Our role as a controller or a processor depends upon the nature of our engagement with you. If you are a customer this will be defined in your letter of engagement and associated schedules and Terms of Business which form our contract with you. But generally:
- Where we decide the purpose and means of processing, we are a controller.
- Where we jointly decide the purpose and means of processing with you, we are a joint controller.
- Where we process personal data according to your explicit written instructions, in a contract that satisfies Article 28 of the GDPR, we are a processor.