Legal Document for DPSA

DATA PROTECTION AND SHARING AGREEMENT (DPSA)

This Data Protection and Sharing Agreement (the Agreement) is entered into as of by and between Data Provider: with principal place of business at and Data Recipient: with principal place of business at (each a Party and collectively the Parties).

RECITALS

WHEREAS, Data Provider possesses certain categories of data, including personal data and other information, that are necessary for the Data Recipient to perform the services and purposes set forth in this Agreement; and

WHEREAS, the Parties seek to define their respective obligations regarding the confidentiality, protection, processing, transfer and return or destruction of such data in compliance with applicable data protection laws and contractual obligations; and

WHEREAS, the Parties intend that Data Recipient shall only process the data on behalf of and under the documented instructions of Data Provider, except as otherwise required by applicable law.

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is provided, transferred or otherwise made available by Data Provider to Data Recipient under this Agreement.

1.2 "Processing" or "process" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, erasure or destruction.

2. PURPOSE

2.1 The Parties acknowledge that Data Recipient will process Personal Data solely for the purpose of:

3. SCOPE OF DATA AND DATA ELEMENTS

3.1 Data Provider shall disclose only the categories and elements of data necessary to accomplish the Purpose. The Parties agree that the categories of data covered by this Agreement include, without limitation:

4. OBLIGATIONS OF DATA PROVIDER

4.1 Data Provider represents and warrants that it has the lawful basis and authority to share the Personal Data with Data Recipient for the stated Purpose and that such transfer does not violate applicable law or contractual obligations to third parties.

4.2 Data Provider shall provide Data Recipient with documented instructions regarding the Processing of Personal Data and shall notify Data Recipient promptly of any changes to such instructions.

5. OBLIGATIONS OF DATA RECIPIENT

5.1 Data Recipient shall process Personal Data only on documented instructions from Data Provider and shall not use or disclose Personal Data for purposes incompatible with the Purpose.

5.2 Data Recipient shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. The Parties acknowledge that such measures shall be proportionate to the risk and state of the art.

6. SUBPROCESSORS

6.1 Data Recipient shall not engage any subprocessor to perform Processing on behalf of Data Provider without prior written authorization. If authorization is given, Data Recipient shall impose on each subprocessor obligations equivalent to those in this Agreement and shall remain liable for the subprocessor's compliance.

6.2 Data Provider authorizes the use of subprocessors as follows (check if authorized):

7. DATA SUBJECT RIGHTS

7.1 Taking into account the nature of the Processing, Data Recipient shall assist Data Provider by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Data Provider's obligation to respond to requests for exercising data subject rights under applicable law.

8. BREACH NOTIFICATION

8.1 In the event of a confirmed security incident or breach affecting Personal Data, Data Recipient shall notify Data Provider without undue delay and, in any event, no later than hours after becoming aware of the breach, providing sufficient information to enable Data Provider to meet its obligations under applicable law.

9. AUDIT AND COMPLIANCE

9.1 Data Recipient shall make available to Data Provider all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including on-site inspections, subject to reasonable prior notice and protection of confidential information.

10. RETENTION, RETURN AND DESTRUCTION

10.1 Data Recipient shall retain Personal Data only for as long as necessary to fulfill the Purpose or as required by applicable law. Upon termination of this Agreement, Data Recipient shall, at Data Provider's election, return all Personal Data to Data Provider or securely destroy such data and certify destruction.

11. LIABILITY AND INDEMNITY

11.1 Each Party's liability arising out of or in connection with this Agreement shall be governed by the applicable law clause below. Except to the extent prohibited by applicable law, the Parties agree that the total aggregate liability of each Party arising from a claim relating to this Agreement shall not exceed unless resulting from willful misconduct or gross negligence.

11.2 Data Recipient shall indemnify and hold harmless Data Provider from and against all losses arising from Data Recipient's breach of this Agreement, including unauthorized disclosure or misuse of Personal Data, subject to the limitations in this Agreement.

12. TERM AND TERMINATION

12.1 This Agreement shall commence on the Effective Date and shall continue in effect until the earlier of completion of the Purpose or termination by either Party in accordance with this Agreement.

13. CONFIDENTIALITY

13.1 Each Party shall treat as confidential all Personal Data and any non-public information received from the other Party and shall not disclose such information except to authorized personnel, agents, subprocessors or as required by law. Confidential information shall be protected with at least the same degree of care as the receiving Party uses to protect its own confidential information, but in no event less than reasonable care.

14. NOTICES

14.1 All notices, requests, consents and other communications required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below or to such other address as either Party may designate by notice in accordance with this section.

15. AMENDMENTS AND WAIVER

15.1 No amendment, modification or waiver of any provision of this Agreement shall be effective unless in writing and signed by duly authorized representatives of both Parties. The failure of either Party to enforce any right shall not constitute a waiver of future enforcement of that or any other right.

16. SEVERABILITY

16.1 If any provision of this Agreement is held to be invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired.

17. ENTIRE AGREEMENT

17.1 This Agreement constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior or contemporaneous understandings, agreements, representations and warranties, both written and oral, regarding such subject matter.

18. GOVERNING LAW

18.1 This Agreement shall be governed by and construed in accordance with the laws specified by the Parties below without regard to conflict of law principles.

19. COUNTERPARTS

19.1 This Agreement may be executed in any number of counterparts, each of which when executed and delivered shall constitute an original, but all such counterparts together shall constitute one and the same instrument.

IN WITNESS WHEREOF, the Parties have executed this Agreement through their duly authorized representatives.

Sign Now