DATA PROCESSING AGREEMENT
This Agreement is: (i) made between InFormed Software Limited (“InFormed”) and the individual or entity named in the applicable Services Agreement (“Customer” or “You”); (ii) supplemental to the Services Agreement; and (ii) records the terms upon which each party complies with its respective obligations under the Data Protection Laws as relates to the Services Agreement. By continuing to use the services provided under the Services Agreement You are deemed to accept all of these terms and conditions. If You are entering into this Agreement on behalf of a company or other legal entity you represent that you have the authority to bind such entity to this Agreement.
NOW IT IS HEREBY AGREED as follows:
1. Definitions and Interpretation
1.1 Definitions
In this Agreement the following expressions shall have the following meanings:-
"Data Protection Laws"
means any laws and regulations in the UK relating to privacy or the use or processing of data relating to natural persons, including: (a) EU Directives 95/46/EC and 2002/58/EC (as amended by 2009/139/EC) and any legislation implementing or made pursuant to such directives, including (in the UK) the Data Protection Act 1998 (the "DPA") and the Privacy and Electronic Communications (EC Directive) Regulations 2003; and (b) from 25 May 2018, EU Regulation 2016/679 ("GDPR"); and (c) any laws or regulations ratifying, implementing, adopting, supplementing or replacing GDPR or DPA; in each case, to the extent in force, and as such are updated, amended or replaced from time to time;
"DP Regulator"
means any person or regulatory body with responsibility for monitoring and/or enforcing compliance with the Data Protection Laws; and
"Services Agreement”"
means the agreement made between the parties under the terms of which InFormed supplies Customer with data processing services.
1.2 The terms, "Data Controller" "Data Subject", "Data Processor", "Personal Data", "process", "processing", "transfer" (in the context of Personal Data transfers) and "appropriate technical and organisational measures" shall be interpreted in accordance with the applicable Data Protection Laws.
2. Data Protection
2.1 Customer acknowledges that InFormed processes Personal Data as a Data Processor under the Services Agreement and that Customer is the Data Controller and each Party shall comply with the provisions imposed on them by the Data Protection Laws.
2.2 Each Party shall maintain records of all processing operations relating to the Services Agreement under its responsibility that contain at least the minimum information required by the Data Protection Laws and shall make such information available to any DP Regulator on request.
2.3 The Services Agreement sets out details of the processing of Personal Data to be undertaken by Processor, including in respect of the types of Personal Data, categories of Data Subjects, and nature and purposes of processing. Such processing shall take place throughout the duration of the Services Agreement.
2.4 The Customer hereby confirms the appointment of InFormed to process the data passed to it for the purposes of the Services Agreement and in so far as InFormed processes any Personal Data on behalf of the Customer pursuant to the Services Agreement, InFormed shall:
a. process such Personal Data only in accordance with the Customer’s written instructions from time to time (including those set out in this Agreement) save for processing which InFormed is required to do pursuant to any applicable laws;
b. take reasonable steps to ensure that any personnel who have access to such Personal Data are subject to binding obligations of confidentiality when processing such Personal Data;
c. implement and maintain appropriate technical and organisational measures and procedures to ensure an appropriate level of security for such Personal Data, including protecting such Personal Data against the risks of accidental, unlawful or unauthorised destruction, loss, alteration, disclosure, dissemination or access;
d. inform the Customer if any Personal Data is (while within InFormed or its subcontractors' possession or control) subject to a personal data breach (as defined in Article 4 of GDPR);
e. not disclose any such Personal Data to any Data Subject or to a third party other than at the written request of the Customer or as expressly provided for in the Services Agreement;
f. return or delete all such Personal Data on termination or expiry of the Services Agreement, and not make any further use of such Personal Data (except to the extent applicable law requires continued storage of any such Personal Data by InFormed);
g. provide to the Customer and any DP Regulator (at the Customer’s cost) all information and assistance necessary to demonstrate or ensure compliance with the obligations in this clause 2;
h. permit the Customer or its representatives (at the Customer’s cost) to access any relevant premises, personnel or records of InFormed on reasonable notice (but being no less than fifteen (15) business days) to audit and otherwise verify compliance with this clause 2;
i. take such steps as are reasonably required to assist the Customer (at the Customer’s cost) in ensuring compliance with the Customer’s obligations under Articles 30 to 36 (inclusive) of the GDPR;
j. notify the Customer if it receives a request from a Data Subject to exercise its rights under the Data Protection Laws in relation to that person's Personal Data; and
k. provide the Customer (at the Customer’s cost) with its reasonable co-operation and assistance in relation to any request made by a Data Subject to exercise its rights under the Data Protection Laws in relation to that person's Personal Data.
2.5 If either Party receives any complaint, notice or communication which relates directly or indirectly to the processing of Personal Data by the other Party or to either Party's compliance with the Data Protection Laws, it shall promptly notify the other Party and it shall provide the other Party with reasonable co-operation and assistance in relation to any such complaint, notice or communication.
