Green Kinkajou data processing terms

1 DEFINITIONS

1.1. The definitions in Green Kinkajou terms shall apply except where expressly stated otherwise. In addition, in these data processing terms:

Controller, data subject, personal data, process, processor and supervisory authority shall, for the purposes of this data processing terms, have the meanings set out in the GPDR;

GDPR means the General Data Protection Regulation (Regulation (EU) 2016/679), or similar legislation as implemented under English law (including any national implementing laws, regulations and secondary legislation), in each case as applicable and in force in the United Kingdom from time to time including the Data Protection Act 2018. References to Article numbers of the GDPR shall be deemed to include the equivalent provisions in the event the Article numbers in the legislation are changed from time to time;

Model clauses means the clauses established pursuant to Article 26 (2) of Directive 95/46/EC for tthe transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection (or any equivalent clauses subsequently introduced pursuant to the implementation of the GDPR);

Green Kinkajou’s personnel means the employees, staff, other workers and agents of Green Kinkajou’s subcontractors or agents who are engaged in the provision of the services from time to time;

2 DATA PROCESSING

2.1. In the event Green Kinkajou processes personal data in the course of performing its obligations under the agreement, the parties agree that, for the purposes of the GDPR, the client shall be the controller and Green Kinkajou shall be the processor.

2.2. The client instructs Green Kinkajou (and authorises Green Kinkajou to instruct any sub-processor it appoints) to:

2.2.1. process the client’s data; and

2.2.2. transfer the client’s personal data outside the European Economic Area (provided that in respect of any transfers outside the European Economic Area an adequacy decision applies in relation to the relevant third country or an appropriate safeguard is in place in relation of the transfers (such as the Model Clauses)), in each case as reasonably necessary for the performance of and in accordance with the terms of the agreement.

2.3. The parties agree that the processing of personal data by Green Kinkajou on behalf of the client is as follows (as may be updated by the parties in writing from time to time):

2.3.1. the subject-matter, nature and purpose of the processing is the performance of the services;

2.3.2. the duration of the processing is the term of the agreement and for such further time as the parties shall agree in writing;

2.3.3. the type (s) of personal data depend on the circumstances and particular services provided and may include name, contact details, employment information and other personal data;

2.3.4. the categories of data subjects depend on the circumstances and particular services provided personal data on websites hosted by Green Kinkajou.

2.4. Green Kinkajou, to the extent it is acting as a processor in respect of such personal data, agrees to:

2.4.1. process the personal data on documented instructions from the client (including those set out in this agreement), unless required to do so by English, European Union (“EU”) or EU Member State law to which Green Kinkajou is subject. In such a case, Green Kinkajou shall inform the client of the legal requirement before processing (unless that law prohibits such information on important ground of public interest);

2.4.2. not transfer the personal data outside the Eurpoean Economic Area without the prior written consent of the client, except as permitted under clauses 2.2. and 2.4.1;

2.4.3. ensure that Green Kinkajou’s personnel authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

2.4.4. taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity of rights and freedoms of natural persons, in relation to the client’s personal data, implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk including considering those measures referred to in Article 32 of the GDPR (‘Security of Processing’);

2.4.5. taking into account the nature of the processing, assist the client by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the client’s obligation to respond to requests for exercising data subjects’ rights laid down in Chapter III (‘Rights of the Data Subject’) of the GDPR;

2.4.6. taking into account the nature of the processing and information available to Green Kinkajou, provide assistance to the client in order to assist the client in ensuring the client’s compliance with the obligations set out in the GDPR Article 32 (‘Security of Processing’), Article 33 (‘Notification of a Personal Data Breach of the Supervisory Authority’), Article 34 (‘Communication of a Personal Data Breach to the Data Subject’), Article 35 (‘Data Protection Impact Assessment’), and Article 36 (‘Prior Consultation’), in each case solely in relation to processing of the client’s personal data;

2.4.7. at the option of the client, delete or return all the client’s personal data to the client after the end of the provision of the services relating to processing, and delete existing copies, unless applicable laws require retention of the personal data and save for back-up or archive data which is kept in accordance with Green Kinkajou’s data retention procedures;

2.4.8. make available to the client all information necessary to demonstrate compliance with Article 28 of the GDPR and permit audits and inspections conducted by the client or auditor appointed by the client; and

2.4.9. immediately inform the client if, in its opinion, an instruction of the client pursuant to clause 2.4.8. infringes the GDPR or other EU or EU Member State data protection provsions.

