Business Privacy Statement

BUSINESS PRIVACY STATEMENT

WHEREAS: Business Name: and Client Name: (collectively, the Parties) desire to define the terms under which Personal Data will be collected, accessed, processed, protected, and transferred in connection with services provided by Business to Client.

WHEREAS: Business provides services that require processing of Personal Data on behalf of Client, and Client requires assurances regarding the confidentiality, security, and handling of such Personal Data.

WHEREAS: The Parties intend this Business Privacy Statement to allocate responsibilities, set processing limits, and establish remedies for noncompliance. Effective Date:

Scope of Work

Definitions

For purposes of this Statement, "Personal Data" means any information that identifies or can reasonably be used to identify an individual. "Processing" means any operation performed on Personal Data including collection, recording, storage, retrieval, use, disclosure, and deletion. "Controller" and "Processor" shall be construed in accordance with applicable data protection law.

Categories of Data and Purpose

The types of Personal Data to be processed include (select applicable categories):

Personal identifiers (name, national ID, date of birth)
Contact information (email, postal address, telephone)
Financial and payment data (bank account, transaction history)
Employment and HR-related data
Customer service and transaction records
Other:

Purposes and Legal Basis

The Parties represent that the processing activities described herein are supported by an appropriate legal basis under applicable data protection law, including performance of a contract and legitimate interests where applicable. Client shall document and retain the legal basis for such processing.

Controller / Processor Roles

The Parties acknowledge and agree that Client shall act as the Controller of Personal Data for the purposes specified, and Business shall act as Processor performing processing on Client's behalf. Business will process Personal Data only on documented instructions from Client, unless required by law to act otherwise, in which case Business will inform Client to the extent permitted.

Security Measures

Business will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Such measures shall include, at a minimum, access controls, encryption of Personal Data in transit and at rest when feasible, regular vulnerability assessments, logging and monitoring, and personnel training.

Data Breach Notification

In the event Business becomes aware of a confirmed security incident resulting in unauthorized access to Personal Data, Business will notify Client without undue delay and will provide reasonably available information to allow Client to meet any regulatory obligations. Notification shall include the nature of the breach, categories of affected data, number of individuals affected if known, mitigation steps taken, and contact information for follow-up.

Subprocessing and International Transfers

Business will not engage subprocessors to process Personal Data without Client's prior written consent. Where subprocessors are engaged, Business will impose equivalent data protection obligations by contract. Transfers of Personal Data across national borders are permitted only where adequate safeguards are in place and Client has been notified in advance.

Return, Retention, and Deletion

Upon termination or expiration of the services, Business will, at Client's direction, return all Personal Data in a commonly used electronic format or securely destroy and irrecoverably delete such data within the timeframe agreed below. Retention period after termination (days):

Audit Rights

Client has the right to request and review documentation demonstrating Business's compliance with this Statement and, subject to reasonable advance notice and confidentiality protections, to conduct audits or inspections, which may include third-party auditors bound by confidentiality obligations. The Parties will cooperate to minimize disruption during any such audit.

Payment Terms

Late payments shall incur interest at per month, compounded monthly, plus recovery costs. Business reserves the right to suspend processing services for overdue balances after providing days' written notice.

Term and Termination

Term Start Date:    Term End Date:

Either Party may terminate this Statement for convenience upon days' prior written notice. Termination for material breach may be immediate where the breaching Party fails to cure within 10 business days of written notice describing the breach.

Confidentiality

Each Party will treat as confidential all nonpublic information received from the other Party that is designated confidential or ought reasonably to be considered confidential under the circumstances, including Personal Data. Confidential information will not be disclosed except to employees, contractors, or agents who need access to perform obligations under this Statement and who are bound by confidentiality obligations no less protective than those herein. Confidentiality obligations survive termination for a period of five years, except for Personal Data retention obligations governed by this Statement.

Indemnification and Liability

Each Party shall indemnify the other for third-party claims arising from its breach of this Statement or applicable data protection law, except to the extent caused by the indemnified Party's own negligence or willful misconduct. Except for liability arising from a Party's breach of confidentiality or data protection obligations, aggregate direct damages for claims arising under this Statement shall be limited to the fees paid by Client to Business under this Statement in the twelve (12) months preceding the claim.

Governing Law

This Statement and any dispute arising out of or relating to it shall be governed by the laws of: without regard to conflict of law principles.

Entire Agreement

This Statement constitutes the entire agreement between the Parties with respect to the subject matter herein and supersedes all prior and contemporaneous agreements, proposals, and communications, whether oral or written, concerning the processing of Personal Data. Any amendment must be in writing and signed by authorized representatives of both Parties.

Miscellaneous

If any provision of this Statement is found to be unenforceable, the remainder will continue in full force and effect. The Parties are independent contractors; nothing in this Statement creates a partnership, joint venture, or agency relationship.

Sign Now