Business Privacy Policy

BUSINESS PRIVACY POLICY AND DATA PROCESSING AGREEMENT

Company Name:     Client Name:

Effective Date:

WHEREAS

WHEREAS, Company Name is engaged in the business of providing services that require the collection, use and processing of personal and business information; and

WHEREAS, Client Name desires Company Name to process certain personal data on Client Name’s behalf, and the parties wish to define their respective rights and obligations regarding such processing and the privacy protections to be applied; and

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows.

DEFINITIONS

"Personal Data" means any information relating to an identified or identifiable natural person processed under this Agreement. "Process/Processing" means any operation performed upon Personal Data, including collection, recording, organization, storage, modification, retrieval, disclosure, transmission and deletion.

SCOPE OF PROCESSING

CATEGORIES OF PERSONAL DATA

The parties acknowledge that processing may include the following categories of Personal Data (check all that apply):

Personal identifiers (name, email, phone)
Financial and billing information
Transactional and service usage data
Technical data (IP address, device identifiers)
Other:

USE OF INFORMATION

Company Name will Process Personal Data only for the purposes described in the Scope of Processing and as necessary to provide contracted services, perform contractual obligations, ensure security and compliance, and as required by law. Company Name will not use Personal Data for unrelated commercial purposes without Client Name’s prior written consent.

LAWFUL BASIS AND CONSENT

The parties represent that they have obtained any required consents and legal bases for the Processing set forth in this Agreement. Client Name authorizes Company Name to act as a processor where applicable and to rely on documented instructions from Client Name for Processing decisions.

DATA SUBJECT RIGHTS

Company Name will, taking into account the nature of the processing, assist Client Name by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Client Name’s obligations to respond to requests to exercise Data Subject rights (access, rectification, erasure, restriction, portability, objection). Company Name will promptly notify Client Name of any such requests and will not respond to a Data Subject request without Client Name’s authorization unless legally obliged to do so.

DATA RETENTION

Personal Data will be retained only for the period necessary to fulfill the purposes described in this Agreement or as required by law. Retention period or criteria:

SECURITY AND BREACH NOTIFICATION

Company Name shall implement and maintain reasonable technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. In the event of a confirmed data security breach affecting Personal Data, Company Name will notify Client Name without undue delay and provide information necessary to fulfill notification obligations.

SUBPROCESSORS AND THIRD PARTIES

Company Name may engage subprocessors to perform specific processing activities. Company Name will ensure that any subprocessors are bound by written obligations no less protective than those set forth in this Agreement. Company Name remains responsible for the subprocessors’ compliance with these obligations.

INTERNATIONAL TRANSFERS

Where Personal Data is transferred across national borders, Company Name will ensure that such transfers are governed by appropriate safeguards that provide an adequate level of protection consistent with applicable law.

CONFIDENTIALITY

Each party shall treat Personal Data and other confidential information received from the other as confidential and shall not disclose such information except to its employees, agents or subprocessors who have a need to know and who are bound by confidentiality obligations. The receiving party will use at least the same degree of care to protect confidential information as it uses to protect its own confidential information, but in no event less than reasonable care.

PAYMENT TERMS

TERM AND TERMINATION

This Agreement commences on the Effective Date and shall continue until terminated in accordance with this section.

TERMINATION EFFECTS

Upon termination, Company Name shall, at Client Name’s election, return or securely destroy Personal Data processed on behalf of Client Name, except to the extent retention is required by law. Company Name will certify destruction upon written request.

LIMITATION OF LIABILITY

Each party’s liability under this Agreement shall be subject to any limitations set forth in the parties’ primary services agreement. Nothing in this Agreement shall exclude or limit liability for gross negligence, willful misconduct or other liabilities that cannot be excluded by applicable law.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws selected by the parties. Chosen jurisdiction:

ENTIRE AGREEMENT

This Agreement, together with any appendices and the parties’ primary services agreement to the extent referenced herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior or contemporaneous understandings and agreements, whether written or oral.

AMENDMENTS AND NOTICES

Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties. Notices required under this Agreement shall be sent to the contact information provided below.

MISCELLANEOUS PROVISIONS

If any provision of this Agreement is held invalid or unenforceable, the remaining provisions will remain in full force and effect. The failure of either party to enforce any right shall not be deemed a waiver of that right.

Sign Now