Processing of Controller Personal Data. 3.1 Processor and each Processor Affiliate shall:
3.1.1 comply with all applicable Data Protection Laws in the Processing of Controller Personal Data; and
3.1.2 not Process Controller Personal Data other than on the relevant Controller Group Member’s written instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Processor or the relevant Processor Affiliate shall to the extent permitted by Applicable Laws inform the relevant Controller Group Member of that legal requirement before the relevant Processing of that Controller Personal Data.
3.2 Each Controller Group Member:
3.2.1 instructs Processor and each Processor Affiliate (and authorizes Processor and each Processor Affiliate to instruct each Subprocessor and each Subprocessor Affiliate) to:
3.2.1.1 Process Controller Personal Data; and
3.2.1.2 in particular, transfer Controller Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Agreement, Applicable Laws, and this Addendum;
3.2.2 warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the instruction set out in section 3.2.1 on behalf of each relevant Controller Affiliate;
3.2.3 warrants and represents that all of its instructions to any Contracted Processor will, at all times, comply with Data Protection Laws.
3.3 Annex 1 to this Addendum sets out certain information regarding the Contracted Processors' Processing of the Controller Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Controller may, upon 60 days prior written notice, make reasonable amendments to Annex 1 by written notice to Processor from time to time as Controller reasonably considers necessary to meet those requirements.
Processing of Controller Personal Data. 2.1. Processor shall not Process Controller Personal Data other than on the Controller’s documented reasonable and customary instructions as specified in the Agreement or this DPA, unless such Processing is required by Applicable Laws to which the Processor is subject or as strictly necessary for the provision of Processor's services under the Agreement.
2.2. Controller instructs Processor (and authorizes Processor to instruct each Sub Processor) to (i) Process Controller Personal Data; and (ii) in particular, transfer Controller Personal Data to any country or territory, all as reasonably necessary for the provision of the Services and consistent with the Agreement and in accordance with Applicable Laws.
2.3. Furthermore, Controller warrants and represents that it is and will remain duly and effectively authorized to give the instruction set out in Section 2.1 and any additional instructions as provided pursuant to the Agreement and/or in connection with the performance thereof, on behalf of itself and each relevant Controller Affiliate, at all relevant times and at least for as long as the Agreement is in effect and for any additional period during which Processor is lawfully processing the Controller Personal Data.
2.4. Controller sets forth the details of the Processing of Controller Personal Data, as required by article 28(3) of the GDPR in Annex 1 (Details of Processing of Controller Personal Data) hereto.
2.5. Without derogating from the provisions of the Agreement, solely Controller (and not Processor) shall be liable for any excess Controller Personal Data provided or otherwise made available to Processor or any Sub Processor in the course of providing Processor's Services under the Agreement or this DPA. Processor's obligations under the Agreement or this DPA shall not apply to any such excess Controller Personal Data.
Processing of Controller Personal Data. 3.1. The Processor shall only process Controller Personal Data for the purposes of the Order Form. The Processor shall not process, transfer, modify, amend or alter the Controller Personal Data or disclose or permit the disclosure of the Controller personal data to any third party other than in accordance with Controller’s documented instructions, unless processing is required by EU or Member State law to which Processor is subject. The Processor shall, to the extent permitted by such law, inform the Controller of that legal requirement before processing the Personal Data and comply with the Controller’s instructions to minimize, as much as possible, the scope of the disclosure.
3.2. For the purposes set out in section above, the Controller hereby instructs the Processor to transfer Controller Personal Data to the recipients in the Third Countries listed in Annex 3 (Authorized Transfers of Controller Personal Data), always provided that Processor shall comply with section 6 (Sub-Processing).
Processing of Controller Personal Data. 2.1. Processor shall Process Controller Personal Data on Controller's behalf and at Controller's instructions as specified in the Agreement and in this DPA, including without limitation with regard to transfers of Controller Personal Data to a third country or international organization. Any other Processing shall be permitted only in the event that such Processing is required by any Data Protection Laws to which the Processor is subject. In such event, Processor shall, unless prohibited by such Data Protection Laws on important grounds of public interest, inform Controller of that requirement before engaging in such Processing.
Processing of Controller Personal Data. 4.1. Velsera and each Velsera Affiliate shall:
4.1.1. comply with all applicable Data Protection Laws in the Processing of Controller Personal Data; and
4.1.2. not Process Controller Personal Data other than on the relevant Controller’s documented instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Velsera or the relevant Velsera Affiliate shall to the extent permitted by Applicable Laws inform the relevant Controller of that legal requirement before the relevant Processing of that Personal Data.
4.2. Each Controller instructs Xxxxxxx and each Velsera Affiliate (and authorises Velsera and each Velsera Affiliate to instruct each Subprocessor) to:
4.2.1. Process Controller Personal Data; and in particular, transfer Controller Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Agreement; and
4.2.2. warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in section 4.2.1 on behalf of each relevant Client Affiliate.
