Review of legality and data minimisation (a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
Amendments to Clarify and Correct Errors and Defects The parties may amend this Agreement to clarify an ambiguity, correct an error or correct or supplement any term of this Agreement that may be defective or inconsistent with the other terms of this Agreement, in each case, without the consent of the Noteholders, the Certificateholders or any other Person. The parties may amend any term or provision of this Agreement from time to time for the purpose of conforming the terms of this Agreement to the description thereof in the Prospectus, without the consent of Noteholders, the Certificateholders or any other Person.
Data Security and Unauthorized Data Release The Requester and Approved Users, including the Requester’s IT Director, acknowledge NIH’s expectation that they have reviewed and agree to manage the requested controlled-access dataset(s) and any Data Derivatives of controlled-access datasets according to NIH’s expectations set forth in the current NIH Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the Requester’s IT security requirements and policies. The Requester, including the Requester’s IT Director, agree that the Requester’s IT security requirements and policies are sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the Requester. If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH GDS Policy. The Requester and PI agree to notify the appropriate DAC(s) of any unauthorized data sharing, breaches of data security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the incident is identified. As permitted by law, notifications should include any known information regarding the incident and a general description of the activities or process in place to define and remediate the situation fully. Within 3 business days of the DAC notification, the Requester agrees to submit to the DAC(s) a detailed written report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), and plans or processes developed to prevent further problems, including specific information on timelines anticipated for action. The Requester agrees to provide documentation verifying that the remediation plans have been implemented. Repeated violations or unresponsiveness to NIH requests may result in further compliance measures affecting the Requester. NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security incident or policy violation. Approved Users and their associates agree to support such investigations and provide information, within the limits of applicable local, state, tribal, and federal laws and regulations. In addition, Requester and Approved Users agree to work with the NIH to assure that plans and procedures that are developed to address identified problems are mutually acceptable and consistent with applicable law.
Material Safety Data Sheet Seller shall provide to Buyer with each delivery any Material Safety Data Sheet applicable to the work in conformance with and containing such information as required by the Occupational Safety and Health Act of 1970 and regulations promulgated thereunder or its State approved counterpart.
Data Return and Destruction of Data (a) Protecting PII from unauthorized access and disclosure is of the utmost importance to the EA, and Contractor agrees that it is prohibited from retaining PII or continued access to PII or any copy, summary or extract of PII, on any storage medium (including, without limitation, in secure data centers and/or cloud-based facilities) whatsoever beyond the period of providing Services to the EA, unless such retention is either expressly authorized for a prescribed period by the Service Agreement or other written agreement between the Parties, or expressly requested by the EA for purposes of facilitating the transfer of PII to the EA or expressly required by law. As applicable, upon expiration or termination of the Service Agreement, Contractor shall transfer PII, in a format agreed to by the Parties to the EA.
(b) If applicable, once the transfer of PII has been accomplished in accordance with the EA’s written election to do so, Contractor agrees to return or destroy all PII when the purpose that necessitated its receipt by Contractor has been completed. Thereafter, with regard to all PII (including without limitation, all hard copies, archived copies, electronic versions, electronic imaging of hard copies) as well as any and all PII maintained on behalf of Contractor in a secure data center and/or cloud-based facilities that remain in the possession of Contractor or its Subcontractors, Contractor shall ensure that PII is securely deleted and/or destroyed in a manner that does not allow it to be retrieved or retrievable, read or reconstructed. Hard copy media must be shredded or destroyed such that PII cannot be read or otherwise reconstructed, and electronic media must be cleared, purged, or destroyed such that the PII cannot be retrieved. Only the destruction of paper PII, and not redaction, will satisfy the requirements for data destruction. Redaction is specifically excluded as a means of data destruction.
(c) Contractor shall provide the EA with a written certification of the secure deletion and/or destruction of PII held by the Contractor or Subcontractors.
(d) To the extent that Contractor and/or its subcontractors continue to be in possession of any de-identified data (i.e., data that has had all direct and indirect identifiers removed), they agree not to attempt to re-identify de-identified data and not to transfer de-identified data to any party.
MATERIAL SAFETY DATA SHEETS As applicable, Contractor shall provide Purchaser with all appropriate Material Safety Data Sheets (“MSDS”) at the time of delivery of each shipment of Goods which requires such compliance and/or and for materials used by Contractor while performing Services and any updates of the same.
Inspection of Goods 8.1 The Buyer shall inspect the goods upon delivery.
8.2 Where goods are damaged the Buyer shall notify the Supplier. The Buyer may reject the damaged goods and the following provisions shall apply:
8.2.1 the Supplier shall collect the damaged goods from the Buyer at the Supplier’s expense;
8.2.2 during the period between delivery of the goods to the Buyer and collection by the Supplier, the Buyer shall not be liable for any loss or further damage caused to the damaged goods;
8.2.3 all sums payable by the Buyer in relation to the damaged goods shall cease to become payable;
8.2.4 all sums paid by the Buyer in relation to the damaged goods shall be repaid by the Supplier immediately;
8.2.5 the Buyer shall be entitled to claim damages from the Supplier for any losses caused to the Buyer as a result of the goods being damaged.
