Processing and security. 3.1 In performing its obligations under this Agreement, bookinglab shall only process the categories of Personal Data and only in respect of the categories of Data Subjects, and only for the nature and purposes of processing and duration, as is set out in the Annex to this Appendix or as necessary to perform its obligations under this Agreement, save as otherwise required by any Applicable law.
3.2 In processing the Customer Personal Data, bookinglab shall:
(a) process Customer Personal Data only in accordance with the Customer's written instructions from time to time (including those set out in this Agreement) except as otherwise required by any Applicable Law;
(b) not process the Customer Personal Data for any purpose other than those set out in the Annex and as necessary to perform its obligations under this Agreement unless otherwise expressly authorised by the Customer;
(c) promptly notify the Customer if it receives a Data Subject Request in respect of Customer Personal Data;
(d) as far as reasonably practicable, co-operate with and provide assistance to the Customer in relation to any Data Subject Request in respect of Customer Personal Data;
(e) taking into account:
(i) the state of the art;
(ii) the nature, scope, context and purposes of the processing; and
(iii) the risk and severity of potential harm, protect the Customer Personal Data by ensuring that it has in place appropriate technical and organisational measures, including measures to protect the Customer Personal Data against the risks of a Security Breach; and
(f) ensure that any persons authorised by bookinglab to process Customer Personal Data are obliged to keep such data confidential.
3.3 bookinglab shall, without undue delay after discovering any Security Breach or any failure or defect in security which leads, or might reasonably be expected to lead, to a Security Breach (together a "Security Issue") notify the Customer of the same.
3.4 Where a Security Issue arises, bookinglab shall:
(a) as soon as reasonably practicable, provide the Customer with details of the Security Issue, the actual or expected consequences of it, and the measures taken or proposed to be taken to address or mitigate it;
(b) co-operate with the Customer, and provide the Customer with all reasonable assistance in relation to the Security Issue; and
(c) unless required by Applicable Law, not make any notifications to a DP Regulator or any Data Subjects about the Security Issue without the Customer's prior writte...
Processing and security. 3.1 In performing its obligations under this Agreement, Field Dynamics shall only process the categories of Personal Data and only in respect of the categories of Data Subjects, and only for the nature and purposes of processing and duration, as is set out in the Annex to this Schedule or as necessary to perform its obligations under this Agreement, save as otherwise required by any Applicable law.
3.2 In processing the Personal Data, Field Dynamics shall:
a) process Personal Data only in accordance with the Customer's written instructions from time to time (including those set out in this Agreement) except as otherwise required by any Applicable Law;
Processing and security. 4.1. In performing its obligations under this Agreement, Bizagi shall only process the types of Personal Data, and only in respect of the categories of Data Subjects, and only for the nature and purposes of processing and duration, as is set out in the Schedule 1 to this DPA.
4.2. In processing the Customer Personal Data, Bizagi shall:
4.2.1. process Customer Personal Data only in accordance with the Customer's written instructions from time to time (including those set out in this Agreement) unless it is otherwise required by applicable law;
4.2.2. not process the Customer Personal Data for any purpose other than those set out in this Agreement or otherwise expressly authorised by the Customer;
4.2.3. promptly notify the Customer if it receives a Data Subject Request in respect of Customer Personal Data;
4.2.4. provide the Customer with its all reasonable co-operation and assistance in relation to any Data Subject Request in respect of Customer Personal Data;
4.2.5. utilise appropriate technical and organisational measures to facilitate responding to requests from Data Subjects;
4.2.6. not disclose any Customer Personal Data to any Data Subject or to a third party (including any subcontractor or affiliate) other than at the written request of the Customer or as expressly provided for in this Agreement;
4.2.7. considering:
4.2.7.1. the state of the art;
4.2.7.2. the nature, scope, context and purposes of the processing; and
4.2.7.3. the risk and severity of potential harm,
4.3. protect the Customer Personal Data by ensuring that it has in place appropriate technical and organisational measures, including measures to protect the Customer Personal Data against the risks of a Security Breach; and
4.4. ensure that only persons authorised by Bizagi process Customer Personal Data and that such persons are (i) subject to binding obligations to maintain the confidentiality of the Customer Personal Data; and (ii) trained on both (1) the requirements of the Data Protection Laws, and
Processing and security. In performing its obligations under this Agreement, BookingLab shall only process the categories of Personal Data and only in respect of the categories of Data Subjects, and only for the nature and purposes of processing and duration, as is set out in the Annex to this Appendix or as necessary to perform its obligations under this Agreement, save as otherwise required by any Applicable law.
Processing and security. 3.1. The Company shall only process the types of Personal Data, and only in respect of the categories of Data Subjects and types of processing, set out in the Appendix or as otherwise notified by Client.
3.2. In processing the Client Personal Data, the Company shall:
3.2.1 process Client Personal Data only in accordance with Client’s written instructions from time to time unless required to do so by European Union or EU member state law;
3.2.2 not process the Client Personal Data for any purpose other than those set out in this Addendum or otherwise expressly authorised by Client;
3.2.3 notify Client within 24 hours if it receives a Data Subject Request in respect of Client Personal Data;
3.2.4 provide Client with its full co-operation and assistance in relation to any Data Subject Request;
3.2.5 not disclose any Client Personal Data to any Data Subject or to a third party other than at the written request of Client;
3.2.6 clearly mark or identify Client Personal Data as belonging to Client;
3.2.7 protect the Client Personal Data by ensuring that it meets the requirements of Data Protection Laws and that the protection of the rights of Data Subjects under Data Protection Laws are ensured, including:
(1) ensuring that any computer system on which personal data is stored or processed is controlled by password which is kept confidential; and
(2) measures to protect the personal data against the risks of a security breach; and
3.2.8 ensure that only persons authorised process Client Personal Data.
3.3. The Company shall, without undue delay and in any event within 24 hours, in the event of any failure or defect in security that leads, or might reasonably be expected to lead, to a Security Breach (together a “Security Issue”) notify Client.
3.4. Where a Security Issue arises, the Company shall:
3.4.1 as soon as reasonably practicable, provide Client with full details of the Security Issue, the actual or expected consequences of it, and the measures taken or proposed to be taken to address or mitigate it;
3.4.2 co-operate with Client, and provide Client with all reasonable assistance in relation to the Security Issue; and
3.4.3 unless required by applicable law, not make any notifications to a DP Regulator or Data Subjects about the Security Issue without Client prior written consent (not to be unreasonably withheld or delayed).
Processing and security. 1In performing its obligations under this Agreement, the Processor shall only process the types of personal data, and only in respect of the categories of data subjects, and only for the nature and purposes of processing and duration, as is set out in the Schedule 1 to this Agreement.
Processing and security. 3.1 In performing its obligations under this Agreement, Miso shall only process the categories of Personal Data and only in respect of the categories of Data Subjects, and only for the nature and purposes of processing and duration, as is set out in the Annex to this Schedule or as necessary to perform its obligati ons under this Agreement, save as otherwise required by any Applicable law.
3.2 In processing the Personal Data, Miso shall:
a) process Personal Data only in accordance with the Customer's written instructions from time to time (including those set out in this Agreement) except as otherwise required by any Applicable Law;
b) not process the Personal Data for any purpose other than those set out in the Annex and as necessary toperform its obligations under this Agreementunless otherwise expressly authorised by the Customer;
