Service Terms and Conditions

General Terms and Conditions for ONTRACK Data Recovery Services

1. THESE TERMS

1.1 These terms and conditions ("Terms") govern the supply of Data Recovery Services to you by KLDiscovery Ontrack Limited, registered in England and Wales, Company Number 02669766 trading as “Ontrack”).  Please read these Terms carefully before you submit your Order to us. These Terms tell you who we are, how we will provide the Services to you, how you and we may change or end the Contract, what to do if there is a problem and other important information.

1.2 Our Service Description for data recovery services as well as the Data Processing Agreement (DPA), which regulates the processing of personal data within the scope of the provision of our service, is part of these Terms. For more information on the features and limitations of our data recovery service, please read our service description. The DPA governs the processing of personal data provided to Ontrack by the customer for data recovery purposes.

1.3 For information on how we, as the responsible party, collect, process and store personal data, please refer to our privacy policy.

1.4 Terms and conditions of the customer or third parties are explicitly excluded and shall not apply. These Terms and Conditions Service Description and DPA shall also apply to all future business relations, even if they are not expressly agreed again.

1.5 The services are predominantly provided in our laboratory in England. Ontrack has technical facilities and locations in Europe and the USA. If required, you hereby grant Ontrack access to data on storage devices from any Ontrack facility, including the United States of America, in order for Ontrack to provide the services. Please refer to Clause 6.3.

2. CONTACT DETAILS

2.1 How to contact us. You can contact us by telephoning our customer service team on +44 (0)1372 741 999, by writing to us at Nexus, 25 Farringdon Street, London, EC4A 4AB or ukinfo@ontrack.com.

3. INTERPRETATION

3.1 In these Terms the following definitions will apply:

(a) "Business Customer" means a customer acting for the purpose of their business, trade or profession including, without limitation, a sole trader, partnership, limited company or public authority;

(b) "Backup Media" means an Ontrack data carrier on which the recovered data is stored in encrypted form. This is usually a USB hard drive.

(c) “Confidential Information” means any information disclosed or communicated by one party to the other party in the course of the business relationship and where the receiving party had a legitimate expectation, based on a marking of the relevant information as confidential or in good faith based on the nature of the information, that the disclosing party had a particular protectable interest in keeping the relevant information confidential;

(d) “Consumer Customer” means a customer that is an individual who is not acting for the purposes of a business, trade or profession (excluding, for the avoidance of doubt, any Business Customer);

(e) “Contract” means as defined in Clause 4.4;

(f) “Customer” means both a business customer and a consumer customer.

(g) "Data" means data in electronic form of any description, including 'personal data' as defined by the General Data Protection Regulation EU 2016/679 and/or the Data Protection Act 2018;

(h) "Equipment" means your Media and, if applicable, mobile phone or tablet;

(i) "Fee" means the fee payable by you for the Services, as set out in the relevant Quotation;

(j) "Media" means storage media such as hard-drives, USB drive, SSD, memory chips, tapes or other data carriers;

(k) "Order" and "Quotation” means as defined in Clauses 4.5 and 4.1;

(l) “Service Descriptions” means the specific processes employed by Ontrack as more described at the following link https://www.ontrack.com/en-gb/service-terms#service-descriptions, which sets out, amongst other matters, service limitations, service levels and expectations;  

(m) "Services" means the data recovery services to be provided by us to you, as described in Clauses 4 (Order Process) and 5 (Services) of these Terms as well as in the Service Description; and

(n) "Website" means our website at www.ontrack.com/en-gb or such other website as we use to operate our business from time to time.

4. ORDER PROCESS (Quotation and Order)

4.1 Excluding mobile phones and tablets, for standard data recovery, following an initial telephone consultation, submission of an online form via our Website or email, you will send us your Equipment for our evaluation.  We will use reasonable endeavours to: (a) examine the Equipment to determine: (i) what Data is accessible on the Equipment: (ii) the cause of any damage to the Equipment and/or the Data on the Equipment; and (iii) the amount of Data (if any) likely to be recoverable on the Equipment; ("Evaluation"); (b) report the results of our Evaluation to you.  In most cases, we will provide you with a quotation setting out the scope of Services and applicable Fee broken into two parts: (i) the optional diagnosis; and (ii) the full data recovery. For complex cases, you will be offered a paid diagnosis due to the potential complexity of the data recovery (collectively the "Quotation").  All Services will be provided according to the Service Descriptions.    

