Personal Data Registry Operator shall (i) notify each ICANN-‐accredited registrar that is a party to the registry-‐registrar agreement for the TLD of the purposes for which data about any identified or identifiable natural person (“Personal Data”) submitted to Registry Operator by such registrar is collected and used under this Agreement or otherwise and the intended recipients (or categories of recipients) of such Personal Data, and (ii) require such registrar to obtain the consent of each registrant in the TLD for such collection and use of Personal Data. Registry Operator shall take reasonable steps to protect Personal Data collected from such registrar from loss, misuse, unauthorized disclosure, alteration or destruction. Registry Operator shall not use or authorize the use of Personal Data in a way that is incompatible with the notice provided to registrars.
Service Personal Data The Personal Data supplied by a Buyer to the Supplier in the course of the use of the G-Cloud Services for purposes of or in connection with this Call-Off Contract. Spend controls The approval process used by a central government Buyer if it needs to spend money on certain digital or technology services, see ▇▇▇▇▇://▇▇▇.▇▇▇.▇▇/service-manual/agile-delivery/spend-controls- check-if-you-need-approval-to-spend-money-on-a-service Start date The Start date of this Call-Off Contract as set out in the Order Form. Subcontract Any contract or agreement or proposed agreement between the Supplier and a subcontractor in which the subcontractor agrees to provide to the Supplier the G-Cloud Services or any part thereof or facilities or goods and services necessary for the provision of the G- Cloud Services or any part thereof. Subcontractor Any third party engaged by the Supplier under a subcontract (permitted under the Framework Agreement and the Call-Off Contract) and its servants or agents in connection with the provision of G-Cloud Services. Subprocessor Any third party appointed to process Personal Data on behalf of the Supplier under this Call-Off Contract. Supplier The person, firm or company identified in the Order Form. Supplier Representative The representative appointed by the Supplier from time to time in relation to the Call-Off Contract. Supplier staff All persons employed by the Supplier together with the Supplier’s servants, agents, suppliers and subcontractors used in the performance of its obligations under this Call-Off Contract. Supplier terms The relevant G-Cloud Service terms and conditions as set out in the Terms and Conditions document supplied as part of the Supplier’s Application. Term The term of this Call-Off Contract as set out in the Order Form. Variation This has the meaning given to it in clause 32 (Variation process). Working Days Any day other than a Saturday, Sunday or public holiday in England and Wales. Year A contract year. Schedule 7: GDPR Information This schedule reproduces the annexes to the GDPR schedule contained within the Framework Agreement and incorporated into this Call-off Contract. Annex 1: Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.
Processing Personal Data This ▇▇▇▇▇ shall be completed by the Controller, who may take account of the view of the Processors, however the final decision as to the content of this Annex shall be with the Buyer at its absolute discretion.
Your Personal Data If you determine that you will be supplying us with your Personal Data (as defined in the Data Processing Addendum referenced below) for us to process on your behalf, in the provision of maintenance and support services or hosting services (if the Product licensed to you is a Hosted Service) or during the course of any audits we conduct pursuant to section 1.14 (Audit), you may submit a written request at ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇ for the mutual execution of a Data Processing Addendum substantially in the form we make available at ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/docs/default-source/progress-software/data-processing-addendum.pdf and we will enter into such Data Processing Addendum with you. To the extent there is any conflict between this ▇▇▇▇ and such Data Processing Addendum, the Data Processing Addendum will prevail with respect to our handling and processing of your Personal Data.
Handling Sensitive Personal Information and Breach Notification A. As part of its contract with HHSC Contractor may receive or create sensitive personal information, as section 521.002 of the Business and Commerce Code defines that phrase. Contractor must use appropriate safeguards to protect this sensitive personal information. These safeguards must include maintaining the sensitive personal information in a form that is unusable, unreadable, or indecipherable to unauthorized persons. Contractor may consult the “Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals” issued by the U.S. Department of Health and Human Services to determine ways to meet this standard.
B. Contractor must notify HHSC of any confirmed or suspected unauthorized acquisition, access, use or disclosure of sensitive personal information related to this Contract, including any breach of system security, as section 521.053 of the Business and Commerce Code defines that phrase. Contractor must submit a written report to HHSC as soon as possible but no later than 10 business days after discovering the unauthorized acquisition, access, use or disclosure. The written report must identify everyone whose sensitive personal information has been or is reasonably believed to have been compromised.
C. Contractor must either disclose the unauthorized acquisition, access, use or disclosure to everyone whose sensitive personal information has been or is reasonably believed to have been compromised or pay the expenses associated with HHSC doing the disclosure if:
1. Contractor experiences a breach of system security involving information owned by HHSC for which disclosure or notification is required under section 521.053 of the Business and Commerce Code; or
2. Contractor experiences a breach of unsecured protected health information, as 45 C.F.R. §164.402 defines that phrase, and HHSC becomes responsible for doing the notification required by 45 C.F.R. §164.404. HHSC may, at its discretion, waive Contractor's payment of expenses associated with HHSC doing the disclosure.