Fees: the fees specified in the Order Form for
Client’s use of BSI Connect Plus.

The British Standards Institution
BSI CONNECT PLUS TERMS AND CONDITIONS

Initial Term: the period of 12 months commencing
on the Effective Date.

USE OF BSI CONNECT PLUS IS GOVERNED BY THESETERMS AND CONDITIONS (the ''TERMS''). ENTERING
INTO AN ORDER FORM BY INDICATING ACCEPTANCEONLINE CREATES A BINDING AGREEMENT BETWEEN THE
CLIENTAND BSI.
1.

DEFINITIONS AND INTERPRETATION

1.1

The following definitions apply to these Terms:

Intellectual Property Rights: any and all present
and future, patents, inventions, know- how, trade
secrets and other confidential information,
trademarks, service marks, logos, emblems,badges, mascots, insignia, identifying music andsounds, get-up, domain names, business names,
trade names, moral rights, performance rights,
registered designs, copyrights, database rights,
design rights and other intellectual property rightsof whatever nature, in each case whether registeredor unregistered and including applications forregistration, and all rights or forms of protection
having equivalent or similar effect anywhere in theworld.

Agreement: the agreement for Client’s use of BSI
Connect Plus formed when the Order Form andthese Terms are taken together.
Authorised Users: those fixed number of Client
employees, agents and independent contractors
authorised to use BSI Connect Plus as set out in theOrder Form.

Order Form: the document completed either: (i)as part of a BSI proposal or (ii) presented online at
the time of purchasing a subscription to BSI Connect
Plus, containing Client specific information, such as
Fees, invoicing arrangement, and, number ofAuthorised Users.

BSI: BSI Assurance UK Limited a company
incorporated in England and Wales (company
number 780), whose registered office is 389
Chiswick High Road, Chiswick, London, W4 4AL.

Party: BSI or Client.

Business Day: a day that is a normal working
day for the BSI supporting office managing
Client’s subscription to BSI Connect Plus,
excluding any locally observed holidays
within the country where such an office islocated.

Renewal Term: each successive period of 12months following the end of the Initial Term.
Subscription Term: The Initial Term or a Renewal
Term.

Business Hours: 9.00 am to 5.00 pm eachBusiness Day.

Virus: any code or malware whose purpose isto disable a computer or network or adversely
affect its performance such as a computervirus, worm, 'trojan horse', back door or
similar item which may impair or otherwise
adversely affect the operation of any
computer or network, prevent or hinderaccess to any program or data, impair theoperation of any program or the reliability ofany data (whether by re-arranging within thecomputer or any storage medium or device,altering or erasing, the program or data inwhole or part or otherwise).

Client: the organisation that subscribes to theuse of BSI Connect Plus via an Order Formand agrees to be bound by these Terms.
Client Data: the data provided/transferred to BSI
by or on behalf of the Client as part of Client’s useof BSI Connect Plus.
Data Processing Addendum: the additionalterms attached as Schedule 1 to these Terms andincorporated by reference.
Documents: means the technical materials
provided by BSI to the Client in electronic
form describing the use and operation of BSI
Connect Plus.
Effective Date: either:(i) the date of the last
signature to an Order Form or (ii) the date the Order
Form is accepted online as part of an order for BSI
Connect Plus.

1.2

The clause headings in these Terms are included forconvenience only and shall not affect theinterpretation of these Terms.

1.3

A person includes a natural person, corporate orunincorporated body (whether or not having
separate legal personality) and that person's
personal representatives, successors and permitted
assigns.

Terms and Conditions

Page 1 of 9

BSI Connect Plus Terms and Conditions
1.4

Unless the context otherwise requires, words in the
singular shall include the plural and, in the plural,shall include the singular and a reference to one
gender shall include a reference to the othergenders.

1.5

A reference to any Party shall include that Party's
personal representatives, successors and permitted
assigns.

1.6

A reference to a statute or statutory provision is areference to it as amended or re-enacted. A
reference to a statute or statutory provision includes
all subordinate legislation made under that statuteor statutory provision.

1.7

Any words following the terms including, include,in particular, for example or any similar
expression shall be construed as illustrative andshall not limit the sense of the words, description,
definition, phrase or term preceding those terms.

2.

