This DPA governs any processing of Client personal data by ALS Analytical Ltd. acting as processor on the Client’s instructions. It is deemed incorporated into the Testing Services Terms & Conditions (LEG-002) whenever such processing occurs, and satisfies Article 28 GDPR.
Terms defined in the EU GDPR (‘controller’, ‘processor’, ‘sub-processor’, ‘processing’, ‘personal data’, ‘data subject’, ‘personal-data breach’, ‘supervisory authority’) have the same meaning in this DPA. ‘Data Protection Laws’ means the EU GDPR, UK GDPR and DPA 2018, HK PDPO, Singapore PDPA, and any other applicable equivalent.
| Item | Description |
|---|---|
| Subject matter | Delivery of analytical testing services by ALS |
| Duration | For the term of the underlying agreement, plus retention periods in §07 of the Privacy Policy |
| Nature and purpose | Receiving, storing, analysing samples and generating reports |
| Types of personal data | Business contact details of the submitter, portal credentials, chain-of-custody signatures, and any personal data on sample labels |
| Categories of data subjects | Client personnel, authorised recipients, and — where present — individuals identifiable on sample labels |
| Special-category data | None required. Client to redact any special-category data from sample labels. |
ALS processes personal data only on documented Client instructions (which include the underlying agreement, the accepted quotation, and portal submissions) unless required to do otherwise by applicable law, in which case ALS will notify the Client unless prohibited from doing so.
ALS ensures that personnel authorised to process Client personal data have committed themselves to confidentiality under written contract and receive annual data-protection training. A named training register is maintained under QMS-047.
ALS implements the following measures (see also SEC-002):
The Client provides general written authorisation for ALS to engage the sub-processors listed in the current Sub-processors Register (PRI-004). ALS gives at least 30 days’ prior notice of intended additions or replacements, during which the Client may object on reasonable data-protection grounds; unresolved objections entitle the Client to terminate the affected services for convenience.
ALS imposes written contract terms on each sub-processor no less protective than those in this DPA and remains fully liable for their performance.
Taking into account the nature of processing, ALS assists the Client by appropriate technical and organisational measures — including the portal’s data-subject request tooling — to fulfil obligations to respond to data-subject rights requests within the timelines of applicable law.
ALS assists the Client with security (Art. 32), data-breach notification (Arts. 33–34), data-protection impact assessments (Art. 35), and prior consultation (Art. 36). ALS notifies the Client of a personal-data breach affecting Client personal data without undue delay and in any event within 48 hours of becoming aware.
ALS makes available all information necessary to demonstrate compliance and allows for and contributes to audits, including inspections, conducted by the Client or a mutually agreed independent auditor once per rolling 12-month period on 30 days’ written notice, at the Client’s cost. ALS will not unreasonably delay third-party certificates (ISO/IEC 27001, SOC 2) being provided in lieu of on-site audit.
On termination ALS will, at the Client’s election, return or delete Client personal data (except where retention is required by Data Protection Laws or the ISO/IEC 17025 records-retention regime described in the Privacy Policy §07). A written certificate of destruction is provided within 45 days.
The parties incorporate by reference the EU Standard Contractual Clauses (Module 2, controller-to-processor) and the UK IDTA for any transfer to a country not benefiting from an adequacy decision. Annex III (transfer TIA summary) is available on request.
To the extent of any conflict between this DPA and the underlying agreement in matters of personal-data protection, this DPA prevails.