Common use of DUTIES OF THE CONTRACTOR Clause in Contracts

DUTIES OF THE CONTRACTOR. (1) The Contractor shall process personal data exclusively as contractually agreed or as instructed by the Client, unless the Contractor is legally obliged to carry out a specific processing. If such obligations exist for the Contractor, the Contractor shall notify the Client of these prior to processing, unless the notification is prohibited by law. Furthermore, the Contractor shall not use the data provided for processing for any other purposes, in particular not for its own purposes. (2) The Contractor confirms that it is aware of the relevant general data protection regulations. It shall observe the principles of proper data processing. (3) The Contractor undertakes to strictly maintain confidentiality during processing. (4) Persons who may gain knowledge of the data processed in the order shall undertake in writing to maintain confidentiality, insofar as they are not already subject to a relevant confidentiality obligation by law. (5) The Contractor warrants that the persons employed by it for processing have been familiarized with the relevant provisions of data protection and this Agreement prior to the start of processing. Corresponding training and awareness-raising measures shall be repeated on an appropriate regular basis. The Contractor shall ensure that persons deployed for commissioned processing are appropriately instructed and monitored on an ongoing basis with regard to compliance with data protection requirements. (6) In connection with the commissioned processing, the Contractor shall support the Customer to the extent necessary in fulfilling its obligations under data protection law, in particular in creating and updating the list of processing activities, in carrying out the data protection impact assessment and any necessary consultation with the supervisory authority. The required information and documentation shall be kept available and provided to the Customer without undue delay upon request. (7) If the Client is subject to inspection by supervisory authorities or other bodies or if data subjects assert rights against it, the Contractor undertakes to support the Client to the extent necessary, insofar as the processing under the contract is affected. (8) The Contractor may only provide information to third parties or the person concerned with the prior consent of the Client. The Contractor shall immediately forward any inquiries addressed directly to it to the Client. (9) To the extent required by law, the Contractor shall appoint a competent and reliable person as data protection officer. It must be ensured that there are no conflicts of interest for the commissioner. In cases of doubt, the Customer may contact the data protection officer directly. The Contractor shall inform the Customer without delay of the contact details of the data protection officer or give reasons why no officer has been appointed. The Contractor shall inform the Customer without delay of any changes in the person or the internal tasks of the data protection officer. (10) As a matter of principle, the commissioned processing shall take place within the EU or the EEA. Any relocation to a third country may only take place with the consent of the client and under the conditions contained in Chapter V of the General Data Protection Regulation and in compliance with the provisions of this contract.

DUTIES OF THE CONTRACTOR. (1) The Contractor shall process personal data exclusively as contractually agreed or as instructed by the Client, unless the Contractor is legally obliged to carry out a specific processing. If such obligations obliga- tions exist for the Contractor, the Contractor shall notify the Client of these prior to processing, unless the notification is prohibited by law. Furthermore, the Contractor shall not use the data provided for processing for any other purposes, in particular not for its own purposes. (2) The Contractor confirms that it is aware of the relevant general data protection regulations. It shall observe the principles of proper data processing. (3) The Contractor undertakes to strictly maintain confidentiality during processing. (4) Persons who may gain knowledge of the data processed in the order shall undertake in writing to maintain confidentiality, insofar as they are not already subject to a relevant confidentiality obligation obli- gation by law. (5) The Contractor warrants that the persons employed by it for processing have been familiarized with the relevant provisions of data protection and this Agreement prior to the start of processing. Corresponding training and awareness-raising measures shall be repeated on an appropriate regular reg- ular basis. The Contractor shall ensure that persons deployed for commissioned processing are appropriately instructed and monitored on an ongoing basis with regard to compliance with data protection requirements. (6) In connection with the commissioned processing, the Contractor shall support the Customer to the extent necessary in fulfilling its obligations under data protection law, in particular in creating and updating the list of processing activities, in carrying out the data protection impact assessment and any necessary consultation with the supervisory authority. The required information and documentation doc- umentation shall be kept available and provided to the Customer without undue delay upon requestre- quest. (7) If the Client is subject to inspection by supervisory authorities or other bodies or if data subjects assert rights against it, the Contractor undertakes to support the Client to the extent necessary, insofar as the processing under the contract is affected. (8) The Contractor may only provide information to third parties or the person concerned with the prior consent of the Client. The Contractor shall immediately forward any inquiries addressed directly di- rectly to it to the Client. (9) To the extent required by law, the Contractor shall appoint a competent and reliable person as data protection officer. It must be ensured that there are no conflicts of interest for the commissionercommis- sioner. In cases of doubt, the Customer may contact the data protection officer directly. The Contractor Con- tractor shall inform the Customer without delay of the contact details of the data protection officer or give reasons why no officer has been appointed. The Contractor shall inform the Customer without with- out delay of any changes in the person or the internal tasks of the data protection officer. (10) As a matter of principle, the commissioned processing shall take place within the EU or the EEA. Any relocation to a third country may only take place with the consent of the client and under the conditions contained in Chapter V of the General Data Protection Regulation and in compliance with the provisions of this contract.