PROVISION OF BSI CONNECT PLUS

2.1

In consideration of the Fees paid by Client to BSI
and Client’s continued compliance with theseTerms, BSI hereby grants to the Client a nonexclusive, revocable, non-transferable, nonsublicensable right for the Subscription Term topermit Authorised Users, solely for the Client's
internal business operations, to:(i) use BSI Connect
Plus; and (ii) use the Documents which shall include
but is not limited to making sufficient copies as arenecessary for Client;

2.2

All rights not expressly granted by BSI to the Client
to use BSI Connect Plus are reserved to BSI. Client
shall not have the right to modify, translate, reverse
engineer, disassemble or decompile any portion of
BSI Connect Plus. The Client shall not have the rightto (i) license, sublicense, sell, resell, transfer,assign, distribute or otherwise commercially exploit
or make available BSI Connect Plus to any third
party in any way; and (ii) ''frame'' or ''mirror'' any
content from BSI Connect Plus on any server orwireless or internet based device. BSI reserves theright to make changes to any part of BSI Connect
Plus that it deems necessary or useful and notify the
Client five (5) Business Days ahead of materialchanges taking place.

2.3

Client grants to BSI a worldwide, perpetual,irrevocable, royalty-free license to use andincorporate into BSI Connect Plus any suggestion,enhancement request, recommendation, correction
or other feedback provided by Client or its
Authorised Users relating to the operation of BSI
Connect Plus.

3.

ACCESS AND AUTHORISED USERS

3.1

BSI Connect Plus shall be accessible from the online
location or such other hosted location notified to the
Client. Client will ensure that all Authorised Users
are made aware of and comply with any additionalterms of use or applicable privacy policy that may
be posted at a user’s point of access.

3.2

BSI shall use reasonable endeavours to make BSI
Connect Plus accessible to Authorised Users 24hours a day, seven days a week, except for: (i)planned maintenance; and (ii) emergency
maintenance performed outside Business Hours.

3.3

The Client undertakes that:
3.3.1 the maximum number of Authorised Users
that it permits to access and use BSI Connect
Plus and the Documents shall not exceed thenumber of users specified in the Order Form;
and3.3.2 it shall permit BSI or BSI's designatedauditor to audit the Client’s use of BSI
Connect Plus in order to confirm compliancewith these Terms. Each such audit may be
conducted no more than once per quarter,
at BSI's expense, and this right shall be
exercised with reasonable prior notice, insuch a manner as not to substantiallyinterfere with the Client's normal conduct ofbusiness.

4.

SUPPORT SERVICES

4.1

BSI shall provide: (i) an e-mail address to raise any
problems encountered during the use of BSI
Connect Plus and (ii) access to self-learningmaterial. BSI shall use reasonable endeavours todiagnose and fix reported issues or answer any
questions related to BSI Connect Plus that arepresented to the help desk but does not guaranteethat the Client will receive a particular outcome.

4.2

Client acknowledges that the provision of BSI
Connect Plus is dependent on access to various third
party services (including third party hosting
providers such as AWS) and the Client agrees that
BSI is not responsible for the non-availability,
delays, failures or interruption affecting BSI Connect
Plus or the performance of BSI Connect Plus causedby any such third party services, errors, anomalies
or bugs in software, hardware or the Internet on
which BSI Connect Plus relies as BSI does notcontrol such third party services and such errors orbugs are inherent in the use of such software,
hardware and the Internet. Accordingly, any nonavailability, delays, failures or interruption affecting
BSI Connect Plus as a result of the foregoing shallnot constitute a breach by BSI of its warranties in

Terms and Conditions

Page 2 of 9

BSI Connect Plus Terms and Conditions
this Agreement and shall not entitle the Client toterminate the Agreement under clause 8.2.
5.

WARRANTIES,REPRESENTATIONSEXCLUSIVE REMEDIES

5.1

BSI warrants that:

6.2

Except as expressly set forth herein, no express or
implied license or right of any kind is granted to the
Client regarding BSI Connect Plus or any part
thereof, including any right to obtain possession of
any source code, data or other technical material
relating to BSI Connect Plus.

6.3

Client grants BSI a non-exclusive, worldwide,royalty-free and fully paid license (a) to use the
Client Data as necessary for purposes of providing
BSI Connect Plus and (b) to use the Client Data (i)to provide BSI Connect Plus and to perform its
obligations under the Agreement and (ii) for
research and development purposes, including but
not limited to measuring and improving theeffectiveness of BSI’s products and services.

