Legal Privacy Statement

LEGAL PRIVACY STATEMENT

This Legal Privacy Statement (the Statement) is entered into as of by and between Company Name: and Client Name: (each a Party and together the Parties).

RECITALS

WHEREAS, Company Name processes Personal Data in the course of providing services to Client Name and the Parties wish to set out their respective rights and obligations with respect to the processing, protection and transfer of Personal Data;

WHEREAS, the Parties intend for this Statement to govern the collection, use, disclosure, retention, security and other processing activities of Personal Data to the extent such processing arises from or relates to the services provided under any existing or future contractual arrangement between the Parties;

WHEREAS, the Parties acknowledge that they must comply with applicable data protection laws and that this Statement allocates responsibilities between the Parties consistent with such laws.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is processed by a Party in connection with the services. Categories of Personal Data to be processed are described in Section 3.

1.2 "Processing" or "process" means any operation or set of operations which is performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure by transmission, erasure or destruction.

2. SCOPE AND ROLES

2.1 The Parties acknowledge and agree that, in respect of the processing activities contemplated by this Statement, Client Name shall act as and Company Name shall act as unless otherwise agreed in writing.

2.2 Where either Party acts as Processor, that Party will only process Personal Data on documented instructions from the Controller and will implement appropriate technical and organizational measures to protect Personal Data.

3. CATEGORIES OF PERSONAL DATA AND DATA SUBJECTS

4. PURPOSES AND LAWFUL BASIS

4.1 Personal Data will be processed for the following purposes:

4.2 Lawful basis for processing (check all that apply):

5. DATA SUBJECT RIGHTS

5.1 Each Party shall assist the other, insofar as this is possible, by appropriate technical and organizational measures, in responding to requests from Data Subjects exercising rights under applicable data protection laws, including rights of access, rectification, erasure, restriction of processing, data portability and objection.

6. SECURITY AND CONFIDENTIALITY

6.1 Each Party will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures to protect against unauthorized or unlawful processing and against accidental loss, destruction or damage.

6.2 Each Party shall ensure that persons authorized to process Personal Data are under obligations of confidentiality and are subject to restrictions at least as protective as those set out in this Statement.

7. SUBPROCESSORS

7.1 Company Name may engage subprocessors to process Personal Data. Company Name will ensure that any subprocessor is bound by written obligations that provide at least the same level of protection for Personal Data as those set out in this Statement.

8. INTERNATIONAL DATA TRANSFERS

8.1 If Personal Data is transferred across national borders, the Parties will ensure that such transfers are subject to appropriate safeguards required by applicable law, including but not limited to standard contractual protections or other lawful transfer mechanisms.

9. DATA BREACH NOTIFICATION

9.1 In the event of a confirmed Personal Data breach affecting Personal Data processed under this Statement, the Party discovering the breach shall notify the other Party without undue delay and in any event within hours of becoming aware of the breach.

9.2 Notification shall include reasonable details about the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences and measures taken or proposed to address the breach.

10. RETENTION AND DELETION

10.1 Personal Data shall be retained only for as long as necessary to fulfill the purposes set out herein or as required by law. Upon termination of the Parties' contractual relationship or upon Controller's instruction, Processor shall return or securely delete Personal Data in accordance with documented instructions.

11. LIABILITY AND INDEMNITY

11.1 Each Party's liability arising under or in connection with this Statement shall be subject to the limits and exclusions of liability set out in the primary services agreement between the Parties. Nothing in this Statement shall exclude or limit liability for a Party's fraud, willful misconduct, or violation of applicable data protection law.

11.2 The Processor shall indemnify the Controller for losses arising from Processor's breach of its obligations under this Statement, subject to any limitations agreed between the Parties.

12. NOTICES

12.1 Any notices required under this Statement shall be given in writing and delivered to the addresses set forth below or to such other address as a Party may designate in writing.

13. AMENDMENTS, WAIVER AND COUNTERPARTS

13.1 This Statement may be amended only by a written instrument executed by authorized representatives of both Parties. No failure or delay by either Party in exercising any right shall operate as a waiver of that right.

13.2 This Statement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

14. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

14.1 Governing Law: This Statement shall be governed by and construed in accordance with the laws chosen by the Parties: .

14.2 Severability: If any provision of this Statement is held to be invalid or unenforceable, such provision shall be severed to the minimum extent necessary and the remaining provisions shall remain in full force and effect.

14.3 Entire Agreement: This Statement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements, understandings and representations relating to the protection of Personal Data.

15. MISCELLANEOUS

15.1 Survival: Provisions that by their nature should survive termination of this Statement shall so survive, including obligations regarding confidentiality, retention, deletion, and liability for breaches.

15.2 Cooperation: The Parties will cooperate in good faith to ensure ongoing compliance with applicable data protection law and to make such lawful and reasonable amendments to this Statement as may be necessary to reflect changes in law.

Sign Now