Master Data Processing Agreement

1. Purpose and application

This DPA applies only to processing activities for which the Client is controller and Sentra is processor. It does not convert separate controller activities undertaken by Sentra into processor activities.

2. Processing instructions

Sentra will process Client Personal Data only on documented instructions from the Client, including instructions contained in the Services Agreement, unless processing is required by applicable law. Sentra will notify the Client if, in its reasonable view, an instruction infringes applicable data protection law.

3. Confidentiality

Sentra will ensure persons authorised to process Client Personal Data are subject to appropriate confidentiality obligations.

4. Security

Sentra will implement appropriate technical and organisational measures taking account of the nature, scope, context and purposes of processing and the risks to individuals.

5. Subprocessors

The Client provides general authorisation for Sentra to appoint subprocessors required to deliver the Services, subject to appropriate data-protection obligations. Sentra will maintain a current Subprocessor & Enrichment Provider Framework and a reasonable mechanism for notifying Clients of material changes where required by contract or law.

6. Data subject requests

Taking account of the nature of processing, Sentra will provide reasonable assistance to enable the Client to respond to data-subject requests where the relevant personal data is processed by Sentra as processor.

7. Breach assistance

Sentra will notify the Client without undue delay after becoming aware of a personal data breach affecting Client Personal Data and will provide information reasonably available to support the Client’s assessment and notification obligations.

8. DPIAs and regulator consultation

Sentra will provide reasonable assistance, taking account of the nature of processing and information available to it, with data protection impact assessments and prior consultation obligations relating to the processor Services.

9. Deletion or return

At the end of the relevant Services, Sentra will delete or return Client Personal Data as required by the Services Agreement or Client instruction, unless applicable law requires continued retention.

10. Audit and information

Sentra will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Audit arrangements should be proportionate, protect other clients’ confidentiality and avoid unnecessary disruption.

11. International transfers

Sentra will not make a restricted transfer of Client Personal Data without an appropriate lawful transfer mechanism where one is required.

12. Processing particulars

Subject matter: the Services described in the applicable Services Agreement.
Duration: for the term of the Services and any permitted retention period.
Nature and purpose: data research, enrichment, workflow operation, CRM/integration, managed digital outreach and related reporting as instructed.
Data subjects: Client personnel, prospects, professional contacts and other individuals relevant to the Services.
Data types: professional identity, company relationship, business contact, engagement, suppression and other data specified in the Services Agreement.