claim over to our collection agency. We will charge interest on arrears at the legally permissible rate in the event of late payment. We reserve the right to assert further claims (e.g., for damages caused by default).

12.5 No Data will be provided by Ontrack until payment has been made in full for the applicable Order. If you fail to pay to us any amount due under these Terms we may retain the Equipment and Data until you make full payment.  If you do not make full payment within 90 (ninety) calendar days of the due date we may, without liability or consulting you further, dispose of your Equipment and/or Data in line with applicable law.  We will also charge interest to you on the overdue amount at the rate of 4% a year above the base lending rate of Barclays Bank plc from time to time. This interest will accrue on a daily basis from the due date until the date of actual payment of the overdue amount, whether before or after judgment.



13.1 We do not accept responsibility for any corruption of, or physical or other damage to, or destruction of your Equipment, your Data, or any other equipment that may occur, or invalidation of any warranties in respect of your Equipment or other equipment, either: prior to our receiving your Equipment, your Data, or other equipment; or in the course of our providing the Services where such damage, destruction, corruption or invalidation arises from our performing the Services in accordance these Terms.

13.2 Whilst we will use reasonable endeavours to take care of your Equipment or Data whilst in our possession, we will not be responsible to you if any of your Equipment or Data is lost, destroyed, corrupted or otherwise damaged through fair wear and tear.

13.3 We do not exclude or limit in any way our liability to you where it would be unlawful to do so. This includes our liability for death or personal injury caused by our negligence or the negligence of our employees, agents or subcontractors; for fraud or fraudulent misrepresentation; and for Consumer Customers, for breach of your legal rights in relation to the Services and for defective Services under the Consumer Protection Act 1987.

13.4 Subject to the provisions of this clause 12, our total liability to you, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with a Contract shall be limited to (i) in cases of breach of confidentiality, data protection or intellectual property, the greater of £10,000 or the value of the Fee payable under the applicable Contract; or (ii) in any other case, the value of the Fee payable under the Contract.

13.5 Neither Party shall be liable to the other, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with these Terms or any Contract for any indirect or consequential loss, loss of profits or loss of sales or business.

13.6 Use of Couriers.  Consistent with the provisions of section 5, In collecting your Equipment prior to the commencement of the Services, or in delivering the recovered Data and/or original Equipment, we outsource such service to nationally recognised courier companies.  By agreeing to us using them for the Services, you agree that any loss or damage to the Equipment or Data shall be expressly subject to the terms and conditions provided by the applicable courier company, including limitations of liability and compensation limits.  You hereby waive all right to bring any claim against Ontrack for any loss or damage to Data or Equipment arising from negligence and/or breach of contract by the courier company beyond any compensation scheme set out by them.  



14.1 You shall indemnify us in full against and hold us harmless from all claims, costs, damages, liabilities, expenses (including without limitation legal expenses) demands and judgments awarded against or incurred or paid by us as a result of or in connection with any and all of your acts, inactions and/or omissions connected with the Contract and these Terms.



15.1 Information on how we collect, process and retain your personal data, please see our Privacy Policy at the following link on our website:




16.1 To the extent that Ontrack processes personal data for you as a customer in the course of data recovery, our Data Processing Agreement applies, which is available at



17.1 Each party agrees to not disclose any Confidential Information of the other party to any third party without the prior written authorisation of the party disclosing the Confidential Information and to:  (i) use such Confidential Information only for the purposes of carrying out its obligations pursuant to these Terms; (ii) use the same methods and degree of care to prevent disclosure of such Confidential Information as it uses to prevent disclosure of its own proprietary and Confidential Information but in no event less than reasonable care; and (iii) disclose Confidential Information to its employees and approved third parties, only on a need-to-know basis provided that all such persons are bound by duties of confidentiality no less onerous than are set out in these Terms.

17.2 Confidentiality obligations shall not apply to any Confidential Information: (i) which enters the public domain through no fault of the recipient party; (ii) which was known to the recipient party prior to receipt from the other party; (iii) which is disclosed to the recipient party by a third party (other than employees or agents of either party) in circumstances that such disclosure is not in violation of any confidentiality obligation to the party disclosing the Confidential Information; or (iv) which is independently developed by the recipient party without recourse to Confidential Information.



18.1 This Contract is between you and us. No other person shall have any rights to enforce any of its terms.  Each of the paragraphs of these Terms operates separately. If any court or relevant authority decides that any of them are unlawful and/or unenforceable, the remaining paragraphs will remain in full force and effect.  If we delay in taking steps against you in respect of your breaking this contract, this will not prevent us taking steps against you at a later date.

