GDPR Compliant Data Protection Clause
[X]. General Provisions
1.1A In this clause, the terms “Personal Data”, “Processing” (and “Process” and “Processed”), “Data Processor”, “Data Controller” and “Data Subject” shall have the meanings ascribed to them under the Data Protection Act 1998 and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, EU Directive 96/46/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (the “Data Protection Legislation”).
1.1 If Customer supplies Jutel with Personal Data (for example relating to End Users) Customer shall ensure that it is accurate and up to date when disclosed. Customer shall also ensure that Customer has obtained from the individuals concerned all necessary consents under the Data Protection Legislation to both the supply of the data to Jutel, and the Processing of it by Jutel, for the purposes of performance of this Agreement, supply of the Equipment and Services . Customer shall also ensure that any individual to whom Personal Data relates has given consent for Jutel to pass such data back to Customer. Customer agrees that where it is reasonably requested by a Partner, Jutel may provide Customer’s billing and contract information to the relevant Partner for the purposes of calculating commissions and administration of the account.
1.2 In connection with the provision or receipt of the Services, each Party shall comply with its obligations under the Data Protection Legislation and shall not cause the other Party to breach any of its obligations under the Data Protection Legislation. Customer acknowledges that Jutel retains the role of Data Controller except in the limited circumstances where Jutel Processes any Personal Data for and on behalf of Customer. Jutel shall take appropriate technical and organisational measures against unauthorised or unlawful Processing of Personal Data provided to it by Customer, and against accidental loss, alteration, unauthorised disclosure or destruction of or damage to that Personal Data. Such technical and organisational measures shall include, as appropriate and without limitation:
- The pseudonymisation and encryption of Personal Data;
- The ability to ensure ongoing confidentiality, integrity, availability and resilience of Processing systems and services;
- The ability to restore the availability and access to the data in a timely manner in the event of a physical or technical incident; and
- A process to regularly test, assess and evaluate the effectiveness of technical and organisational measures for ensuring the security of the Processing of the data.
When acting as a Data Processor, Jutel will only process Personal Data to the extent and in the manner necessary for the purpose of performing its obligations under this Agreement or as otherwise instructed in writing by the Customer from time to time acting reasonably and in accordance with Data Protection Legislation and the terms of this Agreement and Jutel shall only use Personal Data for “big data” analysis or purposes or match Personal Data with or against any other personal data (whether belonging to Jutel or any Authorised Sub-Processor) after that Personal Data has been anonymised and otherwise depersonalised, such that it does not constitute Personal Data for the purposes if the Data Protection Legislation.
Except as strictly necessary for the provision of the Services or to achieve compliance with applicable law, Jutel will not modify, amend or alter the contents of Personal Data without the Customer’s prior written permission. Jutel will assist the Customer in undertaking any conducting privacy impact assessments of any Processing operations in relation to this Agreement and will facilitate any audits or inspections by Customer in relation to the same.
Jutel will ensure that access to the Personal Data is limited to those of its personnel who need to have access to it for the purposes of the provision of the Services and that those members of its personnel are informed of the confidential nature of the Personal and that they are bound by confidentiality restrictions in respect of Personal Data no less stringent than those imposed herein;
Jutel will notify and assist the Customer if the Customer receives:
- a subject access request from a Data Subject, requesting access to the Personal Data that the Customer holds on that Data Subject;
- a complaint or request relating to the Customer’s obligations under the Data Protection Legislation; or
- any other communication directly relating to the processing of any Personal Data in connection with this Agreement.
Jutel will, without undue delay (but in any event within 48 hours of becoming aware of it) (i) notify the Customer in writing in the event that Jutel becomes comes aware of any unauthorised or unlawful processing, disclosure, loss, destruction, alteration or access to Personal Data; and (ii) implement any measure reasonably necessary to restore the security and integrity of compromised Personal Data; and (iii) use reasonable endeavours to support the Customer to make any required notification to the relevant regulatory body and where necessary the affected Data Subjects;
Jutel will nominate a Jutel representative who shall have responsibility to respond to Customer enquiries regarding the processing of Personal Data; and
Save where Jutel is required to retain Personal Data to achieve compliance with applicable laws, policies, procedures or guidance specifically relating to the Services, upon termination or expiry of this Agreement, Jutel will return all Personal Data and any copies to the Customer or, at the Customer’s written request, destroy all Personal Data and any copies except where required by applicable laws or regulations to store that Personal Data.
