Retention periods, return and destruction of Personal Data Sample Clauses

Retention periods, return and destruction of Personal Data. The Processor may not retain Personal Data for longer than strictly necessary. The statutory retention periods and any retention periods agreed between the Parties as set out in Schedule 1 also qualify as strictly necessary periods. Under no circumstances will the Processor retain Personal Data beyond the end of this Data Processing Agreement. The Controller determines whether data should be retained and, if so, for how long.
Sample 1Sample 2
AutoNDA by SimpleDocs
Retention periods, return and destruction of Personal Data. 11.1 The Processor shall not retain the Personal Data any longer than is strictly necessary and in any case not longer than until the end of this Data Processor Agreement or, if a retention period has been agreed between the Parties, not longer than this period. 11.2 Upon termination of this Data Processor Agreement, or if applicable at the end of the retention periods agreed, or at the written request of the Controller, the Processor shall either immediately destroy the Personal Data or return them to the Controller, at the discretion of the Controller. At the request of the Controller, the Processor shall provide evidence of the fact that the data have been destroyed or removed. If return, destruction or removal is not possible, the Processor shall immediately notify the Controller thereof. In that case the Processor guarantees that he shall treat the Personal Data confidentially and shall no longer process them. 11.3 Upon the end of the Data Processor Agreement the Processor shall inform all third parties involved in the processing of the Personal Data of the termination of the Data Processor Agreement and shall guarantee that all third parties involved will destroy the Personal Data or assign them to the Controller, at the discretion of the Controller. 11.4 If due to technical limitations a full deletion or destruction of the Personal Data is not deemed possible, the Processor shall take all necessary measures to (i) achieve the closest possible approximation of a full and permanent deletion and/or destruction and (ii) anonymise the remaining Personal Data and render them unavailable for further processing. The Processor shall always inform the Controller in writing.
Sample 1
Retention periods, return and destruction of Personal Data. At the end of the Agreement, the data processor undertakes, upon request from the data controller, to return all the data. Once the data is returned, the data processor will attest to its deletion from his systems.
Sample 1
Retention periods, return and destruction of Personal Data. 10.1. The Processor may not retain Personal Data for longer than strictly necessary. The statutory retention periods and any retention periods agreed between the Parties as set out in Schedule 1 also qualify as strictly necessary periods. Under no circumstances will the Processor retain Personal Data beyond the end of this Data Processing Agreement. The Controller determines whether data should be retained and, if so, for how long. 10.2. On termination of the Data Processing Agreement or, where applicable, on expiry of the agreed retention periods, or at the Controller’s written request, the Processor will, at reasonable cost and at the Controller’s option, irreversibly destroy the Personal Data (or cause the Personal Data to be irreversibly destroyed) or return the Personal Data to the Controller. At the Controller’s request the Processor must provide proof that the data have been irreversibly destroyed or deleted. In the event that the data are returned, they must be returned electronically, in a commonly used, structured and documented data format. If it is impossible to return, irreversibly destroy or delete Personal Data, the Processor must notify the Controller of this immediately. In that case the Processor guarantees that it will treat the Personal Data in confidence and will no longer process them.
Sample 1
Retention periods, return and destruction of Personal Data. 12.1. The Processor will not retain the Personal Data any longer than is strictly necessary, including the legal retention periods or any agreement about retention periods made between the Parties. The Controller shall determine whether and, if so, how long data must remain retained. 12.2. On termination of the Processor Agreement or at the end of the agreed retention periods or at the written request of the Controller, the Processor will, at reasonable cost, at the choice of the Controller irrevocably either destroy or return the Personal Data to the Controller or have them destroyed or returned. At the request of the Controller the Processor will produce evidence of the destruction or removal. 12.3. In the event that the data are returned, this will take place electronically in a generally accepted, structured and documented data format. 12.4. If returning the data, irrevocable destruction or removal is impossible, the Processor guarantees that it will treat the Personal Data confidentially and will no longer Process them.
Sample 1

Related to Retention periods, return and destruction of Personal Data

  • RETURN AND DELETION OF PERSONAL DATA 7.1 We shall return to You and, to the extent allowed by applicable law, delete Your Personal Data as set out in the Agreement. We are obliged to ensure that any Sub-processors adhere to the same obligation

