Effective Date: the date of the last signature toan Order Form.
The British Standards Institution
BSI CONNECT CUSTOM TERMS AND CONDITIONSUSE OF BSI CONNECT CUSTOM IS GOVERNED BY THESETERMS AND CONDITIONS (the TERMS). ENTERING INTO
AN ORDER FORM BYEXECUTING A BSI PROPOSAL
CREATES A BINDING AGREEMENT BETWEEN THE PARTIESNAMED IN THE ORDER FORM.
1.

DEFINITIONS AND INTERPRETATION

1.1

The following definitions apply to these Terms:
Administrative Users: those Authorised Users
who are authorised to access the Support Services
on Client’s behalf as set out in the Order Form or
notified to BSI in writing from time to time.
Agreement: the agreement for Client’s use of
BSI Connect Custom formed when the Order Formand these Terms are taken together.
Authorised Users: those fixed number of Client
employees, agents and independent contractors
authorised to use BSI Connect Custom as set out
in the Order Form.
BSI: BSI Assurance UK Limited a company
incorporated in England and Wales (company
number 780), whose registered office is 389
Chiswick High Road, Chiswick, London, W4 4AL.
Business Day: a day that is a normal working
day for the BSI supporting office managing
Client’s subscription to BSI Connect Custom,
excluding any locally observed holidays within the
country where such an office is located.
Business Hours: 9.00 am to 5.00 pm eachBusiness Day.
Client: the organisation who subscribes to theuse of BSI Connect Custom via an Order Form andagrees to be bound by these Terms.

Fees: the fees specified in the Order Form for
Client’s use of BSI Connect Custom.
Implementation
Period:theperiodcommencing on the Effective Date and ending
within 180 days thereafter.
Initial Term: the period of 36 months
commencing after the Second Training Date.
Intellectual Property Rights: any and allpresent and future, patents, inventions, knowhow, trade secrets and other confidential
information, trademarks, service marks, logos,
emblems, badges, mascots, insignia, identifying
music and sounds, get-up, domain names,business names, trade names, moral rights,
performancerights,registered
designs,
copyrights, database rights, design rights andother intellectual property rights of whatevernature, in each case whether registered or
unregistered and including applications forregistration, and all rights or forms of protection
having equivalent or similar effect anywhere in theworld.
Order Form: the document completed as part ofa BSI proposal containing Client specificinformation, such as Fees, invoicing arrangement,
number of Authorised Users, and names of
Administrative Users.
Party: BSI or Client.
Renewal Term: each successive period of 12months following the end of the Initial Term.
Second Training Date: the date BSI delivers oris scheduled to deliver the second Training.
Subscription Term: The Initial Term or a
Renewal Term.
Support Services: those services described inclause 4.

Client Data: the data provided/transferred to BSI
by or on behalf of the Client as part of Client’s useof BSI Connect Custom.

Training: the specified training to be delivered by
BSI to the Administrative Users about the use of
BSI Connect Custom.

Data Processing Addendum: the additionalterms attached as Schedule 1 to these Terms andincorporated by reference.

Virus: any code or malware whose purpose is todisable a computer or network or adversely affectits performance such as a computer virus, worm,'trojan horse', back door or similar item which may
impair or otherwise adversely affect the operationof any computer or network, prevent or hinderaccess to any program or data, impair theDocuments: means the technical materials
provided by BSI to the Client in hard copy orelectronic form describing the use and operationof BSI Connect Custom.

Terms and Conditions

Page 1 of 9

operation of any program or the reliability of any
data (whether by re-arranging within thecomputer or any storage medium or device,altering or erasing, the program or data in wholeor part or otherwise).
1.2

The clause headings in these Terms are included
for convenience only and shall not affect theinterpretation of these Terms.

1.3

A person includes a natural person, corporate orunincorporated body (whether or not having
separate legal personality) and that person's
personal
representatives,
successors
andpermitted assigns.

