Common use of DATA PROCESSING TERMS Clause in Contracts

DATA PROCESSING TERMS. 2.1 The parties to this ▇▇▇▇ hereby agree that they must comply with their respective obligations under all Data Protection Legislation, to the extent that the Data Protection Legislation is applicable to any processing of Customer Personal Data in connection with this ▇▇▇▇. 2.2 We acknowledge that, for the purposes of Data Protection Legislation, if we process any Customer Personal Data when performing our obligations under this ▇▇▇▇, you are the controller. You acknowledge that we are the processor of Customer Personal Data. A description of the scope, nature and purpose of processing by us, the duration of the processing and the types of personal data is set out in paragraph 3 of these Data Processing Terms. 2.3 Without prejudice to the generality of paragraph 2.1, you must ensure that you have all necessary appropriate consents and notices in place to enable lawful transfer of the Customer Personal Data to us for the duration and purposes of this ▇▇▇▇ so that we may lawfully use, process and transfer the Customer Personal Data in accordance with this ▇▇▇▇ on your behalf. 2.4 We must, in relation to any Customer Personal Data processed in connection with the provision of Support and the performance of our obligations under the ▇▇▇▇: 2.4.1 only process the Customer Personal Data for the purpose set out in paragraph 3 of these Data Processing Terms and not for any other purpose unless we are acting on your documented written instructions or where otherwise required to do so by the laws of Australia, the European Union, the United States or by any laws applicable to us (Applicable Law). Where we are relying on Applicable Law as the basis for processing Customer Personal Data, we will notify you of this reliance before performing the processing required by the Applicable Law (unless prohibited by such Applicable Law); 2.4.2 ensure that we have in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, Customer Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Customer Personal Data, 2.4.3 ensure that all personnel who have access to and/or process personal data are obliged to keep the Customer Personal Data confidential; 2.4.4 ensure we take such measures required pursuant to the Privacy Act, Article 32 of the GDPR and all other applicable Data Protection Legislation; 2.4.5 at your expense, assist you in responding to any request from a data subject and in ensuring compliance with your obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; 2.4.6 notify you without as soon as reasonably practicable after becoming aware of a personal data breach in relation to the Customer Personal Data; 2.4.7 on your written direction, delete or return the Customer Personal Data and copies thereof to you on termination of this ▇▇▇▇ unless required by Applicable Law to retain and store the Customer Personal Data; and 2.4.8 maintain complete and accurate records and information to demonstrate our compliance with these Data Processing Terms and allow for audits, including inspections by you or your designated auditor and as soon as reasonably practicable inform you if, in our opinion, an instruction infringes the applicable Data Protection Legislation. 2.5 You warrant and undertake that any processing of Customer Personal Data which is, or may occur in accordance with this ▇▇▇▇ has a lawful basis and that any such Personal Data may properly be processed in accordance with the terms of this ▇▇▇▇. 2.6 You agree that we may appoint such sub-processors to process the Customer Personal Data as we deem appropriate for the proper performance of the ▇▇▇▇, provided that we impose contractual obligations on the sub-processor which are no less onerous 2.7 Without prejudice to the generality of any other provisions of the ▇▇▇▇, we may revise these Data Processing Terms by replacing them with any applicable controller to processor standard clauses or similar terms from time to time (which will apply when replaced by attachment to this ▇▇▇▇).

DATA PROCESSING TERMS. 2.1 1.1 The parties to this ▇▇▇▇ hereby agree that they must shall comply with their respective obligations under all the Data Protection Legislation, to the extent that the Data Protection Legislation is applicable to any processing of Customer Personal Data in connection with this ▇▇▇▇. 2.2 1.2 We acknowledge that, for the purposes of Data Protection Legislation, , if we process any Customer Personal Data when performing our obligations under this ▇▇▇▇, you are the controller. You acknowledge that we are the processor of Customer Personal Data. A general description of the scope, nature and purpose of processing by us, the duration of the processing and the types of personal data is set out in paragraph 3 2 of these Data Processing Termsthis Schedule. 2.3 1.3 Without prejudice to the generality of paragraph 2.11.1, you must shall ensure that you have all necessary appropriate consents and notices in place to enable lawful transfer of the Customer Personal Data to us for the duration and purposes of this ▇▇▇▇ so that we may lawfully use, process and transfer the Customer Personal Data in accordance with this ▇▇▇▇ on your behalf. 2.4 1.4 We mustshall, in relation to any Customer Personal Data processed in connection with the provision of Support and the performance of our obligations under the ▇▇▇▇: 2.4.1 1.4.1 only process the Customer Personal Data for the purpose set out in paragraph 3 2 of these Data Processing Terms this Schedule and not for any other purpose unless we are acting on your documented written instructions or where otherwise required to do so by the laws of Australia, any member of the European Union, the United States Union or by any the laws of the European Union applicable to us (Applicable Law). Where we are relying on Applicable Law as the basis for processing Customer Personal Data, we will shall notify you of this reliance before performing the processing required by the Applicable Law (unless prohibited by such Applicable Law); 2.4.2 1.4.2 ensure that we have in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, Customer Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Customer Personal Data,, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Customer Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it); 2.4.3 1.4.3 ensure that all personnel who have access to and/or process personal data are obliged to keep the Customer Personal Data confidential; 2.4.4 1.4.4 ensure we take such measures required pursuant to the Privacy Act, Article 32 of the GDPR and all other applicable Data Protection LegislationGDPR; 2.4.5 1.4.5 at your expense, assist you in responding to any request from a data subject and in ensuring compliance with your obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; 2.4.6 1.4.6 notify you without as soon as reasonably practicable after undue delay on becoming aware of a personal data breach in relation to the Customer Personal Data; 2.4.7 on 1.4.7 at your written direction, delete or return the Customer Personal Data and copies thereof to you on termination of this ▇▇▇▇ unless required by Applicable Law to retain and store the Customer Personal Data; and 2.4.8 1.4.8 maintain complete and accurate records and information to demonstrate our compliance with these Data Processing Terms this Schedule and allow for audits, including inspections by you or your designated auditor and as soon as reasonably practicable immediately inform you if, in our opinion, an instruction infringes the applicable Data Protection Legislation. 