  • Obligation after the termination of personal data processing services

  • Data Return and Destruction of Data (a) Protecting PII from unauthorized access and disclosure is of the utmost importance to the EA, and Contractor agrees that it is prohibited from retaining PII or continued access to PII or any copy, summary or extract of PII, on any storage medium (including, without limitation, in secure data centers and/or cloud-based facilities) whatsoever beyond the period of providing Services to the EA, unless such retention is either expressly authorized for a prescribed period by the Service Agreement or other written agreement between the Parties, or expressly requested by the EA for purposes of facilitating the transfer of PII to the EA or expressly required by law. As applicable, upon expiration or termination of the Service Agreement, Contractor shall transfer PII, in a format agreed to by the Parties to the EA. (b) If applicable, once the transfer of PII has been accomplished in accordance with the EA’s written election to do so, Contractor agrees to return or destroy all PII when the purpose that necessitated its receipt by Contractor has been completed. Thereafter, with regard to all PII (including without limitation, all hard copies, archived copies, electronic versions, electronic imaging of hard copies) as well as any and all PII maintained on behalf of Contractor in a secure data center and/or cloud-based facilities that remain in the possession of Contractor or its Subcontractors, Contractor shall ensure that PII is securely deleted and/or destroyed in a manner that does not allow it to be retrieved or retrievable, read or reconstructed. Hard copy media must be shredded or destroyed such that PII cannot be read or otherwise reconstructed, and electronic media must be cleared, purged, or destroyed such that the PII cannot be retrieved. Only the destruction of paper PII, and not redaction, will satisfy the requirements for data destruction. Redaction is specifically excluded as a means of data destruction. (c) Contractor shall provide the EA with a written certification of the secure deletion and/or destruction of PII held by the Contractor or Subcontractors. (d) To the extent that Contractor and/or its subcontractors continue to be in possession of any de-identified data (i.e., data that has had all direct and indirect identifiers removed), they agree not to attempt to re-identify de-identified data and not to transfer de-identified data to any party.

  • Notification of personal data breach 1. In case of any personal data breach, the data processor shall, without undue delay after having become aware of it, notify the data controller of the personal data breach. 2. The data processor’s notification to the data controller shall, if possible, take place within 24 hours after the data processor has become aware of the personal data breach to enable the data controller to comply with the data controller’s obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33

  • Protection of Personal Data 25.1 The Parties agree that they may obtain and have access to personal data for the duration of the Agreement for the fulfilment of the rights and obligations contained herein. In performing the obligations as set out in this Agreement, the Parties shall at all times ensure that: a) they process data only for the express purpose for which it was obtained; b) once processed for the purposes for which it was obtained, all data will be destroyed to an extent that it cannot be reconstructed to its original form; c) data is provided only to authorised personnel who strictly require the personal data to carry out the Parties’ respective obligations under this Agreement; d) they do not disclose personal data of the other Party, other than in terms of this Agreement; e) they have all reasonable technical and organisational measures in place to protect all personal data from unauthorised access and/or use; f) they have appropriate technical and organisational measures in place to safeguard the security, integrity and authenticity of all data in its possession or under its control in terms of this Agreement; g) such personal data is protected against unauthorised or unlawful processing, accidental loss, destruction or damage, alteration, disclosure or access. 25.2 The Parties agree that if personal data will be processed for additional purposes beyond the original purpose for which it was obtained, explicit consent must be obtained beforehand from those persons whose information will be subject to further processing. 25.3 Should it be necessary for either Party to disclose or otherwise make available the personal data to any third party (including sub-contractors and employees), it may do so only with the prior written permission of the other Party. The Party requiring such permission shall require of all such third parties, appropriate written undertakings to be provided, containing similar terms to that set forth in this clause 25, and dealing with that third party's obligations in respect of its processing of the personal data. Following approval by the other Party, the Party requiring permission agrees that the provisions of this clause 25 shall mutatis mutandis apply to all authorised third parties who process personal data. 25.4 The Parties shall ensure that any persons authorized to process data on their behalf (including employees and third parties) will safeguard the security, integrity and authenticity of all data. Where necessary to meet this requirement, the Parties shall keep all personal data and any analyses, profiles, or documents derived therefrom logically separated from all other data and documentation held by it. 25.5 The Parties shall carry out regular assessments to identify all reasonably foreseeable internal and external risks to the personal data in its possession or under its control. The Parties shall implement and maintain appropriate safeguards against the risks which it identifies and shall also regularly verify that the safeguards which it has in place has been effectively implemented. 25.6 The Parties agree that they will promptly return or destroy any personal data in their possession or control which belongs to the other Party once it no longer serves the purpose for which it was collected in relation to this Agreement, subject to any legal retention requirements. This may be at the request of the other Party and includes circumstances where a person has requested the Parties to delete all instances of their personal data. The information will be destroyed in such a manner that it cannot be reconstructed to its original form, linking it to any particular individual or organisation.

