In order that you as a service provider and data processor (referred to as “Processor” or “you” or “your”) may provide or continue to provide certain services (the “Services”) to us, the Notary Business and data controller (referred to as “Notary Business” or “we”, “us” or “our”), you have agreed that these data processing terms (“Terms”) shall apply (notwithstanding any other terms and conditions applicable to the delivery of the Services to the contrary) in order to address the compliance obligations imposed upon the Notary Business and its Clients pursuant to the Data Protection Law. These Terms shall constitute a separate agreement or they may be incorporated by reference in the relevant Services agreement, as the case may be.
1.1. In this Agreement, capitalised words shall have the meaning as set out below or, as the case may be, elsewhere in this Agreement:
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with, a party from time to time during the Term;
“Data Protection Law” means the data privacy laws applicable to the processing in connection with the Services, including, where applicable, the Directive 95/46/EC, as amended or replaced by any subsequent Regulation, Directive or other legal instrument of the European Union including by the General Data Protection Regulation or similar law, or the applicable data privacy laws of any other relevant jurisdiction;
“Client” means any client of the Notary Business;
“Contractual Clauses” means the standard contractual clauses of the European Commission for the transfer of personal data across borders, as amended or replaced from time to time, or any equivalent set of contractual clauses approved for use under Data Protection Law; and
“Notary Business Personal Data” means the personal data processed by Processor in connection with the Services on behalf of the Notary Business during the Term. The processing may include activities auxiliary to our notarial services, such as postal, courier, legalisation, translation, hosting, administrative and other services. This will include names and other information about data subjects included in Client materials.
1.2. The words “data subject”, “personal data”, “processing” and variations, “controller” and “processor” shall have the meaning attributed to them in Data Protection Law.
2.1. The Notary Business is designated by its Clients, Client Affiliates and Notary Business Affiliates (collectively “Instructing Parties”) to provide and manage various services, including the Services on their behalf. Accordingly, Notary Business Personal Data may contain personal data in relation to which Instructing Parties are controllers. Notary Business confirms that it is authorised to communicate to Processor any instructions or other requirements on behalf of Instructing Parties in respect of processing of Notary Business Personal Data by Processor in connection with the Services.
2.2. Processor is appointed by Notary Business to process Notary Business Personal Data on behalf of the Notary Business and/or the Instructing Parties, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.
The Terms shall commence on the Effective Date and shall continue in full force and effect until such time as all Services have ceased and all Notary Business Personal Data in the Processor’s possession or within its reasonable control (including those held by a Subprocessor) has been returned or destroyed (the “Term”).
4.1. In relation to its processing of Notary Business Personal Data, save as otherwise required by law, you agree to:
5.1. Processor will sub-contract, outsource, assign, novate or otherwise transfer obligations under these Terms or engage any subcontractors involved in the processing of Notary Business Personal Data (each a “Subprocessor”) only with Notary Business’s prior written consent and subject to clause 5.2.
5.2. When engaging a Subprocessor, Processor will:
6.1. “Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Notary Business Personal Data transmitted, stored or otherwise processed.
6.2. Processor will notify the Notary Business without undue delay if Processor aware of any Security Breach.
6.3. Processor will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. Processor will take such further action as we may reasonably request in order to comply with Data Protection Law.
6.4. Processor may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach ("Notices") without our prior written approval; such approval shall not be unreasonably withheld.
7.1. Processor will ensure that no Notary Business Personal Data are transferred out of either:
7.2. Notary Business will ensure that Contractual Clauses or other applicable transfer mechanism, such as EU-US Privacy Shield Framework in relation to EU-US transfers, is in place to ensure adequate level of data protection.
Notwithstanding any provisions of the relevant Services agreement to the contrary, Processor shall and hereby agrees to indemnify Notary Business and Instructing Parties and their officers, employees, agents and subcontractors (each an “Indemnified Party”) from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any gross negligence or wilful breach by Processor of these Terms.
9.1. Clause and other headings in these Terms are for convenience only and shall not affect the meaning or interpretation of these Terms.
9.2. To the extent of any conflict, these Terms shall prevail over any Services agreement or other agreement.
9.3. Nothing in these Terms will exclude or limit the liability of either party which cannot be limited or excluded by applicable law. Subject to the foregoing sentence,
9.4. Processor shall agree any amendment to these Terms that may be required from time to time for us and Instructing Parties to comply with any amended Data Protection Laws.
9.5. All notices of termination or breach must be in English, in writing and addressed to the other party’s primary contact person or legal department. Notice will be treated as given on receipt, as verified by a valid receipt or electronic log. Postal notices will be deemed received 48 hours from the date of posting by recorded delivery or registered post.
9.6. Subject to clause 9.3, the Notaries Society is not a party to these Terms and it shall have no liability whatsoever.
9.7. The provisions of these Terms are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of these Terms shall remain in full force and effect.
9.8. These Terms are governed by English law and the parties submit to the exclusive jurisdiction of the English courts in relation to any dispute (contractual or non-contractual) concerning these Terms save that either party may apply to any court for an injunction or other relief to protect its property or confidential information.
Processor shall put in place the following measures, as applicable.
Minimum technical measures
Minimal organisational measures