2.5 1.5 You warrant and undertake that any processing of Customer Personal Data which is, is or may occur in accordance with this ▇▇▇▇ has a lawful basis and that any such Personal Data may properly be processed in accordance with the terms of this ▇▇▇▇. 2.6 1.6 You agree that we may appoint such sub-processors to process the Customer Personal Data as we deem appropriate for the proper performance of the ▇▇▇▇, provided that we shall impose contractual obligations terms on the sub-processor which are no less onerousonerous than those set out in this Schedule. We shall inform you of any intended changes concerning the addition or replacement of third-party processors, giving you the opportunity to object to such changes. 2.7 1.7 We confirm that we have entered or (as the case may be) will enter with any third-party processor(s) into a written agreement substantially on the relevant third-party processor’s standard terms of business or incorporating terms which are substantially similar to those set out in this Schedule 1. 1.8 Without prejudice to the generality of any other provisions of the ▇▇▇▇, we may revise these Data Processing Terms this Schedule by replacing them it with any applicable controller to processor standard clauses or similar terms from time to time (which will shall apply when replaced by attachment to this ▇▇▇▇).

DATA PROCESSING TERMS. 2.1 1.1 The parties to this ▇▇▇▇ hereby agree that they must shall comply with their respective obligations under all the Data Protection Legislation, to the extent that the Data Protection Legislation is applicable to any processing of Customer Personal Data in connection with this ▇▇▇▇. 2.2 1.2 We acknowledge that, for the purposes of Data Protection Legislation, if we process any Customer Personal Data when performing our obligations under this ▇▇▇▇, you are the controller. You controller and you acknowledge that we are the processor of Customer Personal Data. A general description of the scope, nature and purpose of processing by us, the duration of the processing and the types of personal data is set out in paragraph 3 2 of these Data Processing Termsthis Schedule. 2.3 1.3 Without prejudice to the generality of paragraph 2.11.1, you must shall ensure that you have all necessary appropriate consents and notices in place to enable lawful transfer of the Customer Personal Data to us for the duration and purposes of this ▇▇▇▇ so that we may lawfully use, process and transfer the Customer Personal Data in accordance with this ▇▇▇▇ on your behalf. 2.4 1.4 We mustshall, in relation to any Customer Personal Data processed in connection with the provision of Support and the performance of our obligations under the ▇▇▇▇: 2.4.1 1.4.1 only process the Customer Personal Data for the purpose set out in paragraph 3 2 of these Data Processing Terms this Schedule and not for any other purpose unless we are acting on your documented written instructions or where otherwise required to do so by the laws of Australia, any member of the European Union, the United States Union or by any the laws of the European Union applicable to us (Applicable Law). Where we are relying on Applicable Law as the basis for processing Customer Personal Data, we will shall notify you of this reliance before performing the processing required by the Applicable Law (unless prohibited by such Applicable Law); 2.4.2 1.4.2 ensure that we have in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, Customer Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Customer Personal Data,, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Customer Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it); 2.4.3 1.4.3 ensure that all personnel who have access to and/or process personal data are obliged to keep the Customer Personal Data confidential; 2.4.4 1.4.4 ensure we take such measures required pursuant to the Privacy Act, Article 32 of the GDPR and all other applicable Data Protection LegislationGDPR; 2.4.5 1.4.5 at your expense, assist you in responding to any request from a data subject and in ensuring compliance with your obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; 2.4.6 1.4.6 notify you without as soon as reasonably practicable after undue delay on becoming aware of a personal data breach in relation to the Customer Personal Data; 2.4.7 on 1.4.7 at your written direction, delete or return the Customer Personal Data and copies thereof to you on termination of this ▇▇▇▇ unless required by Applicable Law to retain and store the Customer Personal Data; and 2.4.8 1.4.8 maintain complete and accurate records and information to demonstrate our compliance with these Data Processing Terms this Schedule and allow for audits, including inspections inspections, by you or your designated auditor and as soon as reasonably practicable immediately inform you if, in our opinion, an instruction infringes the applicable Data Protection Legislation. 2.5 1.5 You warrant and undertake that any processing of Customer Personal Data which is, is or may occur in accordance with this ▇▇▇▇ has a lawful basis and that any such Personal Data may properly be processed in accordance with the terms of this ▇▇▇▇. 2.6 1.6 You agree that we may appoint such sub-processors to process the Customer Personal Data as we deem appropriate for the proper performance of the ▇▇▇▇, provided that we shall impose contractual obligations terms on the sub-processor which are no less onerousonerous than those set out in this Schedule. We shall inform you of any intended changes concerning the addition or replacement of third-party processors, giving you the opportunity to object to such changes. 2.7 1.7 We confirm that we have entered or (as the case may be) will enter with any third-party processor(s) into a written agreement substantially on the relevant third-party processor’s standard terms of business or incorporating terms which are substantially similar to those set out in this Schedule 1. 1.8 Without prejudice to the generality of any other provisions of the ▇▇▇▇, we may revise these Data Processing Terms this Schedule by replacing them it with any applicable controller to processor standard clauses or similar terms from time to time (which will shall apply when replaced by attachment to this ▇▇▇▇).