  • Return/Destruction of PHI 15.1 Business Associate in connection with the expiration or termination of the contract or grant shall return or destroy, at the discretion of the Covered Entity, all PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity pursuant to this contract or grant that Business Associate still maintains in any form or medium (including electronic) within thirty (30) days after such expiration or termination. Business Associate shall not retain any copies of the PHI. Business Associate shall certify in writing for Covered Entity (1) when all PHI has been returned or destroyed and (2) that Business Associate does not continue to maintain any PHI. Business Associate is to provide this certification during this thirty (30) day period. 15.2 Business Associate shall provide to Covered Entity notification of any conditions that Business Associate believes make the return or destruction of PHI infeasible. If Covered Entity agrees that return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible for so long as Business Associate maintains such PHI. This shall also apply to all Agents and Subcontractors of Business Associate.

  • Certification of Funds; Budget and Fiscal Provisions; Termination in the Event of Non-Appropriation This Agreement is subject to the budget and fiscal provisions of the City’s Charter. Charges will accrue only after prior written authorization certified by the Controller, and the amount of City’s obligation hereunder shall not at any time exceed the amount certified for the purpose and period stated in such advance authorization. This Agreement will terminate without penalty, liability or expense of any kind to City at the end of any fiscal year if funds are not appropriated for the next succeeding fiscal year. If funds are appropriated for a portion of the fiscal year, this Agreement will terminate, without penalty, liability or expense of any kind at the end of the term for which funds are appropriated. City has no obligation to make appropriations for this Agreement in lieu of appropriations for new or other agreements. City budget decisions are subject to the discretion of the Mayor and the Board of Supervisors. Contractor’s assumption of risk of possible non-appropriation is part of the consideration for this Agreement. THIS SECTION CONTROLS AGAINST ANY AND ALL OTHER PROVISIONS OF THIS AGREEMENT.

  • Transfer of Personal Data The Participant authorizes, agrees and unambiguously consents to the transmission by the Company (or any Subsidiary) of any personal data information related to the RSUs awarded under this Agreement for legitimate business purposes (including, without limitation, the administration of the Plan). This authorization and consent is freely given by the Participant.

  • Processing of Personal Data 1.1. With regard to the Processing of Personal Data, You are the controller and determine the purposes and means of Processing of Personal Data You provide to Us (“Controller”) and You appoint Us as a processor (“Processor”) to process such Personal Data (hereinafter, “Data”) on Your behalf (hereinafter, “Processing”). 1.2. The details of the type and purpose of Processing are defined in the Exhibits attached hereto. Except where the DPA stipulates obligations beyond the Term of the Agreement, the duration of this DPA shall be the same as the Agreement Term. 1.3. You shall be solely responsible for compliance with Your obligations under the applicable Data Protection Laws, including, but not limited to, the lawful disclosure and transfer of Personal Data to Us by upload of source data into the Cloud Service or otherwise. 1.4. Processing shall include all activities detailed in this Agreement and the instructions issued by You. You may, in writing, modify, amend, or replace such instructions by issuing such further instructions to the point of contact designated by Us. Instructions not foreseen in or covered by the Agreement shall be treated as requests for changes. You shall, without undue delay, confirm in writing any instruction issued orally. Where We believe that an instruction would be in breach of applicable law, We shall notify You of such belief without undue delay. We shall be entitled to suspend performance on such instruction until You confirm or modify such instruction. 1.5. We shall ensure that all personnel involved in Processing of Customer Data and other such persons as may be involved in Processing shall only do so within the scope of the instructions. We shall ensure that any person Processing Customer Data is subject to confidentiality obligations similar to the confidentiality terms of the Agreement. All such confidentiality obligations shall survive the termination or expiration of such Processing.

  • Complete Disposal Upon Termination of Service Agreement Upon Termination of the Service Agreement Provider shall dispose or delete all Student Data obtained under the Service Agreement. Prior to disposition of the data, Provider shall notify LEA in writing of its option to transfer data to a separate account, pursuant to Article II, section 3, above. In no event shall Provider dispose of data pursuant to this provision unless and until Provider has received affirmative written confirmation from LEA that data will not be transferred to a separate account.

Draft better contracts in just 5 minutes Get the weekly Law Insider newsletter packed with expert videos, webinars, ebooks, and more!