Data Protection Schedule.

Puzzle Technology Ltd

1. Definitions

In addition to the definitions set out in the Terms, in this Schedule the following terms shall have the following meanings:

Applicable Laws means:

• (a) to the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom; and
• (b) to the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which Puzzle Technology is subject.

Applicable Data Protection Laws means:

• (a) to the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of personal data; and
• (b) to the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which Puzzle Technology is subject, which relates to the protection of personal data.

Customer Personal Data means any personal data which Puzzle Technology processes in connection with this Agreement, in the capacity of a processor on behalf of the Customer.

EU GDPR means the General Data Protection Regulation ((EU) 2016/679).

Purpose means the purposes for which the Customer Personal Data is processed, as set out in clause 2.7(a).

Puzzle Technology Personal Data means any personal data which Puzzle Technology processes in connection with this Agreement, in the capacity of a controller, which shall for the avoidance of doubt include any personal data contained in support tickets issued by the Customer when requesting our support services.

Retention Policy means Puzzle Technology’s retention policy, document reference 10190 — Puzzle Technology — Retention Policy, as referred to in clause 15.1 of the Terms.

Terms means https://puzzletech.co.uk/terms.

UK GDPR has the meaning given to it in the Data Protection Act 2018.

2. Data Protection

2.1 For the purposes of this clause 2, the terms controller, processor, data subject, personal data, personal data breach and processing shall have the meaning given to them in the UK GDPR.

• (a) Both parties will comply with all applicable requirements of Applicable Data Protection Laws. This clause 2 is in addition to, and does not relieve, remove or replace, a party’s obligations or rights under Applicable Data Protection Laws.

2.2 The parties have determined that, for the purposes of Applicable Data Protection Laws:

• (a) Puzzle Technology shall act as controller in respect of the personal data which it processes in connection with Customer personnel to enable it to provide the Services; and
• (b) Puzzle Technology shall process the Customer Personal Data as a processor on behalf of the Customer.

2.3 Should the determination in clause 2.2 change, then each party shall work together in good faith to make any changes which are necessary to this clause 2 or the related annexes.

2.4 Puzzle Technology processes Puzzle Technology Personal Data as a controller in accordance with the then-current version of its privacy policy available at https://puzzletech.co.uk/privacypolicy (Privacy Policy), which sets out the lawful bases on which that processing is carried out. The Customer shall provide such notices to, and where required obtain such consents from, its personnel, representatives and agents as are necessary to enable that processing. In the event of any inconsistency or conflict between the terms of the Privacy Policy and this Agreement relating to the processing of personal data by Puzzle Technology as a controller, the Privacy Policy will take precedence.

2.5 Without prejudice to the generality of clause 2.1(a), the Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of Puzzle Technology Personal Data and Customer Personal Data to Puzzle Technology and lawful collection of the same by Puzzle Technology for the duration and purposes of this Agreement.

2.6 In relation to the Customer Personal Data, Annex 1 sets out the scope, nature and purpose of processing by Puzzle Technology, the duration of the processing and the types of personal data and categories of data subject.

2.7 Without prejudice to the generality of clause 2.1(a) Puzzle Technology shall, in relation to Customer Personal Data:

• (a) process that Customer Personal Data only on the documented instructions of the Customer, which shall be to process the Customer Personal Data for the purposes set out in Annex 1, unless Puzzle Technology is required by Applicable Laws to otherwise process that Customer Personal Data. Where Puzzle Technology is relying on Applicable Laws as the basis for processing Customer Personal Data, Puzzle Technology shall notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Puzzle Technology from so notifying the Customer on important grounds of public interest. Puzzle Technology shall inform the Customer if, in the opinion of Puzzle Technology, the instructions of the Customer infringe Applicable Data Protection Laws;
• (b) implement appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Customer Personal Data and against accidental loss or destruction of, or damage to, Customer Personal Data, which the Customer has reviewed and confirms are appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;
• (c) ensure that any personnel engaged and authorised by Puzzle Technology to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory or common law obligation of confidentiality;
• (d) assist the Customer insofar as this is possible (taking into account the nature of the processing and the information available to Puzzle Technology), and at the Customer’s cost and written request, in responding to any request from a data subject and in ensuring the Customer’s compliance with its obligations under Applicable Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
• (e) notify the Customer without undue delay on becoming aware of a personal data breach involving the Customer Personal Data;
• (f) at the written direction of the Customer, given no later than 30 days after the effective date of termination or expiry of the Agreement, delete or return Customer Personal Data and copies thereof to the Customer, unless Puzzle Technology is required by Applicable Law to continue to process that Customer Personal Data. Where no such direction is given within that period, Puzzle Technology shall delete the Customer Personal Data. For the purposes of this clause 2.7(f) Customer Personal Data shall be considered deleted where it is put beyond further use by Puzzle Technology. This clause does not apply to Puzzle Technology Personal Data or to any data which Puzzle Technology retains in accordance with the Retention Policy, Applicable Laws or any regulatory or accreditation requirement, or which it reasonably requires in order to establish, exercise or defend legal claims;
• (g) where the Customer directs the return of Customer Personal Data under clause 2.7(f), Puzzle Technology may charge its reasonable costs of compiling and delivering that data at its then current rates, but shall not withhold the return or deletion of Customer Personal Data by reason of any sum outstanding under the Agreement; and
• (h) for the avoidance of doubt, clause 2.7(f) applies to Customer Personal Data processed by Puzzle Technology as processor in the ordinary course of providing the Services. It does not apply to backup data, archives or system images held on the Customer’s behalf under a backup service, the return and disposal of which is governed by clause 11.6.4 of the Terms; and
• (i) maintain records to demonstrate its compliance with this clause 2.

