Common use of Management of Personal Data Clause in Contracts

Management of Personal Data. Provisions applicable in the event of a direct contract agreement with the Designated Expert In application of Article 13 of EU regulation 2016/670 of the European Parliament and of the Council of 27 April 2016 concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (GDPR), the Contractor is hereby informed the personal data collected (in particular surname, first name, email address) in connection with the present contract are liable to processing. The legitimate legal grounds for this processing correspond to sections (c) and (e) of the GDPR, namely: The processing is necessary to comply with a legal obligation to which Expertise France is subject; The processing is necessary for the performance of a public interest mission or relevant to the exercise of official authority vested in Expertise France; The purposes of the processing are: The management and monitoring of this contract, The management and monitoring of reporting to funding bodies and other control authorities. The recipients or category of recipients of personal data are exclusively authorised persons from the contracting authority, ministries, State operators and funding bodies in charge of the signing and performance of this contract, as well as the service providers assisting them in their activities. Retention period: these data are retained for the whole duration of the performance of the contract, as well as throughout the duration of administrative usefulness (DUA) applicable to the contract. To comply with the provisions to Articles 15-21 of the GDPR, persons whose personal data are collected have the right of access, rectification and erasure for information concerning them. They also have a right the limit the processing of this data and to oppose the processing on legitimate grounds. The rights of information and any other right for persons affected by the processing implemented can be exercised by contacting the Expertise France Data Protection Officer (xxxxxxxxxxxx.xxxxxxxx@xxxxxxxxxxxxxxx.xx). Individuals whose personal data are collected in connection with the present procedure have the right to lodge a complaint with the French Data Protection Authority (CNIL). Applicable provisions in the event of a contract agreement with a company to which the Designated Expert is affiliated This contract may include one or more personal data processing operations. The parties undertake to comply with the regulations in force applicable to the processing of personal data in compliance with Law no. 78-17 of 6 January 1978, as modified, regarding the protection of personal data and to EU regulation 2016/679, the so-called “General Data Protection Regulation” (GDPR). The Contractor undertakes in particular to: Process personal data only for the purpose(s) that are the subject of this contract; Ensure that those persons authorised to process the personal data undertake to respect its confidentiality or are subject to a suitable legal confidentiality obligation; Implement suitable technical and organisational measures to guarantee a level of security appropriate to the risks arising from the contract including, in particular, the encryption, confidentiality and integrity of data; Notify the contracting authority, by any means, of any breach of personal data within 24 hours of becoming aware of it; Assist the contracting authority in fulfilling its obligation to pursue requests from data subjects; Delete all personal data or return this data to the contracting authority at the conclusion of the services relating to the contract, at the latter’s request, unless EU law or the law of the Member State requires the retention of said data; Make available to the contracting authority all information necessary to demonstrate compliance with the obligations pursuant to this Article, and allow audits to be carried out by the contracting authority or another party that it has appointed. If the Contractor uses a subcontractor to carry out its personal data processing in connection with the contact, it must first obtain the written authorisation of Expertise France. Likewise, the Contractor shall inform Expertise France of any planned change concerning the addition or replacement of other subcontractors, thereby giving the contracting authority the option to object to these changes. The same obligations regarding data protection as those set in the contract between the contracting authority and the Contractor are imposed on the subcontractors, in particular for presenting sufficient guarantees regarding the implementation of appropriate technical and organisational measures for the protection of personal data processing. If the subcontractor does not fulfil these obligations, the Contractor shall be fully liable towards the contracting authority for the subcontractor’s performance of these obligations. It should be recalled that the Contractor may be held liable in the event of non-compliance with the aforementioned provisions. Expertise France may announce the immediate termination of the contract, without compensation to the Contractor, in the event of a breach of professional secrecy or non-compliance with the aforementioned provisions.

Management of Personal Data. Provisions applicable in the event of a direct contract agreement with the Designated Expert In application of Article 13 of EU regulation 2016/670 of the European Parliament and of the Council of 27 April 2016 concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (GDPR), the Contractor is hereby informed the personal data collected (in particular surname, first name, email address) in connection with the present contract are liable to processing. The legitimate legal grounds for this processing correspond to sections (c) and (e) of the GDPR, namely: The processing is necessary to comply with a legal obligation to which Expertise France is subject; The processing is necessary for the performance of a public interest mission or relevant to the exercise of official authority vested in Expertise France; The purposes of the processing are: The management and monitoring of this contract, The management and monitoring of reporting to funding bodies and other control authorities. The recipients or category of recipients of personal data are exclusively authorised persons from the contracting authorityExpertise France, ministries, State operators and funding bodies in charge of the signing and performance of this contract, as well as the service providers assisting them in their activities. Retention period: these data are retained for the whole duration of the performance of the contract, as well as throughout the duration of administrative usefulness (DUA) applicable to the contract. To comply with the provisions to Articles 15-21 of the GDPR, persons whose personal data are collected have the right of access, rectification and erasure for information concerning them. They also have a right the limit the processing of this data and to oppose the processing on legitimate grounds. The rights of information and any other right for persons affected by the processing implemented can be exercised by contacting the Expertise France Data Protection Officer (xxxxxxxxxxxx.xxxxxxxx@xxxxxxxxxxxxxxx.xx). Individuals whose personal data are collected in connection with the present procedure have the right to lodge a complaint with the French Data Protection Authority (CNIL). Applicable provisions in the event of a contract agreement with a company to which the Designated Expert is affiliated This contract may include one or more personal data processing operations. The parties undertake to comply with the regulations in force applicable to the processing of personal data in compliance with Law no. 78-17 of 6 January 1978, as modified, regarding the protection of personal data and to EU regulation 2016/679, the so-called “General Data Protection Regulation” (GDPR). The Contractor undertakes in particular to: Process personal data only for the purpose(s) that are the subject of this contract; Ensure that those persons authorised to process the personal data undertake to respect its confidentiality or are subject to a suitable legal confidentiality obligation; Implement suitable technical and organisational measures to guarantee a level of security appropriate to the risks arising from the contract including, in particular, the encryption, confidentiality and integrity of data; Notify the contracting authorityExpertise France, by any means, of any breach of personal data within 24 hours of becoming aware of it; Assist the contracting authority Expertise France in fulfilling its obligation to pursue requests from data subjects; Delete all personal data or return this data to the contracting authority Expertise France at the conclusion of the services relating to the contract, at the latter’s request, unless EU law or the law of the Member State requires the retention of said data; Make available to the contracting authority Expertise France all information necessary to demonstrate compliance with the obligations pursuant to this Article, and allow audits to be carried out by the contracting authority or another party that it has appointed. If the Contractor uses a subcontractor to carry out its personal data processing in connection with the contact, it must first obtain the written authorisation of Expertise France. Likewise, the Contractor shall inform Expertise France of any planned change concerning the addition or replacement of other subcontractors, thereby giving the contracting authority Expertise France the option to object to these changes. The same obligations regarding data protection as those set in the contract between the contracting authority Expertise France and the Contractor are imposed on the subcontractors, in particular for presenting sufficient guarantees regarding the implementation of appropriate technical and organisational measures for the protection of personal data processing. If the subcontractor does not fulfil these obligations, the Contractor shall be fully liable towards the contracting authority Expertise France for the subcontractor’s performance of these obligations. It should be recalled that the Contractor may be held liable in the event of non-compliance with the aforementioned provisions. Expertise France may announce the immediate termination of the contract, without compensation to the Contractor, in the event of a breach of professional secrecy or non-compliance with the aforementioned provisions.