This Data Processing Addendum ("Addendum") forms part of the Services Agreement ("Principal Agreement") between the Program Participant and the Company acting on its own behalf or on behalf of one of several of the Company Affiliates, where applicable.
The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Principal Agreement. Except as modified below, the terms of the Principal Agreement shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Principal Agreement. Except where the context requires otherwise, references in this Addendum to the Principal Agreement are to the Principal Agreement as amended by, and including, this Addendum.
The present Addendum aims at defining the parties’ agreement with regard to the Processing of Personal Data.
"Standard Contractual Clauses" means the decision 2010/87/EU governing the data transfer between an EU controller to a non-EU or EEA processor and any subsequent amendments and provided in Appendix 3.
The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processing", “Processor” and "Supervisory Authority" shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.
The Parties acknowledge and agree that with regard to the Processing of Company Personal Data, Company or another Company Group Member, where applicable, is the Data Controller and Program Participant is the Data Processor.
ensure the confidentiality of the Company Personal Data processed under the Principal Agreement and the present Addendum.
The Company Group Member’s instructions for the Processing of Personal Data shall comply with Applicable Laws. The Company Group Member warrants and represents, where applicable, that it is and will at all relevant times remain duly and effectively authorised to give the instructions set out in section 2.2.3 on behalf of each relevant Company Affiliate.
The subject-matter, duration, nature and purpose(s) of the Processing, the type of Company Personal Data and categories of Data Subjects processed, under this Addendum are specified in Appendix 1, as required by article 28(3) of the GDPR. Any Company Group Member may make reasonable amendments to Appendix 1 by written notice to Program Participant from time to time as Company Group Member reasonably considers necessary to meet those requirements.
Program Participant shall take reasonable steps to ensure the reliability of any employee or agent, where applicable, who may have access to the Company Personal Data.
Program Participant shall ensure that access to Company Personal Data is strictly limited to those individuals who need to know / access the relevant Company Personal Data, as strictly necessary for the purposes of the Principal Agreement and the present Addendum, or to comply with Applicable Laws.
Program Participant shall ensure that all such individuals engaged in the Processing of Company Personal Data are informed of the confidential nature of the Company Personal Data, have received the appropriate training on their responsibility, and are subject to appropriate confidentiality undertakings or professional or statutory obligations of confidentiality.
and as provided in Appendix 2.
Program Participant undertakes not to materially decrease the overall security of the Processing activities during the term of the Principal Agreement and the present Addendum.
where such change cannot be made within fourteen (14) days from Program Participant's receipt of Company's objections, notwithstanding anything in the Principal Agreement, Company may, at its own discretion, by written notice to Program Participant with immediate effect terminate the Principal Agreement to the extent that it relates to the Services which require the use of the proposed Subprocessor.
Program Participant shall not appoint the proposed Subprocessor, until the written objections raised by Company or Company Affiliate have been resolved.
Taking into account the nature of the Processing, Program Participant shall assist each Company Group Member by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company Group Members' obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.
not respond to that request except on the documented instructions of Company or the relevant Company Affiliate or as required by Applicable Laws to which the Program Participant is subject, in which case Program Participant shall to the extent permitted by Applicable Laws inform Company of that legal requirement before Program Participant responds to the request.
describe the measures taken or proposed to be taken to address the Personal Data Breach.
Program Participant shall co-operate with the Company and each Company Group Member and take such reasonable steps as are directed by Company or each Company Group Member to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
Program Participant shall provide reasonable assistance to each Company Group Member with any data protection impact assessments, and prior consultations with Supervisory Authorities or other competent data privacy authorities, which Company reasonably considers to be required of any Company Group Member by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking into account the nature of the Processing and information available to Program Participant.
Program Participant shall within thirty (30) days of the date of cessation of any Program(s) participation involving the processing of Personal Data (the "Cessation Date") delete all Personal Data processed.
Program Participant shall make available to each Company Group Member on request all information necessary to demonstrate compliance with this Addendum, and shall allow for and contribute to audits, including inspections, by any Company Group Member or an auditor mandated by any Company Group Member in relation to the Processing of the Personal Data.
Subject to section 11.3, each Company Group Member (as "data exporter") and each Program Participant, as appropriate, (as "data importer") hereby enter into the Standard Contractual Clauses in respect of any Restricted Transfer.
Section 11.1 shall not apply to a Restricted Transfer unless its effect, together with other reasonably practicable compliance steps (which, for the avoidance of doubt, do not include obtaining consents from Data Subjects), is to allow the relevant Restricted Transfer to take place without breach of applicable Data Protection Law.
Program Participant warrants and represents that, before the commencement of any Restricted Transfer to a Subprocessor, (i) the relevant Subprocessor enters into an agreement incorporating the Standard Contractual Clauses with the relevant Company Group Member(s), or (ii) Program Participant enters into an agreement incorporating the Standard Contractual Clauses with the relevant Company Group Member(s) under section 11.1, as agent for and on behalf of that Subprocessor, such entry having been duly and effectively authorised (or subsequently ratified) by that Subprocessor.
non-compliance by the Program Participant or Subprocessor with the provisions of the Applicable Laws.
this Addendum and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the Grand Duchy of Luxembourg.
Nothing in this Addendum reduces Program Participant’s obligations under the Principal Agreement in relation to the protection of Personal Data or permits Program Participant to Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Principal Agreement. In the event of any conflict or inconsistency between this Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
Subject to section 13.2, with regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and any other agreements between the parties, including the Principal Agreement and agreements entered into or purported to be entered into after the date of this Addendum (except where explicitly agreed otherwise in writing, signed on behalf of the parties), the provisions of this Addendum shall prevail.
To the extent permitted by applicable law, such amendments will be applicable from the time they are published on the awempire.com website, unless a date of entry into force is specified. The continued use by Program Participant of awempire.com and its continued participation to the Programs from that day on will be subject to the amended Addendum.
IN WITNESS WHEREOF, this Addendum is entered into and becomes a binding part of the Principal Agreement with effect from the date first set out above.
The subject matter and duration of the Processing of the Company Personal Data are set out in the Principal Agreement and this Addendum.
Setup, maintain and optimize Program Participant’s marketing campaigns or promotional activities.
The obligations and rights of Company and Company Affiliates are set out in the Principal Agreement and this Addendum.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Program Participant shall in relation to the Company Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.
Company reserves the right to request the list of technical and organizational measures implemented to Program Participant.
Company shall also have the right to require the implementation by Program Participant of additional technical and organizational measures, in case Company considers that the measures in place are not sufficient to cover the risks.
'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.