Legal Data Protection Notice

LEGAL DATA PROTECTION NOTICE

This Legal Data Protection Notice (the "Notice") is made effective as of between Client Name: , Entity Type: Corporation Partnership Individual Other, with registered address: ; and Recipient Name: , Entity Type: Corporation Partnership Individual Other, with registered address: .

RECITALS

WHEREAS, Controller processes certain Personal Data and requires assurances from Recipient that such Personal Data will be handled in accordance with applicable data protection laws and the terms of this Notice; and

WHEREAS, Recipient will receive Personal Data from Controller in connection with the Parties' business relationship and agrees to implement appropriate technical and organizational measures to protect such Personal Data; and

WHEREAS, the Parties intend by this Notice to set out the obligations, responsibilities, and procedures applicable to the transfer, processing, retention, and security of Personal Data exchanged between them.

NOW THEREFORE, in consideration of the mutual covenants set forth herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is provided by Controller to Recipient, as described in Section 2. 1.2 "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.

2. SCOPE OF PROCESSING

2.1 Description of Processing Activities and Purposes: Recipient shall process Personal Data solely for the following documented purposes:

2.2 Categories of Personal Data collected:

3. DATA SUBJECT RIGHTS

Recipient shall, to the extent legally required and practicable, assist Controller in responding to requests from data subjects to exercise their rights under applicable data protection laws, including access, rectification, erasure, restriction, portability, and objection. Recipient shall notify Controller without undue delay upon receipt of any such request and shall not respond to the data subject except on Controller's documented instructions or as required by law.

4. SECURITY MEASURES

4.1 Recipient shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Those measures shall include, at minimum, administrative policies, access controls, encryption where applicable, and regular security testing.

5. BREACH NOTIFICATION

5.1 Recipient shall notify Controller without undue delay and, where feasible, within hours of becoming aware of a confirmed or suspected Personal Data breach. The notification shall include sufficient information to allow Controller to meet any obligations to report or inform data subjects.

6. SUBPROCESSORS

Recipient shall not engage any subcontractor to process Personal Data without Controller's prior written consent. Where consent is provided, Recipient shall impose on the subcontractor the same data protection obligations as set forth in this Notice and remain fully liable for the subcontractor's performance.

7. RETENTION, RETURN AND DELETION

Upon termination of the business relationship or upon Controller's written instruction, Recipient shall, at Controller's election, return all Personal Data to Controller or securely delete and irretrievably destroy such Personal Data within .

8. AUDIT AND INSPECTION

Controller or an independent auditor mandated by Controller shall have the right, upon reasonable notice and subject to confidentiality obligations, to audit Recipient's compliance with this Notice. Recipient shall provide reasonable assistance and access to records, facilities, personnel, and technical systems necessary to demonstrate compliance.

9. CONFIDENTIALITY

Recipient shall treat Personal Data as confidential and shall not disclose such data except as necessary to perform its obligations under this Notice or as required by law. Recipient shall ensure that any personnel with access to Personal Data are subject to confidentiality obligations.

10. LIABILITY AND INDEMNITY

Each Party shall be liable for its own breach of this Notice. Recipient shall indemnify Controller for any losses, liabilities, fines, costs, or expenses arising from Recipient's breach of this Notice, including breaches attributable to subcontractors engaged by Recipient.

11. NOTICES

Any notices required or permitted under this Notice shall be in writing and delivered to the addresses set forth below or to such other address as a Party may designate by notice under this Section.

12. GOVERNING LAW

This Notice shall be governed by and construed in accordance with the laws of .

13. ENTIRE AGREEMENT

This Notice constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, and understandings relating to such subject matter.

14. SEVERABILITY

If any provision of this Notice is held to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect and shall be construed so as to effectuate the intent of the Parties as closely as possible.

15. AMENDMENT AND WAIVER

No amendment to this Notice shall be effective unless made in writing and signed by authorized representatives of both Parties. Failure or delay by either Party to exercise any right shall not constitute a waiver of that right.

16. COUNTERPARTS

This Notice may be executed in counterparts, each of which when executed shall be deemed an original, but all of which together shall constitute one and the same instrument.

Sign Now