Vendor Data Processing Agreement

VENDOR DATA PROCESSING AGREEMENT

This Vendor Data Processing Agreement ("Agreement") is entered into as of by and between Client Name: , with principal place of business at (hereinafter "Controller"), and Vendor Name: , with principal place of business at (hereinafter "Processor").

Recitals

WHEREAS, Controller engages Processor to perform certain services pursuant to a written services agreement between the parties describing the services and related deliverables; and

WHEREAS, in the course of providing such services Processor will process Personal Data (as defined below) on behalf of Controller;

WHEREAS, the parties wish to set forth the terms and conditions under which Personal Data will be processed, secured, and protected consistent with applicable data protection laws.

NOW, THEREFORE, in consideration of the foregoing and the mutual covenants contained herein, the parties agree as follows:

1. Definitions

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that Controller provides to Processor or that Processor collects, receives or has access to in connection with the Services. 1.2 "Processing" and "process" have the meaning given in applicable data protection law. 1.3 "Subprocessor" means any Processor engaged by Processor to carry out specific Processing activities on behalf of Controller.

2. Subject Matter, Duration and Purpose

2.1 The subject matter of Processing under this Agreement is Processor's provision of services described in the operative services agreement and any statements of work between the parties. The Processing activities to be performed and the categories of Personal Data and categories of Data Subjects are set forth below.

2.2 The duration of Processing under this Agreement shall be for the term of the underlying agreement between the parties and for such further time as required to return or delete Personal Data in accordance with Section 14.

3. Controller Instructions

3.1 Processor shall process Personal Data only on documented instructions from Controller, unless required to do so by law. Controller's documented instructions shall include the terms of this Agreement and the processing activities described in Section 2.

4. Processor Obligations

4.1 Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures to protect against unauthorized or unlawful processing and accidental loss, destruction or damage.

4.2 Processor shall ensure that persons authorized to process Personal Data have committed to confidentiality and are subject to appropriate confidentiality obligations.

5. Use of Subprocessors

5.1 Controller authorizes Processor to engage Subprocessors to perform specified processing activities. Processor shall enter into a written contract with each Subprocessor imposing obligations no less protective than those in this Agreement.

  Processor is authorized to engage Subprocessors subject to the requirements of Section 5.

6. Data Subject Rights

6.1 Processor shall assist Controller, taking into account the nature of the processing, by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests to exercise Data Subject rights under applicable law.

7. Personal Data Breach

7.1 Processor shall notify Controller without undue delay upon becoming aware of a Personal Data Breach. Notification shall at minimum describe the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

8. International Transfers

8.1 Where Processing involves transfer of Personal Data outside the jurisdiction where it was collected, Processor shall implement appropriate safeguards required by applicable data protection law and shall inform Controller of any such transfers.

9. Audit Rights

9.1 Processor shall make available to Controller all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including on-site inspections, subject to reasonable confidentiality protections and advance notice.

10. Confidentiality

10.1 Processor shall ensure that persons authorized to process Personal Data have committed to confidentiality and shall not disclose Personal Data to any third party except as expressly permitted by Controller or as required by law, provided Processor gives Controller prior notice of any disclosure required by law unless prohibited.

11. Liability and Indemnity

11.1 Each party's liability arising out of or in connection with this Agreement shall be subject to the limitations and exclusions set forth in the underlying services agreement, except that liability for breaches of confidentiality, infringement of data protection laws, or willful misconduct shall not be limited to the extent prohibited by law.

12. Termination

12.1 This Agreement shall continue for the term of the underlying agreement. Either party may terminate this Agreement in accordance with the termination provisions of the underlying agreement.

13. Return and Deletion of Personal Data

13.1 Upon termination or expiration of this Agreement, Processor shall, at Controller's choice, return all Personal Data to Controller and delete existing copies unless retention of specific Personal Data is required by applicable law. Processor shall certify in writing to Controller that such deletion has been completed within the period specified below.

14. Governing Law; Venue

14.1 This Agreement shall be governed by and construed in accordance with the laws specified below without regard to conflict of law principles. The parties submit to the exclusive jurisdiction of the courts specified below for disputes arising under this Agreement.

15. Notices

15.1 All notices under this Agreement shall be in writing and delivered to the contact details set forth below or to such other address as a party may designate by notice in accordance with this Section.

16. Amendments; Waiver; Counterparts; Severability; Entire Agreement

16.1 No amendment to this Agreement will be effective unless in writing and signed by authorized representatives of both parties. 16.2 No failure or delay by either party in exercising any right will operate as a waiver of that right. 16.3 This Agreement may be executed in counterparts, each of which shall be deemed an original. 16.4 If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. 16.5 This Agreement, together with the underlying services agreement and any appendices, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior discussions and agreements.

17. Miscellaneous

17.1 Any provision of this Agreement that by its nature is intended to survive termination shall survive. 17.2 The parties shall cooperate to execute any additional documents necessary to give full effect to the intent of this Agreement.

Sign Now