7.

CHARGES AND PAYMENT

7.1

BSI shall invoice the Client for the Fees as set out in
the Order Form, and the Client shall pay the Fees
within 30 days from the date of an invoice which is
not the subject of a genuine dispute.

7.2

If BSI has not received payment within 30 days ofthe due date, without prejudice to any other rights
and remedies:AND

5.1.1 BSI Connect Plus shall comply with allapplicable governing laws and regulations;and5.1.2 BSI Connect Plus shall perform materially inaccordance with the Documentation.
5.2

If a breach of the above warranties substantiallyinterferes with the Client’s use of the Connect Plus
and Client notifies BSI with reference specifically tosuch warranties, BSI will offer, and Client shall havethe option of either (i) extending the Subscription
Term for the length of the affected period from BSI’s
receipt of such notice at no additional cost or
expense to the Client or (ii) terminating thesubscription and requesting a refund of a pro-rata
portion of the Fee relating to the affected period
from BSI’s receipt of such notice and the unexpired
Subscription Term.

5.3

Each Party represents that it has the right to enter
into the Agreement and carry out its obligations
under the Agreement.

5.4

The Client assumes sole responsibility for results
obtained from the use of BSI Connect Plus and forconclusions drawn or decisions taken from such use
and any reliance on the results obtained from theuse of BSI Connect Plus is at Client’s own risk.

5.5

Except for the express warranties provided in thisAgreement, BSI Connect Plus is provided and madeavailable ''as is'' and the warranties contained in theAgreement are in lieu of all other warranties,
representations or conditions, express, implied,statutory or otherwise, including but not limited to,those implied warranties of merchantability andfitness for a particular purpose, all of which are
expressly disclaimed. BSI does not represent that
BSI Connect Plus will be uninterrupted or error freeor meet the Client’s specific requirements.

6.

PROPRIETARY RIGHTS

6.1

All Intellectual Property Rights belonging to a Partyprior to entering into the Agreement shall remain
vested and remain the property of that Party. The
Client Data hosted by BSI as part of BSI Connect
Plus, and all worldwide Intellectual Property Rights
in it, is the exclusive property of the Client. All rights
in and to the Client Data not expressly granted to
BSI in this Agreement remain with the Client.

7.2.1 BSI may, without liability to the Client,suspend the Client's access to BSI Connect
Plus while the amounts due remain unpaid;
and7.2.2 interest shall accrue on a daily basis on suchdue amounts at an annual rate equal to 3%
over the then current base lending rate of
Barclays Bank plc (or its successor) fromtime to time, commencing on the due dateand continuing until fully paid, whether
before or after judgment.
7.3

The Fees do not include, and the Client is solely
responsible for, all applicable taxes including value
added tax and other sales taxes.

7.4

BSI shall be entitled to increase the Fees at the startof each Renewal Term (i) in line with the annual
increase in the UK Retail Prices Index without
notice; and (ii) upon 60 days' prior notice to the
Client where the increase exceeds the annual
increase in the UK Retail Prices Index, and the Order
Form shall be deemed to have been amended
accordingly.

7.5

The number of Authorised Users cannot be
increased during a Subscription Term. If additional
Authorised Users are required, Client shall subscribe
to a new Agreement with a new Subscription Termwith such agreement superseding Client’s existing
Agreement which shall be terminated upon entry
into the new Agreement. Any pre-paid Fees relating

Terms and Conditions

Page 3 of 9

BSI Connect Plus Terms and Conditions
to the remaining Subscription Term of theterminated agreement shall be refunded to the
Client.
8.

TERM AND TERMINATION

8.1

The Agreement shall, unless otherwise terminatedas provided in this clause 8, commence on the
Effective Date and continue for the duration of each
Subscription Term unless either Party notifies theother Party of termination, in writing, at least 30
days before the end of a Subscription Term, inwhich case the Agreement shall terminate upon the
expiry of the applicable Subscription Term.