4.2 In the Quotation, where the diagnosis is listed as optional, this stage is automatically applied to the Quotation as the diagnosis will provide more detailed information on the success of the data recovery.  If the optional diagnosis is selected, following payment, you will receive a file listing specifying the Data that is likely to be recovered once the full data recovery is completed.  Subject to your cancellation rights set out in section 8 below, both optional and paid diagnosis fees are not refundable once the work has been completed, irrespective of the outcome of the diagnosis.  In some cases, the diagnosis will indicate that a full data recovery is not likely to be successful and only a partial data recovery is expected.  In addition to a Consumer Customer’s statutory cancellation rights (see section 8 below) regarding diagnosis, the optional diagnosis can be cancelled at any time within 24 hours of the Quotation acceptance. 

4.3 For mobile phones and tablets, you will be provided with a fixed price quotation following Ontrack’s receipt of details from you.  Mobiles and tablets do not require an evaluation by Ontrack’s engineers.  For mobiles and tablets, Ontrack will provide you with a free diagnosis report outlining the likely recovery of your Data.  You will then be able to choose to proceed with the data recovery process at the price specified in the Quotation.    

4.4 For other Services, such as remote data recovery (“RDR”) where you do not submit any Equipment to us, or degaussing, the Quotation shall consist of the work expected to be required by Ontrack to perform the Services.

4.5 Following receipt of our Quotation, you may at your option either: (i) accept and sign the service request or statement of work to submit an order for our Services ("Order"); (ii) submit a request for us to return your Equipment (if applicable), the delivery cost of which you agree to pay; or (iii) submit a request for us to destroy your Equipment, in which case we will be permitted to immediately destroy your Equipment.  If we do not receive an Order or request to return your Equipment within 90 (ninety) calendar days of the date of the Quotation, we will dispose of your Equipment in line with applicable law.

5. SENDING DAMAGED STORAGE MEDIA AND DEVICES AND RETURN OF STORAGE MEDIA AND DEVICES AND BACK-UP MEDIA

5.1 You have the following options to provide us with your devices: (i) you may drop off your Storage Media in person at our business premises during opening hours (prior notice required); (ii) you may arrange for a courier service of your choice at your own expense, and, if this option is chosen, Ontrack will provide you with packaging instructions for your Devices.  Alternatively, Ontrack offers a third-party pick-up service by selecting the "Pick-up and Delivery" option during the order process.  Ontrack will send you a shipping label for your package along with packing instructions and inform you of the location where you can drop off your media for collection by the third-party courier.

5.2 All storage media should be packed in accordance with the instructions at at https://www.ontrack.com/en-ie/data-recovery/shipping as Ontrack will not be liable for any damage to your equipment during transit if the packages are incorrectly packed.

5.3 Following the diagnosis or restoration (see section 6), we will send your Backup Media to your address by means of a recognised courier service. Please contact Ontrack before completing the order if you do not want Ontrack to return your backup media by courier.  You can also use a courier service of your choice at your own expense, for example, or collect the backup media in person from our business premises during opening hours (by prior appointment).

5.4 The costs for returning your equipment are based on the information in the respective offer.  You will be informed of the exact costs during the ordering process.

6. OUR SERVICES

6.1 In return for your payment of the Fee, we will perform provide the Services with reasonable care and skill. For a detailed description of the services, please refer to our Service Description. The Service Description is part of these Terms. We will use reasonable endeavours to: (i) restore your Data and provide you with the restored Data on an encrypted Backup Media; or (ii) perform any other Services that we have agreed with you in writing to provide, such as erasing the Data from the storage media.

6.2 When examining the Devices, we will take reasonable precautions to determine: (i) what data on the Devices is accessible and recoverable; (ii) what damage to the Devices and/or data structures may be identified; (iii) how much data (if any) on the Devices is likely to be recoverable; and (iv) to advise you of the expected results of recovering data from the Devices. Our data recovery services may include data recovery of data in the laboratory, through the provision of software solutions and, for business customers, by means of remote data recovery. 

6.3 We provide most of our services at the premises of KLDiscovery Ontrack Limited at Nexus, 25 Farringdon Street, London, EC4A 4AB, England, United Kingdom of Great Britain and Ireland. However, we may also send your device to a sister company located in the European Economic Area. In line with Clause 1.5 we may also be required to access your data remotely from outside the United Kingdom or European Economic Area to provide the Services.

6.4 Mobile Phone Repair.  The primary service we offer will be the recovery of the Data from the mobile phone and we do not offer a standalone mobile phone repair.  In some cases, the work required for a data recovery may result in the partial or temporary repair of the mobile phone.  In such cases, this may result in the restoration of functionality to the mobile phone so that you are able to use it in normal usage conditions but Ontrack does not offer any guarantee or warranty with respect to such repairs.