1.4

Unless the context otherwise requires, words inthe singular shall include the plural and, in theplural, shall include the singular and a reference
to one gender shall include a reference to theother genders.

1.5

A reference to any Party shall include that Party's
personal
representatives,
successors
andpermitted assigns.

1.6

A reference to a statute or statutory provision is areference to it as amended or re-enacted. A
reference to a statute or statutory provision
includes all subordinate legislation made underthat statute or statutory provision.

1.7

Any words following the terms including,include, in particular for example or any
similar expression shall be construed as illustrativeand shall not limit the sense of the words,
description, definition, phrase or term preceding
those terms.

2.

PROVISION OF BSI CONNECT CUSTOM

2.1

In consideration of the Fees paid by Client to BSI
and Client’s continued compliance with theseTerms:
2.1.1

2.1.2

BSI hereby grants to the Client a nonexclusive, revocable, non-transferable,
non-sublicensable
right
for
the
Subscription Term to permit Authorised
Users, solely for the Client's internalbusiness operations, to:(i) use BSI
Connect Custom; and (ii) use theDocuments which shall include but is not
limited to making sufficient copies as arenecessary for Client;

2.1.3

BSI shall configure BSI Connect Custom
for Client’s use as specified in the Order
Form or as otherwise notified by Client to
BSI in writing; and2.1.4

BSI shall, during the first 12 months of
the Subscription Term only, provide theagreed Training.

2.2

All rights not expressly granted by BSI to the
Client to use BSI Connect Custom are reserved to
BSI. Client shall not have the right to modify,translate, reverse engineer, disassemble ordecompile any portion of BSI Connect Custom.
The Client shall not have the right to (i) license,
sublicense, sell, resell, transfer, assign, distributeor otherwise commercially exploit or makeavailable BSI Connect Custom to any third party
in any way; and (ii) frame or mirror

2.3

any content from BSI Connect Custom on any
server or wireless or internet based device. BSI
reserves the right to make changes to any part of
BSI Connect Custom that it deems necessary or
useful and notify the Administrative User five (5)Business Days ahead of material changes taking
place.

2.4

Client grants to BSI a worldwide, perpetual,irrevocable, royalty-free license to use andincorporate into BSI Connect Custom any
suggestion,enhancement
request,recommendation, correction or other feedback
provided by Client or its Authorised Users relating
to the operation of BSI Connect Custom.

3.

ACCESS AND AUTHORISED USERS

3.1

BSI Connect Custom shall be accessible from theonline location or such other hosted location
notified to the Client. Client will ensure that all
Authorised Users are made aware of and comply
with any additional terms of use or applicableprivacy policy that may be posted at a user’s pointof access.

3.2

BSI shall use reasonable endeavours to make BSI
Connect Custom accessible to Authorised Users 24hours a day, seven days a week, except for: (i)planned maintenance; and (ii) emergency
maintenance performed outside Business Hours.

3.3

The Client undertakes that:

BSI grants Client’s Administrative Users,
for the Subscription Term, the right toaccess the Support Services;

Terms and Conditions

3.3.1

the maximum number of Authorised
Users that it permits to access and use
BSI Connect Custom and the Documents
shall not exceed the number of users
specified in the Order Form; andPage 2 of 9

3.3.2it shall permit BSI or BSI's designatedauditor to audit the Client’s use of BSI
Connect Custom in order to confirm
compliance with these Terms. Each suchaudit may be conducted no more thanonce per quarter, at BSI's expense, andthis right shall be exercised withreasonable prior notice, in such a manner
as not to substantially interfere with the
Client's normal conduct of business.

4.

SUPPORT SERVICES,TRAINING

4.1

BSI shall provide: (i) a telephone and email help
desk during Business Hours, as a single point ofcontact for all issues concerning BSI Connect
Custom and (ii) access to self-learning material(the Support Services). BSI shall use reasonableendeavours to diagnose and fix reported issues oranswer any questions related to BSI Connect
Custom or Documents that are presented to thehelp desk but does not guarantee that the Client
will receive a particular outcome.