8.2

8.3

Either Party may terminate the Agreement at any
time on written notice to the other if the other: (i)is in material or persistent breach of any of theseTerms and either that breach is incapable ofremedy, or the other Party fails to remedy thatbreach within 30 days after receiving written noticerequiring it to remedy that breach; or (ii) becomesinsolvent, or is subject to an order or a resolution
for its liquidation, administration, winding-up or
dissolution (otherwise than for the purposes of asolvent amalgamation or reconstruction), or has anadministrative or other receiver, manager, trustee,liquidator, administrator or similar officer appointed
over all or any substantial part of its assets, orenters into or proposes any composition or
arrangement with its creditors generally, or issubject to any analogous event or proceeding in any
applicable jurisdiction.
On termination of the Agreement:termination, the Fees for the remainder of the
Subscription Term.
9.

CONFIDENTIALITY

9.1

Each Party may be given access to confidential
information from the other Party in order to perform
its obligations under these Terms. A Party's
confidential information shall not be deemed toinclude information that:
9.1.1 is or becomes publicly known other than
through any act or omission of the receiving
Party;
9.1.2 was in the other Party's lawful possession
before the disclosure;
9.1.3 is lawfully disclosed to the receiving Party bya third Party without restriction on
disclosure; or
9.1.4 is independently developed by the otherParty, and such independent development
can be shown by written evidence.

9.2

Subject to clause 9.3, each Party shall hold theother's confidential information in confidence andnot make the other's confidential information
available to any third party, or use the other'sconfidential information for any purpose other than
the implementation of these Terms.

9.3

A Party may disclose confidential information to theextent such confidential information is required tobe disclosed by law, by any governmental or otherregulatory authority or by a court or other authority
of competent jurisdiction, provided that, to theextent it is legally permitted to do so, it gives theother Party as much notice of such disclosure as
possible and, where notice of disclosure is notprohibited and is given in accordance with thisclause 9.3, it takes into account the reasonable
requests of the other Party in relation to the content
of such disclosure.

9.4

The provisions of this clause 9 shall survive
termination of the Agreement, however arising.

10.

LIMITATION OF LIABILITY

10.1

Nothing in these Terms limit any liability whichcannot legally be limited, including, but not limited
to, liability for: (i)death or personal injury caused by
negligence;(ii)fraudorfraudulent
misrepresentation; or (iii) any liabilities whichcannot be excluded by statute.

10.2

Subject to clauses 10.1:

8.3.1 all licences granted under these Terms shallimmediately terminate and the Client shallimmediately cease all use of BSI Connect
Plus and/or the Documents;
8.3.2 BSI may destroy or otherwise dispose of anyof the Client Data in its possession; and8.3.3 any provision of these Terms that expressly
or by implication is intended to come into orcontinue in force on or after termination of
the Agreement shall remain in full force andeffect.
8.4

8.5

Termination of the Agreement shall not affect anyof the rights, remedies, obligations or liabilities of
the Parties that have accrued up to the date of
termination, including the right to claim damages inrespect of any breach of the Terms which existed ator before the date of termination.
If BSI terminates the Agreement for the Client's
breach under clause 8.2 above, then, in addition to
any other remedies BSI may have at law or inequity, the Client must pay to BSI within 30 days ofTerms and Conditions

Page 4 of 9

BSI Connect Plus Terms and Conditions
10.2.1 BSI shall not be liable whether in tort(including for negligence or breach ofstatutory duty), contract, misrepresentation,
restitution or otherwise for any loss of
profits, loss of business, depletion of
goodwill and/or similar losses or loss or
corruption of data or information, or pureeconomic loss, or for any special, indirect orconsequential loss, costs, damages, charges
or expenses however arising; and10.2.2 BSI's total aggregate liability in contract, tort(including negligence or breach of statutoryduty), misrepresentation, restitution orotherwise, arising in connection with theseTerms shall be limited to the total Fees paidor payable for BSI Connect Plus for the
Subscription Term.
10.3

This clause 10 shall survive termination of theAgreement.

11.

DATA PROTECTION

11.1

To the extent Client Data includes Personal Data,
the Data Processing Addendum shall apply, and theParties shall comply with the provisions therein.

12.