6.5. Degaussing.  Ontrack will place your Equipment into a degaussing unit which is a machine which effectively and securely scrambles the magnetic data held on the Equipment.  Following the degaussing process, the Data is no longer readable and will have been securely destroyed.

6.6 Remote Data Recovery – applicable only to business customers. With Remote Data Recovery (RDR), the above Terms will apply. Ontrack will require the customer to connect to the customer's internal network. No devices will be submitted to Ontrack’s lab, unless requested. For remote data recovery, you must download and install the Ontrack RDR customer software from the link provided by Ontrack. Once installed, the RDR customer allows the user to connect to Ontrack via an encrypted internet connection. The RDR connection is used by Ontrack solely to run the Ontrack recovery tools directly on the customer's computer. Ontrack uses the RDR connection to store the Ontrack Recovery Tools on the customer's computer in a protected folder.  Your data will not be transmitted to Ontrack during this process. Once the RDR is complete, the Ontrack Recovery Tools are deleted from the customer's computer. Ontrack warrants that the RDR Customer Software, (a) is free of program code or program instructions intentionally designed to interrupt, disable, damage, interfere with or otherwise adversely affect computer programs, files or operations; and (b) does not contain other malicious or harmful code typically referred to as viruses or described by similar terms including Trojan horse, worm or backdoor.

6.7 At the time of entering the Contract, we can only estimate the time when your data recovery is likely to be completed. It is not possible to provide a specific date for a completed Data Recovery due to the nature of the Services. However, you will be informed of the estimated completion date during the provision of the service. When you receive your backup media containing your recovered data from Ontrack, we ask that you immediately check the backup media (USB hard drive or other storage device) for technical functionality. Ontrack can only reproduce your recovered data in the event of a failure of the backup media within our data retention period for your recovered personal data as set out in Ontrack's Data Processing Agreement. The costs of returning the Equipment will be as set out on the relevant Quotation. 

6.8 For some Services, we may need certain information from you such as user names, passwords and/or access codes.   If you do not provide this information within a reasonable time of our request, or if you provide incomplete or incorrect information, we may make an additional charge of a reasonable sum to compensate us for any extra work that is required as a result. We will not be responsible for supplying the Services late or not supplying any part of them if this is caused by you not giving us the information we need.

 6.9 We may have to suspend the supply of Services to: (i) deal with technical problems or make technical changes; (ii) update the Services to reflect changes in relevant laws and regulatory requirements; (iii) make changes to the Services as requested by you.  We may also suspend supply of the Services if you do not pay after giving you notice.

6.10 While we use approved original equipment manufacturer repairs, we offer no guarantee that the Services will be consistent with any warranty offered by the original equipment manufacturer.  Our performance of the Services should, under no circumstances, be taken as a guarantee that the Services will be successful, that all or any of your Data is recoverable or will be useable, that the Mobile Phone will be capable of being used or that we will achieve any other particular result. No success is owed within the scope of our service provision.

6.11 Please note that we may not accept all Apple products for data recovery. Our data recovery services do not usually include data recovery from iPhones/iPads after a factory reset. In cases where data is lost from an iMac, in most cases we will require the storage device to be removed from the iMac prior to sending in to our Ontrack facility. Please contact our customer service team before sending in Apple products as an Ontrack representative will be able to provide you instructions or recommendations for your case.

7. INTELLECTUAL PROPERTY RIGHTS

7.1 Your Equipment and Data shall at all times remain your property, and we shall have no right, title or interest in or to them (except the right to possession and use of your Equipment and Data to perform the Services).  You retain all intellectual property rights you have in your data.

7.2 All intellectual property rights related to the provision of the Services shall remain with Ontrack, including the development, creation and provision of the Services, inventions, copyrighted works, methods, processes and know-how used to develop or comprise the Services, together with any hardware, firmware, platforms, software and any modifications, enhancements, new features or functionality created or used by Ontrack as part of the Services ("KLD-IP").

8. RIGHTS TO END CONTRACT (CONSUMER CUSTOMERS)

8.1 This Clause 8 applies solely to our Contracts with Consumer Customers.  Following an Order, you have a legal right to change your mind.  These rights, under The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, are explained in more detail below.