4.2

CONFIGURATION,

Client acknowledges that the provision of BSI
Connect Custom is dependent on access tovarious third party services (including third party
hosting providers such as AWS) and the Client
agrees that BSI is not responsible for the nonavailability, delays, failures or interruption
affecting BSI Connect Custom or the performanceof BSI Connect Custom caused by any such third
party services, errors, anomalies or bugs insoftware, hardware or the Internet on which BSI
Connect Custom relies as BSI does not control
such third party services and such errors or bugs
are inherent in the use of such software, hardware
and the Internet. Accordingly, any nonavailability, delays, failures or interruption
affecting BSI Connect Custom as a result of theforegoing shall not constitute a breach by BSI of
its warranties in this Agreement and shall notentitle the Client to terminate the Agreement
under clause 8.2.

4.3

BSI shall use reasonable endeavours to configure
BSI Connect Custom for the Client’s use within thetime frames agreed in an Order Form but in no
event later than the end of the Implementation
Period. Where Client requires BSI to provide
configuration
supportoutsideoftheImplementation Period, such support will bechargeable at BSI’s then rates for providing
professional services.

4.4

Training shall be conducted at the times andlocation agreed between the Parties and any
agreed training hours that have not been usedshall expire 12 months after the Effective Date and

BSI shall have no further obligation or liability inrelation to any Training after this period of time.
4.5

Client shall be liable for all losses incurred by BSI
from Client’s cancellation of any Training unless
BSI has been notified 28 Business Days prior tosuch cancellation.

5.

WARRANTIES, REPRESENTATIONSEXCLUSIVE REMEDIES

5.1

BSI warrants that:

AND

5.1.1

BSI Connect Custom shall comply with allapplicablegoverninglaws
andregulations; and

5.1.2

BSI Connect Custom shall performmaterially in accordance with theDocumentation.

5.2

If a breach of the above warranties substantiallyinterferes with the Client’s use of the BSI Connect
Custom and Client notifies BSI with reference
specifically to such warranties, BSI will offer, andClient shall have the option of either (i) extending
the Subscription Term for the length of theaffected period from BSI’s receipt of such noticeat no additional cost or expense to the Client or(ii) terminating the subscription and requesting a
refund of a pro-rata portion of the Fee relating to
the affected period from BSI’s receipt of such
notice and the unexpired Subscription Term.

5.3

Each Party represents that it has the right to enter
into the Agreement and carry out its obligations
under the Agreement.

5.4

The Client assumes sole responsibility for results
obtained from the use of BSI Connect Custom andfor conclusions drawn or decisions taken fromsuch use and any reliance on the results obtained
from the use of BSI Connect Custom is at Client’s
own risk.

5.5

Except for the express warranties provided in thisAgreement, BSI Connect Custom is provided andmade available as is and the warranties containedin the Agreement are in lieu of all otherwarranties, representations or conditions,express, implied, statutory or otherwise, including
but not limited to, those implied warranties ofmerchantability and fitness for a particularpurpose, all of which are expressly disclaimed. BSI
does not represent that BSI Connect Custom will
be uninterrupted or error free or meet the Client’s
specific requirements.

Terms and Conditions

Page 3 of 9

6.

PROPRIETARY RIGHTS

6.1

All Intellectual Property Rights belonging to a
Party prior to entering into the Agreement shallremain vested and remain the property of that
Party. The Client Data hosted by BSI as part of
BSI Connect Custom, and all worldwide
Intellectual Property Rights in it, is the exclusive
property of the Client. All rights in and to the Client
Data not expressly granted to BSI in thisAgreement remain with the Client.