18.2 We may change the Services to reflect changes in relevant laws and regulatory requirements and to implement minor technical adjustments and improvements, for example to address a security threat. These changes will not affect your use of the Services. In addition, we may make more material changes to these Terms or the Services, but if we do so we will notify you and you may then contact us to end the Contract before the changes take effect and receive a refund for any Services paid for but not received.

18.3 As well as any other rights you have under law or regulation, if you are resident in the European Union, you may have the option to submit complaints on the European Union’s Online Dispute Resolution platform (the “Platform”) which facilitates the settlement of disputes online.  For more information, please visit the Platform on Ontrack does not intend to use the Platform to settle disputes and you accept that Ontrack is under no obligation to use the Platform to settle any disputes.

18.4 These terms are governed by English law and each Party may bring legal proceedings in the courts of England and Wales.

Effective: 1 July 2023


Schedule - Model cancellation form

(Complete and return this form only if you wish to withdraw from the contract)





Subject: Revocation of the service contract


I/We* hereby give notice that I/We* cancel my/our* contract for the supply of the following service*,

Ordered on*/received on*,        

Name of consumer(s),  

Address of consumer(s),              

Ontrack customer number,

Signature of consumer(s) (only if this form is notified on paper),


Sign: __________________


*Delete as appropriate


Service description for Ontrack data recovery services

1. The data recovery process, Ontrack's service and limitations

a) Data recovery services are carried out in several steps:

  • The Evaluation - see section 2 below -; or/and
  • The Diagnosis - see section 4 below -; and
  • Data Recovery after Evaluation or Diagnosis - see section 5 below -, or RDR Remote data recovery service for business customers - see section 6 below.
  • Quotation for smartphones and tablets – see section 3 below;

b) Ontrack will recover as much data as possible from one or more damaged media by taking the appropriate measures. Ontrack does not test usability or compatibility on any application software.

c) It is possible that deleted and/or corrupted data cannot be read even when using Ontrack's tools and technologies. Therefore, Ontrack cannot guarantee that data on damaged media can be recovered, repaired or read.

d) Ontrack will examine media to determine what damage needs to be overcome in order to recover data and data structures to the point where they are likely to be read and used again in their respective applications. To do this, Ontrack applies the highest technical standards and proprietary processes, as well as software and hardware tools. Due to the nature of Ontrack's work with damaged data or media, there is a general risk that any remaining data on the damaged media may be partially or completely lost or destroyed. 

e) The customer acknowledges that there remains a risk that:

  • once existing data can no longer be recovered, additional data may be lost;
  • recovered data can no longer be used by the customer;
  • the information content embodied in the storage media is destroyed in whole or in part; and
  • the data carriers, software and other items provided may be damaged, unusable or destroyed.

2. Evaluation 

a) The Evaluation is an initial assessment by an experienced data recovery engineer that determines what damage can be seen on the media to give an estimate of the amount of data that can be expected to be recovered. The Evaluation can be used for HDDs, SDDs and RAID/NAS systems. Excluded from the Evaluation service are, among others, mobile phones, tablets and flash media, as well as media with deleted data, water and fire damage, and storage media that have already been opened. During the evaluation, the client's data  carrier  is connected to our own  proprietary systems and opened if necessary. In the Evaluation, no data is copied/backed up (imaged) or further analysed. No listing of recoverable data sets or indication of which files can be recovered is produced. Ontrack does not provide a standalone damage report.

b) Ontrack will inform the Customer after the Evaluation whether (i) a data recovery is eligible, (ii) a further chargeable diagnostic is required to determine the data recovery options including the amount of data likely to be recoverable (see Section 3); (iii) or a data recovery cannot be performed by Ontrack in the circumstances.

c) An assessment of the likely success of a data recovery after the Evaluation is made on the basis of the following classifications:

  • Excellent - We expect 95-100% of your data to be successfully recovered.
  • Good. We expect 75-100% of your data to be successfully recovered.
  • Partially recoverable- We estimate that a small portion of your raw data can be recovered in the range of up to 50%.
  • Complex Due to the complexity of the failure, we cannot yet give an exact percentage for the recoverability of your data. Therefore, we recommend an extended diagnosis in this case.
  • Not recoverable - We cannot access the data on your data carrier.

d) The assessment of the chances of success of a data recovery based on the above classification is no guarantee that the percentages listed in section 2 letter c) will be met, as neither physical nor data structural damage is repaired in an Evaluation.

e) If requested by the Customer, Ontrack may, after the Evaluation, carry out a diagnosis, subject to a fee, which includes, where possible the creation of a Verifile File List, which can more accurately determine the amount of data to be recovered (see section 3 below).  Please note, it is not always possible to provide a File Listing in the eventuality that no data is recoverable.

f) If the Customer places an order for diagnosis or data recovery based on the results of the  Evaluation (see section 4 below), Ontrack will perform the applicable service, either diagnosis (see section 4) or data recovery (see section 5).

g) The Customer may decide not to perform the data recovery or diagnosis after the Evaluation in which case the order is complete.  If the Client so wishes, the media will be returned to the Client for the fee specified in the quotation form. Otherwise, the media will be securely disposed of.

h) Please note that processing during the evaluation may damage the customer's equipment. 

