Legal Privacy Practices Template

LEGAL PRIVACY PRACTICES TEMPLATE

This Legal Privacy Practices Template (the "Agreement") is entered into as of Effective Date: by and between Client Name: with principal address: and Service Provider Name: with principal address: .

RECITALS

WHEREAS, Client collects, processes, and maintains certain personal data of individuals in connection with the Client's business operations; and

WHEREAS, Provider provides services to Client that require access to or processing of such personal data and the parties desire to set forth mutually agreed privacy practices and obligations applicable to such processing; and

WHEREAS, the parties intend that this Agreement allocate responsibilities and specify technical, organizational and administrative measures necessary to protect Personal Data and to satisfy applicable legal requirements.

NOW THEREFORE

NOW, THEREFORE, in consideration of the mutual covenants set forth below and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the parties agree as follows.

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person processed by Provider on behalf of Client in connection with the services described in this Agreement.

1.2 "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, modification, retrieval, use, disclosure, transmission, erasure and destruction.

1.3 "Controller" and "Processor" shall have the meanings given under applicable privacy laws and regulations. For the purposes of this Agreement the parties shall indicate the role of each party below: Controller: Client    Provider Processor: Client    Provider

2. SCOPE AND PURPOSE OF PROCESSING

2.1 Provider shall process Personal Data only on documented instructions from Client, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do otherwise by applicable law, in which case Provider shall notify Client of such legal requirement to the extent permitted by law.

2.2 The subject matter and duration of the processing and the nature and purpose of the processing activities are: ; the categories of data subjects and types of Personal Data are specified in Section 3 and 4 below.

3. CATEGORIES OF DATA SUBJECTS

Categories of data subjects include, as applicable: employees, contractors, customers, prospects, suppliers, and users of Client systems and services. Additional categories (if any):

4. TYPES OF PERSONAL DATA

The types of Personal Data to be processed may include:

Identifiers (name, email, phone, national ID)    Financial and payment information    Location data    Online identifiers and device information

Sensitive categories (if applicable): Health data    Racial or ethnic origin    Political opinions

5. LAWFUL BASIS AND PURPOSE LIMITATION

5.1 Provider represents that it shall process Personal Data only for the purposes set forth in this Agreement and as instructed by Client. Provider shall not process Personal Data for any purpose incompatible with Client's documented instructions.

5.2 The lawful basis for processing (as applicable) includes: Consent    Performance of a contract    Legal compliance    Legitimate interests

6. DATA SUBJECT RIGHTS

6.1 Provider shall, to the extent legally permitted, promptly notify Client of any request received from a Data Subject to exercise rights such as access, rectification, erasure, restriction, objection, or data portability. Provider shall not respond to such requests except on documented instructions from Client or as required by applicable law.

7. SECURITY AND CONFIDENTIALITY

7.1 Provider shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing.

8. SUBPROCESSORS

8.1 Provider shall not engage any subprocessor to process Personal Data except with Client's prior written authorization. Provider shall impose on each subprocessor data protection obligations no less protective than those imposed on Provider under this Agreement, and shall remain liable for the acts and omissions of its subprocessors.

9. INTERNATIONAL TRANSFERS

9.1 Where Personal Data is transferred to a jurisdiction that does not provide an adequate level of protection under applicable law, the parties shall ensure appropriate safeguards are implemented, such as standard contractual clauses, binding corporate rules, or other mechanisms that ensure an adequate level of protection in accordance with applicable legal requirements.

10. DATA RETENTION AND DELETION

10.1 Provider shall retain Personal Data only for as long as necessary to fulfill the documented instructions of Client and in accordance with Client's retention schedule. Upon expiration of the retention period, or earlier upon Client's written instruction, Provider shall securely delete or return Personal Data to Client as specified below.

11. SECURITY INCIDENTS AND BREACH NOTIFICATION

11.1 Provider shall notify Client without undue delay, and in any event within seventy-two (72) hours after becoming aware, of any confirmed or reasonably suspected Personal Data breach affecting Client's Personal Data. Provider shall provide Client with sufficient details to enable Client to meet any obligations to notify supervisory authorities and affected Data Subjects.

12. AUDIT RIGHTS

12.1 Client shall have the right to conduct audits, inspections, or to require a third-party audit demonstrating Provider's compliance with its obligations under this Agreement, subject to reasonable notice and confidentiality protections. Provider shall cooperate and provide relevant documentation and evidence of compliance.

13. REPRESENTATIONS AND WARRANTIES

Each party represents and warrants that: (a) it has the full right, power and authority to enter into and perform this Agreement; (b) its processing and instructions regarding Personal Data will comply with applicable privacy and data protection laws; and (c) it will not knowingly instruct the other party to process Personal Data in a manner that would cause the other party to be in breach of applicable laws.

14. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the designated contacts below by certified mail, nationally recognized overnight courier, or personal delivery.

15. AMENDMENT, WAIVER AND COUNTERPARTS

15.1 No amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by authorized representatives of both parties. The failure of either party to enforce any right shall not constitute a waiver of that right. This Agreement may be executed in counterparts, each of which shall be deemed an original but all of which together shall constitute one and the same instrument.

16. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

16.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws specified by the parties below. Governing law:

16.2 Entire Agreement. This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral, relating to the same subject matter.

16.3 Severability. If any provision of this Agreement is held to be invalid, illegal or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect and the parties shall negotiate in good faith to replace the invalid provision with a valid and enforceable provision that, to the greatest extent possible, effectuates the original intent of the parties.

SIGNATURES

Sign Now