Data Processing In this clause:
Data Privacy Participant hereby explicitly and unambiguously consents to the collection, use and transfer, in electronic or other form, of Participant’s personal data as described in this Award Agreement and any other Restricted Stock Unit grant materials by and among, as applicable, the Employer, the Company and any Parent or Subsidiary for the exclusive purpose of implementing, administering and managing Participant’s participation in the Plan. Participant understands that the Company and the Employer may hold certain personal information about Participant, including, but not limited to, Participant’s name, home address and telephone number, date of birth, social insurance number or other identification number, salary, nationality, job title, any Shares or directorships held in the Company, details of all Restricted Stock Units or any other entitlement to Shares awarded, canceled, exercised, vested, unvested or outstanding in Participant’s favor (“Data”), for the exclusive purpose of implementing, administering and managing the Plan. Participant understands that Data will be transferred to a stock plan service provider as may be selected by the Company in the future, which is assisting the Company with the implementation, administration and management of the Plan. Participant understands that the recipients of the Data may be located in the United States or elsewhere, and that the recipients’ country of operation (e.g., the United States) may have different data privacy laws and protections than Participant’s country. Participant understands that if he or she resides outside the United States, he or she may request a list with the names and addresses of any potential recipients of the Data by contacting his or her local human resources representative. Participant authorizes the Company, any stock plan service provider selected by the Company and any other possible recipients which may assist the Company (presently or in the future) with implementing, administering and managing the Plan to receive, possess, use, retain and transfer the Data, in electronic or other form, for the sole purpose of implementing, administering and managing his or her participation in the Plan. Participant understands that Data will be held only as long as is necessary to implement, administer and manage Participant’s participation in the Plan. Participant understands if he or she resides outside the United States, he or she may, at any time, view Data, request additional information about the storage and processing of Data, require any necessary amendments to Data or refuse or withdraw the consents herein, in any case without cost, by contacting in writing his or her local human resources representative. Further, Participant understands that he or she is providing the consents herein on a purely voluntary basis. If Participant does not consent, or if Participant later seeks to revoke his or her consent, his or her status as a Service Provider and career with the Employer will not be adversely affected; the only adverse consequence of refusing or withdrawing Participant’s consent is that the Company would not be able to grant Participant Restricted Stock Units or other equity awards or administer or maintain such awards. Therefore, Participant understands that refusing or withdrawing his or her consent may affect Participant’s ability to participate in the Plan. For more information on the consequences of Participant’s refusal to consent or withdrawal of consent, Participant understands that he or she may contact his or her local human resources representative.
Personal Data Processing 2.1 The Processor shall process Personal Data only on the basis of corresponding recorded orders from the Controller.
2.2 By way of exception, in particular in urgent cases, processing orders from the Data Controller may also be made orally. In this case, the Data Controller shall confirm as soon as possible and in writing, by any appropriate means, the instructions given orally.
2.3 Where the processing concerns the transmission of Personal Data to a third country outside the European Union or to an international organization, the Data Processor shall also comply with the relevant instructions of the Data Controller, unless different legal requirements exist under European Union laws or the laws of the Member State to which the Data Processor is subject. In such a case, the Data Processor shall inform the Data Controller before processing of the legal requirement in question, unless the said law prohibits this kind of information for reasons of substantial public interest.
2.4 The transmission of Personal Data to a third country outside the European Union is prohibited unless the Data Controller has given prior explicit approval to that end, and one of the following conditions is met: • the European Commission has resolved that an adequate level of protection of personal data is ensured in the country the Personal Data is to be transmitted; • the transmission is to be made to the U.S.A.; and the recipient of the Personal Data has acceded to and abides by the Privacy Shield Framework; • the transmission will be governed by the standard data protection clauses issued by the European Commission.
2.5 The Data Processor shall inform the Data Controller immediately upon receipt of the order or as soon as possible if he / she determines that the content of a particular processing order violates the Regulation and / or national law and / or the law of another Member State of the European Union (EU), and / or other provisions of EU law on the protection of Personal Data.
2.6 The Data Processor acknowledges that the Data Controller has full control over her Personal Data and determines any particular feature of the processing to which the Personal Data will be submitted. If the Data Processor ignores the instructions of the Data Controller and determines alone the scope, the means and generally any other matter concerning the processing of Personal Data, she shall render herself the Data Controller for the purposes of implementing the Regulation and the legal framework on the protection of Personal Data. The practical consequence of this is that, in addition to the full responsibility of the Processor towards the Controller, she shall carry the same level of responsibility vis-à-vis the independent supervisory authority (and any other competent state authority) as well as the Natural Persons - Data Subjects of the data being processed.
Reasonable Suspicion Testing All Employees Performing Safety-Sensitive Functions
A. Reasonable suspicion testing for alcohol or controlled substances may be directed by the Employer for any employee performing safety-sensitive functions when there is reason to suspect that alcohol or controlled substance use may be adversely affecting the employee’s job performance or that the employee may present a danger to the physical safety of the employee or another.
B. Specific objective grounds must be stated in writing that support the reasonable suspicion. Examples of specific objective grounds include but are not limited to:
1. Physical symptoms consistent with alcohol and/or controlled substance use;
2. Evidence or observation of alcohol or controlled substance use, possession, sale, or delivery; or
3. The occurrence of an accident(s) where a trained manager, supervisor or lead worker suspects alcohol or other controlled substance use may have been a factor.
Your Billing Rights: Keep this Document for Future Use This notice tells you about your rights and our responsibilities under the Fair Credit Billing Act.
Reporting of Non-Force Majeure Events Each Party (the “Notifying Party”) shall notify the other Parties when the Notifying Party becomes aware of its inability to comply with the provisions of this Agreement for a reason other than a Force Majeure event. The Parties agree to cooperate with each other and provide necessary information regarding such inability to comply, including the date, duration, reason for the inability to comply, and corrective actions taken or planned to be taken with respect to such inability to comply. Notwithstanding the foregoing, notification, cooperation or information provided under this Article shall not entitle the Party receiving such notification to allege a cause for anticipatory breach of this Agreement.
Details of Data Processing (a) Subject matter: The subject matter of the data processing under this DPA is the Customer Data.
Data Protection Impact Assessment If, pursuant to Data Protection Law, Customer (or its Controllers) are required to perform a data protection impact assessment or prior consultation with a regulator, at Customer’s request, SAP will provide such documents as are generally available for the Cloud Service (for example, this DPA, the Agreement, audit reports or certifications). Any additional assistance shall be mutually agreed between the Parties.
Data Input Control It will be possible to retrospectively examine and establish whether and by whom Personal Data have been entered, modified or removed from SAP data processing systems.
Cybersecurity; Data Protection The Company’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with its business, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company is presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except where the failure to be in compliance would not, individually or in the aggregate, have a Material Adverse Effect.