DATA PROCESSING TERMS. 2.1 1.1 The parties to this ▇▇▇▇ hereby agree that they must shall comply with their respective obligations under all the Data Protection Legislation, to the extent that the Data Protection Legislation is applicable to any processing of Customer Personal Data in connection with this ▇▇▇▇. 2.2 1.2 We acknowledge that, for the purposes of Data Protection Legislation, if we process any Customer Personal Data when performing our obligations under this ▇▇▇▇, you are the controller. You controller and you acknowledge that we are the processor of Customer Personal Data. A general description of the scope, nature and purpose of processing by us, the duration of the processing and the types of personal data is set out in paragraph 3 2 of these Data Processing Termsthis Schedule. 2.3 1.3 Without prejudice to the generality of paragraph 2.11.1, you must shall ensure that you have all necessary appropriate consents and notices in place to enable lawful transfer of the Customer Personal Data to us for the duration and purposes of this ▇▇▇▇ so that we may lawfully use, process and transfer the Customer Personal Data in accordance with this ▇▇▇▇ on your behalf. 2.4 1.4 We mustshall, in relation to any Customer Personal Data processed in connection with the provision of Support and the performance of our obligations under the ▇▇▇▇: 2.4.1 1.4.1 only process the Customer Personal Data for the purpose set out in paragraph 3 2 of these Data Processing Terms this Schedule and not for any other purpose unless we are acting on your documented written instructions or where otherwise required to do so by the laws of Australia, any member of the European Union, the United States Union or by any the laws of the European Union applicable to us (Applicable Law). Where we are relying on Applicable Law as the basis for processing Customer Personal Data, we will shall notify you of this reliance before performing the processing required by the Applicable Law (unless prohibited by such Applicable Law); 2.4.2 1.4.2 ensure that we have in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, Customer Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Customer Personal Data,, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Customer Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it); 2.4.3 1.4.3 ensure that all personnel who have access to and/or process personal data are obliged to keep the Customer Personal Data confidential; 2.4.4 1.4.4 ensure we take such measures required pursuant to the Privacy Act, Article 32 of the GDPR and all other applicable Data Protection LegislationGDPR; 2.4.5 1.4.5 at your expense, assist you in responding to any request from a data subject and in ensuring compliance with your obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators; 2.4.6 1.4.6 notify you without as soon as reasonably practicable after undue delay on becoming aware of a personal data breach in relation to the Customer Personal Data; 2.4.7 on 1.4.7 at your written direction, delete or return the Customer Personal Data and copies thereof to you on termination of this ▇▇▇▇ unless required by Applicable Law to retain and store the Customer Personal Data; and 2.4.8 1.4.8 maintain complete and accurate records and information to demonstrate our compliance with these Data Processing Terms this Schedule and allow for audits, including inspections by you or your designated auditor and as soon as reasonably practicable immediately inform you if, in our opinion, an instruction infringes the applicable Data Protection Legislation. 2.5 1.5 You warrant and undertake that any processing of Customer Personal Data which is, is or may occur in accordance with this ▇▇▇▇ has a lawful basis and that any such Personal Data may properly be processed in accordance with the terms of this ▇▇▇▇. 2.6 1.6 You agree that we may appoint such sub-processors to process the Customer Personal Data as we deem appropriate for the proper performance of the ▇▇▇▇, provided that we shall impose contractual obligations terms on the sub-processor which are no less onerousonerous than those set out in this Schedule. We shall inform you of any intended changes concerning the addition or replacement of third-party processors, giving you the opportunity to object to such changes. 2.7 1.7 We confirm that we have entered or (as the case may be) will enter with any third-party processor(s) into a written agreement substantially on the relevant third-party processor’s standard terms of business or incorporating terms which are substantially similar to those set out in this Schedule 1. 1.8 Without prejudice to the generality of any other provisions of the ▇▇▇▇, we may revise these Data Processing Terms this Schedule by replacing them it with any applicable controller to processor standard clauses or similar terms from time to time (which will shall apply when replaced by attachment to this ▇▇▇▇).