6.2

6.3

Except as expressly set forth herein, no express or
implied license or right of any kind is granted to
the Client regarding BSI Connect Custom or any
part thereof, including any right to obtainpossession of any source code, data or othertechnical material relating to BSI Connect Custom.
Client grants BSI a non-exclusive, worldwide,royalty-free and fully paid license (a) to use the
Client Data as necessary for purposes of providing
BSI Connect Custom and (b) to use the Client Data(i) to provide BSI Connect Custom and to perform
its obligations under the Agreement and (ii) for
research and development purposes, including
but not limited to measuring and improving theeffectiveness of BSI’s products and services.

7.

CHARGES AND PAYMENT

7.1

BSI shall invoice the Client for the Fees as set out
in the Order Form, and the Client shall pay theFees within 30 days from the date of an invoice
which is not the subject of a genuine dispute.

7.2

If BSI has not received payment within 30 days ofthe due date, without prejudice to any other rights
and remedies:
7.2.1

BSI may, without liability to the Client,suspend the Client's access to BSIConnect Custom while the amounts due
remain unpaid; and7.2.2

interest shall accrue on a daily basis on
such due amounts at an annual rateequal to 3% over the then current baselending rate of Barclays Bank plc (or its
successor)
from
time
to
time,
commencing on the due date andcontinuing until fully paid, whether
before or after judgment.

7.3

The Fees do not include, and the Client is solely
responsible for, all applicable taxes including value
added tax and other sales taxes.

7.4

BSI shall be entitled to increase the Fees at thestart of each Renewal Term (i) in line with theannual increase in the UK Retail Prices Index

without notice; and (ii) upon 60 days' prior noticeto the Client where the increase exceeds theannual increase in the UK Retail Prices Index, andthe Order Form shall be deemed to have been
amended accordingly.
7.5

The number of Authorised Users can only be
increased during a Subscription Term, and theFees will be adjusted to reflect any increase in thenumber of Authorised Users. Requests for an
increase shall be subject to 5 days written noticeto BSI.

8.

TERM AND TERMINATION

8.1

The Agreement shall, unless otherwise terminatedas provided in this clause 8, commence on the
Effective Date and continue for the duration ofeach Subscription Term unless either Party
notifies the other Party of termination, in writing,at least 60 days before the end of a Subscription
Term, in which case the Agreement shallterminate upon the expiry of the applicable
Subscription Term.

8.2

Either Party may terminate the Agreement at any
time on written notice to the other if the other: (i)is in material or persistent breach of any of theseTerms and either that breach is incapable ofremedy, or the other Party fails to remedy thatbreach within 30 days after receiving written
notice requiring it to remedy that breach; or (ii)becomes insolvent, or is subject to an order or a
resolution for its liquidation, administration,
winding-up or dissolution (otherwise than for the
purposes of a solvent amalgamation orreconstruction), or has an administrative or otherreceiver,manager,trustee,liquidator,
administrator or similar officer appointed over allor any substantial part of its assets, or enters intoor proposes any composition or arrangement with
its creditors generally, or is subject to any
analogous event or proceeding in any applicablejurisdiction.

8.3

On termination of the Agreement:

Terms and Conditions

8.3.1

all licences granted under these Terms
shall immediately terminate and theClient shall immediately cease all use of
BSI Connect Custom and/or theDocuments;

8.3.2

BSI may destroy or otherwise dispose of
any of the Client Data in its possession;
and

8.3.3

any provision of these Terms that
expressly or by implication is intended tocome into or continue in force on or after

Page 4 of 9

8.4

8.5

termination of the Agreement shallremain in full force and effect.

9.4

The provisions of this clause 9 shall survive
termination of the Agreement, however arising.

Termination of the Agreement shall not affect anyof the rights, remedies, obligations or liabilities of
the Parties that have accrued up to the date of
termination, including the right to claim damages
in respect of any breach of the Terms which
existed at or before the date of termination.

10.

