The GDPRLocal Master Service Agreement and additional Terms herein govern our products, services and customer relationships.
There are no requirements to purchase services. No credit card needed to sign up, and once registered services may be purchased and activated at any time.
This Schedule forms part of the Master Services Agreement (“Agreement”) between the Customer and GDPRLocal Ltd (“GDPRLocal”). It sets out the scope of Consultancy Services delivered by GDPRLocal on either a fixed (defined-scope) or rolling (ongoing) basis. Terms used in this Schedule have the same meaning as in the Master Services Agreement.
Consultancy Services are advisory in nature. GDPRLocal does not assume operational decision-making or execution responsibility for the Customer’s compliance activities.
In the event of any conflict between this Schedule and the Master Services Agreement, this Schedule prevails.
1.1 Nature of Consultancy Services. Consultancy Services are advisory services provided by GDPRLocal to support the Customer’s compliance activities. Typical engagements include (without limitation): compliance assessments, documentation drafting (policies, procedures, records), data protection impact assessments (DPIAs), legitimate interest assessments (LIAs), remediation projects, assurance and review projects, and ad-hoc advisory support.
1.2 Delivery models. Consultancy Services are activated in one of two forms:
(a) Fixed Consultancy: a defined-scope engagement covering a specific deliverable or set of deliverables, at a fixed fee or hourly against a capped estimate; and
(b) Rolling Consultancy: an ongoing monthly capacity commitment against a package of hours, per the Rate Card.
1.3 Scope confirmation. Prior to activation of any Consultancy engagement, the scope of work (whether a specific set of deliverables for Fixed Consultancy, or the hours commitment and general engagement remit for Rolling Consultancy) shall be agreed between the parties in writing. Written agreement by email is sufficient. The written scope forms the applicable Statement of Work (“SOW”) for that engagement and is captured against the Service Activation Record.
2.1 Service delivery. GDPRLocal shall deliver the Consultancy Services described in the SOW in accordance with the scope, timeline, and priorities agreed between the parties.
2.2 Advice and reporting. GDPRLocal shall provide guidance, recommendations, and deliverables agreed under the SOW within reasonable timeframes agreed between the parties from time to time.
2.3 Rolling capacity. Where the engagement is a Rolling Consultancy commitment, hours may be used across any advisory activity within scope. Unused hours roll over by one month unless otherwise stated in the SOW. Rolling packages are governed by the Rate Card in force at Service Activation.
In addition to the obligations set out in MSA §6, the Customer shall:
3.1 nominate a Customer Contact responsible for issuing instructions under the SOW;
3.2 provide reasonable and timely cooperation, information, and access to systems or personnel required for GDPRLocal to deliver the Consultancy Services;
3.3 respond within reasonable timeframes to requests for information, clarification, or decisions issued by GDPRLocal;
3.4 promptly notify GDPRLocal of any change in circumstances that materially affects the scope, direction, or timing of the engagement.
4.1 Consultancy Services are limited to the scope agreed in the applicable SOW. The Services do not include the provision of legal advice, legal opinions, or the discharge of any statutory role.
4.2 GDPRLocal shall not assume operational decision-making or execution responsibility for the Customer’s compliance activities. The Customer retains sole responsibility for the adoption, implementation, and operation of any recommendations or deliverables provided by GDPRLocal.
4.3 GDPRLocal’s role is advisory and supportive. While GDPRLocal may develop frameworks, documentation, and recommendations, the Customer retains sole responsibility for their adoption, implementation, and ongoing operation.
4.4 Any services outside the agreed SOW scope may be requested as billable additional services in accordance with the Master Services Agreement.
5.1 Scope. The Services are limited to the deliverables and activities set out in the applicable SOW.
5.2 Additional Services. Where GDPRLocal identifies a request or requirement that falls outside the SOW scope, GDPRLocal shall notify the Customer in writing (email sufficient) together with a good-faith estimate of the additional time or cost involved. Additional Services shall not commence until authorised by the Customer in writing (email sufficient).
5.3 Billing. Additional Services authorised under §5.2 are billed at the applicable Rate Card rate unless the parties expressly agree a different fee in writing prior to the work commencing.
5.4 SOW variation. Where Additional Services represent a material extension of the engagement, the parties shall agree a written variation to the SOW recording the revised scope, timeline, and fees.
5.5 Records. GDPRLocal maintains records of time and activity performed under the SOW, and shall make these available to the Customer on reasonable request.
5.6 Rolling Consultancy overrun. For Rolling Consultancy engagements, hours consumed in excess of the monthly package commitment are notified to the Customer per §5.2, and where authorised are billed at the Rate Card hourly rate in the following billing period.
6.1 Fees. Consultancy fees are set out in the SOW, reflecting the Rate Card current at Service Activation.
6.2 Fixed Consultancy. Fixed engagements are billed at a fixed fee against a defined scope, or hourly against a capped estimate, as specified in the SOW.
6.3 Rolling Consultancy. Rolling engagements are billed monthly at the package fee stated in the SOW. Additional hours beyond the package are billed hourly at the Rate Card rate.
7.1 Aggregate liability. Aggregate liability under this Schedule shall not exceed the total Fees paid or payable by the Customer under the applicable SOW in the twelve (12) months preceding the event giving rise to the claim.
7.2 Excluded losses. Neither party shall be liable for indirect, consequential, special, or punitive loss.
7.3 Advisory-role carve-outs. GDPRLocal shall have no liability for: loss arising from the Customer’s failure to implement or act on GDPRLocal’s recommendations; regulatory findings, fines, or enforcement action against the Customer; or the Customer’s own decisions taken on the basis of GDPRLocal’s advice.
7.4 Exclusions from cap. The liability cap does not apply to: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; any liability that cannot be limited by law; the Customer’s obligation to pay Fees; or breach of confidentiality.
7.5 Professional Indemnity Insurance. GDPRLocal shall maintain professional indemnity insurance of not less than £1,000,000 per claim throughout the term.
8.1 Term.
(a) Fixed Consultancy engagements commence on the Service Start Date and continue until completion of the last SOW deliverable or such earlier termination in accordance with this clause or MSA §12.
(b) Rolling Consultancy engagements commence on the Service Start Date, run monthly, and auto-renew each month unless terminated in accordance with this clause.
8.2 Termination for convenience.
(a) Fixed Consultancy: either party may terminate on thirty (30) days’ prior written notice, subject to payment for all Services delivered to the effective termination date and any non-cancellable third-party costs.
(b) Rolling Consultancy: either party may terminate on thirty (30) days’ prior written notice, effective at the end of the next full billing month.
8.3 Termination for cause. Termination for cause is governed by MSA §12.2.
8.4 Consequences of termination. On termination, GDPRLocal shall deliver a handover of work in progress and deliverables completed to date. All outstanding Fees for Services performed become immediately due.
__________________________________________________
The SOW for a Consultancy engagement is the written scope agreed between the parties prior to activation, per clause 1.3. The written scope may be:
(a) a portal-generated Service Activation Record confirming Customer selections;
(b) a signed SOW document; or
(c) an email exchange between the parties recording the material terms.
The SOW shall as a minimum record:
The written SOW is captured against the Service Activation Record for evidentiary purposes.