Subscribe to GEN
Login to GEN
This Policy supplements Section 5.8 of the Framework Agreement, which contains the processor terms required by Article 28 of the UK GDPR. It does not replace or vary those terms. Its purpose is to provide the service-specific detail that Article 28(3) requires being the subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subject for each Service GEN provides.
Where the Framework Agreement and this Policy differ, the Framework Agreement prevails, save that this Policy governs the particulars of processing for the Service it describes. Where the parties have signed a separate data processing agreement, that agreement prevails for the Services it covers, as provided at Section 5.8.10.
Only the entries for Services the Customer actually takes apply. Where a Service is not taken, its entry is of no effect. Where a Statement of Work describes processing not covered below, that Statement of Work supplies the particulars for it.
Nature and purpose: receiving, triaging, investigating and resolving support
requests; recording work performed; communicating with the Customer's personnel.
Personal data: names, job roles, business contact details, ticket correspondence
and its contents, authentication and account identifiers, device and session identifiers, IP
addresses, and whatever personal data the Customer's personnel include in a request or attach to
it.
Data subjects: the Customer's personnel; and any individual referred to in the
contents of a support request, who may include the Customer's own customers, suppliers or
contacts.
Nature and purpose: administering, monitoring, patching, configuring and securing
the systems within the Managed Environment; incident detection and response; change and asset
management.
Personal data: directory and account records, group and permission membership,
mailbox and file metadata, authentication logs, endpoint and telemetry data, and any personal data
present in the systems administered, which GEN processes incidentally in administering them.
Data subjects: the Customer's personnel and any other user of the administered
systems; and any individual whose data is held in those systems.
Nature and purpose: hosting, storing, transmitting and making available the
Customer's systems, applications and data; platform maintenance, capacity management, backup and
restoration.
Personal data: any personal data the Customer or its users place on the platform,
the content and structure of which is determined by the Customer and not by GEN; together with
platform access logs, authentication records and resource usage data.
Data subjects: determined by the Customer; typically its personnel, its customers,
and any individual whose data it chooses to host.
Nature and purpose: copying, storing, retaining, testing and restoring the
Customer's data on the schedule agreed.
Personal data: a copy of whatever personal data exists in the systems within the
scope of the backup, in the state it existed when the copy was taken.
Data subjects: as for the source systems.
Note on retention: backup copies are retained for their configured cycle and are
overwritten on expiry rather than deleted individually, as provided at Step 3 of Section 10.3 of the
Framework Agreement.
Nature and purpose: transmitting, routing, filtering, scanning, storing and
archiving email; spam and malware control; mailbox administration.
Personal data: sender and recipient addresses, message headers, subject lines,
message bodies and attachments, delivery and filtering logs, and mailbox configuration.
Data subjects: the Customer's personnel, and any person who sends email to or
receives email from them.
Nature and purpose: providing, configuring, routing, monitoring and supporting the
connection; fault diagnosis; capacity and security management.
Personal data: user and device identifiers, authentication and certificate records,
assigned and source IP addresses, connection and session logs, and traffic metadata. GEN does not
inspect the content of traffic except where necessary to diagnose a specific reported fault.
Data subjects: the Customer's personnel and any other authorised user of the
connection.
Nature and purpose: carrying, routing, recording where configured, and billing voice
traffic; number management; fault diagnosis.
Personal data: calling and called numbers, extension and user records, call detail
records, call duration and routing data, voicemail, and call recordings and transcriptions where the
Customer has enabled them.
Data subjects: the Customer's personnel and any party to a call with them.
Note: where the Customer enables call recording it is the Customer's
responsibility, as controller, to provide the notification and obtain any consent that the law
requires.
Nature and purpose: registering, renewing, transferring and administering domain
names, and operating DNS.
Personal data: registrant, administrative, technical and billing contact details as
required by the registry, and DNS query and change logs.
Data subjects: the Customer's nominated contacts.
Note: registries and registrars are recipients in their own right and may publish
or disclose registrant data under their own rules and applicable registry policy.
Nature and purpose: scheduling and delivering training; managing attendance;
issuing certification and feedback.
Personal data: attendee names, job roles, business contact details, attendance
records, assessment results and feedback.
Data subjects: the individuals the Customer nominates to attend.
GEN engages sub-processors under the general authorisation at Section 5.8.5 of the Framework Agreement. A current list naming each sub-processor, its role and its location is available to the Customer on request. The categories used are:
GEN's processing is performed principally in the United Kingdom. Where processing or support takes place outside the United Kingdom, GEN relies on adequacy regulations where they apply, and otherwise on an approved transfer mechanism such as the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any additional measures a transfer risk assessment identifies. The sub-processor list identifies the location of each sub-processor.
The measures GEN applies under Article 32 and Section 5.8.3 of the Framework Agreement include: role-based access control and least privilege; credential storage restricted to the Site Record; encryption of data in transit, and at rest where the platform supports it; network segregation and firewalling; patching and vulnerability management; logging, monitoring and alerting; backup with tested restoration; physical security at hosting locations; confidentiality obligations and training for personnel; documented incident response; and change control. GEN will provide further detail, and complete a security questionnaire, on reasonable request under Section 5.8.6.
This Policy is an Incorporated Policy and is updated in accordance with Section 12.6 of the Framework Agreement. The version published on this page is the authoritative one; any printed or saved copy is for convenience only.