LIMITATION OF LIABILITY

10.1

Nothing in these Terms limit any liability whichcannot legally be limited, including, but not limited
to, liability for:(i) death or personal injury causedby negligence; (ii) fraud or fraudulent
misrepresentation; or (iii) any liabilities whichcannot be excluded by statute.

10.2

Subject to clauses 10.1:

If BSI terminates the Agreement for the Client's
breach under clause 8.2 above, then, in addition
to any other remedies BSI may have at law or inequity, the Client must pay to BSI within 30 daysof termination, the Fees for the remainder of the
Subscription Term.

9.

CONFIDENTIALITY

9.1

Each Party may be given access to confidential
information from the other Party in order toperform its obligations under these Terms. A
Party's confidential information shall not be
deemed to include information that:

9.2

9.3

10.2.1

BSI shall not be liable whether in tort(including for negligence or breach ofstatutoryduty),
contract,
misrepresentation,
restitutionorotherwise for any loss of profits, loss ofbusiness, depletion of goodwill and/or
similar losses or loss or corruption of data
or information, or pure economic loss, orfor any special, indirect or consequential
loss, costs, damages, charges or
expenses however arising; and10.2.2

BSI's total aggregate liability in contract,
tort (including negligence or breach ofstatutoryduty),
misrepresentation,
restitution or otherwise, arising inconnection with these Terms shall belimited to the total Fees paid or payablefor BSI Connect Custom during the 12months immediately preceding the dateon which the claim arose. .

9.1.1

is or becomes publicly known other than
through any act or omission of thereceiving Party;

9.1.2

was in the other Party's lawful possession
before the disclosure;

9.1.3

is lawfully disclosed to the receiving Party
by a third Party without restriction on
disclosure; or

9.1.4

is independently developed by the otherParty,
andsuch
independent
development can be shown by written
evidence.

10.3

This clause 10 shall survive termination of theAgreement.

11.

DATA PROTECTION

Subject to clause 9.3, each Party shall hold theother's confidential information in confidence andnot make the other's confidential information
available to any third party, or use the other'sconfidential information for any purpose otherthan the implementation of these Terms.

11.1

To the extent Client Data includes Personal Data,
the Data Processing Addendum shall apply, and
the Parties shall comply with the provisions
therein.

12.

FORCE MAJEURE

A Party may disclose confidential information to
the extent such confidential information isrequired to be disclosed by law, by any
governmental or other regulatory authority or bya court or other authority of competentjurisdiction, provided that, to the extent it islegally permitted to do so, it gives the other Party
as much notice of such disclosure as possible and,
where notice of disclosure is not prohibited and isgiven in accordance with this clause 9.3, it takes
into account the reasonable requests of the otherParty in relation to the content of such disclosure.

Terms and Conditions

BSI shall have no liability to the Client under theseTerms if it is prevented from or delayed inperforming its obligations under these Terms, orfrom carrying on its business, by acts, events,
omissions or accidents beyond its reasonable
control, including, without limitation, strikes, lockouts or other industrial disputes (whether
involving the workforce of BSI or any other party),
failure of a utility service or transport or
telecommunications network, act of God, war,riot, civil commotion, malicious damage,compliance with any law or governmental order,
rule, regulation or direction, accident, breakdown

Page 5 of 9

of plant or machinery, fire, flood, storm or defaultof BSI's sub-contractors, provided that the Client
is notified of such an event and its expected
duration.
13.

any of its rights or obligations under the
Agreement.
18.

VARIATION

Nothing in these Terms is intended to or shall
operate to create a partnership between theParties, or authorise either Party to act as agent
for the other, and neither Party shall have theauthority to act in the name or on behalf of orotherwise to bind the other in any way (including,but not limited to, the making of any
representation or warranty, the assumption of any
obligation or liability and the exercise of any rightor power).

No variation of the Agreement shall be effective
unless it is in writing and signed by the Parties.
14.