FORCE MAJEURE
BSI shall have no liability to the Client under theseTerms if it is prevented from or delayed inperforming its obligations under these Terms, orfrom carrying on its business, by acts, events,
omissions or accidents beyond its reasonable
control, including, without limitation, strikes, lockouts or other industrial disputes (whether involving
the workforce of BSI or any other party), failure ofa utility service or transport or telecommunications
network, act of God, war, riot, civil commotion,
malicious damage, compliance with any law or
governmental order, rule, regulation or direction,
accident, breakdown of plant or machinery, fire,
flood, storm or default of BSI's sub-contractors,
provided that the Client is notified of such an event
and its expected duration.

13.

shall prevent or restrict the further exercise of thator any other right or remedy.
15.

SEVERANCE

15.1

If any provision or part-provision of these Terms isor becomes invalid, illegal or unenforceable, it shallbe deemed deleted, but that shall not affect thevalidity and enforceability of the rest of theseTerms.

16.

ENTIRE AGREEMENT

16.1

The Agreement constitutes the entire agreement
between the Parties and supersedes andextinguishes all previous agreements, promises,
assurances, warranties, representations andunderstandings between them, whether written ororal, relating to its subject matter.

16.2

Each Party acknowledges that in entering into theAgreement it does not rely on, and shall have noremedies in respect of, any statement,
representation, assurance or warranty (whether
made innocently or negligently) that is not set out
in the Agreement.

17.

ASSIGNMENT

17.1

The Client shall not, without the prior writtenconsent of BSI, assign, transfer, charge, subcontract or deal in any other manner(including a
grant to affiliates, subsidiaries or successors-ininterest of a right to use BSI Connect Plus) with allor any of its rights or obligations under these Terms,
such consent may be withheld in BSI's sole
discretion and subject to any necessary
recalculation of the Fees.

17.2

BSI may at any time assign, transfer, charge, subcontract or deal in any other manner with all or anyof its rights or obligations under the Agreement.

18.

NO PARTNERSHIP OR AGENCY
Nothing in these Terms is intended to or shall
operate to create a partnership between the Parties,
or authorise either Party to act as agent for theother, and neither Party shall have the authority to
act in the name or on behalf of or otherwise to bindthe other in any way (including, but not limited to,the making of any representation or warranty, theassumption of any obligation or liability and theexercise of any right or power).

VARIATION
No variation of the Agreement shall be effective
unless it is in writing and signed by the Parties.

14.

WAIVERNo failure or delay by a Party to exercise any rightor remedy provided under these Terms or by law
shall constitute a waiver of that or any other rightor remedy, nor shall it prevent or restrict the further
exercise of that or any other right or remedy. No
single or partial exercise of such right or remedy

19.

THIRD PARTY RIGHTS
These Terms do not confer any rights on any person
or party, other than the Parties to the Agreement

Terms and Conditions

Page 5 of 9

BSI Connect Plus Terms and Conditions
and, where applicable,
permitted assigns.

their successors

and

20.

NOTICES

20.1

Any notice required to be given under these Terms
shall be in writing and shall be delivered by hand or
sent by post or email to the other Party at its
address set out in these Terms or specified in theOrder Form, or such other address as may havebeen notified by that Party for such purposes during
the Subscription Term.

20.2

A correctly addressed notice sent by pre-paid firstclass post or recorded delivery post shall be deemed
to have been received at the time at which it would
have been delivered in the normal course of post. A
notice sent by email shall be deemed to have been
received at the time of transmission (as shown by
the time sent in respect of an email).

21.

GOVERNING LAW
The Agreement and any dispute or claim arising outof or in connection with it or its subject matter orformation (including non-contractual disputes orclaims) shall be governed by and construed inaccordance with the law of England and Wales.

22.

JURISDICTION
Each Party irrevocably agrees that the courts ofEngland and Wales shall have exclusive jurisdiction
to settle any dispute or claim arising out of or inconnection with these Terms or its subject matteror formation (including non-contractual disputes orclaims).

Terms and Conditions

Page 6 of 9

BSI Connect Plus Terms and Conditions
SCHEDULE 1

Personal
Data

DATA PROCESSING ADDENDUM
1.

