Initial Audit, Controlling Rights of the Controller. Prior to the first data transfer, the Controller may audit or have audited the procedures pursuant to clause 11.5 („Initial Audit“). At any time during the term and for a period of six months after the termination of the Agreement, the Controller may at its own cost audit or have audited the Processor's procedures in accordance with clause 6 of the Annex to § 9 of the BDSG (processor compliance control). For this purpose, the Controller may take random samples on site in the Processor’s facilities, inspect files and data processing programs, or ask for voluntary disclosures. Upon request, the Processor will provide the Controller, at the Controller’s cost, with any information or documentation necessary for compliance with the Controller's obligations under clause 6 of the Annex to § 9 of the BDSG (processor compliance control). The Processor shall further enable the Controller, at the Controller’s cost, to ascertain that the Processor has implemented the required technical and organizational procedures pursuant to clause 11.5. For this purpose, the Processor may, with respect to measures which are not limited to the Processor Relationship with the specific Controller, at its option submit a Certificate. The Controller shall compensate Processor’s costs and efforts in connection with audits according to this clause 11.9.
Initial Audit, Controlling Rights of the Controller. Prior to the first data transfer, the Controller may audit or have audited the measures pursuant to clause 6 and 7 („Initial Audit“) or request Processor to submit relevant Certificates. Upon request, the Processor will provide the Controller, with any information or documentation necessary for processor compliance control. The Processor shall further enable the Controller to ascertain that the Processor has implemented the required technical and organizational measures pursuant to clause 6 and 7 by audits and information requests in accordance with clause 3 and 9. For this purpose, the Processor may, with respect to measures which are not limited to the Processor Relationship with the specific Controller, at its option submit a Certificate. The Controller shall give the Processor reasonable advance notice of not less than 30 days of any audit. The start date, scope and duration of, and security and confidentiality controls applicable to, any audit will be discussed and agreed between the Parties. Audits shall not interfere with the Processor’s buiness operations or compromise the security of its sytems or premises. The Processor may object to any third party auditor appointed by Controller if the auditor is, in its reasonable opinion, not suitably qualified or independent, a competitor or otherwise manifestly unsuitable. Any such objection will require Controller to appoint another auditor.
