Common use of Subprocessors and Data Transfer Clause in Contracts

Subprocessors and Data Transfer. 4.1 The Customer acknowledges and authorizes Iron Mountain to engage the third parties and affiliates ("Subprocessor”) to process the personal data that are listed and accessible under this web address. If a Subprocessor processes personal data outside the EEA and the recipient country does not provide an adequate level of protection for the personal data, the necessary safeguards (such as EU Commission’s Standard Contractual Clauses or similar approved mechanisms) that legitimize the data transfer shall also be implemented by Iron Mountain. Documentation about the data transfer mechanism shall be provided to the Customer upon request. Such data transfer is considered approved by the Customer. The authorisation provided by the Customer under this section 4.1 also includes an express authorisation by the Customer to enable Iron Mountain to directly enter into Standard Contractual Clauses with each Subprocessor on behalf of the Customer. 4.2 In case any additions or replacements to the list of Subprocessors are required, Iron Mountain shall notify the Customer by email in advance of such addition or replacement. In order to receive these email notifications, the Customer shall subscribe and manage any existing subscription to Iron Mountain’s notification mechanism via this web page. If the Customer fails to subscribe to this notification service, Iron Mountain shall not be liable for the lack of Subprocessor notification. If the Customer fails to subscribe, Customer will not receive notification of the appointment, and all such appointments shall be deemed to be authorized by the Customer. If the Customer subscribes, the appointment of any new Subprocessor shall be deemed authorized by the Customer unless Customer reasonably objects on demonstrable grounds that relate to data protection in writing and within fifteen (15) days of Iron Mountain’s provision of notice. 4.3 Iron Mountain shall (i) impose contractual terms on its Subprocessors which are no less onerous than those set out in this DPA, (ii) regularly monitor the performance of its Subprocessors.