WAIVERNo failure or delay by a Party to exercise any rightor remedy provided under these Terms or by law
shall constitute a waiver of that or any other rightor remedy, nor shall it prevent or restrict thefurther exercise of that or any other right orremedy. No single or partial exercise of such rightor remedy shall prevent or restrict the further
exercise of that or any other right or remedy.

15.

SEVERANCE

15.1

If any provision or part-provision of these Terms
is or becomes invalid, illegal or unenforceable, it
shall be deemed deleted, but that shall not affectthe validity and enforceability of the rest of theseTerms.

16.

ENTIRE AGREEMENT

16.1

The Agreement constitutes the entire agreement
between the Parties and supersedes andextinguishes all previous agreements, promises,
assurances, warranties, representations andunderstandings between them, whether written ororal, relating to its subject matter.

16.2

Each Party acknowledges that in entering into theAgreement it does not rely on, and shall have noremedies in respect of, any statement,
representation, assurance or warranty (whether
made innocently or negligently) that is not set out
in the Agreement.

17.

ASSIGNMENT

17.1

The Client shall not, without the prior writtenconsent of BSI, assign, transfer, charge, subcontract or deal in any other manner(including a
grant to affiliates, subsidiaries or successors-ininterest of a right to use BSI Connect Custom)with all or any of its rights or obligations underthese Terms, such consent may be withheld in
BSI's sole discretion and subject to any necessary
recalculation of the Fees.

17.2

NO PARTNERSHIP OR AGENCY19.

THIRD PARTY RIGHTS
These Terms do not confer any rights on any
person or party, other than the Parties to theseTerms and, where applicable, their successors andpermitted assigns.

20.

NOTICES

20.1

Any notice required to be given under these Terms
shall be in writing and shall be delivered by handor sent by post or email to the other Party at its
address set out in these Terms or specified in theOrder Form, or such other address as may havebeen notified by that Party for such purposes
during the Subscription Term.

20.2

A correctly addressed notice sent by pre-paid firstclass post or recorded delivery post shall bedeemed to have been received at the time atwhich it would have been delivered in the normal
course of post. A notice sent by email shall bedeemed to have been received at the time oftransmission (as shown by the time sent in respectof an email).

21.

GOVERNING LAW
The Agreement and any dispute or claim arisingout of or in connection with it or its subject matteror formation (including non-contractual disputes
or claims) shall be governed by and construed inaccordance with the law of England and Wales.

22.

BSI may at any time assign, transfer, charge, subcontract or deal in any other manner with all or

Terms and Conditions

JURISDICTION
Each Party irrevocably agrees that the courts ofEngland and Wales shall have exclusive
jurisdiction to settle any dispute or claim arisingout of or in connection with these Terms or its
subject matter or formation (including noncontractual disputes or claims).

Page 6 of 9

BSI Connect CustomTerms and Conditions
Personal
Data

SCHEDULE 1
DATA PROCESSING ADDENDUM
1.

DEFINITIONSIn this Data Processing Addendum, terms used but
not defined shall have the meaning given in theAgreement. The following definitions shall apply inthis addendum:

Controller,
shall have the meaning given to those
Processor,
terms in the applicable Data Protection
Supervisory Laws;
Authority,
and Data
Subject
Data
Protection
Laws

means (a) any law, statute, declaration,
decree, directive, legislative enactment,
order, ordinance, regulation, rule or otherbinding
restriction(asamended,consolidated or re-enacted from time totime) which relates to the protection ofindividuals with regards to the Processingof Personal Data to which a Party is subject,including (where applicable) the GDPR; and(b) any code of practice or guidance
published by a relevant Supervisory
Authority from time to time;means any personal data (as defined in the
Data Protection Laws) Processed by either
Party in connection with the Services, andfor the purposes of this Data Processing
Addendum includes Sensitive Personal
Data;

