Data Processing Terms

Subject to any binding arrangement to the contrary, where

you, as a party to these Terms in your capacity as a data controller, supply to us, Vanner Perez Notaries LLP (“VPN”), in our capacity as a service provider and data processor; or
we, VPN, as a party to these Terms in our capacity as a data controller, supply to you, in your capacity as a service provider and data processor,

Personal Data for processing by the party acting in its capacity as a data processor (“Processor”) on behalf of the party acting in its capacity as a data controller (“Controller”), then by accepting the supply of Personal Data or by otherwise commencing performance of the Services (“Effective Date”), Processor hereby accepts and agrees that it shall process the Personal Data in accordance with these Terms.

NOW IT IS HEREBY AGREED as follows:

1. Definitions

In this Agreement, capitalised words shall have the meaning as set out below or, as the case may be, elsewhere in this Agreement:

“Affiliate”	means any entity that, directly or indirectly, controls, is controlled by, is under the common control of or represents a party from time to time during the Term (as defined below);
“Data Protection Law”	means the data privacy laws applicable to the processing in connection with the Services, including, where applicable, the Directive 95/46/EC, as amended or replaced by any subsequent regulation, directive or other legal instrument of the European Union including by the General Data Protection Regulation (Regulation (EU) 2016/679) or similar law, or the applicable data privacy laws of any other relevant jurisdiction;
“Client”	means any client of Controller in respect of the Business Personal Data;
“Contractual Clauses”	means the standard contractual clauses of the European Commission for the transfer of Personal Data across borders, as amended or replaced from time to time, or any equivalent set of contractual clauses approved for use under Data Protection Law;
“Business Personal Data”	means the Personal Data processed by Processor in connection with the Services on behalf of Controller during the Term. The processing may include activities auxiliary to our notarial activities, such as translation, postal, courier, legalisation, hosting, administrative and other services. This will include names and other information about Data Subjects included in Client materials; and
“Services”	means the services or activities that one party agrees to perform and/or supply at the request of the other in respect of the Business Personal Data

The words “Data Subject”, “Personal Data”, “processing” and variations, “data controller” and “data processor” shall have the meaning attributed to them under the Data Protection Law.

2. Appointment

Clients and/or Affiliates (collectively “Instructing Parties”) may request Controller to provide and manage various services, including the Services on their behalf. Accordingly, Business Personal Data may contain Personal Data in relation to which Instructing Parties act as data controllers.
Where Business Personal Data is supplied to Processor, Controller confirms that it is authorised to communicate to Processor any instructions or other requirements on behalf of Instructing Parties in respect of processing of Business Personal Data by Processor in connection with the Services.
Processor is appointed by Controller to process Business Personal Data on behalf of the Controller and/or the Instructing Parties, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.

3. Duration

The Terms shall commence on the Effective Date and shall continue in full force and effect until such time as all Services have ceased and all Business Personal Data in the Processor’s possession or within its reasonable control (including those held by a Subprocessor (as defined below)) has been returned or destroyed (the “Term”).

4. Data Protection Compliance

In relation to its processing of Business Personal Data, save as otherwise required by law, Processor agrees and warrants to Controller that it shall:

process Business Personal Data only as required in connection with the Services and in accordance with Controller’s documented lawful instructions from time to time;
inform Controller if, in Processor’s opinion, an instruction infringes Data Protection Law;
ensure that all personnel authorised by Processor to process Business Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
implement appropriate technical and organisational measures to appropriately safeguard Business Personal Data, having regard to the nature of the Personal Data that is to be protected and the risk of harm which might result from any Security Breach (as defined below), at a minimum the measures set out in the Schedule;
promptly inform Controller of any data subject requests under Data Protection Law, or of regulatory or law enforcement requests relating to Business Personal Data. Processor undertakes not to acknowledge or otherwise respond to such a subject access request except with Controller’s prior written approval, which shall not be unreasonably withheld;
provide such assistance as Controller may reasonably require in order to ensure compliance by Controller or the Instructing Parties with Data Protection Law in relation to data security, data breach notifications, data protection impact assessments and prior consultations with the Information Commissioner’s Office or other competent authority;
at Controller’s choice, without delay delete or return all Business Personal Data to Controller, and delete existing copies of all Business Personal Data in the Processor’s possession or within its reasonable control (including those held by a Subprocessor (as defined below)); and
make available to Controller information reasonably necessary to demonstrate Processor’s compliance with these Terms and allow for, and contribute to, audits and inspections carried out by Controller.