4.3. Annex I to Attachment 1 of this DPA sets out certain information regarding the Contracted Processors' Processing of the Controller Personal Data as required by article 28(3) of the GDPR (and, possibly, equivalent requirements of other Data Protection Laws). Controller may make reasonable amendments to Annex I of Attachment 1 by written notice to Xxxxxxx from time to time as Controller reasonably considers necessary to meet those requirements. Nothing in Annex I to Attachment 1 (including as amended pursuant to this section 4.3) confers any right or imposes any obligation on any party to this DPA.
4.4. The Parties acknowledge that some Velsera companies, specifically PierianDx, Inc. and UgenTec NV, may use anonymized and aggregate data, such as data generated by Velsera for the purposes below. Strictly related to these purposes, Velsera may also provide the anonymized and aggregate data to third parties, it being noted that Velsera is solely responsible to ensure full compliance thereof with Applicable Laws. As these anonymized and aggregate data cannot in any manner be linked to a corresponding data subject, these data do not constitute Personal Data in the context of the Agreement. The other provisions of this DPA do not apply to these anonymized and aggregate data. After the data has been fully anonymiz...
Processing of Controller Personal Data. 3.1. Processor shall Process Controller Personal Data on Controller's behalf and at Controller's instructions as specified in the Agreement and in this DPA, including without limitation, with regard to transfers of Controller Personal Data to a third country or international organization and to other controllers, who may process Controller Personal Data at their discretion. Controller's approval of partners or publishers that are designated as controllers (including via email) shall constitute Controller's instructions to transfer Controller Personal Data to such other controllers in accordance with this section. Any other Processing shall be permitted only in the event that such Processing is required by any Data Protection Laws to which the Processor is subject. In such event, Processor shall, unless prohibited by such Data Protection Laws on important grounds of public interest, inform Controller of that requirement before engaging in such Processing.
3.2. Controller instructs Processor (and authorizes Processor to instruct each Sub Processor) (i) to Process Controller Personal Data for the provision of the services, as detailed in the Agreement ("Services") and as otherwise set forth in the Agreement and in this DPA, and/or as otherwise directed by Controller; (ii) where Controller has approved engagement with partners or publishers designated as controllers, to transfer Controller Personal Data to such approved controllers; and
Processing of Controller Personal Data. 2.1 The Processor shall:
2.1.1 comply with all applicable Data Protection Laws in the Processing of Controller Personal Data; and
2.1.2 not Process Controller Personal Data other than on the Controller’s documented instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case the Processor shall to the extent permitted by Applicable Laws inform the Controller of that legal requirement before the relevant Processing of that Personal Data.
Processing of Controller Personal Data. 2.1. The Controller instructs the Processor to process Controller Personal Data.
2.2. The Processor shall treat personal data as confidential and the Processor shall not process Controller Personal Data other than on the Controller’s documented reasonable and customary instructions as specified in the Agreement or this Addendum, unless such processing is required by Applicable Data Protection Law.
2.3. The Processor shall inform the Controller if, in its opinion, an instruction from the Controller infringes any Applicable Data Protection Law.
2.4. The details of the processing of Controller Personal Data are set out in Schedule 1.
Processing of Controller Personal Data. 3.1 The Processor shall only process Controller Personal Data for the purposes of the Principal Agreement. The Processor shall not process, transfer, modify, amend or alter the Controller Personal Data or disclose or permit the disclosure of the Controller personal data to any third party other than in accordance with Controller’s documented instructions, unless processing is required by EU or Member State law to which Processor is subject. The Processor shall, to the extent permitted by such law, inform the Controller of that legal requirement before processing the Personal Data and comply with the Controller’s instructions to minimize, as much as possible, the scope of the disclosure.
3.2 For the purposes set out in section above, the Controller hereby instructs the Processor to transfer Controller Personal Data to the recipients in the Third Countries listed in Annex 3 (Authorised Transfers of Controller Personal Data), always provided that Processor shall comply with section Sub-P.
Processing of Controller Personal Data. (a) The Processor shall only process Controller Personal Data as reasonably necessary for the provision of the Services and consistent with the Agreement and for the purposes described in the Agreement and its related SOWs (“Permitted Purpose”). The Processor shall not process, transfer, modify, amend or alter the Controller Personal Data or disclose or permit the disclosure of the Controller Personal Data to any third party other than in accordance with this GDPR DPA or Controller’s documented instructions, unless processing is required by EU or Member State law, or US laws to which Processor is subject. The Processor shall, to the extent permitted by such law, inform the Controller of that legal requirement before processing the Personal Data and comply with the Controller’s instructions to minimize, as much as possible, the scope of the disclosure.
(b) The Processor may transfer Controller Personal Data to recipients in the Third Countries only in accordance with this GDPR DPA (which acts as the Controller’s written instructions) or as otherwise instructed by the Controller in writing.
