The GDPRLocal Master Service Agreement and additional Terms herein govern our products, services and customer relationships.
There are no requirements to purchase services. No credit card needed to sign up, and once registered services may be purchased and activated at any time.
This Schedule forms part of the Master Services Agreement (“Agreement”) between the Customer and GDPRLocal Ltd (“GDPRLocal”). It sets out the scope of Project Services delivered by GDPRLocal against an agreed Statement of Work. Terms used in this Schedule have the same meaning as in the Master Services Agreement.
Project Services are discrete, defined-scope engagements delivered against a written Statement of Work. GDPRLocal does not assume operational decision-making or execution responsibility for the Customer’s compliance activities.
In the event of any conflict between this Schedule and the Master Services Agreement, this Schedule prevails.
1.1 Nature of Project Services. Project Services are discrete, defined-scope engagements delivered by GDPRLocal in support of the Customer’s compliance, governance, or operational objectives. Typical engagements include (without limitation): governance framework builds, compliance programme support (including audits), remediation projects, provision of AI governance expertise, and one-off assurance projects.
1.2 Scope confirmation. Prior to activation of any Project engagement, the scope of the Project (deliverables, timeline, fee model, appointed Project Manager, and any acceptance criteria) shall be agreed between the parties in writing. Written agreement by email is sufficient. The written scope forms the applicable Statement of Work (“SOW”) for that Project and is captured against the Service Activation Record.
1.3 Project delivery. Projects are delivered by a Project Manager appointed by GDPRLocal, supported by such Project Team members as GDPRLocal determines are appropriate. Internal allocation of Project Team members is at GDPRLocal’s discretion.
2.1 Service delivery. GDPRLocal shall deliver the Project Services described in the SOW in accordance with the scope, timeline, and milestones agreed between the parties.
2.2 Advice and reporting. The Project Manager shall provide periodic updates to the Customer regarding the progress of the Project. Updates may be provided via written status update, meeting, or shared workspace posting, as agreed in the SOW.
2.3 Handover. On completion of the Project, GDPRLocal shall deliver the finalised outputs to the Customer and conduct a handover, either through a meeting or written communication, as agreed in the SOW.
In addition to the obligations set out in MSA §6, the Customer shall:
3.1 nominate a Customer Contact responsible for issuing instructions under the SOW and coordinating with the Project Manager;
3.2 provide reasonable and timely cooperation, information, and access to systems or personnel required for GDPRLocal to deliver the Project Services;
3.3 respond within reasonable timeframes to requests for information, clarification, or decisions issued by the Project Manager;
3.4 promptly notify GDPRLocal of any change in circumstances that materially affects the scope, direction, or timing of the Project.
4.1 Project Services are limited to the scope agreed in the applicable SOW. The Services do not include the provision of legal advice, legal opinions, or the discharge of any statutory role.
4.2 GDPRLocal shall not assume operational decision-making or execution responsibility for the Customer’s compliance activities. The Customer retains sole responsibility for the adoption, implementation, and operation of any Project deliverables.
4.3 GDPRLocal’s role is advisory and supportive. While GDPRLocal may develop frameworks, documentation, and recommendations, the Customer retains sole responsibility for their adoption, implementation, and ongoing operation.
4.4 Any services outside the agreed SOW scope may be requested as billable additional services in accordance with the Master Services Agreement.
5.1 Scope. The Services are limited to the deliverables and activities set out in the applicable SOW.
5.2 Additional Services. Where GDPRLocal identifies a request or requirement that falls outside the SOW scope, GDPRLocal shall notify the Customer in writing (email sufficient) together with a good-faith estimate of the additional time or cost involved. Additional Services shall not commence until authorised by the Customer in writing (email sufficient).
5.3 Billing. Additional Services authorised under §5.2 are billed at the applicable Rate Card rate unless the parties expressly agree a different fee in writing prior to the work commencing.
5.4 SOW variation. Where Additional Services represent a material extension of the engagement, the parties shall agree a written variation to the SOW recording the revised scope, timeline, and fees.
5.5 Records. GDPRLocal maintains records of time and activity performed under the SOW, and shall make these available to the Customer on reasonable request.
5.6 Project scope extensions. For Project engagements, the following are treated as Additional Services and notified to the Customer per §5.2: (a) scope extensions identified during delivery (including expanded stakeholder groups, additional workstreams, or expanded deliverables); (b) any additional Project Team roles or increased team size required to deliver the extended scope; and (c) advisory or delivery work requested by the Customer after Project handover.
6.1 Fees. Project fees are set out in the SOW, reflecting the Rate Card current at Service Activation.
6.2 Fee models. Projects may be priced as (a) a fixed fee against a defined scope, (b) milestone-based against agreed deliverables, or (c) hourly per the Rate Card, as specified in the SOW.
7.1 Aggregate liability. Aggregate liability under this Schedule shall not exceed the total Fees paid or payable by the Customer under the applicable SOW.
7.2 Excluded losses. Neither party shall be liable for indirect, consequential, special, or punitive loss.
7.3 Advisory-role carve-outs. GDPRLocal shall have no liability for: loss arising from the Customer’s failure to implement or act on Project deliverables; regulatory findings, fines, or enforcement action against the Customer; or the Customer’s own decisions taken based on Project deliverables.
7.4 Exclusions from cap. The liability cap does not apply to: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; any liability that cannot be limited by law; the Customer’s obligation to pay Fees; or breach of confidentiality.
7.5 Professional Indemnity Insurance. GDPRLocal shall maintain professional indemnity insurance of not less than £1,000,000 per claim throughout the term.
8.1 Term. This Schedule commences on the Service Start Date for the Project and continues until completion of the last SOW deliverable, or such earlier termination in accordance with this clause or MSA §12.
8.2 Termination for convenience. Either party may terminate on thirty (30) days’ prior written notice. Where the Customer terminates for convenience, the Customer shall pay for all Services delivered to the effective termination date and any non-cancellable third-party costs committed.
8.3 Termination for cause. Termination for cause is governed by MSA §12.2.
8.4 Consequences of termination. On termination, GDPRLocal shall deliver a handover of work in progress and all Customer-facing deliverables completed to date. All outstanding Fees for Services performed become immediately due.
__________________________________________________
The SOW for a Project engagement is the written scope agreed between the parties prior to activation, per clause 1.2.
The written scope may be:
(a) a portal-generated Service Activation Record confirming Customer selections;
(b) a signed SOW document; or
(c) an email exchange between the parties recording the material terms.
The written SOW is captured against the Service Activation Record for evidentiary purposes.