PIPIDA Legal Agreement

PIPIDA Legal Agreement

This PIPIDA Legal Agreement (the Agreement) is entered into as of Effective Date: by and between , with principal address (hereinafter "Data Provider"), and , with principal address (hereinafter "Data Recipient"). Data Provider and Data Recipient are each a Party and collectively the Parties.

RECITALS

WHEREAS, the Parties wish to exchange, transfer and process certain Personal Information in connection with the Parties' business relationship and operations, and desire to establish the terms and conditions governing such processing to ensure compliance with applicable data protection and privacy obligations; and

WHEREAS, the Parties intend that the Data Recipient shall process Personal Information on behalf of, or jointly with, the Data Provider for the limited purposes described in this Agreement, and shall implement administrative, technical and organizational measures designed to protect Personal Information against unauthorized access, disclosure, alteration or destruction; and

WHEREAS, the Parties agree to adopt terms consistent with applicable law and the mutual obligations set forth herein in order to govern international transfers of Personal Information if and as applicable.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Personal Information" means any information relating to an identified or identifiable natural person that is provided, accessed, transferred or processed under this Agreement.

1.2 "Processing" means any operation or set of operations performed upon Personal Information, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure by transmission, erasure or destruction.

1.3 "Controller" and "Processor" shall have the meanings assigned under applicable data protection law and, where the legal characterisation is not clear, the Parties will determine roles in writing in Annex A or via a Controller/Processor Statement.

2. PURPOSE AND SCOPE

2.1 The Parties shall Process Personal Information solely for the purposes described in this Agreement and any mutually agreed written instructions: recruitment, customer relationship management, service delivery, compliance, audit and related business purposes (the Permitted Purposes). The Data Recipient shall not Process Personal Information for any other purpose without the Data Provider's prior written consent.

3. ROLES AND INSTRUCTIONS

3.1 The Data Provider represents and warrants that it has the right and lawful basis to transfer Personal Information to the Data Recipient for the Permitted Purposes. The Data Recipient shall act only on documented instructions of the Data Provider as set forth in this Agreement or as otherwise authorized in writing.

3.2 Any additional or amended instructions that materially change the nature, scope, or purpose of Processing shall be subject to mutual written agreement prior to implementation.

4. COMPLIANCE WITH LAWS

4.1 Each Party shall comply with all applicable data protection and privacy laws in the exercise of its obligations under this Agreement. Where specific legal requirements apply to cross-border transfers, the Parties shall implement appropriate safeguards consistent with those requirements.

5. SECURITY; CONFIDENTIALITY

5.1 The Data Recipient shall implement and maintain administrative, technical and organizational measures appropriate to the risk to protect Personal Information, including measures to ensure confidentiality, integrity and availability. Such measures shall include, as appropriate, access controls, encryption in transit and at rest, network security, secure disposal, logging and vulnerability management.

5.2 Each Party's personnel with access to Personal Information shall be subject to confidentiality obligations no less protective than those set forth in this Agreement.

6. SUBPROCESSORS

6.1 The Data Recipient shall not engage any Subprocessor to Process Personal Information without first providing written notice to the Data Provider and obtaining consent where required by applicable law. The Data Recipient shall ensure that each Subprocessor is bound by data protection obligations that are at least as protective as those in this Agreement.

7. INTERNATIONAL TRANSFERS

7.1 Where Personal Information is transferred across international borders, the Parties shall implement appropriate transfer mechanisms and safeguards required by applicable laws to ensure a lawful transfer and continued protection of Personal Information.

8. DATA SUBJECT RIGHTS

8.1 The Parties shall cooperate to enable the Data Provider to fulfill its obligations to respond to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection) in accordance with applicable law. The Data Recipient will promptly inform the Data Provider of any such request and will comply with documented instructions.

9. BREACH NOTIFICATION

9.1 The Data Recipient shall notify the Data Provider without undue delay upon becoming aware of a confirmed or reasonably suspected security incident affecting Personal Information and shall provide sufficient information to enable the Data Provider to meet its legal obligations. The Data Recipient shall cooperate with investigation and remediation efforts.

10. TERM AND TERMINATION

10.1 This Agreement commences on the Effective Date and continues until terminated in writing by either Party upon the provision of the notice period specified below, or as otherwise set forth in a related services agreement. Upon termination or expiration, the Data Recipient shall, at the Data Provider's option, return or securely destroy Personal Information and certify destruction within a reasonable period.

11. LIABILITY AND INDEMNIFICATION

11.1 Each Party shall be liable for breach of its obligations under this Agreement to the extent caused by its acts or omissions. To the extent permitted by law, each Party shall indemnify and hold harmless the other Party from third-party claims arising out of the indemnifying Party's breach of this Agreement or applicable data protection law.

12. NOTICES

12.1 All notices required or permitted under this Agreement shall be given in writing and shall be deemed received upon personal delivery, one business day after delivery by reputable overnight courier, or three business days after deposit in the mail.

13. AMENDMENTS; WAIVER

13.1 No amendment, modification or waiver of any provision of this Agreement shall be effective unless in writing and signed by authorized representatives of both Parties. A waiver of any breach shall not constitute a waiver of any other breach.

14. GOVERNING LAW; JURISDICTION

14.1 This Agreement shall be governed by and construed in accordance with the laws selected by the Parties below. The Parties submit to the exclusive jurisdiction of the courts specified below for disputes arising out of or in connection with this Agreement.

Governing Law:   Forum/Location for Disputes:

15. ENTIRE AGREEMENT; SEVERABILITY

15.1 This Agreement, together with any annexes or written statements of work expressly incorporated herein, constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior and contemporaneous understandings. If any provision of this Agreement is held invalid or unenforceable, the remainder shall continue in full force and effect.

16. COUNTERPARTS; EXECUTION

16.1 This Agreement may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument. Signed electronic copies or facsimile signatures shall be binding.

ADDITIONAL REPRESENTATIONS

Each Party represents and warrants that: (a) it has the full power and authority to enter into this Agreement; (b) performance under this Agreement will not violate other agreements or obligations; and (c) it will comply with applicable law in performing its obligations hereunder.

Sign Now