2.6 Where the Customer transfers Personal Data to InFormed, the Customer warrants to InFormed that: (i) all such information supplied to InFormed by or on behalf of the Customer shall be accurate and up-to-date; and (ii) it has the right to transfer such Personal Data to InFormed, and has either:
a obtained all necessary consents to transfer such Personal Data to InFormed at the appropriate time; or
b secured another legal data processing ground, in accordance with applicable Data Protection Laws, to process such Personal Data and to share such Personal Data with InFormed.
2.7 The Customer acknowledges that InFormed is reliant on the Customer alone for direction as to the extent InFormed is entitled to use and process the Personal Data. Consequently, InFormed shall be entitled to relief from liability in circumstances where a Data Subject makes a claim or complaint with regards to InFormed’s actions to the extent that such actions result from: (a) instructions received from the Customer or (b) a breach by the Customer of its obligations under this clause 2.
2.8 InFormed may subcontract its processing of the Personal Data on behalf of the Customer. InFormed shall procure that any such sub-contractors enter into a written contract with InFormed which contains obligations for the protection of the Personal Data which are no less onerous than those set out in this clause 2.
2.9 Where requested, InFormed shall make available to the Customer a current list of those sub-contractors which are used by InFormed to undertake processing of any Personal Data on behalf of the Customer under this Agreement. By entering into this Agreement, the Customer is deemed to have approved the use of InFormed’s current sub-contractors ("Current Sub-Contractor"). The rights afforded to the Customer in clauses 2.10, 2.11 and 2.12 shall not apply in relation to Current Sub-Contractor.
2.10 InFormed shall notify the Customer of its intention to appoint or use a new sub-contractor in respect of processing of Personal Data on behalf of the Customer (which is not a Current Sub-Contractor). If the Customer has a reasonable basis to object to InFormed’s use of such sub-contractor, and such objection directly relates to the Customer’s obligations under Data Protection Laws, the Customer shall notify InFormed promptly in writing within five (5) business days of receipt of InFormed’s notice.
2.11 If the Customer objects to any new sub-contractor in accordance with clause 2.10, InFormed will use reasonable efforts to make available to the Customer an alternative solution or arrangement to avoid the processing by the relevant sub-contractor of any Personal Data supplied by the Customer, provided that:
a InFormed shall not be required to implement an alternative solution or arrangement which unreasonably burdens InFormed; and
b InFormed shall be entitled to make a reasonable additional charge to cover the costs of implementing and operating the alternative solution or arrangement.
2.12 If InFormed is unable to make available an alternative solution or arrangement within a reasonable period of time (which shall not exceed sixty (60) days) or the Customer is unwilling to pay any charge by InFormed to cover the costs of implementing and operating the alternative solution or arrangement, the Customer may, by written notice to InFormed:
a discontinue its use of that part of the Personal Data Processed by InFormed which is impacted by the Customer’s objection; or
b terminate the Services Agreement, but only in such circumstances as it is not technically possible to partly discontinue the Processing of Personal Data pursuant to clause 2.12.a.
3. Termination and Return of Data
3.1 This Agreement shall automatically terminate upon the expiry or termination of the Services Agreement for any reason.
3.2 Upon request by the Customer, at any time, and upon the expiration or termination of this Agreement, InFormed shall promptly return all of the Customer’s Personal Data, in the original format and InFormed shall irremediably destroy or erase (using a file erasure program that renders previously stored data irretrievable) all Personal Data in the possession or control of InFormed, without retaining any whole or partial copies (unless required by Data Protection Laws).
4. Waiver
No delay, neglect or forbearance on the part of either Party in enforcing against the other party any term or condition of this Agreement shall either be or be deemed to be a waiver or in any way prejudice any right of that Party under this Agreement.
5. Severability
If and to the extent that any of the terms and conditions of this Agreement shall be determined to be invalid, unlawful or unenforceable, such term or condition shall to that extent be severed from the remaining terms and conditions which shall continue to be valid to the fullest extent permitted by law.
6. Entire Agreement
This Agreement shall supersede all prior agreements, arrangements and undertakings between the Parties and together with the Services Agreement constitutes the entire agreement between the Parties relating to this subject matter.
7. Variation
No variation of this Agreement shall be valid unless it is in writing and signed by and on behalf of each of the parties.
8. Conflict
In the event of any conflict or inconsistency between any clause of the Services Agreement and the terms of this Agreement the terms of this Agreement shall prevail to the extent of such conflict or inconsistency.
9. Counterparts
This Agreement may be executed in any number of counterparts, each of which shall be deemed to be an original, and which together shall constitute one and the same Agreement.
10. Governing Law
This Agreement shall be governed by and construed in accordance with the laws of England and Wales.
11. Jurisdiction
Each party agrees that any legal action, suit or proceeding in any way arising out of or in connection with this Agreement shall be submitted to the exclusive jurisdiction of the courts of England.
Version 1.1 dated 15 May 201