Data Processing Agreement

This DPA is made between:

• Innovative Cloud Services Ltd, trading as Jibba Jabba, a company incorporated in England and Wales with company number 09491094, whose registered office is at Keepmoat Stadium, Stadium Way, Doncaster, South Yorkshire, DN4 5JW; or, where the Principal Agreement names it as the contracting entity, Innovative Cloud Middle East FZE, a free zone establishment registered in FREE ZONE (awaiting confirmation), United Arab Emirates, with licence number NUMBER (awaiting confirmation) ("Jibba Jabba" or "Processor"); and

• the customer that has entered into the Principal Agreement with Jibba Jabba, as identified in that Principal Agreement (the "Customer" or "Controller"),

each a "Party" and together the "Parties".

Background:

• (A) Jibba Jabba provides the Customer with some or all of: VoIP and hosted telephony, IT support and managed services, Microsoft 365 administration, cyber security and monitoring services (the "Services") under an order form, contract or the Customer's acceptance of Jibba Jabba's terms and conditions (the "Principal Agreement").

• (B) In providing the Services, Jibba Jabba will process Personal Data on behalf of the Customer.

• (C) The Parties enter into this DPA to meet the requirements of Article 28(3) of the UK GDPR and, where applicable, other Data Protection Laws.

2.1 In this DPA:

• "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any other data protection law that applies to the processing, including, where relevant, the EU GDPR and the DIFC Data Protection Law No. 5 of 2020.

• "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.

• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the Data Protection Laws.

• "Customer Personal Data" means Personal Data processed by Jibba Jabba on behalf of the Customer in providing the Services, as described in Schedule 1.

• "Sub-processor" means any third party engaged by Jibba Jabba to process Customer Personal Data.

• "Restricted Transfer" means a transfer of Customer Personal Data outside the United Kingdom that is restricted under Chapter V of the UK GDPR.

• "IDTA" means the International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018.

2.2 If this DPA conflicts with the Principal Agreement on the processing of Personal Data, this DPA prevails.

2.3 Headings do not affect interpretation. References to a law include that law as amended or replaced.

3.1 The Customer is the Controller and Jibba Jabba is the Processor of Customer Personal Data. Where Jibba Jabba decides the purposes and means of processing for its own purposes, such as billing, account management, fraud prevention, network security and meeting its own legal and regulatory duties as a communications provider, Jibba Jabba acts as an independent Controller, and this DPA does not apply to that processing.

3.2 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects.

3.3 The Customer warrants that it has a lawful basis for the processing, and has given any notices and obtained any consents needed for Jibba Jabba to process Customer Personal Data under this DPA. This includes any notices required for call recording.

4.1 Jibba Jabba will:

• process Customer Personal Data only on the Customer's documented instructions, including on transfers outside the UK, unless UK law requires otherwise. In that case Jibba Jabba will tell the Customer before processing, unless the law forbids this. The Principal Agreement, this DPA and the Customer's use and configuration of the Services are the Customer's documented instructions;

• tell the Customer straight away if, in its opinion, an instruction breaks Data Protection Laws. Jibba Jabba may suspend that instruction until the Customer confirms or changes it;

• not sell Customer Personal Data or use it for any purpose other than providing the Services; and

• keep records of its processing activities carried out on the Customer's behalf, as required by Article 30(2) of the UK GDPR.

4.2 The Customer is responsible for the accuracy, quality and lawfulness of Customer Personal Data and of its instructions.

5.1 Jibba Jabba will make sure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, whether by contract or by law. It will give access only to those who need it to provide the Services.

5.2 Jibba Jabba will make sure those staff receive suitable data protection and information security training.

6.1 Jibba Jabba will put in place and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. It will take into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to Data Subjects. Those measures include, as a minimum, the measures in Schedule 2.

6.2 Jibba Jabba may update the measures in Schedule 2 from time to time, as long as the overall level of protection is not reduced.

6.3 The Customer is responsible for security it controls: user accounts and passwords, the configuration options it picks, its own devices and networks, and any decision not to take up security measures Jibba Jabba has recommended.

7.1 The Customer gives Jibba Jabba general written authorisation to engage Sub-processors. Jibba Jabba publishes a current list of its Sub-processors, with the service each provides and where it processes data, at Sub-processor List (awaiting confirmation) (the "Sub-processor List"). The Sub-processors on the Sub-processor List when the Customer accepts this DPA are approved.

7.2 Jibba Jabba will give the Customer at least 30 days' written notice before adding or replacing a Sub-processor. Jibba Jabba will give notice by updating the Sub-processor List and emailing the Customer's nominated contact. Customers can also subscribe to updates at a subscription contact awaiting confirmation. The Customer may object on reasonable data protection grounds within that notice period. The Parties will then discuss the objection in good faith. If they cannot resolve it, the Customer may end the affected Services without penalty by giving written notice.

7.3 Jibba Jabba will put a written contract in place with each Sub-processor. That contract will impose data protection obligations that are substantially the same as those in this DPA, and in particular sufficient guarantees of appropriate technical and organisational measures.

7.4 Jibba Jabba remains liable to the Customer for its Sub-processors' performance of their data protection obligations.

7.5 Where a Sub-processor offers a service on standard terms that Jibba Jabba cannot negotiate (for example Microsoft), the Customer accepts that the Sub-processor's own published data processing terms apply to that Sub-processor.

8.1 Jibba Jabba provides support from teams in the United Kingdom and the United Arab Emirates. The Customer authorises Jibba Jabba and its group companies and Sub-processors to access and process Customer Personal Data in the UAE, and in the other locations shown on the Sub-processor List, to provide the Services.

8.2 Jibba Jabba will make a Restricted Transfer only where one of these applies:

• the destination is covered by UK adequacy regulations;

• the transfer is covered by the IDTA, or by the EU Standard Contractual Clauses together with the UK Addendum, and Jibba Jabba has carried out a transfer risk assessment; or

• another transfer mechanism or exception under Chapter V of the UK GDPR applies.

8.3 For transfers to Jibba Jabba's UAE team, the Parties agree that the IDTA in force between Jibba Jabba and its UAE group company Innovative Cloud Middle East FZE applies. Jibba Jabba will provide a copy to the Customer on request.

8.4 Where the Customer is established in the DIFC, Jibba Jabba will also meet the transfer requirements of Part 4 of the DIFC Data Protection Law No. 5 of 2020 for transfers out of the DIFC.

9.1 If Jibba Jabba receives a request from a Data Subject about Customer Personal Data, it will pass it to the Customer without undue delay and within 5 working days. It will not respond to the request itself unless the Customer authorises it to.

9.2 Taking into account the nature of the processing, Jibba Jabba will help the Customer, through appropriate technical and organisational measures, to respond to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR. Examples include exporting call records, recordings or mailbox data.

10.1 Jibba Jabba will tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2 The notice will include, as far as it is known at the time:

• the nature of the breach, including the categories and approximate numbers of Data Subjects and records concerned;

• the name and contact details of Jibba Jabba's contact point;

• the likely consequences of the breach; and

• the steps taken or proposed to deal with the breach and reduce its effects.

10.3 Jibba Jabba will take reasonable steps to contain and investigate the breach, and will cooperate with the Customer. This includes providing relevant logs, such as Microsoft 365 audit and sign-in logs held on Jibba Jabba's SIEM. The Customer decides whether to notify the Supervisory Authority or Data Subjects. Jibba Jabba will not notify them on the Customer's behalf unless instructed to, or unless the law requires it to.

11.1 Jibba Jabba will give the Customer reasonable help with data protection impact assessments and prior consultations with a Supervisory Authority that relate to the Services. That help is limited to information Jibba Jabba holds.

