Definitions. For the purposes of this DPA, the following terms shall have the meanings set out below. Capitalized terms used but not defined in this DPA shall have the meanings given in the Agreement. All other terms in this DPA not otherwise defined in the Agreement shall have the corresponding meanings given to them in Privacy Laws.

This is some text inside of a div block.

Amendments. The Parties agree to negotiate in good faith modifications to this DPA if changes are required for Vendor to continue to process the Personal Data as contemplated by the Agreement or this DPA in compliance with Privacy Laws, or to address the legal interpretation of the Privacy Laws.

Roles of the Parties. The Parties acknowledge that for purposes of Privacy Laws, Customer is the “service recipient,” “controller,” “business,” or any similar term provided under Privacy Laws, and Vendor is the “service provider,” “processor,” “contractor,” or any similar term provided under Privacy Laws. 

Details of Processing. The Parties agree that the details of processing are as described in Annex 1.

Customer Obligations. Customer shall comply with all Privacy Laws in providing Personal Data to Vendor in connection with the Services. Customer represents and warrants that: (a) the Privacy Laws applicable to Customer do not prevent Vendor from fulfilling the instructions received from Customer and performing Vendor’s obligations under this DPA; (b) all Personal Data was collected and at all times processed and maintained by or on behalf of Customer in compliance with all Privacy Laws, including with respect to any obligations to provide notice to and/or obtain consent from individuals; and (c) Customer has a lawful basis for disclosing the Personal Data to Vendor and enabling Vendor to process the Personal Data as set out in this DPA. Customer shall notify Vendor without undue delay if Customer makes a determination that the processing of Personal Data under the Agreement does not or will not comply with Privacy Laws, in which case, Vendor shall not be required to continue processing such Personal Data. 

Processing of Personal Data. 

Prohibitions. To the extent required by applicable Privacy Laws, Vendor is prohibited from:

Use of Subcontractors. To the extent Vendor engages any subcontractors to process Personal Data on its behalf:

Assistance. To the extent required by Privacy Laws, and taking into account the nature of the processing, Vendor shall, in relation to the processing of Personal Data and to enable Customer to comply with its obligations which arise as a result thereof, provide reasonable assistance to Customer, through appropriate technical and organizational measures, in: 

Security Measures. Vendor shall, taking into account the state-of-the-art, the costs of implementation and the nature, scope, context and purpose of the processing, implement, and ensure that its authorized personnel comply with, appropriate technical and organizational measures designed to provide a level of security appropriate to the risk, as set out in Annex 3, or otherwise agreed and documented between Customer and Vendor from time to time. To the extent required by Privacy Laws, Vendor shall without undue delay notify Customer in writing of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, with further information about the breach provided in phases as more details become available.

Access and Audits. Upon reasonable request of Customer, Vendor shall make available to Customer such information in its possession as is reasonably necessary to demonstrate Vendor’s compliance with its obligations under this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer and reasonably accepted by Vendor. Customer shall be permitted to conduct such an assessment no more than once every 12 months, upon 30 days’ advance written notice to Vendor, and only after the Parties come to agreement on the scope of the audit and the auditor is bound by a duty of confidentiality. As an alternative to an audit performed by or at the direction of Customer, to the extent permitted by Privacy Laws, Vendor may arrange for a qualified and independent auditor to conduct, at Vendor’s expense, an assessment of Vendor’s policies and technical and organizational measures in support of its obligations under Privacy Laws using an appropriate and accepted control standard or framework and assessment procedure for such assessment, and will provide a report of such assessment to Customer upon reasonable request. Notwithstanding the foregoing, in no event shall Vendor be required to give Customer access to information, facilities or systems to the extent doing so would cause Vendor to be in violation of confidentiality obligations owed to other customers or its legal obligations.

Deletion of Personal Data.  At Customer’s written direction, Vendor shall delete or return all Personal Data to Customer as requested at the end of the provision of the Services, unless retention of the Personal Data is required by law. 

Data Transfers. To the extent Vendor processes Personal Data subject to EU/UK Privacy Laws in a Third Country, and it is acting as data importer, Vendor shall comply with the data importer’s obligations and Customer shall comply with the data exporter’s obligations set out in the Controller to Processor Clauses, which are hereby incorporated into and form part of this DPA, and: