THIS DATA PROCESSING AGREEMENT is supplemental to our Terms of Business and any other arrangements relating to the supply of Services to you.
As part of our agreement to provide Services to you, you have agreed to supply certain personal data to Fastnet, which Fastnet shall process in accordance with the terms of this Agreement.
Definitions and interpretation
1.1 In this Agreement:
Complaint means a complaint or request (other than a Data Subject Request) relating to either party’s obligations under Data Protection Laws relevant to this Agreement and/or the processing of any of the Shared Personal Data, including any compensation claim from a Data Subject or any notice, investigation or other action from a Data Protection Supervisory Authority relating to the foregoing (and Complainant means the Data Protection Supervisory Authority, Data Subject or other person initiating or conducting a Complaint);
Controller has the meaning given in applicable Data Protection Laws;
Data Protection Laws means, as applicable to any party and to the rights, responsibilities and obligations of any party in connection with their respective supply agreement:
(a) the GDPR;
(b) the Data Protection Act 2018;
(c) the Directive 2002/58/EC (ePrivacy Directive) and/or the Privacy and Electronic Communications (EC Directive) Regulations 2003;
(d) any other applicable law relating to the processing, privacy and/or use of Personal Data, as applicable to any party and to the rights, responsibilities and obligations of any party in connection with their respective supply agreement;
(e) any laws which implement any such laws; and
(f) any laws that replace, extend, re-enact, consolidate or amend any of the foregoing;
Data Protection Supervisory Authority means any regulator, authority or body responsible for administering Data Protection Laws;
Data Subject has the meaning given in applicable Data Protection Laws from time to time;
Data Subject Request means a request made by a Data Subject to exercise any right(s) of Data Subjects under Chapter III of the GDPR or under any similar Data Protection Laws in relation to any of the Shared Personal Data or concerning the processing of such data;
GDPR means the General Data Protection Regulation, Regulation (EU) 2016/679;
Permitted Lawful Basis means processing personal data with the consent of the data subject;
Permitted Purpose means as detailed in the Schedule hereto;
Permitted Recipients means the Receiving Party’s employees and contractors who need access to the Shared Personal Data for the Permitted Purpose;
Personal Data has the meaning given in applicable Data Protection Laws from time to time;
Personal Data Breach has the meaning given in the GDPR;
Processing has the meaning given in applicable Data Protection Laws from time to time (and related expressions, including process, processed and processes shall be construed accordingly); and
Shared Personal Data means Personal Data received by the Receiving Party from or on behalf of the Disclosing Party, or otherwise made available by the Disclosing Party for the Permitted Purpose.
1.2 Unless otherwise expressly stated in this Agreement the Receiving Party’s obligations and the Disclosing Party’s rights and remedies under this Schedule are cumulative with, and additional to, any other provisions of this Agreement.
2 Status of this Agreement and the parties
Each party shall be a Controller of the Shared Personal Data. Where the parties share the Shared Personal Data, it shall be shared and managed in accordance with the terms of this Agreement.
3 Aims and benefits of the data sharing
The parties wish to document that the specific aims of the sharing of the Shared Personal Data under this Agreement are to offer access to various internet and other telecommunications services and that such sharing is necessary to achieve those aims.
4 Compliance with Data Protection Laws
The Receiving Party shall at all times comply with all Data Protection Laws in connection with the exercise and performance of its respective rights and obligations under this Agreement and the processing of the Shared Personal Data. This Schedule allocates certain rights and responsibilities among the parties as enforceable contractual obligations between themselves, however nothing in this Schedule is intended to limit or exclude either party’s responsibilities or liabilities under Data Protection Laws (including under Article 82 of the GDPR or under any similar Data Protection Laws and the duties owed by each party to Data Subjects under any Data Protection Laws).
5 Obligations on the Disclosing Party
5.1 The Disclosing Party shall ensure prior to sharing the Shared Personal Data with the Receiving Party that all appropriate privacy notices have been made available to each relevant Data Subject, and all consents obtained, as necessary to permit the sharing of the Shared Personal Data with the Receiving Party for the Permitted Purpose on the Permitted Lawful Basis as envisaged under this Agreement in accordance with Data Protection Laws.