Personal
has the meaning set out in the Data
Data Breach Protection Laws;
Personnelmeans all persons engaged or employedfrom time to time by BSI in connection withtheServices,
includingemployees,
consultants, contractors and permitted
agents;Processing

has the meaning set out in the Data
Protection Laws (and Process andProcessed
shallbeconstrued
accordingly);

Restricted
Countrymeans a country, territory or jurisdiction
outside of the European Economic Area
which the EU Commission has not deemed
to provide adequate protection inaccordance with Article 45(1) of the GDPR
(as applicable);Sensitive
PersonalDatameans Personal Data that reveals suchspecial categories of data as are listed in
Article 9(1) of the GDPR;

GDPR

means Regulation (EU) 2016/679 of theEuropean Parliament in relation to theprocessing of the personal data of natural
persons;

Servicesmeans BSI’s provision to Client of the useof or access to the product identified in theOrder Form pursuant to the Agreement;
andLossesmeans all losses, fines, penalties, liabilities,
damages, costs, charges, claims, amounts
paid in settlement and expenses (including
legal fees (on a solicitor/client basis),
disbursements, costs of investigation(including forensic investigation), litigation,
settlement (including ex gratia payments),
judgment, interest and penalties), otherprofessional charges and expenses,
disbursements, cost of breach notification
including notifications to the data subject,
cost of complaints handling (including
providing Data Subjects with credit
reference checks, setting up contact
centres (e.g. call centres) and making ex
gratia payments), all whether arising incontract, tort (including negligence),
breach of statutory duty or otherwise;

Third Party
Requestmeans a written request from any third
party for disclosure of Personal Data wherecompliance with such request is required or
purported to be required by law or
regulation.

Permitted
Purposemeans the purpose of the Processing as set
out in more detail in the Data Protection
Particulars;

2.

DATA PROTECTION

2.1

Arrangement between the Parties
2.1.1 The Parties acknowledge that theirclassification under the Data Protection Laws
is based on the factual arrangement
between them.
2.1.2 In respect of the Services, the Parties hereby
agree that Client shall act as a Controller and
BSI shall act as a Processor where BSI is
Processing the Personal Data on behalf ofClient in relation to the Permitted Purpose inconnection with the performance of its

Terms and Conditions

Page 7 of 9

BSI Connect Custom Terms and Conditions
obligations under this Data Processing
Addendum.

perform the Services in accordancewith this Data Processing Addendum;

2.1.3 Each Party shall in performing its obligations
under this Data Processing Addendum,
comply with the obligations imposed upon it
under the Data Protection Laws.
2.1.4 Each Party acknowledges and agrees thatthe type of Personal Data Processedpursuant to this Data Processing Addendum
and the subject matter, duration, nature andpurpose of the Processing, and thecategories of Data Subjects, are as describedin the table below.

Subject matterand duration ofProcessing

Delivery of the Service during theterm of the Agreement for use by, andaccess by, the Client and its
Authorised Users.

Nature andpurpose ofProcessing

BSI’s processing activities will belimited to the storing of Personal Data
that may form part of the Client Data
that is uploaded to BSI’s systems as
part of Client’s access to the Services
and making such Client Data available
for Client’s retrieval again via Client’s
own access to the Services.
BSI will have no right to use any such
Personal Data for its own purposes orat its own command.

Type of Personal
Data being
Processed- Names and email addresses- Narratives and incident
descriptions about Data Subjects
included within Client Data

Categories ofData Subjects- Client’s employees, agents andadvisors; Client’s customers;
vendors and subcontractors ofClient (who are natural persons);
Authorised Users.

2.2

(b)

ensure that all privacy notices havebeen given (and/or, as applicable,
consents obtained) and are sufficientin scope to allow BSI to Process
Personal Data as required inconnection with the provision of theServices under this Data Processing
Addendum and in accordance with
the Data Protection Laws;(c)ensure that all Personal Data
disclosed or transferred to, or
accessed by, BSI is accurate, up-todate, adequate, relevant and notexcessive to enable BSI to process
Personal Data as required for BSI to
perform the Services in accordancewith this Data Processing Addendum;(d)maintain technical and organisational
security measures sufficient tocomply with the obligations imposedon the Controller by Data Protection
Laws; and(e)

not do anything which shall damage
BSI’s reputation.

