10. DATA PROTECTION
10.1 For the purpose of this clause, the following words should have the following meanings:
“Client Personal Data” means personal data provided by or on behalf of the Client or otherwise obtained or generated by Enfogen on the Client’s behalf in connection with the provision of the Services;
“C-P Model Clauses” shall mean the standard contractual clauses as set out in EC Decision 2010/87/EU for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection (or such other standard contractual clauses approved by the UK, and/or EU authorities with respect to personal data transfers out of the UK and/or the EEA), in each case as may be amended or replaced from time to time);
“Data Privacy Laws” means any applicable data protection related laws and regulations, as amended, extended or re-enacted from time to time, including the following:
(a) Data Protection Act 2018 and any legislation relating to the processing of personal data effective in the UK that is intended to replicate or maintain some or all of the provisions, rights and obligations set out in the GDPR in circumstances where the GDPR is no longer applicable in the UK because the UK is no longer a member of the European Union;
(b) EC Directive 2002/58/EC on Privacy and Electronic Communications;
(c) EC Regulation 2016/679 (the “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
(d) all local laws or regulations implementing or supplementing the EU legislation mentioned in (b) and (c) above;
(e) all codes of practice and guidance issued by national regulators relating to the laws, regulations and EU legislation mentioned in (a)–(d) above;
“EEA” means the European Economic Area;
“EU” means the European Union;
“International Transfer Requirements” means the requirements of Chapter V of the GDPR (Transfers of personal data to third countries or international organizations) and/or analogous provisions under UK Data Privacy Laws (as applicable);
“Losses” means losses, damages, liabilities, claims, demands, actions, penalties, fines, awards, costs and expenses (including reasonable legal and other professional expenses);
“Restricted Transfer” means a transfer of personal data from an entity whose processing of personal data under this Agreement is caught by the requirements of the GDPR (and/or UK Data Privacy Laws (as applicable)), to an entity located in a country, territory or jurisdiction which is not considered by the EU Commission (or in respect of personal data transfers caught by the requirements of UK Data Privacy Laws, the relevant UK governmental or regulatory body as applicable) to offer an adequate level of protection in respect of the processing of personal data pursuant to Article 45(1) of the GDPR (or analogous provisions under UK Data Privacy Laws (as applicable)); and
“UK” means the United Kingdom.
10.2 References in this clause to “controller”, “data subject”, “processor”, “processing”, “personal data” and “personal data breach” shall have the same meaning as defined in the GDPR.
10.3 A reference to the GDPR and/or an Article of the GDPR shall, where the context so requires and insofar as the Data Privacy Law(s) is that of the UK, be construed as a reference to the equivalent Data Privacy Law(s) of the UK and/or the corresponding provision of such Data Privacy Law(s).
10.4 The parties acknowledge and agree that not all personal data processed by Enfogen in connection with the Services will be subject to the GDPR (and/or the UK GDPR). Accordingly, this clause 10 shall only apply if and to the extent that Enfogen’s processing of personal data under this Agreement and in connection with the Services is subject to the GDPR and/or the UK GDPR.
10.5 The parties confirm that where Services comprise of Enfogen’s processing of Client Personal Data, Enfogen shall be the processor and Client shall be the controller with respect to such processing.
10.6 If, as a consequence of Enfogen’s provision of Services, a party considers that the relationship between them no longer corresponds to the intention of the parties stated in clause 10.5 above then it shall notify the other party and the parties shall discuss and agree in good faith such steps that may be required to confirm the parties’ intention.
10.7 Each party shall comply with the obligations imposed on it by applicable Data Privacy Laws with regard to Client Personal Data processed by it in connection with Services. Client acknowledges and agrees that Enfogen’s compliance with applicable Data Privacy Laws may be dependent on Client’s compliance with applicable Data Privacy Laws and accordingly Enfogen will not be liable for failure to comply with applicable Data Privacy Laws where such failure results from a failure of Client to comply with applicable Data Privacy Laws.
10.8 Each party shall ensure that where Services require the processing of Client Personal Data, the description of Services includes the following information:
(a) the subject matter and duration of the processing;
(b) the nature and purpose of the processing;
(c) a description of the type(s) of Client Personal Data processed; and
(d) a description of the categories of the data subjects comprised within the Client Personal Data referred to in this clause.