5.2 During the term of this Agreement, the Disclosing Party shall promptly notify the Receiving Party if it becomes aware that any such consent is withdrawn or if a relevant Data Subject has requested that their Shared Personal Data is no longer processed by either party for the Permitted Purpose.
6 Obligations on Receiving Party
6.1 The Receiving Party shall ensure that at all times:
6.1.1 it shall undertake all processing of the Shared Personal Data only for the Permitted Purpose in accordance with this Agreement and in all respects in accordance with Data Protection Laws;
6.1.2 it shall undertake processing of the Shared Personal Data only to the extent consistent with the Permitted Lawful Basis; and
6.1.3 it shall promptly (and in any event within 10 Business Days) on request provide the Disclosing Party with: (a) all copies of all notices, records and information necessary to demonstrate its compliance with this Schedule; and (b) all records referred to in paragraph 0.
Technical and organisational measures
7.1 The Receiving Party shall at all times:
7.1.1 put in place and maintain appropriate technical and organisational measures so as to ensure the protection of the rights of Data Subjects under Data Protection Laws and as otherwise required to meet the requirements of both parties under all Data Protection Laws;
7.1.2 implement and maintain appropriate technical and organisational measures to protect the Shared Personal Data against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure or access; and
7.1.3 without prejudice to any other obligation in this paragraph 0, implement technical and organisational measures in accordance with any requirements advised by the Disclosing Party.
7.2 The Receiving Party shall at all times ensure the processing of the Shared Personal Data shall be limited to the authorised personnel of the Receiving Party or of a Permitted Recipient that:
7.2.1 need to process it for the Permitted Purpose in accordance with this Agreement;
7.2.2 are reliable and adequately trained on compliance with all Data Protection Laws and this Schedule; and
7.2.3 are subject to (and comply with) a binding written contractual obligation to keep the Shared Personal Data confidential.
8. Disclosures to Permitted Recipients
8.1 The Receiving Party shall be liable to the Disclosing Party for all acts and omissions of each of the Permitted Recipients as if they were the acts and omissions of the Receiving Party. Each obligation in this Schedule on the Receiving Party to do, or refrain from doing, any thing shall include an obligation on the Receiving Party to ensure all Permitted Recipients do, or refrain from doing, such thing.
8.2 The Receiving Party shall not engage nor permit any staff or third parties other than the Permitted Recipients to carry out any processing of any Shared Personal Data. The Receiving Party shall ensure at all times:
8.2.1 that all processing by Permitted Recipients is conducted in a manner consistent with the Permitted Lawful Basis, the Permitted Purpose, the Receiving Party’s obligations under this Agreement and the restrictions on processing imposed on the Receiving Party under this Agreement; and
8.2.2 without prejudice to the above, that each of the Permitted Recipients (other than the employees of a Permitted Recipient or the Receiving Party) carrying out any processing of the Shared Personal Data is subject to a binding written agreement regulating its processing of the Shared Personal Data which complies in all respects with the requirements of Data Protection Laws.
9 International transfers
The Receiving Party shall not transfer the Shared Personal Data to any country outside the United Kingdom or to any international organisation (as defined in the GDPR) without the Disclosing Party’s prior written consent.
10 Data Subject Requests, Personal Data Breaches and Complaints
10.1 The Receiving Party shall promptly (and in any event within 24 hours) notify the Disclosing Party if the Receiving Party suspects or becomes aware of any actual or threatened occurrence of any Personal Data Breach in respect of any Shared Personal Data. The Receiving Party shall promptly (and in any event within 24 hours) provide all such assistance and information as the Disclosing Party requires to report any actual or suspected Personal Data Breach to a Data Protection Supervisory Authority and to notify affected Data Subjects under Data Protection Laws.
10.2 The Receiving Party shall promptly (and, in any event, within 1 Business Day of receipt) inform the Disclosing Party if it receives any Complaint or Data Subject Request. When receiving and responding to a Data Subject Request or a Complaint the Receiving Party shall consult in advance with the Disclosing Party and promptly comply with the Disclosing Party’s reasonable instructions (if any).