Jutel will not engage any Sub-Processor to Process the Personal Data without:
- obtaining the Customer’s prior written authorisation to the engagement of that Sub-Processor;
- such Sub-Processing being subject to a written agreement which includes terms which are substantially the same to those set out in this Clause; and
- Jutel remaining wholly liable to the Customer for any failure by a Sub-Processor appointed by it to fulfil its contractual obligations in relation to the Processing of any Personal Data or otherwise comply with the Data Protection Legislation.
Jutel shall not permit any processing of Personal Data outside the European Economic Area or any country not deemed adequate by the European Commission pursuant to Article 25(6) of Directive 95/46/EC (together “Restricted Countries”) without the Customer’s prior consent which may be subject to conditions at the Customer’s discretion (unless Jutel and/or Authorised Sub-Processor(s) are required to transfer the Personal Data to comply with the Data Protection Legislation and such laws prohibit notice to the Customer).
1.3 All notices served by Customer under this Agreement shall be in writing and sent to the Head of Legal at Jutel Limited, Progress House, 404 Brighton Road, Croydon, Surrey, CR2 6AN, or any other address Jutel directs Customer to use from time to time. Jutel shall send all notices to Customer at Customer’s registered office. Notices will be deemed given: where they are hand delivered, when a duly authorised employee or representative of the recipient gives written acknowledgement of receipt; for e-mail communication, at the time the communication enters into the information system of the recipient; for posting, three days after dispatch; and for fax on receipted transmission of the fax.
1.4 Neither Party shall lose any right under this Agreement if it fails to use that right, or delays in using it. For a waiver of a right to be valid, it must be written and will not give rise to an ongoing waiver of that right unless it is expressly stated to do.
1.5 Termination of this Agreement or any part thereof, shall be without prejudice to any other rights or remedies a Party may be entitled to at law or under the Agreement and shall not affect any accrued rights or liabilities of either Party nor the coming into force or the continuance in force of any provision of the Agreement which is expressly or by implication intended to come into or continue in force on or after such termination.
1.6 This Agreement is governed by English Law and is subject to the non-exclusive jurisdiction of the English Courts.
1.7 Only provisions set out in this Agreement shall apply to Jutel’s supply of Services to Customer. All other provisions are expressly excluded to the maximum extent permitted by law. The Parties acknowledge that, in entering into this Agreement, neither Party has relied upon any statement or warranty made, or agreed to, by any person, except those expressly set out within this Agreement. However, this shall not be taken to exclude either Party’s liability for fraud.
1.8 If a misrepresentation or untrue statement has been made, the only remedy available to the Parties shall be a claim for damages for breach of this Agreement, unless such misrepresentation or untrue statement was made fraudulently, or a provision of the Agreement was induced by fraud, in which case all remedies under English Law shall be available.
1.9 All headings in this Agreement are there for convenience, and do not have any legal effect. Use of the singular includes the plural and vice versa.
1.10 Any changes made to Customer’s systems or processes that may affect the Services (including any change to computer server software) are at Customer’s sole risk. Jutel shall not be liable to continue to support the Services to the extent that they are affected by such change.
1.11 Every provision in this Agreement is independent from the others to the extent that, if a provision, or any part of it, is ruled to be illegal or unenforceable by the English Courts, that provision or the relevant part of it shall be treated as having been deleted from this Agreement, without affecting the remainder of that provision or the other provisions of this Agreement, which shall still have full effect.
1.12 Where Jutel supplies Equipment and Services to Customer that is not expressly covered by the Order Form, such supply shall be deemed to be governed by the terms and conditions of this Agreement.
1.13 If there is a dispute under this Agreement, and Partner has been unable to resolve the issue to Customer’s satisfaction, Customer may escalate the issue to Jutel customer services. If Jutel customer services is unable to resolve the issue, this issue will be escalated through Jutel’s customer complaints procedure. If you are a Customer who employs fewer than 10 employees and our customer services team is unable to resolve your complaint, you may ask that the matter be referred to an independent ombudsman in accordance with our customer complaints code of practise which is available on Jutel’s website or by contacting Jutel. The Parties shall use the escalation process to its full before taking legal action against the other Party.
1.14 All information that the Parties provide to each other in relation to this Agreement must be accurate and complete and Customer shall promptly inform Jutel in writing of all changes to information Customer has provided to Jutel, in particular, if Customer intends to stop, stops or has stopped trading, if Customer intends to sell its business, if Customer changes name or if the legal status of Customer’s business changes.