Client Privacy Policy Agreement

CLIENT PRIVACY POLICY AGREEMENT

This Client Privacy Policy Agreement ("Agreement") is entered into as of Effective Date: by and between Client Name: (Client) and Service Provider Name: (Provider). Client and Provider are each a Party and together the Parties.

RECITALS

WHEREAS, Client engages Provider to perform services that require Provider to access, receive, store, process or otherwise handle Personal Information as defined below; and

WHEREAS, Provider maintains and will implement administrative, technical, and physical safeguards to protect Personal Information and desires to document the Parties' respective obligations with respect to collection, use, retention, disclosure and security of such Personal Information; and

WHEREAS, the Parties agree to the terms and conditions set forth in this Agreement to ensure compliance with applicable privacy and data protection obligations.

NOW THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Information" means any information that identifies, relates to, describes, or is reasonably capable of being associated with an identifiable natural person that is provided to Provider by or on behalf of Client in connection with Provider's performance of services.

1.2 "Processing" means any operation or set of operations performed on Personal Information, including collection, use, storage, transfer, disclosure, or deletion.

1.3 "Subprocessor" means any third party engaged by Provider to Process Personal Information on behalf of Client.

2. SCOPE AND PURPOSE

2.1 Provider shall Process Personal Information solely for the purpose of performing the services described in the Master Service Agreement or Statement of Work between the Parties (the "Purpose") and only in accordance with Client's documented written instructions.

3. CATEGORIES OF PERSONAL INFORMATION & PERMITTED PROCESSING

3.1 The categories of Personal Information to be Processed by Provider include, without limitation, the categories selected below and any additional categories described in writing by Client.

Identifiers (name, national ID, account numbers)
Contact Information (email, phone, address)
Financial Information (payment details)
Sensitive Data (health, biometric)
Other

3.2 Provider shall Process Personal Information only for the following permitted activities: provision of agreed services, support and maintenance, billing and invoicing, fraud prevention, compliance with legal obligations, and other activities expressly authorized in writing by Client.

4. CLIENT OBLIGATIONS

4.1 Client represents and warrants that it has the right and lawful basis to disclose Personal Information to Provider for the Purpose and that Client's instructions comply with applicable law. Client shall obtain all necessary consents, notices and authorizations required by law for the Processing activities described herein.

4.2 Client shall be responsible for responding to Data Subject requests and for providing Provider with documented instructions regarding any requests that require Provider's assistance, unless otherwise agreed in writing.

5. PROVIDER OBLIGATIONS

5.1 Provider shall: (a) Process Personal Information only in accordance with Client's documented instructions; (b) implement and maintain technical and organizational measures appropriate to the risk; (c) ensure that persons authorized to Process Personal Information are bound by confidentiality obligations; (d) not retain or use Personal Information beyond the period necessary to fulfill the Purpose except as required by law.

6. SECURITY MEASURES

6.1 Provider shall maintain administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of Personal Information. Such safeguards shall be appropriate to the sensitivity of the Personal Information and include access controls, encryption where appropriate, monitoring and incident response procedures.

7. SUBPROCESSORS

7.1 Provider shall not engage any Subprocessor without Client's prior written authorization. Where Client provides a general authorization, Provider shall give Client prior written notice of any new Subprocessor and Client shall have a reasonable period to object.

8. DATA SUBJECT RIGHTS

8.1 Provider shall assist Client, to the extent reasonably possible, in responding to Data Subject requests to exercise rights of access, rectification, erasure, restriction, objection and portability. Provider shall promptly notify Client if it receives a request directly from a Data Subject and shall not respond without Client's instruction unless legally required to do so.

9. BREACH NOTIFICATION

9.1 Provider shall notify Client without undue delay upon becoming aware of a Security Incident affecting Personal Information and shall provide sufficient information to enable Client to meet any legal obligations to notify affected individuals and regulators. Such notification shall include a description of the nature of the incident, categories and approximate number of data subjects and records affected, and remedial measures taken.

9.2 Provider's initial notification to Client shall be made within hours of discovery, unless law requires a different timeframe.

10. RETENTION, DELETION AND RETURN

10.1 Provider shall retain Personal Information only for the time necessary to fulfill the Purpose or as required by applicable law. Upon termination of services or upon Client's request, Provider shall, at Client's option, delete or return all Personal Information and certify deletion except to the extent Provider is required to retain such data by law.

11. INTERNATIONAL TRANSFERS

11.1 Where Personal Information is transferred or accessible from jurisdictions outside the country in which the data originated, Provider shall implement appropriate safeguards to protect such Personal Information and shall comply with applicable legal restrictions on cross-border data transfers.

12. AUDIT, RECORDS AND COMPLIANCE

12.1 Provider shall make available to Client, upon reasonable notice, information necessary to demonstrate compliance with its obligations under this Agreement. Client may, subject to confidentiality obligations, audit Provider's relevant records and controls, either by its own auditors or by an independent auditor, with advance notice and during normal business hours.

13. INDEMNITY AND LIMITATION OF LIABILITY

13.1 Provider shall indemnify, defend and hold harmless Client from and against any losses, damages, liabilities and costs arising from Provider's breach of this Agreement or Provider's negligent or willful failure to implement required safeguards. Except for liability arising from Provider's breach of confidentiality obligations or willful misconduct, each Party's aggregate liability arising under this Agreement shall be limited to direct damages not to exceed the total fees paid by Client to Provider for the services under the controlling statement of work during the twelve (12) months preceding the event giving rise to liability.

14. NOTICES

14.1 All notices required or permitted under this Agreement shall be in writing and delivered to the addresses below by certified mail, nationally recognized overnight courier, or delivered in person.

15. AMENDMENTS, WAIVER AND SEVERABILITY

15.1 Any amendment or modification of this Agreement shall be effective only if in writing and signed by authorized representatives of both Parties. Failure to exercise any right shall not constitute a waiver of that right. If any provision of this Agreement is held invalid or unenforceable, the remainder of the Agreement shall remain in full force and effect.

16. GOVERNING LAW; COUNTERPARTS; ENTIRE AGREEMENT

16.1 This Agreement shall be governed by and construed in accordance with the law chosen by the Parties below. The Parties may execute this Agreement in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument. This Agreement, together with any referenced statements of work or Master Service Agreement, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior proposals, negotiations, representations and understandings.

SIGNATURES

Sign Now