Personal data processor. If bioMérieux elects to subcontract all or part of the processing or of the hosting of Client’s personal data or patient personal data, bioMérieux is authorized (i) to engage any other processor without prior specific written authorization from Client as the data controller, except the obligation for bioMérieux to inform the Client of any intended changes concerning the addition or replacement of other processors, thereby giving the Client as the data controller the opportunity to object to such changes in accordance with article 28 (2) of the GDPR. and undertakes (ii) to ensure that the aforementioned subcontractors have entered into confidentiality agreements, (iii) to take appropriate measures to ensure the security processing or hosting services, (iv) to only hire sub-contractors, if any, with the prior written consent of Buyer as the data controller and under a written contract, (iv) to assist Client as the data controller, in providing data subjects access to their personal data, and allowing data subjects to exercise their personal rights in accordance with the applicable personal data protection laws and regulations, (vi) to assist Client as the data controller, in meeting its own obligations in relation to the security of processing, the notification of personal data breaches, and data protection impact assessment, if any, (vii) to delete or return all personal data to Client as the data controller, as requested, at the end of the agreement with bioMérieux,
Personal data processor. MetaSolutions is the Personal Data Processor for personal data in the Client’s data and shall implement technical and organisational measures to protect the personal data. MetaSolutions will follow the general guidelines issued by the supervisory authority, as well as new regulations with respect to security requirements which affect the Client’s data.
