Common use of The General Data Protection Regulation Clause in Contracts

The General Data Protection Regulation. 7.1. In the course of delivery of the services outlined within the dedicated Hoople Schools portal, it may be necessary for the Service Provider to process personal information relating to the Establishment. The Service Provider guarantees that it will implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the General Data Protection Regulation (‘GDPR’) and ensure the protection of the rights of the data subject. 7.2. In order to provide the services under this agreement, it may be necessary to process personal data. The type of personal data which we may process includes employment and financial information. We will only process personal data for the purpose of providing the services requested and we will only process this information during the term of this agreement. The data subjects whose personal information it may be necessary to process includes school staff responsible for complying with the obligations under this agreement, staff members, governors, parents, pupils and other persons who may come into contact with the school from time to time. 7.3. The personal data processed for the delivery of the services will be retained by the Service Provider only for the period specified in the Establishment’s data retention policy. 7.4. In providing the services, the Service Provider will process personal data only on written instructions from the Establishment, including with regard to transfers of personal data to a third country or an international organisation unless the processing is required to comply with a legal obligation. If such a legal obligation arises, the Service Provider will notify the Establishment before processing unless prohibited from doing so by law. 7.5. The Service Provider will ensure that persons authorised to process the personal data have committed themselves to confidentiality. 7.6. The Service Provider will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the personal data being processed. 7.7. The Service Provider will not engage another processor without the authorisation of the Establishment. Where such authorisation is given by the Establishment, the Service Provider will enter into a contract with the sub-processor imposing the same processing obligations as required between the Service Provider and the Establishment. 7.8. The Service Provider will assist the Establishment, to the extent required by the GDPR, in providing subject access and allowing data subjects to exercise their legal rights under the GDPR. 7.9. The Service Provider will assist the Establishment, to the extent required by the GDPR, in ensuring compliance with its obligations in relation to security of processing, the notification of personal data breaches and data protection impact assessments. 7.10. At the conclusion of the services provided under this agreement, the Service Provider will either delete or return all of the personal data to the Establishment relating to processing, and delete existing copies unless storage of the personal data is required by law. 7.11. The Service Provider will make available to the Establishment all information necessary to demonstrate compliance with the processing obligations laid down in Article 28 of the GDPR, and allow for and contribute to audits, including inspections, conducted by the Establishment or another auditor mandated by the Establishment. 7.12. The Service Provider shall immediately inform the Establishment if, in its opinion, an instruction infringes this GDPR or other data protection laws. 7.13. Service Provider point of contact for GDPR: Xxxxxxxx Xxxxx (Business Change Manager) Contact details: xxxx.xxxxxxxxxx@xxxxxxxxx.xx.xx