Subcontracting relationships. 11.1. The Processor is only permitted to commission subcontractors for the Controller’s data processing with the Controller’s prior written consent. This approval shall be given by the authorized person or representative in writing (electronically or in paper), but not verbally. 11.2. The Processor shall conclude subcontracting agreements in writing. This form of requirement is also met if it is in electronic format. 11.3. The Processor shall ensure that the subcontractor(s) are obliged in the subcontracting agreement to provide a standard in writing that does not fall short of the standard agreed herein. Furthermore, the Processor ensures that the responsibilities between Processor and subcontractor and also between multiple subcontractors are clearly delineated. The Processor shall ensure that the Controller is entitled to carry out an appropriate evaluation and inspection with subcontractors, also on site, if necessary, or have these carried out by third parties commissioned by it, unless proof of GDPR compliance can be provided by certification or approval. 11.4. The Processor shall notify the Controller in a timely manner of any intended changes regarding the addition of new or the replacement of previous Subcontractors. The Controller shall have the opportunity to object to these changes for good cause within 30 days. This objection must be in writing and substantiated. Unless approved or objected to within the 30-day period, the relevant subcontractor shall be deemed approved. If the Controller lawfully objects and the Processor cannot comply with the objection, the Processor shall immediately notify the Controller thereof. Within one month of notification by the Processor, the Controller shall be entitled to terminate the Terms of Use in writing.
Appears in 2 contracts