3. Quotation for smartphones and tablets (charged diagnosis)

a) Mobiles and Tablets do not require an evaluation. The first step is to provide Ontrack with information for Ontrack to determine the device type and whether the damage is logical and/or physical.

b) The customer is then provided with a fixed price quotation for data recovery. Upon receiving the device, Ontrack will perform a Diagnosis and provide a report to the customer specifying the amount of data Ontrack expects to recover.  Ontrack requires the customer to supply the passcode for the smartphone or tablet.  The customer may decide not to perform the data recovery after receiving the diagnosis report, in which case the process is complete.

c) If the customer decides to proceed with a data recovery, Ontrack will begin the data recovery as described in section 5.

4. Diagnosis

a) For the recovery of data on smartphones, tablets or flash media or in the case of specific data damage, Ontrack offers a chargeable diagnosis (and not an Evaluation – see section 3 above). In all other cases, Ontrack may also recommend a diagnosis after the Evaluation has been carried out, especially in the case of complex damage. A Diagnosis may also be requested without the Evaluation. In certain cases, the diagnosis will be listed as optional, and can be removed at the customer’s discretion. In such cases, please refer to the specific terms of the quotation provided, as well as Ontrack’s Terms and Conditions for Data Recovery.    

b) The diagnosis will determine the type and extent of the data damage, the exact determination of the possibilities of data recovery on the data carriers provided by the customer and the amount of files/data that can probably be recovered. Ontrack will provide the Customer with access to a proprietary platform that will allow the Client to track the status as well as provide the Client with a final file list (Verifile) if data recovery is possible. In some cases, Ontrack may not be able to access the data and therefore not be able to provide a file list (Verifile).

c) The file list (Verifile) contains an indication of the quality of the data in terms of its usability in the traffic light system:

  • Green - the data will most likely work or open in the respective application.
  • Yellow - the data or files are partially damaged - this may mean that the files cannot be opened and edited in the respective application. It is possible that the damaged files can be repaired.  Ontrack may be able to provide this service in some situations and, in such a case, will contact the customer directly.
  • Red - the data or files are corrupted - this probably means that the files cannot be opened and edited in the respective application.

d) It is not possible for Ontrack to guarantee the usability of the data with the customers respective applications as part of the diagnosis. Ontrack Engineers will provide guidance to the overall status of the recovered data, however these predictions cannot be guaranteed due to other causes of damage that cannot be identified. This applies in the special case to database files of all kinds. The import of the data sets, the effort for cleaning the data sets according to the state of the art of the respective database software and application and the consultation of further experts is the sole responsibility of the customer.  Ontrack will support the customer and commissioned contractors as far as possible.

e) There are special data loss scenarios in which the coloured statements in the file list (Verifile) have no meaning. In the case of such severe structural damage, Ontrack does not guarantee the functionality of the files.   If such a case exists, this is indicated in the diagnosis result.

f) Diagnosis is carried out in Ontrack's laboratory.

g) Depending on the type of media, the diagnosis may result in the transfer of data to another storage medium and the destruction of the original customer device.

h) If the Customer places an order for data recovery based on the results of the diagnosis (see section 4 below), Ontrack will perform the data recovery.

 g) The Customer may decide not to perform the data recovery after the diagnosis. At the request of the Customer, the Customer's media will then be returned to the Customer for the fee specified in the Quotation Form. Otherwise, the media will be securely disposed of.

5. Data recovery after Diagnosis or Evaluation

a) Offer for data recovery after Evaluation

The result of the Evaluation is sent together with an offer for data recovery. Only the expected success rating Excellent/Good/Partial/Complex is transmitted.

The data recovery quotation contains the data recovery price in relation to the service levels (see paragraph c.), which show the processing time for the respective data recovery process and is sent to the customer as described in our Terms.

b) Offer for data recovery after diagnosis

After the diagnosis, Ontrack will send the Verifle list to the client where possible, inform the Client how long the data recovery process will take and what the costs for the data recovery will be. The Client will receive a data recovery quote as described in our Terms and Conditions, which will include the data recovery price in relation to the Service Levels (see paragraph c.) that indicate the processing time for the respective data recovery process.

c) Service levels

For the data recovery order, the customer can choose between the following service levels depending on the urgency:

  • Emergency service
    Processing takes place immediately after receipt of order around the clock.
  • Priority service
    Processing takes place immediately after receipt of the order from Monday to Friday from 8:00 to 18:00. The duration of the data recovery process is usually 3-5 working days.
  • Standard service
    The data medium is processed after receipt of the order from Monday to Friday between 9:00 and 17:00. The duration of the data recovery process is usually 7-10 working days.
  • Economy Service
    The data carrier is processed after receipt of the order from Monday to Friday between 9:00 am and 5:00 pm. The duration of the data recovery process is usually  30 working days.

d) Acceptance of the data recovery

The customer accepts the data recovery offer as described in our Terms.

