Processing of Company Personal Data. 2.1 Processor shall:
2.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
2.1.2 not Process Company Personal Data other than on the relevant Company’s documented instructions.
2.2 The Company instructs Processor to process Company Personal Data.
Processing of Company Personal Data. 3.1 Vendor and each Vendor Affiliate shall:
3.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
3.1.2 not Process Company Personal Data other than on the relevant Company Group Member’s documented instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Vendor or the relevant Vendor Affiliate shall to the extent permitted by Applicable Laws inform the relevant Company Group Member of that legal requirement before the relevant Processing of that Personal Data.
3.2 Each Company Group Member:
3.2.1 instructs Vendor and each Vendor Affiliate (and authorises Vendor and each Vendor Affiliate to instruct each Subprocessor) to:
3.2.1.1 Process Company Personal Data; and
3.2.1.2 in particular, transfer Company Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Agreement; and
3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in section 3.2.1 on behalf of each relevant Company Affiliate.
3.3 Annex 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Company Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Company may make reasonable amendments to Annex 1 by written notice to Vendor from time to time as Company reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any right or imposes any obligation on any party to this Addendum.
Processing of Company Personal Data. 3.1 Vendor and each Vendor Affiliate shall:
3.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
3.1.2 not Process Company Personal Data other than on the relevant Company Group Member’s documented instructions, unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Vendor or the relevant Vendor Affiliate shall to the extent permitted by Applicable Laws inform the relevant Company Group Member of that legal requirement before the relevant Processing of that Personal Data. The relevant Company Group Member’s documented instructions include processing in accordance with the Principal Agreement; no additional instructions are required for such processing.
3.2 Each Company Group Member:
3.2.1 instructs Vendor and each Vendor Affiliate (and authorises Vendor and each Vendor Affiliate to instruct each Subprocessor) to:
3.2.1.1 Process Company Personal Data; and
3.2.1.2 in particular, transfer Company Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Agreement; and
3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in section 3.2.1 on behalf of each relevant Company Affiliate.
3.3 Annex 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Company Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Company may make reasonable amendments to Annex 1 by written notice to Vendor from time to time as Company reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any right or imposes any obligation on any party to this Addendum.
Processing of Company Personal Data. 3.1. Vendor and each Vendor Affiliate shall:
3.1.1. comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
3.1.2. not Process Company Personal Data other than on the relevant Company Group Member’s documented instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Vendor or the relevant Vendor Affiliate shall to the extent permitted by Applicable Laws inform the relevant Company Group Member of that legal requirement before the relevant Processing of that Personal Data.
Processing of Company Personal Data. 2.1 The Processor will:
(a) comply with all applicable Data Protection Laws in the Processing of Personal Data; and
(b) not Process Personal Data other than on the Controller’s documented instructions (including those instructions given under clause 2.2) unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case the Contracted Processor, shall to the extent permitted by Applicable Laws inform the Controller of that legal requirement before the relevant Processing of that Personal Data.
2.2 The Controller instructs the Contracted Processor (and authorises them to instruct each Subprocessor) to:
(a) process the Personal Data; and
(b) transfer the Personal Data to any country or territory, as reasonably necessary for the provision of the Services.
2.3 Schedule 1 sets out certain information regarding the Contracted Processors' Processing of the Personal Data as required by article 28(3) of the GDPR (and, where relevant, equivalent requirements of other Data Protection Laws). The parties may agree from time to time to amend Schedule 1 as necessary to meet those requirements.
Processing of Company Personal Data. Annex I.B below sets out certain information regarding Securonix’s Processing of the Company Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Company may make reasonable amendments to Annex I.B by written notice to Securonix from time to time as Company reasonably considers necessary to meet those requirements. Nothing in Annex I.B (including as amended pursuant to this section) confers any right or imposes any obligation on any party to this DPA.
Processing of Company Personal Data. 2.1 Vendor shall:
2.1.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
2.1.2 not Process Company Personal Data other than on the relevant documented instructions from Company unless Processing is required by Applicable Laws to which Vendor is subject, in which case Vendor shall to the extent permitted by Applicable Laws inform the Company of that legal requirement before the relevant Processing of that Personal Data.