2.2.2 For the avoidance of doubt, the Client shallmake all required notification(s) to therelevant Supervisory Authority in relation to
its processing of Personal Data related to theServices.
2.3

Data Processor Obligations
2.3.1 In relation to the Services, to the extent that
BSI Processes any Personal Data as a
Processor on behalf of Client for the purposeof performing the Services under this Data
Processing Addendum, BSI undertakes to
the Client that BSI shall, per GDPR Art. 28:

Data Controller Obligations(a)only Process Personal Data for and on
behalf of Client for the purposes of
performing its obligations under thisData Processing Agreement and onlyinaccordancewith
Client's
instructions from time to time, unlessotherwise required by law;(b)

inform the Client immediately if itconsiders any of the Client's
instructions infringes Data Protection
Laws;

(c)

implement and maintain appropriatetechnical and organisational security

2.2.1 Without limiting the generality of theobligations set out in paragraph 2.1 above,
the Client shall:(a)ensure that it is not subject to any
prohibition or restriction which
would: (i) prevent or restrict it fromdisclosing or transferring Personal
Data to BSI; (ii) prevent or restrict itfrom granting BSI access to Personal
Data; and/or (iii) prevent or restrict
BSI from Processing Personal Data, ineach case as required for BSI to

Terms and Conditions

Page 8 of 9measures to safeguard against any
unauthorised or unlawful Processingof Personal Data;
(d)

(e)

(f)

(g)

(j)

take all reasonable steps to ensure
the reliability and integrity of any of
its Personnel who have access to
Personal Data and ensure that only
Personnel who are required to assistin performing the Services haveaccess to such Personal Data;
ensure that any of its staff and/or
contractors who have access to
Personal Data have entered into
appropriate contractually binding
confidentiality undertakings;
not disclose Personal Data to a third
party unless the third party agrees toterms which are substantially thesame as the terms set out in this Data
Processing Addendum or in responseto Third Party Requests where BSI is
prohibited by law or regulation fromnotifying Client;at Client’s direction, arrange for the
prompt and safe return and/or securepermanent destruction of all Personal
Data, together with all copies in its
possession or control (if any) withintwenty eight (28) days of suchdirection, except where BSI isrequired by applicable law to retain
any of such Personal Data;(h)not transfer any Personal Data to a
Restricted Country unless suchtransfer is made in compliance with
the Data Protection Laws;(i)at Client’s request use reasonableendeavours to assist Client to comply
with the obligations imposed on
Client by or in relation to:(i)the rights of Data Subjects;(ii)

assistance to the relevantSupervisory Authority; and/or

(iii)

data
protection
assessments

notify Client promptly upon becoming
aware of any Personal Data Breach,
and:
(i)

implement any measuresnecessary to restore thesecurityofcompromised
Personal Data; and(ii)

assist Client to make any
notifications to the relevantSupervisory Authority andaffected Data Subjects.

2.3.2 This Data Processing Addendum shall notaffect any services (or the obligations owed
in respect of them) under the Agreementthat are not related to the Processing of
Personal Data.
3.

INDEMNITY

3.1

The Client shall indemnify on demand and keep BSI
indemnified against any Losses incurred by,awarded against or agreed to be paid by BSI to theextent arising from the Client’s failure to comply
with the Data Protection Laws.

3.2

BSI shall indemnify on demand and keep the Client
indemnified against any Losses incurred by,awarded against or agreed to be paid by the Clientto the extent arising from BSI’s failure to comply
with the Data Protection Laws.

impactprovided that any such assistanceshall be provided to Client subject toa fee payable to BSI to be agreed
between the Parties; andTerms and Conditions

Page 9 of 9