Processor Obligations 4.1 The Processor may collect, process or use Personal Data only within the scope of this DPA.
Sub-processor Obligations MailChimp shall: (i) enter into a written agreement with the Sub-processor imposing data protection terms that require the Sub-processor to protect the Customer Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause MailChimp to breach any of its obligations under this DPA.
Subprocessors Provider shall enter into written agreements with all Subprocessors performing functions for the Provider in order for the Provider to provide the Services pursuant to the Service Agreement, whereby the Subprocessors agree to protect Student Data in a manner no less stringent than the terms of this DPA.
Contractor Obligations The Contractor is responsible for fully meeting all Contract obligations set forth in the OGS Centralized Contract and for providing services in accordance with the Contract and any Authorized User Agreement, Statement of Work or Purchase Order.
Subprocessor For the purposes of this DPA, the term “Subprocessor” (sometimes referred to as the “Subcontractor”) means a party other than LEA or Provider, who Provider uses for data collection, analytics, storage, or other service to operate and/or improve its service, and who has access to Student Data.
Interconnection Customer Obligations The Interconnection Customer shall maintain the Large Generating Facility and the Interconnection Customer’s Interconnection Facilities in a safe and reliable manner and in accordance with this LGIA.
CONTRACTOR OBLIGATION Contractor shall identify and mark the precise portion(s) of the relevant page(s) of any records provided to Enterprise Services that Contractor believes are statutorily exempt from disclosure and identify the precise statutory basis for exemption from disclosure. In addition, if, in Contractor’s judgment, certain portions of such records are not statutorily exempt from disclosure but are sensitive because particular portions of Contractor’s records (NOT including pricing) include highly confidential, proprietary, or trade secret information (or the equivalent) that Contractor protects through the regular use of confidentiality or similar agreements and routine enforcements through court enforcement actions, Contractor shall identify and mark the precise portion(s) of the relevant page(s) of any records that include such sensitive information.
Operator Obligations 2.01 The Operator shall:
LESSOR OBLIGATIONS 3.1 - The Lessor shall furnish to the Lessee and pay the cost of the following:
Processor’s Obligations Except where expressly permitted by Article 28 (3)(a) GDPR, Processor shall process data subjects’ Data only within the scope of the Agreement and the instructions issued by Controller. Where Processor believes that an instruction would be in breach of applicable law, Processor shall notify Controller of such belief without undue delay. Processor shall be entitled to suspend performance on such instruction until Controller confirms or modifies such instruction. Processor shall, within Processor’s scope of responsibility, organize Processor’s internal organization so it satisfies the specific requirements of data protection. Processor shall implement technical and organizational measures to ensure the adequate protection of Controller’s Data, which measures shall fulfil the requirements of the GDPR and specifically its Article 32. Processor shall implement technical and organizational measures and safeguards that ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services and shall implement a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. Controller is familiar with these technical and organizational measures, and it shall be Controller’s responsibility that such measures ensure a level of security appropriate to the risk. The parties agree to refer to the existing certification of Processor by Kiwa International Cert GmbH in accordance with DIN ISO/IEC 27001:2015 which is considered sufficient evidence for these purposes by Controller and which is available on the website of Processor (xxx.xxxxxxx.xxx). Processor reserves the right to modify the measures and safeguards implemented, provided, however, that that the level of security shall not be less protective than initially agreed upon. Processor shall support Controller, insofar as is agreed upon by the parties, and where possible for Processor, in fulfilling data subjects’ requests and claims, as detailed in chapter III of the GDPR and in fulfilling the obligations enumerated in Articles 33 to 36 GDPR. Processor shall ensure that all employees involved in Contract Processing of Controller’s Data and other such persons as may be involved in Contract Processing within Processor’s scope of responsibility shall only do so within the scope of the instructions. Furthermore, Processor shall ensure that any person entitled to process Data on behalf of Controller has undertaken a commitment to confidentiality under terms similar to the confidentiality terms of the Agreement. All such confidentiality obligations shall survive the termination or expiration of such Contract Processing. Processor shall notify Controller without undue delay if Processor becomes aware of any Data breaches within Processor’s scope of responsibility. Processor shall implement the measures necessary for securing Data and for mitigating potential negative consequences for the data subject; the Processor shall coordinate such efforts with Controller without undue delay. Processor shall notify to Controller the point of contact for any issues related to data protection arising out of or in connection with the Agreement. The Exhibit provides for a list of the initially designated persons. Processor shall correct or erase Data if so instructed by Controller and where covered by the scope of the instructions permissible. Where an erasure, consistent with data protection requirements, or a corresponding restriction of processing is impossible, Processor shall, based on Controller’s instructions, and unless agreed upon differently in the Agreement, destroy, in compliance with data protection requirements, all carrier media and other material or return the same to Controller. In specific cases designated by Controller, such Data shall be stored or handed over. The associated cost for doing so and protective measures to put in place shall be agreed upon separately, unless already agreed upon in the Agreement. Processor shall, upon termination of Contract Processing and upon Controller’s instruction, return all Data, carrier media and other materials to Controller or delete the same. Where a data subject asserts any claims against Controller in accordance with Article 82 of the GDPR, Processor shall support Controller in defending against such claims, where possible at Controller’s cost as set out in Section 6 para. 3. § 4Controller’s Obligations Controller shall notify Processor without undue delay, and comprehensively, of any defect or irregularity with regard to provisions on data protection detected by Controller in the results of Processor’s work.