DUTIES OF THE CONTRACTOR. (1) 3.1 The Contractor may only process pD of data subjects within the scope of the DPA and the documented instructions of the Client. If the Contractor is obligated by national or European law to process data in a manner that deviates from this, it shall - insofar as this is legally permissible - inform the Client of this circumstance prior to the start of the processing. 3.2 The Contractor shall process personal organize the internal organization within its area of responsibility in such a way that it meets the special requirements of data exclusively as protection. It shall take the technical and/or organizational measures described in the Annex 1 to adequately protect the Client's pD. The measures shall ensure the confidentiality, integrity, availability and resilience of the systems and services in connection with the processing on a permanent basis. 3.3 The Contractor reserves the right to change the technical and/or organizational measures taken, but it must be ensured that the contractually agreed level of protection is not undercut. The Contractor informs the Client of such a change by email. 3.4 The Contractor shall support the Client within the scope of its possibilities and the contractually owed performance in fulfilling the requests and claims of data subjects pursuant to Chapter III of the GDPR as well as in complying with the obligations set forth in Art. 33 to 36 of the GDPR. 3.5 The Contractor warrants that the employees involved in the processing of the Client's pD and other persons working for the Contractor are prohibited from processing the respective pD outside the Client's instructions. Furthermore, the Contractor warrants that the persons authorized to process the pD have committed themselves to confidentiality or as instructed are subject to an appropriate statutory duty of confidentiality. The confidentiality and non-disclosure obligation shall continue to exist after termination of the order processing agreement. 3.6 The Contractor shall inform the Client without delay if it becomes aware of any violations of the Client's pD protection. The Contractor shall take the necessary measures to secure the pD and to mitigate any possible adverse consequences of the persons concerned and shall consult with the Client on this without delay. 3.7 The Contractor shall inform the Client of the contact person for data protection issues arising within the scope of the DPA. 3.8 The Contractor warrants to comply with its obligations under Article 32(1)(d) of the GDPR and to implement a procedure for the regular review of the effectiveness of the technical and organizational measures to ensure the security of the Processing. 3.9 The Contractor shall correct or delete the pD that are the subject of the contract if the Client instructs it to do so and this is covered by the scope of instructions. If a deletion in compliance with data protection or a corresponding restriction of data processing is not possible, the Contractor shall undertake the destruction of data carriers and other materials in compliance with data protection on the basis of an individual order by the Client, unless already agreed in the Contractor is legally obliged to carry out a specific processing. If such obligations exist for the Contractor, the Contractor shall notify the Client of these prior to processing, unless the notification is prohibited by law. Furthermore, the Contractor shall not use the data provided for processing for any other purposes, in particular not for its own purposescontract. (2) 3.10 The Contractor confirms that it is aware of the relevant general data protection regulations. It shall observe regulations of the principles of proper data GDPR relevant to the commissioned processing. (3) The Contractor undertakes to strictly maintain confidentiality during processing. (4) Persons who may gain knowledge 3.11 Data, data carriers as well as all other materials shall be either surrendered or deleted upon the Client's request after the end of the data processed in the order shall undertake in writing to maintain confidentiality, insofar as they are not already subject to a relevant confidentiality obligation by lawDPA. (5) The Contractor warrants that the persons employed by it for processing have been familiarized with the relevant provisions of data protection and this Agreement prior to the start of processing. Corresponding training and awareness-raising measures shall be repeated on an appropriate regular basis. The Contractor shall ensure that persons deployed for commissioned processing are appropriately instructed and monitored on an ongoing basis with regard to compliance with data protection requirements. (6) In connection with the commissioned processing, the Contractor shall support the Customer to the extent necessary in fulfilling its obligations under data protection law, in particular in creating and updating the list of processing activities, in carrying out the data protection impact assessment and any necessary consultation