If the customer decides not to carry out the data recovery on the basis of the Evaluation results or file list (verifile), the order is deemed to be cancelled. At the customer's request, the data media will be returned to the customer for the fee specified in the offer form. Otherwise, the media will be securely disposed of.

e) Carrying out the data recovery

If the customer places an order for data recovery based on the data recovery quote after reviewing the results of the Evaluation and/or the diagnostic results, Ontrack will perform the data recovery.
The customer receives the data that was recoverable by Ontrack. After a diagnosis, this is usually the data shown in the file list (Verifile).

The data recovered by Ontrack is stored on a portable storage device and sent to the client. In addition to the separate media containing the recovered data, Ontrack may return the damaged media if requested by the Client at the time of placing the data recovery order, subject to payment of the return shipping fee specified therein.
At the Client's request, Ontrack may erase the data on the Data Carrier and/or dispose of the Data Carrier in accordance with applicable regulations.

f) Deviations in the data recovery result

In the event that the amount of recovered data is significantly less than the amount of recoverable data estimated in the evaluation, where no file listing has previously been ordered, one will be provided to the client at no additional charge to assist with the decision to proceed with the recovery stage. If a file listing has previously been ordered and provided, a Customer Representative will be in contact with the customer to discuss the results and the customers options for the Data Recovery. 

g) Data Recovery for smartphones and tablets

If the customer places an order for data recovery based on the diagnosis report and data recovery offer, Ontrack will carry out the data recovery. Upon payment as described in our Terms, Ontrack will return the recovered data along with the damaged smartphone/tablet. At the customer's request, Ontrack may delete and/or dispose of the smartphone/tablet in accordance with data protection regulations at no charge.

In abbreviation to the report, if only a partial data recovery is possible, the order will be deemed unsuccessful, and the customer will not be charged for the data recovery. The smartphone/tablet can be returned to the customer for the fee shown in the quotation. Otherwise, the smartphone/tablet will be destroyed. 

If the customer wishes to receive the partial data, the full fee is payable prior to Ontrack sending the data.  The data is retained for thirty (30) days before it will be deleted.    

6. RDR Remote Data Recovery Service

 a) RDR® stands for Remote Data Recovery™ ("RDR"). RDR is a patented technology that allows Ontrack engineers to perform a lab-quality data recovery directly on the client's server, desktop or laptop via an internet connection. The only requirement is that the disk is operational. Ontrack's RDR consists of three main components:

- Communication client: the client initiates a connection to an Ontrack RDR server using the specially developed RDR client software. The RDR client works with common operating systems. The drives to be recovered do not have to be from a particular operating system.
- RDR Server: Ontrack has several server locations around the world.
- RDR workstation: It is used by Ontrack engineers to remotely control the tools on the client's machine and recover the client's data.

 b) First, the client downloads the appropriate RDR client version and installs it on the server, desktop or laptop that will be used for recovery.  Next, the Ontrack Client software connects as an outbound TCP/IP connection from the Client's location to the Ontrack server, creating a tunnel or point-to-point connection across the Internet. As the connection is likely to use a web connection, it can pass through most firewalls without any additional configuration requirements. Data security is paramount due to Ontrack's proprietary communication protocol, encrypted packets and secure Ontrack facilities.

RDR protects customer data via an RDR connection in four ways:

  1. direct connection to the RDR server: The client software uses a direct TCP connection from the client's computer to the Ontrack RDR server. RDR does not use a third-party hosting product.
  2. encryption: the communication link uses 256 bit encryption on all packets.
  3. Proprietary Protocol: RDR communications use a proprietary protocol, but not HTTP or any other common protocol that others would understand.
  4. no customer data is transmitted over the connection: the RDR connection is only used by the Ontrack engineer to remotely control Ontrack utilities directly on the customer's machine. Screen updates and keyboard packets are sent over the connection, but not actual customer data files. Instead, the Ontrack engineer controls file system structure repair tools to make the data accessible to the customer.

c) As soon as the connection is established, either the diagnosis begins, or the recovery process starts if a data recovery order is placed.

