Common use of CONFIDENTIALITY & DATA PROTECTION Clause in Contracts

CONFIDENTIALITY & DATA PROTECTION. 7.1 The Business shall inform the RSC at the time of submission of the Business Application if any information submitted to the RSC is confidential and subject to a duty of confidentiality between the organisations. Where appropriate, the Business should clearly identify the relevant parts of information that are to be treated as confidential. In the event that the Business does not inform the RSC of the confidential nature of information supplied, the RSC shall be under no duty or obligation to keep such information confidential. 7.2 The RSC is registered with the Information Commissioners Office. The RSC collects, stores and processes personal data in accordance with Data Protection Legislation. Further information on how the RSC does this can be found in our Data Privacy and Data Retention policies, here: xxxx://xxx.xxx.xxx/help-legal/legal/privacy/ 7.3 Terminology or reference to terms such as Data Controller, Personal Data, Data Processor, consent, collecting, storing, processing, transferring and sharing shall have the meaning(s) given by the Data Protection Legislation. 7.4 The Business, as the Data Controller, shall ensure that prior to any transfer or sharing of Personal Data as part of any Internship Placement, they have a legitimate reason for collecting, storing, processing, transferring or sharing that Personal Data, which may include obtaining the express consent of any individual involved (including the Intern). The Business shall ensure that the volume or extent of Personal Data involved in any such transfer or share is minimised in so far as is reasonably possible (such as removing all personal data save for the Intern’s name, for example). The Business shall ensure that it complies with the requirements of Data Protection Legislation in all respects with regard to the collection, storage, processing, transfer or sharing of such Personal Data. The Business shall be responsible for ensuring compliance of its employees, agents, subcontractors or third parties acting on its behalf, with its obligations under these Terms and Conditions. 7.5 The RSC may act as a Data Processor on behalf of the Business with regard to any Personal Data provided for the purpose of the Internship Grant. The RSC will comply with the requirements of Data Protection Legislation in storing and processing that Personal Data in this respect. 7.6 Any information (including the Business Application for the Internship Grant), Personal Data of the Intern and any contract of employment provided by the Business for in accordance with clause 3, shall be deleted and/or destroyed a period of 1 (one) calendar year following completion of the Internship Placement (whether the Internship Placement period has come to a natural end, has been terminated early or otherwise concluded). The RSC is required to retain this information for a period of at least 2 (two) calendar years to meet its audit requirements.

