15. DATA PROTECTION
15.1 Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 15 is in addition to, and does not relieve, remove, or replace, a party's obligations under the Data Protection Legislation.
15.2 In this clause 15, Applicable Data Processing Laws means (for so long as and to the extent that they apply to the Supplier) the law of the European Union, the law of any member state of the European Union and/or Domestic UK Law; and Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK.
15.3 For the avoidance of doubt, the terms “data controller”, “data processor”, “data subject”, “processing” and “personal data” bear the respective meanings given in the Data Protection Legislation.
15.4 The parties acknowledge that for the purposes of the Data Protection Legislation, the Customer is the controller and the Supplier is the processor.
15.5 The Supplier shall process all personal data as a data processor under the Contract in accordance with the relevant terms of the Contract and the following specification:
(a) Scope: Personal data in relation to this Contract must only be processed for the purposes detailed in clause 15.5(c).
(b) Nature of the processing: any processing operation regarding the personal data such as collecting, recording, organising, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data (whether or not by automated means).
(c) Purpose of the processing: to facilitate performance of Supplier’s obligations under the Contract.
(d) Duration of the processing: the term of the Contract, except to the extent required under applicable law to preserve the personal data.
(e) Plan for destruction of the personal data once the processing is complete: seven years from delivery or termination of the Contract.
(f) The types of personal data that will be processed: name, email address, telephone number, work address, payment details.
(g) The categories of data subject are: sole traders, employees, directors and shareholders.
15.6 Without prejudice to the generality of clause 15.1:
(a) the Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the personal data to the Supplier for the duration and purposes of the Contract; and
(b) the Supplier shall, in relation to any personal data processed in connection with the performance by the Supplier of its obligations under the Contract:
(i) process that personal data only on the documented written instructions of the Customer unless the Supplier is required by Applicable Data Processing Laws to otherwise process that personal data. Where the Supplier is relying on Applicable Data Processing Laws as the basis for processing personal data, the Supplier shall promptly notify the Customer of this before performing the processing required by the Applicable Data Processing Laws unless those Applicable Data Processing Laws prohibit the Supplier from so notifying the Customer;
(ii) ensure that it has in place appropriate technical and organisational measures, reviewed and approved by the Customer, to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);
(iii) ensure that all personnel who have access to and/or process personal data are obliged to keep the personal data confidential; and
(iv) not transfer any personal data outside of the European Economic Area unless the prior written consent of the Customer has been obtained and the following conditions are fulfilled:
(A) the Customer or the Supplier has provided appropriate safeguards in relation to the transfer;
(B) the data subject (as defined in the Data Protection Legislation) has enforceable rights and effective legal remedies;
(C) the Supplier complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and
(D) the Supplier complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the personal data;
(v) assist the Customer, at the Customer’s cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
(vi) notify the Customer without undue delay on becoming aware of a personal data breach;
(vii) at the written direction of the Customer, delete or return personal data and copies thereof to the Customer on termination of the Contract unless required by Applicable Law to store the personal data; and
(vii) maintain complete and accurate records and information to demonstrate its compliance with this clause 15 and immediately inform the Customer if, in the opinion of the Supplier, an instruction infringes the Data Protection Legislation.
15.7 The Customer consents to the Supplier appointing credit reference agencies, banks, credit insurers, suppliers, and sub-contractors as third-party processor(s) of personal data under the Contract. The Supplier confirms that it has entered or (as the case may be) will enter with the third-party processors into a written agreement incorporating terms which are substantially similar to those set out in this clause 15 and in either case which the Supplier confirms reflect and will continue to reflect the requirements of the Data Protection Legislation. As between the Customer and the Supplier, the Supplier shall remain fully liable for all acts or omissions of any third party processor (with respect to the processing of personal data) appointed by it pursuant to this clause 15.
15.8 The Supplier is entitled to appoint or replace a third party processor with the prior written consent of the Customer (such consent not be to unreasonably withheld or delayed).
15.9 Either party may, at any time on not less than 30 days’ notice, revise this clause 15 by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when replaced by attachment to the Contract).