8.2 During the Free Evaluation, you can cancel at any time.  If you place an Order including any diagnosis, you can cancel within 14 (fourteen) days after the day we email you to confirm we accept your Order. However, once we have completed the Services, you cannot change your mind, even if the period is still running. By placing an Order, you expressly authorise us to commence the Services immediately.  If you cancel after we have started the Services, you must pay us for the Services provided up until the time you tell us that you have changed your mind.  We will tell you what this Fee will be following the cancellation request.

8.3 To cancel the Order, you can do so through one of the following methods of communication by providing your Order number, name, address and cancellation request:

(a) Phone or email. Call customer services on +44 (0)1372 741 999 or email us at ukinfo@ontrack.com;

(b) By post. write to us at Nexus, 25 Farringdon Street, London, EC4A 4AB ; or

(c) By Cancellation Form: complete and send to us a cancellation form in the format of the Model Cancellation Form included as a Schedule to these Terms.

8.4 The optional diagnosis can be cancelled within 24 hours of the Quotation using the same cancellation methods set out above. 

9. RIGHTS TO END THE CONTRACT (BUSINESS CUSTOMERS)

9.1 This Clause 9 applies solely to our Contracts with Business Customers. Following an Order, you shall not be able to terminate the Services unless set out in clause 10 below.

10. MUTUAL TERMINATION RIGHTS

10.1 Without affecting any other right or remedy available to either Party, each Party may terminate the Contract with immediate effect by giving written notice if:

(a) Either Party commits a material breach of any term of the Contract which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 7 (seven) days after being notified in writing to do so or repeatedly breach these Terms.  A failure to pay the Fee shall constitute a material breach; or

(b) either Party ceases (or threatens to cease) to trade all or part of its business, has a liquidator, receiver or administrative receiver appointed to it or over any part of its undertaking or assets or passes a resolution for its winding up (otherwise than for the purpose of a bona fide scheme of solvent amalgamation or reconstruction where the resulting entity shall assume all of the liabilities of it) or a court of competent jurisdiction makes an administration order or liquidation order or similar order, or enters into any voluntary arrangement with its creditors, or is unable to pay its debts as they fall due, or, if an individual, becomes bankrupt; and/or

(c) (Ontrack's right of termination): the Customer fails to pay the remuneration for the Data Recovery Services when due.

10.2 We may terminate the Contract if, by performing the Contract, we may breach applicable export and sanctions laws relating to dealings with certain companies and individuals set by the European Commission or other national authorities, including the United States.  You agree to provide, upon our request, proof of identity for the purpose of verifying the applicability of applicable export and sanctions law You agree to provide, upon our request, proof of identity for the purpose of verifying the applicability of applicable export and sanctions laws.          10.3 If the termination is for a reason for which Ontrack is not responsible, the Customer is obliged to pay the agreed remuneration for all data recovery services provided by Ontrack until the termination takes effect. 

11. CUSTOMER ACKNOWLEDGEMENTS

11.1 You hereby acknowledge and warrant to us that: (i) you are legally capable of entering into binding contracts; (ii) you have full authority, power and capacity to agree to these Terms and if you are a Business Customer have the appropriate legal authority to conclude the Contract; (iii) all the information that you provide to us in connection with your Order is true, accurate, complete and not misleading; (iv) you are the owner of the Equipment and/or have the permission from the owner of the Equipment for us to perform the Services;  (v) your supply of your Equipment and/or Data to us will not breach any obligations or rights of any third parties; (vi) your supply of your Equipment and/or Data to us will not breach any applicable law; (vii) you are legally permitted to grant access to the Data; (viii) your Equipment does not contain any material (including without limitation any Data) which may infringe the Intellectual Property Rights of any third party; and (ix) your Equipment does not contain any material which will breach applicable law. 

11.2 We reserve the right (and you hereby acknowledge that we have the right) to request documentary evidence of your ownership, permission or legal right to authorise the Services and to suspend or not commence the Services without receipt of such evidence. You agree to provide us with documentary evidence of identity upon request to enable us to verify the applicability of any applicable export and sanctions regulations in accordance with Clause 11.2.

11.3 You hereby acknowledge that your Equipment and/or Data may already be damaged prior to our receipt of them, and that our efforts to complete the Services may result in the destruction of, or any further damage to, your Equipment and/or Data. We will take reasonable care in performing the Services, but will not, save as specified in section 13 of these Terms, bear any responsibility for existing or additional damage that may occur to your Equipment and/or Data during our performance of the Services. This does not affect the provisions of clause 14.

12. PRICE AND PAYMENT

12.1 The price of the Services will be the fee as set out in the relevant Quotation. VAT shall be added at the statutory rate and, if applicable, is payable by the Customer. Payment may be made by cash, bank transfer or credit card, or for business customers also by order on account (order number).