12.1 Jibba Jabba will make available to the Customer all the information needed to show that it is meeting Article 28 of the UK GDPR. That information includes completed security questionnaires, its policies, and relevant certifications or audit reports.

12.2 Where that information is not enough, Jibba Jabba will allow audits and inspections by the Customer, or by an auditor the Customer appoints who is bound by confidentiality. The Customer will give at least 30 days' notice. Audits will take place during business hours, no more than once in any 12-month period (unless after a Personal Data Breach or at the request of a Supervisory Authority), and in a way that does not disrupt the Services or breach Jibba Jabba's duties to other customers.

12.3 Each Party bears its own costs of an audit. Where Jibba Jabba's time spent supporting an audit goes beyond 1 working day (awaiting confirmation), the Customer will pay for it at Jibba Jabba's standard rates.

13.1 When the Services end, the Customer may ask in writing, within 30 days, for Jibba Jabba to return Customer Personal Data in a commonly used format. Examples include CDRs and call recordings exported from the PBX, and mailbox or file exports. Reasonable export work may be charged at Jibba Jabba's standard rates.

13.2 After that 30-day period, Jibba Jabba will securely delete Customer Personal Data within 90 days. Data in backups will be deleted as the backups expire in their normal cycle, and will be protected under this DPA until then.

13.3 Jibba Jabba may keep Customer Personal Data where UK law requires it to. This includes communications data it must keep as a provider of public electronic communications services. That data will be kept confidential and processed only for the purpose required.

14.1 Each Party's liability under or in connection with this DPA is subject to the limits and exclusions of liability in the Principal Agreement.

14.2 Nothing in this DPA limits either Party's liability to Data Subjects or to a Supervisory Authority under Article 82 or Article 83 of the UK GDPR.

15.1 This DPA takes effect when the Principal Agreement starts or the Customer first uses the Services, whichever is earlier. It continues for as long as Jibba Jabba processes Customer Personal Data on the Customer's behalf, and ends automatically after that.

15.2 Clauses 10, 12, 13 and 14, and any other clause intended to survive, continue after this DPA ends.

16.1 If a change in Data Protection Laws or guidance from a Supervisory Authority means this DPA needs amending, the Parties will agree the changes in good faith.

16.2 If any part of this DPA is invalid or unenforceable, the rest stays in full force.

16.3 This DPA and any dispute arising out of it are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

• Access control: role-based, least-privilege access; multi-factor authentication on all admin and remote-access tools; access removed promptly when staff leave.

• Remote support: through the NinjaOne RMM platform with logged, authenticated sessions.

• Encryption: TLS in transit; encryption at rest where the platform supports it; SRTP and TLS for SIP where configured.

• Monitoring and logging: Microsoft 365 audit and sign-in logs exported to Jibba Jabba's separate SIEM for investigation and compliance.

• Resilience: backups of hosted systems and PBX configuration, with tested restores.

• Vulnerability management: patching of managed systems and platforms; malware and endpoint protection on managed devices.

• People: confidentiality obligations, background checks where lawful, and annual security and data protection training.

• Incident response: a documented incident and breach response process.

• Governance: an information security management system aligned to ISO 27001, with scheduled reviews and audits.

• Supplier management: due diligence and data processing terms with all Sub-processors.

The approved Sub-processors are those on the Sub-processor List published at Sub-processor List (awaiting confirmation), as updated under clause 7. A copy of the list as at any date is available on request from support@jibbajabba.uk.com.

This DPA does not need to be signed by the Customer. It is incorporated into the Principal Agreement and binds the Customer when the Customer accepts the Principal Agreement or uses the Services. Customers who need a countersigned copy for their own records can request one from support@jibbajabba.uk.com.

Jibba Jabba may update this DPA by publishing a new version and giving customers at least 30 days' notice, as long as the update does not reduce the protection given to Customer Personal Data.

Signed for and on behalf of Innovative Cloud Services Ltd

Name: Ashley Harris Title: Director (awaiting confirmation)

Signature: ______________________ Date: ______________________