2.5. The client generally consents to Green Kinkajou engaging sub-processors in relation to the personal data and specifically consents to the engagment of those sub-processors engaged by Green Kinkajou on the 25th May 2018 where an agreement was in force between the parties at that data or otherwise at the date of the agreement.

2.6. Green Kinkajou shall inform the client of any intended changes concerning the addition or replacement of such processors. The client shall have the right to object to any changes, where it has reasonable grounds to consider the use of such processors would not comply with the GDPR, and if it does object it must notify Green Kinkajou in writing within 5 days of being informed of the change.

2.7. Where Green Kinkajou receives written notice from the client in accordance with clause 2.6. Green Kinkajou shall not appoint the proposed sub-processor until reasonable steps have been taken to address the objections raised by the client and client has been provided with a reasonable written explanation of the steps taken.

2.8. Green Kinkajou shall ensure that the arrangement between it and each sub-processor contemplated by clauses 2.5. to 2.7. is governed by a written contract including equivalent data protection obligations as those set out in the agreement which are required by Article 28 (3) of the GDPR.

2.9. The client shall reimburse Green Kinkajou for all costs, expenses and time (at the Green Kinkajou’s standard rates) reasonably incurred by Green Kinkajou in connection with the fulfilment of Green Kinkajou’s obligations under clauses 2.4.5. to 2.4.9.. Green Kinkajou shall invoice the client in relation thereto and such invoices shall be paid in accordance with the terms of the agreement.

2.10. The client shall (at its own cost) provide assistance requested by Green Kinkajou in relation to the fulfilment of Green Kinkajou’s obligation to cooperate with the relevant supervisory authority under Article 31 GDPR. Notwithstanding any other provision of the agreement, Green Kinkajou shall be entitled to respond to and provide all relevant information in respect of requests or orders issued by such supervisory authority.

2.11. The client warrants and respresents that:

2.11.1. it will at all times remain duly and effectively authorised to give the instruction set out in clause 2.2.

2.11.2. it has all authority, grounds, rights and consents necessary to enable Green Kinkajou to process the personal data in accordance with the GDPR for purposes of the agreement;

2.11.3. it shall comply with the GDPR and all other applicable laws and regulations, relevant industry codes of practice and guidance in relation to the processing of personal data; and

2.11.4. the information set out in clause 2.3. is accurate.

2.12. The client shall indemnify Green Kinkajou at all time against all claims, demands, costs (including legal costs on a full indemnity basis), damages, expenses, losses, fines and liabilities incurred by Green Kinkajou arising out of or in connection with:

2.12.1. any breach by the client of clause 2.11.;

2.12.2. any act or omission of processing by the client, its affiliates or third party suppliers which infringes the GDPR; and

2.12.3. notwithstanding clause 2.4.9., the provision of unlawful or inadequate instructions by the client in relation to the personal data.

2.13. For the avoidance of doubt, Green Kinkajou shall not be liable for or responsible for any breach of this part 3 (Data Processing Terms and Conditions) due to the acts or omissions of the client.

Specialists in digital marketing.

Promoting your business correctly gets you in front of the right people who will become your clients and customers, thus, bringing money through your doors. We cover all bases.

Ambitious clients come to us from a many different industries who’s businesses are successful. When they collaborate with us we design and implement highly creative strategies and tactics to help their businesses grow and adapt in an ever more competitive world.

Let’s start your project together, today.

We’d love to have a friendly, informal chat. Get in touch.