12.2 In the case of cash payments, advance bank transfer, or credit card payment, the fee is generally payable prior to the commencement of the Services (prepayment) or, if applicable, at the time specified in the payment agreement made separately with Ontrack. If you fail to pay any amount due to us under the Agreement, we may retain the Equipment and Data until payment is made in full. In the event of a cancelled, late or non-payment, you will receive a first reminder (text form) after payment is due. If payment is not received after the first reminder, you will receive another reminder before we reserve the right to hand the claim over to our collection agency. We further reserve the right to claim default interest or issue further claims.

12.3 If you pay by credit/debit card, Ontrack will send you a payment link to a secure 3rd party payment platform to to authorise the payment and complete the payment process once the work is completed but before the backup media is sent to you.

12.4 Business customers will receive an invoice. If you do not pay the invoice in full within the agreed payment period, we will send you a reminder (text form). If payment is not received after the first reminder, you will receive another reminder before we hand the claim over to our collection agency. We will charge interest on arrears at the legally permissible rate in the event of late payment. We reserve the right to assert further claims (e.g., for damages caused by default).

12.5 No Data will be provided by Ontrack until payment has been made in full for the applicable Order. If you fail to pay to us any amount due under these Terms we may retain the Equipment and Data until you make full payment.  If you do not make full payment within 90 (ninety) calendar days of the due date we may, without liability or consulting you further, dispose of your Equipment and/or Data in line with applicable law.  We will also charge interest to you on the overdue amount at the rate of 4% a year above the base lending rate of Barclays Bank plc from time to time. This interest will accrue on a daily basis from the due date until the date of actual payment of the overdue amount, whether before or after judgment.

13. OUR RESPONSIBILITY FOR LOSS OR DAMAGE SUFFERED BY YOU

13.1 We do not accept responsibility for any corruption of, or physical or other damage to, or destruction of your Equipment, your Data, or any other equipment that may occur, or invalidation of any warranties in respect of your Equipment or other equipment, either: prior to our receiving your Equipment, your Data, or other equipment; or in the course of our providing the Services where such damage, destruction, corruption or invalidation arises from our performing the Services in accordance these Terms.

13.2 Whilst we will use reasonable endeavours to take care of your Equipment or Data whilst in our possession, we will not be responsible to you if any of your Equipment or Data is lost, destroyed, corrupted or otherwise damaged through fair wear and tear.

13.3 We do not exclude or limit in any way our liability to you where it would be unlawful to do so. This includes our liability for death or personal injury caused by our negligence or the negligence of our employees, agents or subcontractors; for fraud or fraudulent misrepresentation; and for Consumer Customers, for breach of your legal rights in relation to the Services and for defective Services under the Consumer Protection Act 1987.

13.4 Subject to the provisions of this clause 12, our total liability to you, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with a Contract shall be limited to (i) in cases of breach of confidentiality, data protection or intellectual property, the greater of £10,000 or the value of the Fee payable under the applicable Contract; or (ii) in any other case, the value of the Fee payable under the Contract.

13.5 Neither Party shall be liable to the other, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with these Terms or any Contract for any indirect or consequential loss, loss of profits or loss of sales or business.

13.6 Use of Couriers.  Consistent with the provisions of section 5, In collecting your Equipment prior to the commencement of the Services, or in delivering the recovered Data and/or original Equipment, we outsource such service to nationally recognised courier companies.  By agreeing to us using them for the Services, you agree that any loss or damage to the Equipment or Data shall be expressly subject to the terms and conditions provided by the applicable courier company, including limitations of liability and compensation limits.  You hereby waive all right to bring any claim against Ontrack for any loss or damage to Data or Equipment arising from negligence and/or breach of contract by the courier company beyond any compensation scheme set out by them.  

14. INDEMNITY

14.1 You shall indemnify us in full against and hold us harmless from all claims, costs, damages, liabilities, expenses (including without limitation legal expenses) demands and judgments awarded against or incurred or paid by us as a result of or in connection with any and all of your acts, inactions and/or omissions connected with the Contract and these Terms.

