Data Processor Agreement

The Company acts as a Data Controller.

The Company wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.

The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing, including the UK GDPR, the Data Protection Act 2018 and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

The Parties wish to lay down their rights and obligations.

This Agreement has been entered into in connection with the Data Controller’s use of the Data Processor’s services as part of additional services as described in all quotes and pricing.

The Data Processor processes the types of personal data on behalf of the Data Controller in relation to the relevant data subjects as specified in Schedule 1. The personal data relates to the data subjects listed in Schedule 1.

The Data Processor must only process personal data for purposes which are necessary to fulfil the Data Processor’s obligations and in doing so providing the services set out in the Main Agreement or quote.

The Data Controller warrants that the personal data is processed for legitimate and objective purposes and that the Data Processor is not processing more personal data than required for fulfilling such purposes.

The Data Controller is responsible for ensuring that a valid legal basis for processing exists at the time of transferring the personal data to the Data Processor. Upon the Data Processor’s request, the Data Controller undertakes, in writing, to account for and/or provide documentation of the basis for processing.

In addition, the Data Controller warrants that the data subjects to which the personal data pertains have been provided with sufficient information on the processing of their personal data.

In case the Data Controller instructs a sub-Data Processor, appointed in accordance with clause 5.1 directly, the Data Controller must immediately inform the Data Processor hereof. The Data Processor shall not in any way be liable for any processing carried out by the sub-Data Processor in accordance with such instructions.

All processing by the Data Processor of the personal data provided by the Data Controller must be in accordance with these instructions from the Data Controller, and the Data Processor is, furthermore, obliged to comply with any and all data protection legislation in force from time to time.

If UK law to which the Data Processor is subject stipulates that the Data Processor is required to process the personal data listed in clause 1.2, the Data Processor must inform the Data Controller of that legal requirement before processing. However, this does not apply if this legislation prohibits such information on important grounds of public interests.

The Data Processor must immediately inform the Data Controller if, in the Data Processor’s opinion, an instruction infringes the General Data Protection Regulation or the data protection provisions of UK law.

The Data Processor must take all necessary technical and organisational security measures, including any additional measures, required to ensure that the personal data specified in clause 1.2 is not accidentally or unlawfully destroyed, lost or impaired or brought to the knowledge of unauthorised third parties, abused or otherwise processed in a manner which is contrary to UK or EU data protection legislation in force at any time. These measures are described in more detail in Schedule 1.

The Data Processor must ensure that employees authorised to process the personal data have committed themselves to confidentiality or are under the appropriate statutory obligation of confidentiality.

If so requested by the Data Controller, the Data Processor must state and/or document that the Data Processor complies with the requirements of the applicable data protection legislation, including documentation regarding the data flows of the Data Processor as well as procedures/policies for processing of personal data.

Taking into account the nature of the processing, the Data Processor must, as far as possible, assist the controller by appropriate technical and organisational measures, for the fulfilment of the Data Controller’s obligation to respond to requests for exercising the data subject’s rights as laid down in chapter 3 of the General Data Protection Regulation.

The Data Processor, or another Data Processor (sub-Data Processor) must send requests and objections from data subjects to the Data Controller, for the Data Controller’s further processing thereof, unless the Data Processor is entitled to handle such request itself. If requested by the Data Controller, the Data Processor must assist the Data Controller in answering any such requests and/or objections.

The Data Processor must notify the Data Controller where there is a suspicion that data protection rules have been breached or other irregularities in connection with the processing of the personal data occur. The Data Processor’s deadline for notifying the Data Controller of a security breach is 24 hours from the moment the Data Processor becomes aware of a security breach. If requested by the Data Controller, the Data Processor must assist the Data Controller in relation to clarifying the scope of the security breach, including preparation of any notification to the relevant Data Protection Agency and/or data subjects.

The Data Processor must make available to the Data Controller all information necessary to demonstrate compliance with article 28 of the General Data Protection Regulation and the Agreement. In this connection, the Data Processor allows for and contributes to audits, including inspections, conducted by the Data Controller or another auditor mandated by the Data Controller.

In addition to the above, the Data Processor must assist the Data Controller in ensuring compliance with the Data Controller’s obligations under articles 32–36 of the General Data Protection Regulation. This assistance will consider the nature of the processing and the information available to the Data Processor.

The Data Processor must comply with the conditions laid down in article 28, paragraphs 2 and 4 of the General Data Protection Regulation to engage another Data Processor (sub-Data Processor).

This implies that the Data Processor does not engage another Data Processor (sub-Data Processor) to the performance of the Agreement without prior specific or general written approval from the Data Controller.

The Data Controller hereby grants the Data Processor a general approval to enter into agreements with sub-Data Processors. The Data Processor must notify the Data Controller of any changes concerning the addition or replacement of sub-processors. The Data Controller can make reasonable and relevant objections against such changes. If the Data Processor continues to wish to use a sub-Data Processor to which the Data Controller has objected, the Parties have the right to terminate the Agreement and, if applicable, the Main Agreement with a shorter notice, cf. 7.2. During this period the Data Controller must not require that the Data Processor does not use the sub-Data Processor in question.

The Data Processor must impose the same obligations on the sub-Data Processor as set out in the Agreement. This is executed through a contract or another legal act under applicable law. It must be ensured that sufficient guarantees are provided from the sub-Data Processor to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the General Data Protection Regulation (“back-to-back” terms).

If the sub-Data Processor fails to fulfil its data protection obligations, the Data Processor remains liable to the Data Controller for the performance of the sub-Data Processor’s obligations.

The Data Processor must, on behalf of the Data Controller, enter into Data Processor agreements with sub-Data Processors within the UK and EU/EEA. As for sub-Data Processors outside the UK and EU/EEA, the Data Processor must enter into standard contractual clauses approved for international transfers (including the UK International Data Transfer Agreement or Addendum where applicable).

The Data Controller hereby grants the Data Processor a general power of attorney to enter into standard contracts with sub-Data Processors outside the UK and EU/EEA on behalf of the Data Controller.

The Parties’ liability is governed by the terms of trade and limitation of services as quoted.

The Parties’ liability for damages under this Agreement is governed by the above.

This Agreement becomes effective on confirmation of service via provision of a PO or signed agreement.

In the event of termination of services, this Agreement will also terminate.

However, the Data Processor remains subject to the obligations stipulated in this Agreement, as long as the Data Processor processes personal data on behalf of the Data Controller.

In the situation as described under clause 5.2, the Parties have the right to terminate the Main Agreement and the Agreement with a notice of 1 (one) month ending at the end of a month.

Upon termination of the processing services, the Data Processor is obliged to, upon request of the Data Controller, delete or return all personal data to the Data Controller, as well as to delete existing copies, unless retention of the personal data is prescribed by law.

Any claim or dispute arising from or in connection with this Agreement must be settled by a competent court of the first instance in the same jurisdiction as stated in the Main Agreement.