Status: May 2023

Data Processing Agreement

This Data Processing Agreement is part of the General Terms and Conditions for Ontrack Data Recovery Services and applies to: (i) KLDiscovery Ontrack Limited (company number 02669766) having its registered office address at Ontrack, Nexus, 25 Farringdon Street, London, EC4A 4AB (“Ontrack”); and (ii) the applicable Customer placing an order for Ontrack’s data recovery services pursuant to the applicable service terms of business (“Terms”).

The Parties have agreed that the terms of this Data Processing Agreement shall apply to the Processing of Personal Data (as defined below) that is required to enable Ontrack to provide the services to the applicable Customer.


In this Data Processing Agreement:

Data Controller has the meaning given to that term (or to the term ‘controller’) in Data Protection Laws;
Data Processor  has the meaning given to that term (or to the term ‘processor’) in Data Protection Laws;
Data Protection Laws means all applicable data protection law binding on the Customer, Ontrack and/or in relation to the services including: (i) the GDPR and/or any corresponding or equivalent national laws or regulations; and (ii) in member states of the European Union, all relevant laws or regulations giving effect to or corresponding with the GDPR.
Data Subject has the meaning given to that term in Data Protection Laws;
Data Subject Request means a request made by a Data Subject to exercise any rights of Data Subjects under Data Protection Laws;
GDPR means the General Data Protection Regulation (EU) 2016/679;
Personal Data has the meaning given to that term in Data Protection Laws and covers all personal data provided to Ontrack by the Customer which is contained within the Media;
Personal Data Breach means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Personal Data;
Personnel means any current, former or prospective employee, consultant, temporary worker, agency worker, intern, other non-permanent employee, contractor, secondee or other personnel;
Processing has the meaning given to that term in Data Protection Laws (and related terms such as process have corresponding meanings);
Sub-Processor   Sub-Processor means another Data Processor engaged by KLDiscovery Ontrack on behalf of the Client for carrying out processing activities in respect of the Personal Data for services which relate directly to the main Service. This does not include ancillary services, such as telecommunication services, postal / transport services, maintenance or user support services or the disposal of data and documents as well as other soft- or hardware-based actions; and,
Supervisory Authority means any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering Data Protection Laws.

Data Processing provisions

1  Data Processor and Data Controller

1.1 The Parties agree that, in respect of Personal Data, the Customer shall be the Data Controller and Ontrack shall be the Data Processor.  It is acknowledged that the Customer shall have sole responsibility for the accuracy, quality, integrity and reliability of any Personal Data and of the means by which it acquired such Personal Data.

1.2 The Customer warrants, represents and undertakes, that: (i) all Personal Data used in connection with the services pursuant to the Terms shall comply in all respects with Data Protection Laws; (ii) all instructions given by it to Ontrack in respect of Personal Data shall at all times be in accordance with Data Protection Laws; (iii) it has obtained all necessary consents from any Data Subject whose Personal Data is included within the Personal Data or otherwise has the appropriate legal permission to provide the Personal Data to Ontrack; and (iv) it will comply with the terms of this Data Processing Agreement.

1.3 Ontrack warrants, represents and undertakes, that it shall: (i) process the Personal Data only to the extent necessary in connection with the Terms; and (ii) process the Personal Data in accordance with the Customer’s documented instructions and the requirements of Data Protection Laws; (iii) promptly inform the Customer if Ontrack considers that the Customer’s instructions infringe Data Protection Laws, or if Ontrack becomes unable to comply with Customer's instructions regarding the Processing of Personal Data  (whether as a result of a change in applicable law, or a change in Customer’s instructions); and (iv) comply with the terms of this Data Processing Agreement.

1.4 Within the scope of the commissioned processing, all data handed over by the customer shall be processed. The categories of personal data and the categories of data subjects are known to the customer and are specified for the processor if this is necessary in the context of the order. In the case of data recovery, knowledge of the content of the client data is usually not relevant for the processor.

2 Instructions and details of Processing

2.1 The Processing of Personal Data to be carried out by Ontrack under this Data Processing Agreement shall comprise the Processing as required for Ontrack to provide the Data Recovery services.

3 Technical and organisational measures

3.1 Ontrack shall implement and maintain, at its cost and expense, appropriate technical and organisational measures in relation to the Processing and security of Personal Data in accordance with Data Protection Laws and in accordance with Articles 32-34 of the GDPR in particular.  Ontrack shall ensure that such technical and organisational measures are appropriate to the particular risks that are presented by its Processing activities, in particular to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access.

3.2 Ontrack’s technical and organizational measures at the date of this Data Processing Agreement are set out at Annex 2.