15. DATA PROTECTION

15.1 Information on how we collect, process and retain your personal data, please see our Privacy Policy at the following link on our website: https://www.kldiscovery.com/uk/privacy-policy/

16. HOW WE PROCESS PERSONAL DATA (RECOVERED DATA)

16.1 To the extent that Ontrack processes personal data for you as a customer in the course of data recovery, our Data Processing Agreement applies, which is available at https://www.ontrack.com/en-ie/service-terms#data-processing-agreement

17. CONFIDENTIAL INFORMATION

17.1 Each party agrees to not disclose any Confidential Information of the other party to any third party without the prior written authorisation of the party disclosing the Confidential Information and to:  (i) use such Confidential Information only for the purposes of carrying out its obligations pursuant to these Terms; (ii) use the same methods and degree of care to prevent disclosure of such Confidential Information as it uses to prevent disclosure of its own proprietary and Confidential Information but in no event less than reasonable care; and (iii) disclose Confidential Information to its employees and approved third parties, only on a need-to-know basis provided that all such persons are bound by duties of confidentiality no less onerous than are set out in these Terms.

17.2 Confidentiality obligations shall not apply to any Confidential Information: (i) which enters the public domain through no fault of the recipient party; (ii) which was known to the recipient party prior to receipt from the other party; (iii) which is disclosed to the recipient party by a third party (other than employees or agents of either party) in circumstances that such disclosure is not in violation of any confidentiality obligation to the party disclosing the Confidential Information; or (iv) which is independently developed by the recipient party without recourse to Confidential Information.

18. OTHER IMPORTANT TERMS

18.1 This Contract is between you and us. No other person shall have any rights to enforce any of its terms.  Each of the paragraphs of these Terms operates separately. If any court or relevant authority decides that any of them are unlawful and/or unenforceable, the remaining paragraphs will remain in full force and effect.  If we delay in taking steps against you in respect of your breaking this contract, this will not prevent us taking steps against you at a later date.

18.2 We may change the Services to reflect changes in relevant laws and regulatory requirements and to implement minor technical adjustments and improvements, for example to address a security threat. These changes will not affect your use of the Services. In addition, we may make more material changes to these Terms or the Services, but if we do so we will notify you and you may then contact us to end the Contract before the changes take effect and receive a refund for any Services paid for but not received.

18.3 As well as any other rights you have under law or regulation, if you are resident in the European Union, you may have the option to submit complaints on the European Union’s Online Dispute Resolution platform (the “Platform”) which facilitates the settlement of disputes online.  For more information, please visit the Platform on https://ec.europa.eu. Ontrack does not intend to use the Platform to settle disputes and you accept that Ontrack is under no obligation to use the Platform to settle any disputes.

18.4 These terms are governed by English law and each Party may bring legal proceedings in the courts of England and Wales.

Effective: 1 July 2023

Schedule - Model cancellation form

(Complete and return this form only if you wish to withdraw from the contract)

To          

[TRADER'S NAME, ADDRESS, TELEPHONE NUMBER AND, WHERE AVAILABLE, FAX NUMBER AND E-MAIL ADDRESS TO BE INSERTED BY THE TRADER]

Subject: Revocation of the service contract

I/We* hereby give notice that I/We* cancel my/our* contract for the supply of the following service*,

Ordered on*/received on*,        

Name of consumer(s),  

Address of consumer(s),              

Ontrack customer number,

Signature of consumer(s) (only if this form is notified on paper),

Date

Sign: __________________

*Delete as appropriate

Data Processing Agreement

This Data Processing Agreement is part of the General Terms and Conditions for Ontrack Data Recovery Services and applies to: (i) KLDiscovery Ontrack Limited (company number 02669766) having its registered office address at Ontrack, Nexus, 25 Farringdon Street, London, EC4A 4AB (“Ontrack”); and (ii) the applicable Customer placing an order for Ontrack’s data recovery services pursuant to the applicable service terms of business (“Terms”).

The Parties have agreed that the terms of this Data Processing Agreement shall apply to the Processing of Personal Data (as defined below) that is required to enable Ontrack to provide the services to the applicable Customer.

Definitions

In this Data Processing Agreement:

Data Processing provisions

1  Data Processor and Data Controller

1.1 The Parties agree that, in respect of Personal Data, the Customer shall be the Data Controller and Ontrack shall be the Data Processor.  It is acknowledged that the Customer shall have sole responsibility for the accuracy, quality, integrity and reliability of any Personal Data and of the means by which it acquired such Personal Data.

1.2 The Customer warrants, represents and undertakes, that: (i) all Personal Data used in connection with the services pursuant to the Terms shall comply in all respects with Data Protection Laws; (ii) all instructions given by it to Ontrack in respect of Personal Data shall at all times be in accordance with Data Protection Laws; (iii) it has obtained all necessary consents from any Data Subject whose Personal Data is included within the Personal Data or otherwise has the appropriate legal permission to provide the Personal Data to Ontrack; and (iv) it will comply with the terms of this Data Processing Agreement.

