Use of other processors. 7.1 The Customer hereby grants the Contractor general authorization to engage other processors for the processing of Customer Data. Annex 2 contains an overview of any other processors used at the time of entering into this Agreement. As a general rule, the engagement of service providers who inspect or maintain data processing facilities or processes or other ancillary services that do not entail the processing of Customer Data does not require any authorization, even if access to Customer Data cannot be excluded, provided that the Contractor takes appropriate measures to protect the confidentiality of Customer Data. 7.2 The Contractor shall notify the Customer by e-mail about any intended changes with regard to the engagement or replacement of other processors. The Customer has the right to object, on a case-by-case basis, to the engagement of any potential other processor. However, the Customer may only object if it has good reason to do so and demonstrates such reason to the Contractor. The Customer's right to object to a specific engagement will lapse if the Customer fails to object within 14 days of receiving such notification. Where the Customer raises an objection, the Contractor will be entitled to terminate the Main Agreement and this Agreement by giving four weeks' notice, subject to the provisions of the Main Agreement. 7.3 Any Customer objections must be raised in text form via the portal. 7.4 The agreement between the Contractor and the other processor must impose the same obligations on the other processor that are imposed on the Contractor under this Agreement. The parties agree that this requirement will be deemed to have been met if said agreement provides for a level of protection that corresponds to the level of protection under this Agreement, or the obligations stipulated in Article 28(3) GDPR are imposed on the other processor. 7.5 Subject to compliance with the requirements of clause 2.5of this Agreement, the provisions of this clause 7 shall also apply if another processor in a third country is engaged. In such a case, the Contractor shall be entitled and – insofar as the requirements of clause 2.5 are not otherwise met – obligated to enter into an agreement with the other processor incorporating the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including Module 3 (Transfer processor to processor). The parties agree that such an agreement also meets the requirements under clause7.
Appears in 2 contracts
Sources: Data Processing Agreement, Data Processing Agreement
Use of other processors. 7.1 The Customer hereby grants the Contractor general authorization to engage other processors for the processing of Customer Data. Annex 2 contains an overview of any other additional processors used at the time of entering into this Agreement. As a general rule, the engagement of service providers who inspect or maintain data processing facilities or processes or other ancillary services that do not entail the processing of Customer Data does do not require any authorization, even if access to Customer Data cannot be excluded, provided that the Contractor takes appropriate measures to protect the confidentiality of Customer Data.
7.2 The Contractor shall notify the Customer by e-mail about any intended changes with regard to the engagement or replacement of other additional processors. The Customer has the right to object, on a case-by-case basis, to the engagement of any potential other additional processor. However, the Customer may only object if it has good reason to do so and demonstrates such reason to the Contractor. The Customer's right to object to a specific engagement will lapse if the Customer fails to object within 14 days of receiving such notification. Where the Customer raises an objection, the Contractor will be entitled to terminate the Main Agreement and this Agreement by giving four weeks' notice, subject to the provisions of the Main Agreement.
7.3 Any Customer objections must be raised in text form (Textform) via the portal.
7.4 The agreement between the Contractor and the other additional processor must impose the same obligations on the other additional processor that are imposed on the Contractor under this Agreement. The parties agree that this requirement will be deemed to have been met if said agreement provides for a level of protection that corresponds to the level of protection under this Agreement, or the obligations stipulated in Article 28(3) GDPR are imposed on the other additional processor.
7.5 Subject to In compliance with the requirements under clause 2.5 of clause 2.5of this Agreementcontract, the provisions of regulations in this clause 7 shall also apply if another processor is involved in a third country is engagedcountry. In such a case, the Contractor shall be contractor is entitled and – - insofar as the requirements of clause 2.5 are not otherwise met – obligated - to enter into an agreement a contract with the other processor incorporating additional processor, including the standard contractual clauses for the transfer of personal data to third countries pursuant to in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council in accordance with the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including Module module 3 (Transfer processor transfer of processors to processorprocessors). The parties agree that such an agreement a contract also meets the requirements under clause7of clause 7.4. The client agrees to contribute to the fulfillment of the requirements of Article 49 GDPR to the extent necessary. 8 Rights of data subjects
8.1 To the extent that this is reasonable, the Contractor shall assist the Customer by means of technical and organizational measures to comply with its obligation to respond to requests from data subjects to exercise their rights.
8.2 Where a data subject makes a request to exercise their rights directly vis-à-vis the Contractor, the Contractor shall forward such request in a timely manner to the Customer, provided that the Contractor is able to reliably verify said data subject's identity and the verification of said data subject's association with the Customer is feasible and can reasonably be expected of the Contractor.
8.3 To the extent reasonable and necessary, the Contractor shall enable the Customer to rectify or erase Customer Data, or restrict their further processing, and compensate the Customer for any documented expenses and costs resulting therefrom, or, at the Customer's request, rectify or block Customer Data or restrict their further processing if and to the extent that the Customer is unable to do so.
8.4 Where the data subject, in relation to the Customer, has a right to data portability with regard to the Customer Data pursuant to Article 20 GDPR, the Contractor shall assist the Customer, to the extent reasonable and necessary and for compensation of any documented expenses and costs resulting therefrom, in providing the Customer Data in a commonly used and machine-readable format.
Appears in 1 contract
Use of other processors. 7.1 The Customer hereby grants the Contractor general authorization to engage other processors for the processing of Customer Data. Annex 2 contains an overview of any other additional processors used at the time of entering into this Agreement. As a general rule, the engagement of service providers who inspect or maintain data processing facilities or processes or other ancillary services that do not entail the processing of Customer Data does do not require any authorization, even if access to Customer Data cannot be excluded, provided that the Contractor takes appropriate measures to protect the confidentiality of Customer Data.
7.2 The Contractor shall notify the Customer by e-mail about any intended changes with regard to the engagement or replacement of other additional processors. The Customer has the right to object, on a case-by-case basis, to the engagement of any potential other additional processor. However, the Customer may only object if it has good reason to do so and demonstrates such reason to the Contractor. The Customer's right to object to a specific engagement will lapse if the Customer fails to object within 14 days of receiving such notification. Where the Customer raises an objection, the Contractor will be entitled to terminate the Main Agreement and this Agreement by giving four weeks' notice, subject to the provisions of the Main Agreement.
7.3 Any Customer objections must be raised in text form (Textform) via the portal.
7.4 The agreement between the Contractor and the other additional processor must impose the same obligations on the other additional processor that are imposed on the Contractor under this Agreement. The parties agree that this requirement will be deemed to have been met if said agreement provides for a level of protection that corresponds to the level of protection under this Agreement, or the obligations stipulated in Article 28(3) GDPR are imposed on the other additional processor.
7.5 Subject to compliance with the requirements of clause 2.5of this Agreement, the provisions of this clause 7 shall also apply if another processor in a third country is engaged. In such a case, the Contractor shall be entitled and – insofar as the requirements of clause 2.5 are not otherwise met – obligated to enter into an agreement with the other processor incorporating the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including Module 3 (Transfer processor to processor). The parties agree that such an agreement also meets the requirements under clause7.
Appears in 1 contract
Sources: Data Processing Agreement