CONFIDENTIALITY & DATA PROTECTION. 7.1 The Business 8.1 Supplier shall inform keep in confidence all commercial, technical, financial and other confidential information provided by Huntsman (“Confidential Information”). During the RSC at the time of submission term of the Business Application if Purchase Agreement and for a period of three (3) year thereafter, Supplier shall not disclose Confidential Information to any information submitted third party or use such Confidential Information for any other purpose than the performance of its obligations under the Purchase Agreement. Additional terms contained in any applicable confidentiality or non-disclosure agreement entered into between Supplier and Huntsman shall also be applied to the RSC is confidential and subject to a duty of confidentiality between the organisations. Where appropriate, the Business should clearly identify the relevant parts exchange of information that are under the Purchase Agreement. 8.2 Supplier undertakes to be treated impose the same obligations on any employees and third parties which obtain Confidential Information as confidential. In required for the event that the Business does not inform the RSC performance of the confidential nature of information supplied, the RSC shall be under no duty or obligation to keep Purchase Agreement and warranties that such information confidentialemployees and third parties will comply with such obligations. 7.2 The RSC is registered with 8.3 Supplier shall not be entitled to use Huntsman as a reference for marketing or commercial purposes without the Information Commissioners Office. The RSC collects, stores and processes personal data in accordance with Data Protection Legislation. Further information on how the RSC does this can be found in our Data Privacy and Data Retention policies, here: xxxx://xxx.xxx.xxx/help-legal/legal/privacy/ 7.3 Terminology or reference to terms such as Data Controller, Personal Data, Data Processor, consent, collecting, storing, processing, transferring and sharing shall have the meaning(s) given by the Data Protection Legislationprior written consent of Huntsman. 7.4 The Business, as the Data Controller, 8.4 Each party shall ensure that prior to any transfer or sharing of Personal Data as part of any Internship Placement, they have a legitimate reason for collecting, storing, processing, transferring or sharing that Personal Data, which may include obtaining the express consent of any individual involved (including the Intern). The Business shall ensure that the volume or extent of Personal Data involved in any such transfer or share is minimised in so far as is reasonably possible (such as removing all personal data save for the Intern’s name, for example). The Business shall ensure that it complies comply with the requirements of applicable Data Protection Legislation when Processing Personal Data in all respects with regard to the collection, storage, processing, transfer or sharing course of such Personal Data. The Business shall be responsible for ensuring compliance of its employees, agents, subcontractors or third parties acting on its behalf, with performing its obligations under the Purchase Agreement and these General Purchasing Terms and Conditions. 7.5 The RSC may act 8.5 If and to the extent that Supplier Processes Personal Data as a Data Processor on behalf of Huntsman, and a data transfer agreement that complies with the Business EU GDPR does not exist, these terms shall apply and the Parties agree to comply with regard such terms. The Parties agree that Supplier as Processor a) must act only on the written instructions of Huntsman unless required by law to any act without such instructions; b) must ensure that employees Processing the Personal Data provided for have committed themselves to confidentiality; c) must take appropriate measures to ensure the purpose security of the Internship Grant. The RSC will comply Processing, which includes as appropriate, the pseudonymization and encryption of Personal Data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services, the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident, a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing; d) only engage sub-processors with the prior consent of Huntsman and under a written contract that provides the same sufficient guarantees to implement appropriate technical and organizational measures that meets the requirements of the applicable Data Protection Legislation; e) assist Huntsman in providing Data Subject access and allowing Data Subjects to exercise their rights under Data Protection Legislation; f) assist Huntsman in meeting its obligations in relation to the security of processing; g) provide notification of personal data breaches in sufficient time to enable Huntsman to comply with its own onward obligations after Supplier becomes aware of it; h) at the end of the services or work that results in the Processing of Personal Data delete or destroy all Personal Data belonging to Huntsman; i) submit to Huntsman audits and inspections, providing Huntsman with whatever information it needs to ensure the Parties are meeting their respective Data Protection Legislation in storing obligations; and processing that j) tell Huntsman immediately if it is asked to do something infringing Data Protection Legislation. The subject matter, nature and purpose, types of Personal Data in this respect. 7.6 Any information (including the Business Application for the Internship Grant), and categories of Personal Data of Subjects related to this Processing are set out in the Intern and any contract of employment provided by the Business for in accordance with clause 3, shall be deleted and/or destroyed a period of 1 (one) calendar year following completion of the Internship Placement (whether the Internship Placement period has come to a natural end, has been terminated early or otherwise concluded). The RSC is required to retain this information for a period of at least 2 (two) calendar years to meet its audit requirementsPurchase Agreement.

CONFIDENTIALITY & DATA PROTECTION. 7.1 The Business shall inform the RSC at the time of submission of the Business Application if any information submitted to the RSC is confidential and subject to a duty of confidentiality between the organisations. Where appropriate, the Business should clearly identify the relevant parts of information that are to be treated as confidential. In the event that the Business does not inform the RSC of the confidential nature of information supplied, the RSC shall be under no duty or obligation to keep such information confidential. 7.2 The RSC is registered with the Information Commissioners Office. The RSC collects, stores and processes personal data in accordance with Data Protection Legislation. Further information on how the RSC does this can be found in our Data Privacy and Data Retention policies, here: xxxx://xxx.xxx.xxx/help-legal/legal/privacy/ 7.3 Terminology or reference to terms such as Data Controller, Personal Data, Data Processor, consent, collecting, storing, processing, transferring and sharing shall have the meaning(s) given by the Data Protection Legislation. 7.4 The Business, as the Data Controller, shall ensure that prior to any transfer or sharing of Personal Data as part of any Internship Placement, they have a legitimate reason for collecting, storing, processing, transferring or sharing that Personal Data, which may include obtaining the express consent of any individual involved (including the Intern). The Business shall ensure that the volume or extent of Personal Data involved in any such transfer or share is minimised in so far as is reasonably possible (such as removing all personal data save for the Intern’s name, for example). The Business shall ensure that it complies with the requirements of Data Protection Legislation in all respects with regard to the collection, storage, processing, transfer or sharing of such Personal Data. The Business shall be responsible for ensuring compliance of its employees, agents, subcontractors or third parties acting on its behalf, with its obligations under these Terms and Conditions. 7.5 The RSC may act as a Data Processor on behalf of the Business with regard to any Personal Data provided for the purpose of the Internship Grant. The RSC will comply with the requirements of Data Protection Legislation in storing and processing that Personal Data in this respect. 7.6 Any information (including the Business Application for the Internship Grant), Personal Data of the Intern and any contract of employment provided by the Business for in accordance with clause 3, shall be deleted and/or destroyed a period of 1 (one) one calendar year following completion of the Internship Placement (whether the Internship Placement period has come to a natural end, has been terminated early or otherwise concluded). The RSC is required to retain this information for a period of at least 2 (two) two calendar years to meet its audit requirements.