SPECIAL CONDITIONS: DATA PROCESSOR SCHEDULE DEFINITIONS Data Controller: has the meaning set out in section 1(1) of the Data Protection Act 1998. Data Subject: an individual who is the subject of Personal Data. Personal Data: has the meaning set out in section 1(1) of the Data Protection Act 1998 and relates only to personal data, or any part of such personal data, of which the Customer is the Data Controller and in relation to which the Supplier is providing services under the Contract. Processing and process: have the meaning set out in section 1(1) of the Data Protection Act 1998. 1. 1.1 1.2 1.3 1.4 1.5 1.6 1.7 OBLIGATIONS OF THE SUPPLIER The Customer and the Supplier acknowledge that for the purposes of the Data Protection Act 1998, the Customer is the Data Controller and the Supplier is the data Supplier of any Personal Data. The Supplier further acknowledges and agrees that all rights, title and interest in and to the Personal Data including any copyright and database rights vest in the Customer. All updates and additions to the Personal Data made, obtained or processed by the Supplier in the course of or in connection with the Contract shall form part of the Personal Data and belong to the Customer. The Supplier shall process the Personal Data only to the extent, and in such a manner, as is necessary for the purposes specified in the Contract and in accordance with the Customer’s instructions from time to time and shall not process the Personal Data for any other purpose. The Supplier will keep a record of any processing of personal data it carries out on behalf of the Customer. The Supplier shall promptly comply with any request from the Customer requiring the Supplier to amend, transfer or delete the Personal Data. Where the Contract requires the Supplier to collect any Personal Data on behalf of the Customer it shall only do so on terms specifically agreed with the Customer which will contain a data protection notice informing the data subject of the identity of the Data Controller, the identity of any data protection representative it may have appointed, the purposes or purposes for which their Personal Data will be processed and any other information which is necessary having regard to the specific circumstances in which the data is, or is to be, processed to enable processing in respect of the data subject to be fair. The Supplier shall not modify or alter the terms in any way without the prior written consent of the Customer.] If the Supplier receives any complaint, notice or communication which relates directly or indirectly to the processing of the Personal Data or to either party's compliance with the Data Protection Act 1998 and the data protection principles set out therein, it shall immediately notify the Customer and it shall provide the Customer with full co-operation and assistance in relation to any such complaint, notice or communication. At the Customer's request, the Supplier shall provide to the Customer a copy of all Personal Data held by it in the format and on the media reasonably specified by the Customer. The Supplier shall not transfer the Personal Data outside the UK without the prior written consent of the Customer. Any transfer of Personal data outside the European 401291754 1 1.8 2. 2.1 2.2 2.3 3. 3.1 3.2 3.3 4. 4.1 4.2 5. 5.1 5.2 6. 6.1 Economic Area requires the specific approval of the Customer’s Data Protection Officer. The Supplier shall promptly inform the Customer if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable. The Supplier will restore such Personal Data at its own expense. SUPPLIER'S EMPLOYEES The Supplier shall ensure that access to the Personal Data is limited to: (a) those employees who need access to the Personal Data to meet the Supplier's obligations under the Contract; and (b) in the case of any access by any employee, such part or parts of the Personal Data as is strictly necessary for performance of that employee's duties. The Supplier shall ensure that all employees: (a) are informed of the confidential nature of the Personal Data; (b) have undertaken training in the laws relating to handling personal data; and (c) are aware both of the Supplier's duties and their personal duties and obligations under such laws and the Contract. The Supplier shall take reasonable steps to ensure the reliability of any of the Supplier's employees who have access to the Personal Data. RIGHTS OF THE DATA SUBJECT The Supplier shall notify the Customer within 3 working days if it receives a request from a Data Subject for access to that person's Personal Data. The Supplier shall provide the Customer with full co-operation and assistance in relation to any request made by a Data Subject to have access to that person's Personal Data. The Supplier shall not disclose the Personal Data to any Data Subject or to a third party other than at the request of the Customer or as provided for in the Contract. RIGHTS OF THE CUSTOMER The Customer is entitled, on giving at least 5 working days' notice to the Supplier, to inspect or appoint representatives to inspect all facilities, equipment, documents and electronic data relating to the processing of Personal Data by the Supplier. The requirement under clause 4.1 to give notice will not apply if the Customer believes that the Supplier is in breach of any of its obligations under the Contract. WARRANTIES The Supplier warrants that: (a) it will process the Personal Data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments; and (b) it will take appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and against the accidental loss or destruction of, or damage to, personal data to ensure the Customer's compliance with the seventh data protection principle. The Supplier shall notify the Customer immediately if it becomes aware of any unauthorised or unlawful processing, loss of, damage to or destruction of the Personal Data; INDEMNITY The Supplier agrees to indemnify and keep indemnified and defend at its own expense the Customer against all costs, claims, damages or expenses incurred by the 401291754 2 7. 7.1 8. 8.1 Customer or for which the Customer may become liable due to any failure by the Supplier or its employees or agents to comply with any of its obligations under the Contract. APPOINTMENT OF SUBCONTRACTORS The Supplier may only authorise a third party (sub-contractor) to process the Personal Data: (a) subject to the Customer's prior written consent where the Supplier has supplied the Customer with full details of such sub-contractor; (b) provided that the sub-contractor's contract is on terms which are substantially the same as those set out in the Contract; and (c) provided that the sub-contractor's contract terminates automatically on termination of the Contract for any reason. POST-TERMINATION OF THE CONTRACT On termination of the Contract or any earlier termination of the Supplier’s right or obligation to process Personal Data, and as otherwise directed by the Customer, the Supplier shall either: (a) Destroy the Personal Data and all copies thereof; (b) Transfer the Personal data to the Customer or such other third party as the Customer may direct; or (c) Archive the Personal data subject to agreement on terms of archiving including costs. End 401291754 3