1.3 Ontrack warrants, represents and undertakes, that it shall: (i) process the Personal Data only to the extent necessary in connection with the Terms; and (ii) process the Personal Data in accordance with the Customer’s documented instructions and the requirements of Data Protection Laws; (iii) promptly inform the Customer if Ontrack considers that the Customer’s instructions infringe Data Protection Laws, or if Ontrack becomes unable to comply with Customer's instructions regarding the Processing of Personal Data  (whether as a result of a change in applicable law, or a change in Customer’s instructions); and (iv) comply with the terms of this Data Processing Agreement.

1.4 Within the scope of the commissioned processing, all data handed over by the customer shall be processed. The categories of personal data and the categories of data subjects are known to the customer and are specified for the processor if this is necessary in the context of the order. In the case of data recovery, knowledge of the content of the client data is usually not relevant for the processor.

2 Instructions and details of Processing

2.1 The Processing of Personal Data to be carried out by Ontrack under this Data Processing Agreement shall comprise the Processing as required for Ontrack to provide the Data Recovery services.

3 Technical and organisational measures

3.1 Ontrack shall implement and maintain, at its cost and expense, appropriate technical and organisational measures in relation to the Processing and security of Personal Data in accordance with Data Protection Laws and in accordance with Articles 32-34 of the GDPR in particular.  Ontrack shall ensure that such technical and organisational measures are appropriate to the particular risks that are presented by its Processing activities, in particular to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access.

3.2 Ontrack’s technical and organizational measures at the date of this Data Processing Agreement are set out at Annex 2.

4 Using Personnel and Sub-Processors

4.1 Save as set out in clause 4.2, Ontrack shall not engage any sub-processor for carrying out any processing activities in respect of the Client Data without the Client’s prior written authorisation.  In the event that authorisation is provided, prior to making any disclosure to any approved sub-processor, Ontrack shall put in place written terms with the sub-processor which are equivalent to those set out in this Data Processing Agreement.  It is acknowledged and accepted that, notwithstanding anything to the contrary in this Agreement, Ontrack shall remain fully liable to the Client for the performance of each sub-processor’s obligations.  Ontrack shall inform the Client of any intended changes concerning the addition or replacement of such sub-processors and allow Client a reasonable opportunity to object, on reasonable grounds, to any such changes or replacements. 

4.2 Approved sub-processors at the date of this Data Processing Agreement are set out at Annex 1.

4.3 Ontrack shall ensure the reliability of its Personnel who have access to Personal Data and ensure that they process it only where strictly necessary for the services, ensure that they are fully aware of the measures to be put in place and the steps to be taken when Processing the Personal Data  having regard to Data Protection Laws, and ensure that they have committed themselves to protect the confidentiality of the Personal Data  including by way of an appropriate obligation of confidentiality (whether by written contract or otherwise) in respect of the Personal Data .

5 Assistance with the Customer’s compliance and Data Subject rights

5.1 Ontrack shall promptly refer all Data Subject Requests it receives to the Customer.  Ontrack shall provide such reasonable assistance as the Customer reasonably requires (taking into account the nature of Processing and the information available to Ontrack) to the Customer in ensuring compliance with the Customer’s obligations under Data Protection Laws with respect to: (i) the security of Processing; (ii) data protection impact assessments (as such term is defined in Data Protection Laws); (iii) prior consultation with a Supervisory Authority regarding high risk Processing; and (iv) notifications to the Supervisory Authority and/or communications to Data Subjects by the Customer in response to any Personal Data Breach, provided that, in the event that such assistance is disproportionate in time and resources to Ontrack, Customer shall pay Ontrack’s fees for providing such assistance. 

6  International data transfers

6.1 The Customer acknowledges that, as at the date of this Data Processing Agreement, Ontrack may process personal data in the United Kingdom, Europe, and the United States of America during the term of this Agreement.

6.2 The Customer acknowledges that in respect of Personal Data subject to the Data Protection Act 2018 (UK), Ontrack shall be permitted to process all or any part of the Personal Data within the European Economic Area (“EEA”) pursuant to paragraph 5(1)(a) of Sch.21 to the Data Protection Act 2018. Additionally, the United Kingdom has received an Adequacy Decision dated June 28, 2021, from the European Commission pursuant to Article 45(3) of the GDPR which confirms that transfers may take place without the need to obtain any further authorisation (“Adequacy Decision”). In the event that the Adequacy Decision expires or is otherwise declared invalid, the Parties shall enter the EU Controller to Processor Standard Contractual Clauses in force at the applicable time to ensure compliant Processing of Personal Data by Ontrack in the United Kingdom.