10.3 Subject to the remainder of this Schedule, as between the parties, responsibility for compliance with and responding to:
10.3.1 any Data Subject Request falls on the party which first received such Data Subject Request;
10.3.2 any Complaint falls on the party which receives the Complaint from a Complainant;
10.3.3 each party’s respective obligations in respect of any Personal Data Breach (including notification of the Data Protection Supervisory Authority and/or Data Subject(s)) impacting or relating to any Shared Personal Data in the possession or control of the Receiving Party (or any third party with whom it has shared such data) falls on the Receiving Party; and
10.3.4 each party’s respective obligations in respect of any other obligation under Data Protection Laws (including any obligation to notify the Data Protection Supervisory Authority and/or Data Subject(s) of any other Personal Data Breach) falls on each party subject to such obligation(s).
10.4 Each party shall promptly co-operate with and provide reasonable assistance, information and records to the other to assist each party with their respective compliance with Data Protection Laws and in relation to all Complaints and Data Subject Requests.
10.5 The Disclosing Party’s obligations under paragraphs 10.3 and 10.4 shall be performed at the Receiving Party’s expense, except to the extent that the circumstances giving rise to such obligation arose out of any breach by the Disclosing Party of its obligations under this Agreement.
11 Records
The Receiving Party shall maintain complete, accurate and up to date written records of all of its processing of the Shared Personal Data and as necessary to demonstrate its compliance with this Schedule.
12 Retention
12.1 Except as required by applicable law in the United Kingdom the Receiving Party shall:
12.1.1 process each part of the Shared Personal Data for no longer than such processing is necessary for the Permitted Purpose and compliant with this Schedule and all Data Protection Laws and in any event cease to process each part of the Shared Personal Data on the earlier of termination or expiry of this Agreement; and
12.1.2 immediately confidentially, irrecoverably and securely destroy or dispose of all Shared Personal Data (and all copies) in its possession or control that can no longer be processed in accordance with paragraph 12.1.1.
Indemnity
12.1 The Receiving Party shall indemnify and keep indemnified the Disclosing Party against:
13.1.1 all losses, claims, damages, liabilities, fines, sanctions, interest, penalties, costs, charges, expenses, compensation paid to Data Subjects (including compensation to protect goodwill and ex gratia payments), demands and legal and other professional costs (calculated on a full indemnity basis and in each case whether or not arising from any investigation by, or imposed by, a Data Protection Supervisory Authority) arising out of or in connection with any breach by the Receiving Party of its obligations pursuant to this Agreement; and
13.1.2 all amounts paid or payable by the Disclosing Party to a third party which would not have been paid or payable if the Receiving Party’s breach of this Agreement had not occurred.
14 Breach
Any breach by the Receiving Party of any of its obligations under this Agreement shall be regarded as being material for the purposes of this Agreement.
15 Additional governance arrangements
Each party shall comply with its respective obligations, and may exercise its respective rights and remedies, under respective agreements for the provision of data and services as between them.
16 Key contact
The parties wish to record for reference that the representative within their organisation with overall internal responsibility for ensuring the respective party’s compliance with its obligations are detailed in the Schedule. Each party may update details of their representative referred to in this paragraph 6 by giving 7 days’ notice to the other Party or Parties.
17 Survival
The provisions of this Data Processing Agreement shall survive so long as we are providing Services to you under a Contract which has not been terminated, and for such period following termination as may be necessary to fulfil our obligations in this Data Processing Agreement.
THE SCHEDULE –
PERMITTED PURPOSES
The Permitted Purpose(s) shall be the provision of the specific services being provide to you by us under a separate contract or contracts entered into between us.
The specific nature of the Permitted Purpose shall relate directly to the specific Services being provided at any time. If the nature of the Services, or any other pertinent contractual provision changes, the parties acknowledge that the Permitted Purpose(s) may also change.
The type and categories of personal data and data subjects shall vary depending upon the Services provided, technical specifications, means of data transmission, configuration of connections or equipment and the way in which the Services are used.