10.9 Enfogen shall:
(a) only process Client Personal Data in accordance with the documented instructions of Client;
(b) inform Client if, in Enfogen’s opinion, an instruction given by Client to Enfogen under clause 10.9(a) infringes the Data Privacy Laws;
(c) ensure that any persons authorised by it to process Client Personal Data are subject to an obligation of confidentiality;
(d) implement appropriate technical and organisational measures to ensure that Client Personal Data is subject to a level of security appropriate to the risks arising from its processing by Enfogen or its sub-processors, taking into account the factors and measures stated in Article 32 of the GDPR;
(e) notify Client without undue delay after becoming aware of a personal data breach;
(f) taking into account the nature of the processing, assist Client by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Client’s obligation to respond to requests for exercising a data subject’s rights under the GDPR;
(g) taking into account the nature of the processing and the information available to Enfogen, assist Client with regard to Client’s compliance with its obligations under the following Articles of the GDPR:
(i) Article 32 (Security of Processing);
(ii) Articles 33 and 34 (Notification and communication of a Personal Data Breach);
(iii) Article 35 (Data protection impact assessment); and
(iv) Article 36 (Prior consultation by Client with the Supervisory Authority);
upon termination of Services that required the processing of Client Personal Data (in whole or in part), at the election of Client, deliver up or destroy such Client Personal Data which is in the possession of, or under the control of, Enfogen unless EU/UK Law requires Enfogen to store such Client Personal Data; and
(i) at the request of Client, provide Client with all information necessary to demonstrate a party’s compliance with its obligations under this Agreement.
10.10 Client shall ensure that:
(a) the supply to Enfogen of Client Personal Data by or on behalf of the Client for the purposes of processing undertaken by Enfogen and its permitted sub-processors where such processing is authorised by Client shall comply with the Data Privacy Laws; and
(b) the instructions given by Client to Enfogen by operation of clause 10.9(a) shall comply with the Data Privacy Laws.
Costs of Assistance
10.11 Where, by operation of clause 10.9, Enfogen is obliged to provide assistance to Client, or to third parties at the request of Client (including submission to an audit or inspection and/or the provision of information), such assistance shall be provided at the sole cost and expense of Client, save where such assistance directly arises from Enfogen’s breach of its obligations under this clause 10, in which event the costs of such assistance shall be borne by Enfogen.
Enfogen’s appointment of sub-processors
10.12 Notwithstanding any other provision of the Agreement, Enfogen shall be entitled to sub-contract any part of Services requiring the processing of Client Personal Data, subject to the following conditions in cases where the sub-contractor is not an affiliate of Enfogen:
(a) Enfogen shall notify Client in writing of its intention to engage such sub-contractor. Such notice shall give details of the identity of such sub-contractor and the services to be supplied by it; and
(b) Client shall be deemed to have approved the engagement of the sub-contractor if it has not served a notice in writing on Enfogen objecting (acting reasonably) to such appointment within seven days of the date that the notice is deemed to be received by Client in accordance with clause 10.12(a).
10.13 Client acknowledges and agrees that Client Personal Data may be transferred by Enfogen to third parties located in a Restricted Country, which may be considered a Restricted Transfer. In the event of the transfer being considered a Restricted Transfer, Enfogen shall ensure that the Restricted Transfer meets the International Transfer Requirements. Where Enfogen considers that C-P Model Clauses are deemed an appropriate safeguard for the Restricted Transfer pursuant to the International Transfer Requirements, Enfogen shall be deemed authorised by the Client to enter into C-P Model Clauses in respect of that Restricted Transfer incorporating the details of the data processing, as set out in the relevant Quote, acting on behalf of the Client with the relevant third party.
10.14 The parties acknowledge and agree that to the extent either party considers the use of the relevant lawful transfer mechanism relied on in respect of a Restricted Transfer is no longer an appropriate lawful transfer mechanism to legitimise the relevant Restricted Transfer pursuant to the International Transfer Requirements, the Restricted Transfer shall cease and the parties shall work together to agree and put in place an alternative lawful transfer mechanism or such other supplementary measures to enable the Restricted Transfer to the relevant third party to continue.
10.15 Enfogen and its affiliates shall have no liability under the Agreement for any failure to provide the relevant Services in accordance with the Agreement as a result of the suspension of such Restricted Transfer. Notwithstanding the previous sentence, if such a Restricted Transfer is suspended, the parties shall take all reasonable steps to ensure that the Services can continue to be provided in all material respects in accordance with the Agreement. Further, to the extent the parties agree that certain supplementary measures are required to legitimise the relevant Restricted Transfer, the parties shall, acting reasonably and in good faith, allocate the costs between the parties accordingly.
10.16 Enfogen’s liability under the Agreement for the acts or omissions of any sub-processors appointed in connection with the Agreement shall be limited to an amount equal to any Losses it is able to recover from such sub-processors.