6.3 In respect of Personal Data transfers to the United States of America, the parties agree that the 2021 Controller to Processor Standard Contractual Clauses (Module 2) approved by the European Commission, with the applicable amendments mandated by S119A(1) of the Data Protection Act 2018, and in accordance with the requirements of the Swiss Federal Act on Data Protection of 19 June 1992 ("FADP") and, after entry into force, in accordance with Art. 16(2)(d) of the future revised Federal Act on Data Protection of 25 September 2020 ("revDSG"), (“Standard Contractual Clauses”) are incorporated by reference into this Data Processing Agreement and that all transfers shall be subject to the terms of the Standard Contractual Clauses. If the Standard Contractual Clauses are amended, repealed or replaced by the European Commission or pursuant to applicable Data Protection Laws, the Parties shall work together in good faith to enter into an updated version of the data transfer mechanism, or to negotiate an alternative solution to enable compliant transfers of Personal Data to the United States of America.

6.4 Upon the terms set out in this clause 6 “International Data Transfers”, the Customer authorises the transfer of Personal Data to the United States of America.  The Customer’s consent to the transfer of Personal Data to the United States of America may be withdrawn at any time but, in such an event, the Customer acknowledges that Ontrack may not be able to complete the Order and/or perform the Services if the Customer withdraws consent to the Personal Data transfer.   

7 Records, information and audit

7.1 Ontrack shall: (i) create; (ii) keep up-to-date; and (ii) maintain full and accurate records relating to all Processing of Personal Data.

7.2 Ontrack shall grant to Customer the right of audit, no more than once per calendar year and on a minimum of 30 (thirty) days written notice, during normal business hours and subject to reasonable confidentiality undertakings being given, to access and take copies of such records relating to Processing of Personal Data and shall provide all reasonable assistance to Customer in exercising its audit rights.  This audit right shall not extend to any third-party data centre or other third-party facility housing any server equipment where only visual and accompanied inspection is permitted.

7.3 Ontrack shall at Customer’s request and expense promptly provide Customer with all information necessary to enable Customer to demonstrate compliance with its obligations under the GDPR, to the extent that Ontrack is able to provide such information.

8 Breach notification

8.1 In respect of any Personal Data Breach involving Personal Data, Ontrack shall, without undue delay: (i) notify the Customer of the Personal Data Breach; and (ii) provide the Customer with details of the Personal Data Breach.

9  Deletion or return of Personal Data and copies

9.1 Ontrack shall, at the Customer’s written request or upon expiry of internal retention periods, either delete or return all the Personal Data  to the Customer in such form as the Customer reasonably requests within a reasonable time after the earlier of: (i) the end of the provision of the relevant data recovery services pursuant to the Terms related to Processing; or (ii) once Processing by Ontrack of any Personal Data  is no longer required for the purpose of Ontrack’s performance of its relevant obligations under this Data Processing Agreement, and delete existing copies (unless storage of any Personal Data  is required by applicable law and, if so, Ontrack shall inform the Customer of any such requirement).  Ontrack shall procure that its Sub-Processors shall undertake the same actions with regard to Personal Data. 

9.2 In the event that Personal Data remains within Ontrack’s possession or control for any period longer than 12 (twelve) months without any active instructions from the Customer, Ontrack shall delete such Personal Data.  

10 Indemnity

10.1 Each Party (the “Indemnifying Party”) shall indemnify and keep indemnified the other Party (the “Indemnified Party”) in respect of all claims, demands, actions, settlements, interest, charges, procedures, expenses, losses and damages suffered or incurred by, awarded against or agreed to be paid by, the Indemnified Party arising from or in connection with the Indemnifying Party’s non-compliance with this Data Processing Agreement and/or breach of Data Protection Laws.

11 Liability

11.1 The total liabilities of either Party under this Data Processing Agreement shall in no event exceed the contractual limits set out and agreed in the Terms.

12 Term and Termination

12.1 Unless terminated by agreement of the Parties, this Data Processing Agreement shall commence on the date an order is placed for services pursuant to the Terms and continue in force for so long as Ontrack continues to process Personal Data.

13 Choice of Law

13.1 This Data Processing Agreement shall be subject to the terms of the choice of law provision set out in the Terms.

Date: 1 July 2023

Annex 1 – Sub-Processors and Transfers

Status: June 2023

Annex 2: Technical-Organisational Measures