4 Using Personnel and Sub-Processors

4.1 Save as set out in clause 4.2, Ontrack shall not engage any sub-processor for carrying out any processing activities in respect of the Client Data without the Client’s prior written authorisation.  In the event that authorisation is provided, prior to making any disclosure to any approved sub-processor, Ontrack shall put in place written terms with the sub-processor which are equivalent to those set out in this Data Processing Agreement.  It is acknowledged and accepted that, notwithstanding anything to the contrary in this Agreement, Ontrack shall remain fully liable to the Client for the performance of each sub-processor’s obligations.  Ontrack shall inform the Client of any intended changes concerning the addition or replacement of such sub-processors and allow Client a reasonable opportunity to object, on reasonable grounds, to any such changes or replacements. 

4.2 Approved sub-processors at the date of this Data Processing Agreement are set out at Annex 1.

4.3 Ontrack shall ensure the reliability of its Personnel who have access to Personal Data and ensure that they process it only where strictly necessary for the services, ensure that they are fully aware of the measures to be put in place and the steps to be taken when Processing the Personal Data  having regard to Data Protection Laws, and ensure that they have committed themselves to protect the confidentiality of the Personal Data  including by way of an appropriate obligation of confidentiality (whether by written contract or otherwise) in respect of the Personal Data .

5 Assistance with the Customer’s compliance and Data Subject rights

5.1 Ontrack shall promptly refer all Data Subject Requests it receives to the Customer.  Ontrack shall provide such reasonable assistance as the Customer reasonably requires (taking into account the nature of Processing and the information available to Ontrack) to the Customer in ensuring compliance with the Customer’s obligations under Data Protection Laws with respect to: (i) the security of Processing; (ii) data protection impact assessments (as such term is defined in Data Protection Laws); (iii) prior consultation with a Supervisory Authority regarding high risk Processing; and (iv) notifications to the Supervisory Authority and/or communications to Data Subjects by the Customer in response to any Personal Data Breach, provided that, in the event that such assistance is disproportionate in time and resources to Ontrack, Customer shall pay Ontrack’s fees for providing such assistance. 

6  International data transfers

6.1 The Customer acknowledges that, as at the date of this Data Processing Agreement, Ontrack may process personal data in the United Kingdom, Europe, and the United States of America during the term of this Agreement.

6.2 The Customer acknowledges that in respect of Personal Data subject to the Data Protection Act 2018 (UK), Ontrack shall be permitted to process all or any part of the Personal Data within the European Economic Area (“EEA”) pursuant to paragraph 5(1)(a) of Sch.21 to the Data Protection Act 2018. Additionally, the United Kingdom has received an Adequacy Decision dated June 28, 2021, from the European Commission pursuant to Article 45(3) of the GDPR which confirms that transfers may take place without the need to obtain any further authorisation (“Adequacy Decision”). In the event that the Adequacy Decision expires or is otherwise declared invalid, the Parties shall enter the EU Controller to Processor Standard Contractual Clauses in force at the applicable time to ensure compliant Processing of Personal Data by Ontrack in the United Kingdom.

6.3 In respect of Personal Data transfers to the United States of America, the parties agree that the 2021 Controller to Processor Standard Contractual Clauses (Module 2) approved by the European Commission, with the applicable amendments mandated by S119A(1) of the Data Protection Act 2018, and in accordance with the requirements of the Swiss Federal Act on Data Protection of 19 June 1992 ("FADP") and, after entry into force, in accordance with Art. 16(2)(d) of the future revised Federal Act on Data Protection of 25 September 2020 ("revDSG"), (“Standard Contractual Clauses”) are incorporated by reference into this Data Processing Agreement and that all transfers shall be subject to the terms of the Standard Contractual Clauses. If the Standard Contractual Clauses are amended, repealed or replaced by the European Commission or pursuant to applicable Data Protection Laws, the Parties shall work together in good faith to enter into an updated version of the data transfer mechanism, or to negotiate an alternative solution to enable compliant transfers of Personal Data to the United States of America.

6.4 Upon the terms set out in this clause 6 “International Data Transfers”, the Customer authorises the transfer of Personal Data to the United States of America.  The Customer’s consent to the transfer of Personal Data to the United States of America may be withdrawn at any time but, in such an event, the Customer acknowledges that Ontrack may not be able to complete the Order and/or perform the Services if the Customer withdraws consent to the Personal Data transfer.   

7 Records, information and audit

7.1 Ontrack shall: (i) create; (ii) keep up-to-date; and (ii) maintain full and accurate records relating to all Processing of Personal Data.

7.2 Ontrack shall grant to Customer the right of audit, no more than once per calendar year and on a minimum of 30 (thirty) days written notice, during normal business hours and subject to reasonable confidentiality undertakings being given, to access and take copies of such records relating to Processing of Personal Data and shall provide all reasonable assistance to Customer in exercising its audit rights.  This audit right shall not extend to any third-party data centre or other third-party facility housing any server equipment where only visual and accompanied inspection is permitted.