DEFINITIONSIn this Data Processing Addendum, terms used but
not defined shall have the meaning given in theAgreement. The following definitions shall apply inthis addendum:

Controller,
shall have the meaning given to those
Processor,
terms in the applicable Data Protection
Supervisory Laws;
Authority,
and Data
Subject
Data
Protection
Laws

means (a) any law, statute, declaration,
decree, directive, legislative enactment,
order, ordinance, regulation, rule or otherbinding
restriction(asamended,consolidated or re-enacted from time totime) which relates to the protection ofindividuals with regards to the Processingof Personal Data to which a Party is subject,including (where applicable) the GDPR; and(b) any code of practice or guidance
published by a relevant Supervisory
Authority from time to time;

GDPR

means Regulation (EU) 2016/679 of theEuropean Parliament in relation to theprocessing of the personal data of natural
persons;

Lossesmeans all losses, fines, penalties, liabilities,
damages, costs, charges, claims, amounts
paid in settlement and expenses (including
legal fees (on a solicitor/client basis),
disbursements, costs of investigation(including forensic investigation), litigation,
settlement (including ex gratia payments),
judgment, interest and penalties), otherprofessional charges and expenses,
disbursements, cost of breach notification
including notifications to the data subject,
cost of complaints handling (including
providing Data Subjects with credit
reference checks, setting up contact
centres (e.g. call centres) and making ex
gratia payments), all whether arising incontract, tort (including negligence),
breach of statutory duty or otherwise;

Permitted
Purposemeans the purpose of the Processing as set
out in more detail in the Data Protection
Particulars;means any personal data (as defined in the
Data Protection Laws) Processed by either
Party in connection with the Services, andfor the purposes of this Data Processing
Addendum includes Sensitive Personal
Data;

Personal
has the meaning set out in the Data
Data Breach Protection Laws;
Personnelmeans all persons engaged or employedfrom time to time by BSI in connection withtheServices,
includingemployees,
consultants, contractors and permitted
agents;Processing

has the meaning set out in the Data
Protection Laws (and Process andProcessed
shallbeconstrued
accordingly);

Restricted
Countrymeans a country, territory or jurisdiction
outside of the European Economic Area
which the EU Commission has not deemed
to provide adequate protection inaccordance with Article 45(1) of the GDPR
(as applicable);Sensitive
PersonalDatameans Personal Data that reveals suchspecial categories of data as are listed in
Article 9(1) of the GDPR;

Servicesmeans BSI’s provision to Client of the useof or access to the product identified in theOrder Form pursuant to the Agreement;
andThird Party
Requestmeans a written request from any third
party for disclosure of Personal Data wherecompliance with such request is required or
purported to be required by law or
regulation.

2.

DATA PROTECTION

2.1

Arrangement between the Parties
2.1.1 The Parties acknowledge that theirclassification under the Data Protection Laws
is based on the factual arrangement
between them.
2.1.2 In respect of the Services, the Parties hereby
agree that Client shall act as a Controller and
BSI shall act as a Processor where BSI is
Processing the Personal Data on behalf ofClient in relation to the Permitted Purpose inconnection with the performance of its

Terms and Conditions

Page 7 of 9

BSI Connect Plus Terms and Conditions
obligations under this Data Processing
Addendum.

perform the Services in accordancewith this Data Processing Addendum;

2.1.3 Each Party shall in performing its obligations
under this Data Processing Addendum,
comply with the obligations imposed upon it
under the Data Protection Laws.
2.1.4 Each Party acknowledges and agrees thatthe type of Personal Data Processedpursuant to this Data Processing Addendum
and the subject matter, duration, nature andpurpose of the Processing, and thecategories of Data Subjects, are as describedin the table below.

Subject matterand duration ofProcessing

Delivery of the Service during theterm of the Agreement for use by, andaccess by, the Client and its
Authorised Users.

Nature andpurpose ofProcessing

BSI’s processing activities will belimited to the storing of Personal Data
that may form part of the Client Data
that is uploaded to BSI’s systems as
part of Client’s access to the Services
and making such Client Data available
for Client’s retrieval again via Client’s
own access to the Services.
BSI will have no right to use any such
Personal Data for its own purposes orat its own command.

Type of Personal
Data being
Processed- Names and email addresses- Narratives and incident
descriptions about Data Subjects
included within Client Data

Categories ofData Subjects- Client’s employees, agents andadvisors; Client’s customers;
vendors and subcontractors ofClient (who are natural persons);
Authorised Users.

