Privacy Notice Template

Privacy Notice

This Privacy Notice ("Notice") is entered into as of Effective Date: by and between Company Name: with principal place of business at Company Address: ("Controller") and Recipient Name: with principal place of business at Recipient Address: ("Recipient"). Controller and Recipient are each a "Party" and together the "Parties."

Recitals

WHEREAS, Controller collects, processes, and retains personal data in connection with its business operations and interactions with individuals;

WHEREAS, Recipient provides services to Controller that require Recipient to have access to or process Personal Data on Controller's behalf; and

WHEREAS, the Parties wish to set forth their respective responsibilities regarding the collection, use, disclosure, transfer, retention, protection and deletion of Personal Data and to give notice to Data Subjects as required by applicable privacy laws.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. Definitions

1.1 "Personal Data" means any information relating to an identified or identifiable natural person. Categories of Personal Data to which this Notice applies include, without limitation, the following categories described by the Controller:

1.2 "Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure or destruction.

2. Scope and Applicability

This Notice applies to Personal Data processed by Controller in connection with the Controller's business activities and to any Processing performed by Recipient on behalf of Controller. The Notice applies regardless of the format or medium in which Personal Data are collected or stored.

3. Purposes and Lawful Bases for Processing

Controller processes Personal Data for the following purposes. For each purpose, the lawful basis for Processing under applicable law is identified to the extent known and applicable:

4. Data Subject Rights

Data Subjects may have certain rights in relation to their Personal Data under applicable law, including the right to access, rectify, erase, restrict Processing, object to Processing, and the right to data portability. Requests to exercise any such rights should be submitted to the Controller at the contact details set forth in Section 14.

Controller will assess requests and, where required by law, comply within the statutory timeframe. Controller or Recipient may require verification of identity and may refuse manifestly unfounded or excessive requests as permitted by law.

5. Data Retention

Personal Data will be retained only as long as necessary to fulfill the purposes set forth in this Notice and to satisfy legal, accounting, or reporting requirements. Controller's retention period or criteria for determining retention periods are:

6. Security Measures

Controller and Recipient shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful loss, access, disclosure, alteration, or destruction. Such measures shall be proportionate to the risk and shall include, at a minimum, access controls, encryption where appropriate, and regular testing of security practices.

7. Disclosure and Third Parties

Controller may share Personal Data with third-party service providers, affiliates, and legal authorities as necessary to fulfill the purposes set forth in this Notice or as required by law. Categories of recipients and purposes of disclosure include:

Where Recipient acts as a Processor on behalf of Controller, Recipient shall process Personal Data only on documented instructions from Controller and shall not disclose Personal Data except as authorized by Controller or required by law.

8. International Transfers

Personal Data may be transferred to jurisdictions outside the country of collection. Controller will ensure that such transfers are subject to appropriate safeguards required by applicable law, such as standard contractual protections, binding corporate rules, or other lawful mechanisms. If transfers occur, the following transfer mechanisms apply:

9. Cookies and Tracking Technologies

Controller uses cookies and similar technologies for authentication, analytics, and to improve user experience. Data collected through such technologies may constitute Personal Data. Users may exercise choices regarding cookies in accordance with Controller's practices described herein:

10. Children's Personal Data

Controller does not knowingly collect Personal Data from individuals who are under the age required by applicable law to provide lawful consent. If Controller becomes aware that Personal Data of a minor has been collected without appropriate consent, Controller will take reasonable steps to delete such information in accordance with applicable law.

11. Changes to This Notice

Controller may update this Notice to reflect changes in practices or legal obligations. When appropriate, Controller will provide notice of material changes and will indicate the effective date of the revised Notice in the updated document.

12. Governing Law

This Notice shall be governed by and construed in accordance with the laws of: without regard to conflict of law principles. To the extent permitted by applicable law, the Parties submit to the exclusive jurisdiction of the courts of the selected jurisdiction for disputes arising under this Notice.

13. Notices

All notices required or permitted under this Notice shall be in writing and delivered to the contact details below by hand, certified mail, or other delivery service, or by electronic mail where agreed:

14. Amendments; Waiver; Counterparts

No amendment or modification of this Notice shall be effective unless reduced to writing and signed by both Parties. No waiver by either Party of any breach shall be deemed a waiver of any other or subsequent breach. This Notice may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument.

15. Entire Agreement; Severability

This Notice constitutes the entire agreement of the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings and communications. If any provision of this Notice is held to be invalid or unenforceable, that provision shall be severed and the remainder of the Notice shall remain in full force and effect.

16. Acknowledgment

Each Party acknowledges that it has read and understands this Notice, and that its obligations under this Notice are binding and enforceable. Controller represents that it is authorized to provide the Notice on behalf of the individuals to whom the Personal Data relates.

Sign Now