2.8 The Customer hereby provides its prior, general authorisation for Puzzle Technology to:

• (a) appoint processors to process the Customer Personal Data, provided that Puzzle Technology:
• (i) shall ensure that the terms on which it appoints such processors comply with Applicable Data Protection Laws, and are consistent with the obligations imposed on Puzzle Technology in this clause 2;
• (ii) shall remain responsible for the acts and omissions of any such processor as if they were the acts and omissions of Puzzle Technology; and
• (iii) shall inform the Customer of any intended changes concerning the addition or replacement of the processors, thereby giving the Customer the opportunity to object to such changes, provided that if the Customer objects to the changes and cannot demonstrate, to Puzzle Technology’s reasonable satisfaction, that the objection is due to an actual or likely breach of Applicable Data Protection Law, the Customer shall indemnify Puzzle Technology for any losses, damages, costs (including legal fees) and expenses suffered by Puzzle Technology in accommodating the objection.
• (b) transfer Customer Personal Data outside of the UK as required for the Purpose, provided that Puzzle Technology shall ensure that all such transfers are effected in accordance with Applicable Data Protection Laws. For these purposes, the Customer shall promptly comply with any reasonable request of Puzzle Technology, including any request to enter into standard data protection clauses adopted by the EU Commission from time to time (where the EU GDPR applies to the transfer) or adopted by the UK Information Commissioner from time to time (where the UK GDPR applies to the transfer).

2.9 Where Customer Personal Data is hosted on, or processed by, systems operated by a Third Party Supplier, the retention, availability, export and deletion of that data may be subject to that supplier’s systems and arrangements. Nothing in this clause limits Puzzle Technology’s responsibility under clause 2.8(a)(ii) in respect of processors it appoints.

Annex 1 — Particulars of the processing

1. Particulars of processing

1.1 Scope: the provision of the products or services by Puzzle Technology.

1.2 Nature and Purpose: to enable Puzzle Technology to provide the Services.

1.3 Duration of the processing: the term of the Agreement and, thereafter, until the Customer Personal Data is deleted or returned in accordance with clause 2.7(f), together with such further period as applies to any data retained in accordance with the Retention Policy, Applicable Laws or any regulatory or accreditation requirement, or which Puzzle Technology reasonably requires in order to establish, exercise or defend legal claims.

2. Types of Personal Data

• Names
• Addresses
• Email addresses
• Contact numbers
• Other personal data made available to Puzzle Technology by the Customer

3. Categories of Data Subject

• Customer personnel
• Customer’s customers
• Customer’s suppliers and their personnel

Version control

Approved by robert.childs@puzzletech.co.uk on 22 Sept 2026.

Version	Status	Actions	Action by	Date
1.0	Draft	Initial version. Edited in-app	robert.childs@puzzletech.co.uk	22 Sept 2026
2.0	Draft	Document revised and adjusted together with Import into ISMS Uploaded	robert.childs@puzzletech.co.uk	22 Sept 2026
2.1	Draft	Removed Document effective date from document body as now version controlled. Edited in-app	robert.childs@puzzletech.co.uk	22 Sept 2026
2.1	Approved	Reviewed and approved at version 2.1. Reviewed	robert.childs@puzzletech.co.uk	22 Sept 2026