7.3 Ontrack shall at Customer’s request and expense promptly provide Customer with all information necessary to enable Customer to demonstrate compliance with its obligations under the GDPR, to the extent that Ontrack is able to provide such information.

8 Breach notification

8.1 In respect of any Personal Data Breach involving Personal Data, Ontrack shall, without undue delay: (i) notify the Customer of the Personal Data Breach; and (ii) provide the Customer with details of the Personal Data Breach.

9  Deletion or return of Personal Data and copies

9.1 Ontrack shall, at the Customer’s written request or upon expiry of internal retention periods, either delete or return all the Personal Data  to the Customer in such form as the Customer reasonably requests within a reasonable time after the earlier of: (i) the end of the provision of the relevant data recovery services pursuant to the Terms related to Processing; or (ii) once Processing by Ontrack of any Personal Data  is no longer required for the purpose of Ontrack’s performance of its relevant obligations under this Data Processing Agreement, and delete existing copies (unless storage of any Personal Data  is required by applicable law and, if so, Ontrack shall inform the Customer of any such requirement).  Ontrack shall procure that its Sub-Processors shall undertake the same actions with regard to Personal Data. 

9.2 In the event that Personal Data remains within Ontrack’s possession or control for any period longer than 12 (twelve) months without any active instructions from the Customer, Ontrack shall delete such Personal Data.  

10 Indemnity

10.1 Each Party (the “Indemnifying Party”) shall indemnify and keep indemnified the other Party (the “Indemnified Party”) in respect of all claims, demands, actions, settlements, interest, charges, procedures, expenses, losses and damages suffered or incurred by, awarded against or agreed to be paid by, the Indemnified Party arising from or in connection with the Indemnifying Party’s non-compliance with this Data Processing Agreement and/or breach of Data Protection Laws.

11 Liability

11.1 The total liabilities of either Party under this Data Processing Agreement shall in no event exceed the contractual limits set out and agreed in the Terms.

12 Term and Termination

12.1 Unless terminated by agreement of the Parties, this Data Processing Agreement shall commence on the date an order is placed for services pursuant to the Terms and continue in force for so long as Ontrack continues to process Personal Data.

13 Choice of Law

13.1 This Data Processing Agreement shall be subject to the terms of the choice of law provision set out in the Terms.


Date: 1 July 2023



Annex 1 – Sub-Processors and Transfers

Name and location of the processor

KLDiscovery Ontrack Limited
Nexus, 25 Farringdon Street, London, EC4A 4AB, United Kingdom

KLDiscovery Ontrack B.V.
De Brand 22, 3823 LJ Amersfoort, The Netherlands

Ibas Ontrack AS
Fjellgata 2, 2212 Kongsvinger, Norway

KLDiscovery Ontrack GmbH
Hanns-Klemm-Str. 5, 71034 Böblingen, Germany

KLDiscovery Ontrack Srl
Gallarte (VA) Via Marsala 34/A CAP 21013, Italy

KLDiscovery Ontrack Sp. z o.o
Katowice (40-082), ul. Jana III Sobieskiego 11, Poland

KLDiscovery Ontrack Sarl
2, impasse de la Noisette, 91371 Verriéres-le-Buisson Cedex 413, France

KLDiscovery Ontrack (Switzerland) GmbH
Hertistrasse 25, 8304 Wallisellen, Switzerland

KLDiscovery Ontrack, LLC
9023 Columbine Road, Eden Prairie, MN 55347, USA



Annex 2: Technical-Organisational Measures


Note on the document:
The general technical and organizational measures of KLDiscovery Ontrack are described here. The existing measures are listed generically in this document. These measures are implemented wherever necessary and possible.


1. Confidentiality (Art. 32 para. 1 b GDPR)
Access Control
No unauthorised access to data processing equipment;
√  Building security via Nexus Security on site (24/7)
√  Manned reception during working hours
√  Access fob for rooms
√  Different security zones with different access authorizations
√  Door security (Magnetic door closer, Key Fob)
√  Master key
√  Key/Chip regulation
√  Rules for dealing with visitors and external personnel
√  Visitors list
√  Visitors may only be in server rooms when accompanied
√  Only personnel responsible for computer forensics have access to the clean room and engineering lab
√  Video system monitored by the US
System Access Control
No unauthorized access to data processing systems;
√  authorization concepts and needs-based access rights
√  central user administration
√  secure password procedures / password policy
√  encrypted user authentication
√  automatic blocking mechanisms after unsuccessful access attempts
√  Two-Factor Authentication
√  Encryption for files and data carriers
√  Use of firewalls and virus protection
√  Use of Virtual Private Network (VPN)
√  Logging of accesses and access attempts (room access, VPN, etc)
Data Access Control
No unauthorized reading, copying, modification or removal within the system;
√  authorization concepts and needs-based access rights for programs and data 
√  central user administration
√  Automatic logout in case of inactivity after a certain period of time
√  Use of rotating archiving systems and controlled access to backup tapes
√  Encryption for files and data carriers
√  Logging of accesses and incorrect access attempts
Separation Control
Separate processing of data collected for different purposes;
√  Multi-client capability
√  Separation according to different purposes is ensured by different systems/databases
√  Separation of functions for production / test
√  Different encryption of data records to ensure separation for different processing purposes
√  implementation of defined functions in the information systems: Administrator, auditor, user.
√  authorization concepts and needs-based access rights for programs and data 
√  Use of secure processes such as Challenge Response Procedures to ensure an authorised application
Pseudonymisation (Art. 32 para. 1 a GDPR; Art. 25 para. 1 GDPR)
The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without additional information, provided that this additional information is kept separately and is subject to appropriate technical and organisational measures;
Any pseudonymisation is agreed between the parties in the respective order or contract.


