Legal Data Treatment Document

LEGAL DATA TREATMENT DOCUMENT

This Legal Data Treatment Document (the "Document") is entered into as of Effective Date: by and between Data Controller Name: with principal place of business at (hereinafter "Controller"), and Data Processor Name: with principal place of business at (hereinafter "Processor"). Controller and Processor are each a "Party" and together the "Parties."

RECITALS

WHEREAS, Controller determines the purposes and means of Processing Personal Data in connection with Controller's business operations and services described in this Document;

WHEREAS, Processor provides data processing services pursuant to a separate services agreement and will Process Personal Data on behalf of Controller under Controller's documented instructions; and

WHEREAS, the Parties desire to set forth their respective obligations with respect to the Processing, protection, transfer, retention and deletion of Personal Data.

NOW, THEREFORE, in consideration of the mutual covenants contained herein and for other good and valuable consideration, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is Processed under this Document. 1.2 "Processing" or "Process" means any operation or set of operations performed on Personal Data. 1.3 "Sub-processor" means any Processor engaged by Processor to Process Personal Data on behalf of Controller. 1.4 Other capitalized terms used but not defined in this Document have the meanings given to them in applicable data protection law.

2. SUBJECT-MATTER, DURATION, NATURE AND PURPOSES OF PROCESSING

2.1 Subject-matter: The subject-matter of Processing under this Document is the Personal Data provided to Processor by Controller in connection with the delivery of services described as:

2.2 Purposes: Processing shall be carried out solely for the following purposes:

2.3 Duration: The Parties agree that Processing shall commence on the Effective Date and continue for the term of the underlying services agreement or as otherwise required by applicable law, subject to the retention_period specified below.

3. CATEGORIES OF DATA AND DATA SUBJECTS

4. CONTROLLER INSTRUCTIONS; PROCESSOR OBLIGATIONS

4.1 Processor shall Process Personal Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by applicable law. Processor shall notify Controller promptly if, in Processor's opinion, an instruction infringes applicable data protection law.

4.2 Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as applicable, measures to protect against unauthorized or unlawful Processing and against accidental loss, destruction or damage.

5. BREACH NOTIFICATION

5.1 In the event of a Personal Data Breach affecting Controller's Personal Data, Processor shall notify Controller without undue delay and in no event later than hours after becoming aware of the breach, providing sufficient information to allow Controller to meet its legal obligations.

5.2 Processor shall cooperate with Controller in investigating the breach, mitigating adverse effects and providing required notifications to authorities and data subjects where Controller is required to do so by law.

6. SUB-PROCESSORS

6.1 Controller authorizes Processor to engage Sub-processors as necessary to perform the services, subject to the conditions below.

Processor is authorized to engage Sub-processors. If authorized, Processor shall:

7. DATA SUBJECT RIGHTS

7.1 Processor shall, to the extent legally permitted, promptly notify Controller if it receives a request from a Data Subject to exercise rights under applicable data protection law. Processor shall assist Controller, insofar as this is possible, by implementing appropriate technical and organisational measures for the fulfilment of Controller's obligation to respond to Data Subject requests.

8. INTERNATIONAL TRANSFERS

8.1 Any transfer of Personal Data outside the country of Controller's establishment shall be subject to appropriate safeguards required by applicable law. Parties shall document such transfers and specify the legal basis and safeguards in writing.

9. RETURN OR DELETION OF PERSONAL DATA

9.1 Upon termination or expiration of the services under which Processor Processes Personal Data, Processor shall, at Controller's election, return all Personal Data to Controller and delete existing copies, or securely destroy such Personal Data, unless retention of the Personal Data is required by applicable law. Processor shall certify in writing the completion of such return or deletion upon Controller's request.

10. AUDIT, RECORDS AND COMPLIANCE

10.1 Processor shall maintain records relevant to Processing activities and shall, upon reasonable notice and subject to confidentiality constraints, make available to Controller all information necessary to demonstrate compliance with this Document and allow for and contribute to audits, including on-site inspections where required by applicable law.

11. CONFIDENTIALITY

11.1 Processor shall ensure that personnel authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

12. LIABILITY AND INDEMNIFICATION

12.1 Each Party shall be liable for breaches of this Document to the extent provided by applicable law. Processor shall indemnify Controller for losses arising from Processor's breach of its obligations under this Document, subject to limitations of liability set forth in the underlying services agreement. Nothing in this Document limits liability for wilful misconduct or gross negligence.

13. NOTICES

13.1 Any notice required or permitted under this Document shall be given in writing and sent to the addresses and contacts specified below.

14. AMENDMENT, WAIVER, COUNTERPARTS

14.1 This Document may be amended only by a written instrument signed by authorized representatives of both Parties. A waiver of any provision of this Document shall not be deemed a waiver of any other provision.

14.2 This Document may be executed in counterparts, each of which is an original and all of which constitute one instrument.

15. GOVERNING LAW, ENTIRE AGREEMENT, SEVERABILITY

15.1 Governing Law: This Document shall be governed by and construed in accordance with the laws specified by Controller's choice of jurisdiction:

15.2 Entire Agreement: This Document, together with any related services agreement, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements and understandings.

15.3 Severability: If any provision of this Document is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

EXECUTION

The Parties have executed this Legal Data Treatment Document through their duly authorized representatives as set forth below.

Sign Now