Working.Experts for Pharmacy — Data Processing Addendum

Last updated: 14 April 2026 Provider: Fastidious LLP, trading as Working Experts Email: [email protected]

1. Scope

This Data Processing Addendum applies where Fastidious LLP processes personal data on behalf of a business customer as a processor in connection with agreed Platform services.

2. Roles of the parties

The customer is the controller and Fastidious LLP is the processor, except to the extent Fastidious LLP acts as an independent controller for its own business operations, security, billing, fraud prevention, legal compliance, or service improvement.

3. Subject matter and duration

Processing covers the provision of the agreed Platform services for the duration of the relevant customer relationship, together with any limited post-termination retention required by law or reasonably necessary for security, backup, billing, audit, or legal claims.

4. Nature and purpose of processing

Processing may include hosting, storage, organisation, retrieval, transmission, support, analytics, security monitoring, and related processing necessary to provide the services.

5. Types of personal data and categories of data subjects

These may include account details, user profile data, candidate data, application workflow data, contact details, communications, and usage records relating to customer personnel, candidates, contractors, or end users.

6. Processor obligations

Fastidious LLP will:

• process personal data only on documented instructions from the customer, unless otherwise required by law
• ensure appropriate confidentiality obligations apply to personnel with access to personal data
• implement appropriate technical and organisational security measures
• assist the customer reasonably with data subject rights requests, security incidents, and compliance obligations, taking into account the nature of the processing
• delete or return personal data at the end of the services where required, subject to lawful retention needs
• make available information reasonably necessary to demonstrate compliance with applicable processor obligations

7. Sub-processors

Fastidious LLP may use sub-processors for hosting, communications, analytics, support, payment, security, or similar operational functions, subject to appropriate contractual protections.

8. International transfers

Where personal data is transferred internationally, appropriate safeguards will be used as required by applicable data protection law.

9. Liability

Liability relating to this addendum is subject to the liability framework agreed between the parties in the main customer agreement unless otherwise required by law.

10. Contact

Fastidious LLP trading as Working Experts 10-11 Great Russell Street, London WC1B 3NH 01740 467015 [email protected]