with the supervisory authority. The required information and documentation shall be kept available and provided to the Customer without undue delay upon request. (7) If the Client is subject to inspection by supervisory authorities or other bodies or if data subjects assert rights against it, the Contractor undertakes to support the Client to the extent necessary, insofar as the processing under the contract is affected. (8) The Contractor may only provide information to third parties or the person concerned with the prior consent of the Client. The Contractor shall immediately forward any inquiries addressed directly to it to the Client. (9) To the extent required by law, the Contractor shall appoint a competent and reliable person as data protection officer. It must be ensured that there are no conflicts of interest for the commissioner. In cases of doubt, the Customer may contact the data protection officer directly. The Contractor shall inform the Customer without delay of the contact details of the data protection officer or give reasons why no officer has been appointed. The Contractor shall inform the Customer without delay of any changes in the person or the internal tasks of the data protection officer. (10) As a matter of principle, the commissioned processing shall take place within the EU or the EEA. Any relocation to a third country may only take place with the consent of the client and under the conditions contained in Chapter V of the General Data Protection Regulation and in compliance with the provisions of this contract.

DUTIES OF THE CONTRACTOR. (1) The Contractor shall process personal data exclusively as contractually agreed or as instructed by the Client, unless the Contractor is legally obliged to carry out a specific processing. If such obligations obliga- tions exist for the Contractor, the Contractor shall notify the Client of these prior to processing, unless the notification is prohibited by law. Furthermore, the Contractor shall not use the data provided for processing for any other purposes, in particular not for its own purposes. (2) The Contractor confirms that it is aware of the relevant general data protection regulations. It shall observe the principles of proper data processing. (3) The Contractor undertakes to strictly maintain confidentiality during processing. (4) Persons who may gain knowledge of the data processed in the order shall undertake in writing to maintain confidentiality, insofar as they are not already subject to a relevant confidentiality obligation obli- gation by law. (5) The Contractor warrants that the persons employed by it for processing have been familiarized with the relevant provisions of data protection and this Agreement prior to the start of processing. Corresponding training and awareness-raising measures shall be repeated on an appropriate regular reg- ular basis. The Contractor shall ensure that persons deployed for commissioned processing are appropriately instructed and monitored on an ongoing basis with regard to compliance with data protection requirements. (6) In connection with the commissioned processing, the Contractor shall support the Customer to the extent necessary in fulfilling its obligations under data protection law, in particular in creating and updating the list of processing activities, in carrying out the data protection impact assessment and any necessary consultation with the supervisory authority. The required information and documentation doc- umentation shall be kept available and provided to the Customer without undue delay upon requestre- quest. (7) If the Client is subject to inspection by supervisory authorities or other bodies or if data subjects assert rights against it, the Contractor undertakes to support the Client to the extent necessary, insofar as the processing under the contract is affected. (8) The Contractor may only provide information to third parties or the person concerned with the prior consent of the Client. The Contractor shall immediately forward any inquiries addressed directly di- rectly to it to the Client. (9) To the extent required by law, the Contractor shall appoint a competent and reliable person as data protection officer. It must be ensured that there are no conflicts of interest for the commissionercommis- sioner. In cases of doubt, the Customer may contact the data protection officer directly. The Contractor Con- tractor shall inform the Customer without delay of the contact details of the data protection officer or give reasons why no officer has been appointed. The Contractor shall inform the Customer without with- out delay of any changes in the person or the internal tasks of the data protection officer. (10) As a matter of principle, the commissioned processing shall take place within the EU or the EEA. Any relocation to a third country may only take place with the consent of the client and under the conditions contained in Chapter V of the General Data Protection Regulation and in compliance with the provisions of this contract.