Smart Choice Data Processing Agreement

Smart Choice Data Processing Agreement

This Data Processing Agreement ("Agreement") is entered into as of Effective Date: by and between Data Controller: , with principal place of business at , and Data Processor: , with principal place of business at .

Recitals

WHEREAS, the Data Controller engages the Data Processor to perform certain services that require the Processing of Personal Data on behalf of the Data Controller; and

WHEREAS, the parties wish to set forth their respective rights and obligations concerning Processing of Personal Data and to ensure compliance with Applicable Data Protection Law in connection with such Processing; and

WHEREAS, the parties intend that this Agreement govern the Processing of Personal Data as required by Applicable Law.

NOW THEREFORE, in consideration of the mutual covenants herein, the parties agree as follows:

1. Definitions

1.1. "Applicable Law" means data protection and privacy laws applicable to the Processing of Personal Data under this Agreement, as amended from time to time.

1.2. "Personal Data" means any information relating to an identified or identifiable natural person that is Processed under this Agreement.

1.3. "Processing" has the meaning given in Applicable Law and includes any operation performed upon Personal Data.

2. Subject Matter, Duration and Purpose of Processing

2.1. Subject matter of Processing:

2.2. Nature and purpose of Processing:

2.3. Duration of Processing: Processing shall commence on the Effective Date and shall continue for the period necessary to provide the services described above or until termination of the underlying services agreement, whichever occurs first, subject to any retention obligations under Applicable Law. Retention period or criteria:

3. Categories of Personal Data and Data Subjects

3.1. Types of Personal Data: The Processor may Process Personal Data including, without limitation:

3.2. Categories of Data Subjects: The Personal Data concerns the following categories of Data Subjects:

4. Controller Instructions and Processor Obligations

4.1. The Processor shall Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Applicable Law.

4.2. The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures designed to: (a) ensure ongoing confidentiality, integrity, availability and resilience of Processing systems; (b) restore availability and access to Personal Data in a timely manner after an incident; and (c) regularly test, assess and evaluate the effectiveness of such measures. Technical and organizational measures:

4.3. Confidentiality: The Processor shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Subprocessing

5.1. The Controller: Authorizes engagement of subprocessors: Authorized Not authorized

5.2. Where subcontracting is authorized, the Processor shall impose on each Subprocessor obligations substantially the same as those imposed on the Processor in this Agreement and remain fully liable to the Controller for the acts and omissions of the Subprocessor. Approved Subprocessors (list or attach):

6. Security Incident and Breach Notification

6.1. The Processor shall notify the Controller without undue delay and, where feasible, within hours after becoming aware of a Security Incident that affects Personal Data. The Processor's notification shall contain details of the nature of the incident, categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed to address the incident.

6.2. The Processor shall cooperate with the Controller in investigating and mitigating any Security Incident and shall provide reasonable assistance as required by Applicable Law.

7. Data Subject Rights

7.1. The Processor shall, taking into account the nature of the Processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights under Applicable Law.

8. Audit and Inspection

8.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Agreement and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Required notice period for audits:

9. International Transfers

9.1. The Processor may transfer Personal Data to recipients in countries outside the Controller's jurisdiction only where Controller has provided appropriate documented instructions and where suitable safeguards are in place in accordance with Applicable Law. Transfers permitted: Permitted Not permitted

9.2. Where transfers are required, the Processor shall implement and maintain appropriate transfer mechanisms and document them here:

10. Return or Deletion of Personal Data

10.1. Upon termination or expiry of the underlying services agreement, the Processor shall, at the choice of the Controller, return all Personal Data to the Controller and delete existing copies, or securely delete and certify deletion of Personal Data. Controller choice: Return data Delete data Retain as required by law

11. Liability and Indemnification

11.1. Each party shall be liable for its own breach of this Agreement and Applicable Law. The Processor shall indemnify the Controller for losses arising from Processor's breach of its obligations under this Agreement, including breaches resulting from unauthorized Processing, failure to implement required security measures, or failure to notify the Controller of a Security Incident in accordance with this Agreement, except to the extent such losses result from the Controller's instructions or breach.

12. Confidentiality

12.1. The Processor shall treat all Personal Data and any other confidential information received from the Controller as confidential and shall not disclose such information except as necessary to perform the services or as required by Applicable Law.

13. Notices

14. Governing Law; Entire Agreement; Severability

14.1. Governing Law: This Agreement shall be governed by and construed in accordance with the laws of , without regard to its conflict of laws principles.

14.2. Entire Agreement: This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings.

14.3. Severability: If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be severed and the remainder shall continue in full force and effect.

15. Amendments; Waiver; Counterparts

15.1. No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both parties. No failure or delay by either party in exercising any right shall constitute a waiver of that right.

15.2. This Agreement may be executed in counterparts, each of which shall be deemed an original and together shall constitute one and the same instrument.

16. Additional Administrative Information

The parties acknowledge that they have read and understood this Agreement and agree to be bound by its terms. Authorized signatories for each party are provided below.

Sign Now