2. Integrity (Art. 32 para. 1 b GDPR)
Transfer Control
No unauthorized reading, copying, modification or removal during electronic transmission or transport;
√  Encryption concepts (encryption of data carriers, encryption of files).
√  Use of digital signatures
√  Virtual Private Networks (VPN)
√  Agreements on order processing with contractors
√  Disk management and inventory control via Business System
√  Regulated use of external data carriers such as USB sticks, external hard drives.
√  Issue of data carriers only to authorized recipients (e.g. order receipt, accompanying document)
√  Definition of authorized users for media access
√  Packaging and shipping instructions (type of shipping e.g. in closed containers)
√  Direct collection, courier service, transport escort
√  Separate sealing of confidential data carriers
√  Arrangement for making copies of data
√  Documentation of the retrieval and transmission programs
√  Secure document destruction and data deletion
√  Secure deletion of data before data medium exchange and reuse
√  Data carrier disposal via degaussing according to CESG Claims Tested Mark then sent to Stone Group Ltd for recycling.
√  Secured building access entry for delivery and return
Input Control
Determining whether and by whom personal data have been entered, modified or removed in data processing systems;
√  Organizational defined responsibilities for data entries
√  Role-based authorization concept
√  Logging of inputs (Changed data, users who changed data) in Business System.
√  Securing the protocols against unauthorized access
√  Processing of Computer Forensics media only takes place on working copies, original media are stored in an evidence bag
√  Protocol evaluation systems
√  Dual control principle for particularly sensitive data (Standard process and Chain of Custody)


3. Availability and resilience (Art. 32 para. 1 b GDPR)
Availability Control
Protection against accidental or deliberate destruction or loss;
√  Fire and smoke detection systems
√  Fire extinguisher for server room
√  Air conditioning of the server room
√  Server room temperature monitoring
√  Use of RAID systems
√  Backup concepts & recovery concepts
√  Regular data recovery tests
√  uninterruptible power supply (UPS)
√  Virus protection
√  Firewall)
√  Protection against malicious code
√  defined reporting channels (also with the service provider)
√  Emergency plans
Rapid recoverability (Art. 32 para. 1 c GDPR);
√  Backup concepts & recovery concepts
√  Ensuring fast procurement of hardware by purchasing/partners

4. Procedures for regular review, assessment and evaluation (Art. 32 para. 1 d GDPR; Art. 25 para. 1 GDPR)
Data-Privacy-Management / Data Protection Management
√  Data Protection Management System
√  Employee commitment to confidentiality
√  Guidelines and concepts on data security and data protection (including Information Security Policy, HR Policy, Data Protection Management Concept, Information Security Summary)
Incident-Response-Management (emergency plans)
√  Risk assessment
√  Emergency plans
Data Protection by Design and Default (Art. 25 para. 2 GDPR)
√  Authorization concepts
√  Need-To-Know-Policy
Order Control
No commissioned data processing within the meaning of Art. 28 DS-GVO without corresponding instructions from the client;
√  Contracts for order processing (Art 28 GDPR)
√  Clear contract design with partner companies
√  Formalized order management
√  Strict selection of service providers
√  Secure data medium transport through appropriate service providers
√  Obligation of prior conviction
√  Follow-up checks via Business System.
√  Secure data deletion after the job has been completed/after 30 days or under conditions of the contract, or new instruction to delete by the customer.
√  Standardized processes for processing of order data
√  Standard Change Management Process (according to ITIL)
Monitoring of the processes

5. Further remarks / references / documents
√  In addition, the technical-organizational measures of the subcontracted data processors apply
√  Certification of KLDiscovery Ontrack according to ISO 27001
√  Certification of Third Parties (according to ISO 27001)