5. Subprocessing

Controller hereby authorises Processor and its Affiliate to appoint a third party to process Business Personal Data on behalf of the Processor (“Subprocessor”), subject always to the stipulation that the Processor must ensure that Subprocessor adheres to these Terms in relation to the processing of Business Personal Data.
Controller and its Affiliate may continue to use those Subprocessors already engaged by Controller or its Affiliate at the Effective Date. Controller also expressly agrees that Processor may use at any time the services of Dot Comma Translations Limited for the performance of translation-related services and Westminster Legalisation Services Ltd for the performance of legalisation-related services.
Processor shall, at its own election, by post, email or through publication on its website, give Controller written notice of its intention to appoint any new Subprocessor. If, within 5 working days of communication of the notice, Controller does not object (or where Controller raises an objection on unreasonable grounds), Processor shall be entitled to assume that Controller consents to such appointment. Where a valid objection is raised by Controller, Processor shall work with Controller in good faith to overcome such objection or shall use reasonable endeavours to make alternative arrangements.

6. Security Incidents

“Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Business Personal Data transmitted, stored or otherwise processed.
Processor will notify the Controller without undue delay as soon as Processor becomes aware of any Security Breach.
Processor will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. Processor will take such further action as we may reasonably request in order to comply with Data Protection Law.
Processor may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach without our prior written approval; such approval shall not be unreasonably withheld.

7. International Data Transfers

Processor will ensure that no Business Personal Data are transferred out of either:

a) the European Economic Area; or

b) any other territory in which restrictions are imposed on the transfer of Business Personal Data across borders under Data Protection Laws, without the prior written consent of Controller and subject to clause 7.2.

Controller will ensure that Contractual Clauses or other applicable transfer mechanism, such as the EU-US Privacy Shield Framework in relation to EU-US transfers, is in place to ensure an adequate level of data protection.

8. Indemnity

Notwithstanding any provisions to the contrary of any relevant agreement relating to the Services, Processor shall and hereby agrees to indemnify Controller and Instructing Parties, their respective officers, employees, agents and subcontractors (each an “Indemnified Party”) from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any gross negligence or wilful breach by Processor of these Terms.

9. Miscellaneous

Clause and other headings in these Terms are for convenience only and shall not affect the meaning or interpretation of these Terms.
To the extent of any conflict, these Terms shall prevail over any agreement relating to the Services or other agreement.
Nothing in these Terms will exclude or limit the liability of either party which cannot be limited or excluded by applicable law. Subject to the foregoing sentence, (i) these Terms, including any appendices, constitutes the entire agreement between the parties pertaining to the subject matter hereof and supersedes all prior agreements, understandings, negotiations and discussions of the parties relating to its subject matter; and (ii) in relation to the subject matter of these Terms neither party has relied on, and neither party will have any right or remedy based on, any statement, representation or warranty, whether made negligently or innocently, except those expressly set out in these Terms.
Processor shall agree any amendment to these Terms that may be required from time to time for us and Instructing Parties to comply with any amended Data Protection Laws.
All notices of termination or breach must be in English, in writing and addressed to the other party’s primary contact person or legal department. Notice will be treated as given on receipt, as verified by a valid receipt or electronic log. Postal notices will be deemed received 48 hours from the date of posting by recorded delivery of registered post.
The provisions of these Terms are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of these Terms shall remain in full force and effect.
These Terms are governed by English law and the parties submit to the exclusive jurisdiction of the English courts in relation to any dispute (contractual or non-contractual) concerning these Terms save that either party may apply to any court for an injunction or other relief to protect its property or confidential information.

Schedule: Security Measures

Processor shall put in place the following measures, as applicable.

Minimum technical measures

Firewalls which are properly configured and using the latest software;
user access control management;
unique passwords of sufficient complexity and regular expiry on all devices;
secure configuration on all devices;
regular software updates, if appropriate, by using patch management software;
timely decommissioning and secure deletion of old software and hardware;
real-time protection anti-virus, anti-malware and anti-spyware software;
SSL certificates for websites and encryption of all portable devices ensuring appropriate protection of the key;
encryption of Personal Data in transit by using suitable encryption solutions, where appropriate;
multi-factor authentication for remote access;
WPA-TKIP secured WiFi access;
intrusion detection and prevention systems;
appropriate and proportionate monitoring of personnel; and
data backup and disaster recovery measures and procedures.

Minimal organisational measures

Vet all personnel including staff, contractors, vendors and suppliers (including Subprocessors) on continuous basis;
non-disclosure agreements used with all personnel;
regular training of all personnel on confidentiality, data processing obligations, identification of Security Breaches and risks;
apply principle of least authority, including a restricted or strictly controlled transit of data and material outside of office;
physical security on premises including reception or front desk, security passes, storage of documents in secure cabinets, secure disposal of materials, CCTV, etc.;
apply appropriate policies including Information Security Policy, Data Protection Policy, BYOD, Acceptable Use Policy; limited and monitored personal use of work resources, as appropriate.