2.2

(b)

ensure that all privacy notices havebeen given (and/or, as applicable,
consents obtained) and are sufficientin scope to allow BSI to Process
Personal Data as required inconnection with the provision of theServices under this Data Processing
Addendum and in accordance with
the Data Protection Laws;(c)ensure that all Personal Data
disclosed or transferred to, or
accessed by, BSI is accurate, up-todate, adequate, relevant and notexcessive to enable BSI to process
Personal Data as required for BSI to
perform the Services in accordancewith this Data Processing Addendum;(d)maintain technical and organisational
security measures sufficient tocomply with the obligations imposedon the Controller by Data Protection
Laws; and(e)

not do anything which shall damage
BSI’s reputation.

2.2.2 For the avoidance of doubt, the Client shallmake all required notification(s) to therelevant Supervisory Authority in relation to
its processing of Personal Data related to theServices.
2.3

Data Processor Obligations
2.3.1 In relation to the Services, to the extent that
BSI Processes any Personal Data as a
Processor on behalf of Client for the purposeof performing the Services under this Data
Processing Addendum, BSI undertakes to
the Client that BSI shall, per GDPR Art. 28:

Data Controller Obligations(a)only Process Personal Data for and on
behalf of Client for the purposes of
performing its obligations under thisData Processing Agreement and onlyinaccordancewith
Client's
instructions from time to time, unlessotherwise required by law;(b)

inform the Client immediately if itconsiders any of the Client's
instructions infringes Data Protection
Laws;

(c)

implement and maintain appropriatetechnical and organisational security

2.2.1 Without limiting the generality of theobligations set out in paragraph 2.1 above,
the Client shall:(a)ensure that it is not subject to any
prohibition or restriction which
would: (i) prevent or restrict it fromdisclosing or transferring Personal
Data to BSI; (ii) prevent or restrict itfrom granting BSI access to Personal
Data; and/or (iii) prevent or restrict
BSI from Processing Personal Data, ineach case as required for BSI to

Terms and Conditions

Page 8 of 9

BSI Connect Plus Terms and Conditions
measures to safeguard against any
unauthorised or unlawful Processingof Personal Data;
(d)

(e)

(f)

(g)

(j)

take all reasonable steps to ensure
the reliability and integrity of any of
its Personnel who have access to
Personal Data and ensure that only
Personnel who are required to assistin performing the Services haveaccess to such Personal Data;
ensure that any of its staff and/or
contractors who have access to
Personal Data have entered into
appropriate contractually binding
confidentiality undertakings;
not disclose Personal Data to a third
party unless the third party agrees toterms which are substantially thesame as the terms set out in this Data
Processing Addendum or in responseto Third Party Requests where BSI is
prohibited by law or regulation fromnotifying Client;at Client’s direction, arrange for the
prompt and safe return and/or securepermanent destruction of all Personal
Data, together with all copies in its
possession or control (if any) withintwenty eight (28) days of suchdirection, except where BSI isrequired by applicable law to retain
any of such Personal Data;(h)not transfer any Personal Data to a
Restricted Country unless suchtransfer is made in compliance with
the Data Protection Laws;(i)at Client’s request use reasonableendeavours to assist Client to comply
with the obligations imposed on
Client by or in relation to:(i)the rights of Data Subjects;(ii)

assistance to the relevantSupervisory Authority; and/or

(iii)

data
protection
assessments

notify Client promptly upon becoming
aware of any Personal Data Breach,
and:
(i)

implement any measuresnecessary to restore thesecurityofcompromised
Personal Data; and(ii)

assist Client to make any
notifications to the relevantSupervisory Authority andaffected Data Subjects.

2.3.2 This Data Processing Addendum shall notaffect any services (or the obligations owed
in respect of them) under the Agreementthat are not related to the Processing of
Personal Data.
3.

INDEMNITY

3.1

The Client shall indemnify on demand and keep BSI
indemnified against any Losses incurred by,awarded against or agreed to be paid by BSI to theextent arising from the Client’s failure to comply
with the Data Protection Laws.

3.2

BSI shall indemnify on demand and keep the Client
indemnified against any Losses incurred by,awarded against or agreed to be paid by the Clientto the extent arising from BSI’s failure to comply with
the Data Protection Laws.

impactprovided that any such assistanceshall be provided to Client subject toa fee payable to BSI to be agreed
between the Parties; andTerms and Conditions

Page 9 of 9