8.3 Where there are shortages in the order the Buyer shall notify the Supplier and the following provisions shall apply:
8.3.1 all sums payable by the Buyer in relation to the missing goods shall cease to become payable;
8.3.2 all sums paid by the Buyer in relation to the missing goods shall be repaid by the Supplier immediately;
8.3.3 the Buyer shall be entitled to claim damages from the Supplier for any losses caused to the Buyer as a result of the shortages.
8.4 If the Buyer so requests, the Supplier shall immediately replace damaged goods or supply goods which are missing at the Supplier’s expense or the Buyer shall be entitled to cancel, without notice, the whole or any unexecuted part of the order and the rights referred to in Clause 5.2 shall apply.
8.5 Where there is an excess of goods in relation to the order the Buyer may reject the excess goods by notice in writing to the Supplier and the following provisions shall apply:
8.5.1 the Supplier shall collect the excess goods from the Buyer at the Supplier’s expense;
8.5.2 during the period between delivery of the goods and collection by the Supplier, the Buyer shall not be liable for any loss or damage caused to the excess goods;
8.5.3 no sum shall be due to the Supplier for the excess goods and in the event that sums are paid to the Supplier for the excess goods, the Supplier shall repay such sums to the Buyer immediately.
8.6 The Buyer may accept excess goods by notifying the Supplier of such acceptance and the price of the excess goods shall be payable by the Buyer.
8.7 The Supplier shall repair or replace free of charge, goods damaged or lost in transit upon receiving notice to that effect from the Buyer.
8.8 The Buyer’s signature on any delivery note of the Supplier is evidence of the number of packages received only and not evidence of the correct quantity of goods received or that the goods are in a good condition or of the correct quality.
Packing Specifications 7.3.1 A pack will contain a minimum of one message record or a maximum of 99,999 message records plus a pack header record and a pack trailer record. One transmission can contain a maximum of 99 packs and a minimum of one pack.
Errors, Questions, and Complaints a. In case of errors or questions about your transactions, you should as soon as possible contact us as set forth in Section 6 of the General Terms above.
b. If you think your periodic statement for your account is incorrect or you need more information about a transaction listed in the periodic statement for your account, we must hear from you no later than sixty (60) days after we send you the applicable periodic statement for your account that identifies the error. You must:
1. Tell us your name;
2. Describe the error or the transaction in question, and explain as clearly as possible why you believe it is an error or why you need more information; and,
3. Tell us the dollar amount of the suspected error.
c. If you tell us orally, we may require that you send your complaint in writing within ten (10) Business Days after your oral notification. Except as described below, we will determine whether an error occurred within ten (10) Business Days after you notify us of the error. We will tell you the results of our investigation within three (3) Business Days after we complete our investigation of the error, and will correct any error promptly. However, if we require more time to confirm the nature of your complaint or question, we reserve the right to take up to forty-five (45) days to complete our investigation. If we decide to do this, we will provisionally credit your Eligible Transaction Account within ten (10) Business Days for the amount you think is in error. If we ask you to submit your complaint or question in writing and we do not receive it within ten (10) Business Days, we may not provisionally credit your Eligible Transaction Account. If it is determined there was no error we will mail you a written explanation within three (3) Business Days after completion of our investigation. You may ask for copies of documents used in our investigation. We may revoke any provisional credit provided to you if we find an error did not occur.
New Hampshire Specific Data Security Requirements The Provider agrees to the following privacy and security standards from “the Minimum Standards for Privacy and Security of Student and Employee Data” from the New Hampshire Department of Education. Specifically, the Provider agrees to:
(1) Limit system access to the types of transactions and functions that authorized users, such as students, parents, and LEA are permitted to execute;
(2) Limit unsuccessful logon attempts;
(3) Employ cryptographic mechanisms to protect the confidentiality of remote access sessions;
(4) Authorize wireless access prior to allowing such connections;
(5) Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity;
(6) Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions;
(7) Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles;
(8) Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services;
(9) Enforce a minimum password complexity and change of characters when new passwords are created;
(10) Perform maintenance on organizational systems;
(11) Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance;
(12) Ensure equipment removed for off-site maintenance is sanitized of any Student Data in accordance with NIST SP 800-88 Revision 1;
(13) Protect (i.e., physically control and securely store) system media containing Student Data, both paper and digital;
(14) Sanitize or destroy system media containing Student Data in accordance with NIST SP 800-88 Revision 1 before disposal or release for reuse;
(15) Control access to media containing Student Data and maintain accountability for media during transport outside of controlled areas;
(16) Periodically assess the security controls in organizational systems to determine if the controls are effective in their application and develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems;
(17) Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems;
(18) Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception);
(19) Protect the confidentiality of Student Data at rest;
(20) Identify, report, and correct system flaws in a timely manner;
(21) Provide protection from malicious code (i.e. Antivirus and Antimalware) at designated locations within organizational systems;
(22) Monitor system security alerts and advisories and take action in response; and
(23) Update malicious code protection mechanisms when new releases are available.