2.2 Company shall:
2.2.1 instruct Vendor (and authorises Vendor to instruct each Subprocessor) to:
2.2.1.1 Process Company Personal Data; and
2.2.1.2 in particular, transfer Company Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Agreement; and
2.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in section 2.2.1.
2.3 Annex 1 to this Addendum sets out certain information regarding the Subprocessors’ Processing of the Company Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Company may make reasonable amendments to Annex 1 by written notice to Vendor strictly to the extent necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this section 3.3) confers any right or imposes any obligation on any party to this Addendum.
Processing of Company Personal Data. Capture and Processing of Personal Data in order to initiate single or recurring payments for the benefit of Company using one or more payment service providers. Capture and Processing of Personal Data required to identify and match data subjects to one off or recurring payments made to Company using one or more payment service providers. Capture and Processing of Personal Data required to identify and match data subjects to one off or recurring payments made to Company using one or more payment service providers. Capture and Processing of Personal Data required for Gift Aid declaration towards HMRC if so instructed by Company. Capture and Processing of Personal Data needed in order to inform Company and/or Data subject about the status of a payment, including failed, refunded or reversed payments. Capture and Processing of Personal Data to select the optimal payment method and timing to initiate payments or retry failed, refunded or reversed payments.
Processing of Company Personal Data. 3.1. Each Contracted Vendor shall:
3.1.1. comply with all Applicable Laws in the Processing of Company Personal Data;
3.1.2. if required by GDPR Article 30, maintain a record of all Processing activities carried out on Company Personal Data; and
3.1.3. only Process Company Personal Data as instructed by the relevant Company Group Member, unless such Processing is required by Applicable Laws in which case the Contracted Vendor shall inform the Company Group Member of that legal requirement (to the extent permitted by the Applicable Laws) before Processing that Company Personal Data, or unless such instruction is, in the Contracted Vendor’s good faith belief, violative of Applicable Laws, in which case the Contracted Vendor will immediately notify Company that it is unable to comply with said instruction.
3.2. Each Company Group Member hereby:
3.2.1. instructs Contracted Vendor, only as necessary to provide, and in furtherance of, the Services, to:
3.2.1.1. Process Company Personal Data; and
3.2.1.2. transfer Company Personal Data to any country or territory, provided that, if necessary, an Appropriate Safeguard is in place before any such transfer takes place;
3.2.2. agrees that it shall, at all times relevant to this Agreement, comply with all Applicable Laws;
3.2.3. represents and warrants that it is and will at all relevant times remain duly and effectively authorized to give the instruction set out in Section 3.2.1 on behalf of each relevant Company Affiliate; and
3.2.4. represents and warrants that it will determine an appropriate legal basis, or bases, for the Processing of Company Personal Data which is necessary to perform the Services, and will upon request by Vendor provide proof of the legal basis/bases for processing, as well as compliance with Applicable Laws.
3.3. Pursuant to GDPR Article 28(3), Company agrees that the descriptions of i) the subject matter, duration, nature and purpose of Processing, ii) the types of Company Personal Data to be Processed, and iii) the categories of Data Subjects within the Company Personal Data to be Processed under this Agreement, are sufficiently specified in the Contracted Vendor’s technical documentation as received by Company and within Annex 1, attached to this Agreement. Company will notify the Contracted Vendor with respect to any revisions to such descriptions that may be required regarding the Company Personal Data. Upon written notice to Company, the Vendor may make reasonable revisions to such des...
Processing of Company Personal Data. 2.1 The Company instructs the Data Processor to process Company Personal Data in order for the Data Processor to provide the functionality of the Services.
2.2 The Data Processor shall:
2.2.1 comply with all applicable Data Protection Laws in the Processing of Company Personal Data;
2.2.2 not Process Company Personal Data except to execute the published functionality of the Services; and
2.2.3 process the Company Personal Data only on documented instructions from the controller, including those provided in Section 2.1.
2.3 The Data Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Data Protection Laws.
2.4 The types of Company Personal Data to be processed consist of whatever types of Company Personal Data the Company chooses to put into the apps to which the Services relate, provided those types of Company Personal Data are compatible with the published functionality of the apps.
2.5 The categories of Data Subject whose Company Personal Data may be processed include all categories whose Company Personal Data the Company chooses to put into the apps to which the Services relate, provided that the use of those Company Personal data is compatible with the published functionality of the apps.
