Subcontractor/Supplier Data Privacy Addendum
This Subcontractor/Supplier Data Privacy Addendum (“the“Addendum”) is incorporated into and forms part of a written
Subcontractor Services Agreement (“Services Agreement”)
between Subcontractor and Computacenter. In considerationof the mutual obligations set out herein, the Subcontractor andComputacenter hereby agree that the terms and conditions
set forth below shall be added as a data privacy addendum
to, effective concurrently with, the Services Agreement.
Except as expressly modified by this Addendum, the terms ofthe Services Agreement and the terms of the Services to beprovided under the Services Agreement shall continue in fullforce and effect.
1.

Date of this Addendum, the term “Agreement” as used in theServices Agreement shall mean and refer to the Services
Agreement as amended by this Addendum.
The following provisions apply to Subcontractor’s collection,retention, use, disclosure, and other handling, (collectively,“processing” or “processes”) of Personal Information
provided by Computacenter;A.

Addendum, the capitalized terms used in this section
shall have the meaning assigned to them in the CCPA,
as may be amended.
i.

“Personal Information” shall have themeaning set forth in the CCPA or whereapplicable shall have the same meaning as“personal data,” as defined in the GDPR. In
any event Personal Information shall belimited to Personal Information which
Subcontractor collects or accesses from
Computacenter under the Services
Agreement.

ii.

“Computacenter” shall mean
Computacenter United States Inc. or theaffiliate of Computacenter United States
Inc. that executed the Services Agreementwith Subcontractor.

iii.

“Restricted Transfer" shall mean: (i) where
the EU GDPR applies, a transfer ofpersonal data from the European
Economic Area to a country outside of theEuropean Economic Area which is not
subject to an adequacy determination bythe European Commission; and (ii) wherethe UK GDPR applies, a transfer of
personal data from the United Kingdom toany other country which is not based onadequacy regulations pursuant to Section
17A of the United Kingdom Data
Protection Act 2018

RECITALS

WHEREAS, Computacenter and Subcontractor have enteredinto a Services Agreement whereby Subcontractor provides
services (as described in the respective Services Agreement)(“Services”) to Computacenter;
WHEREAS, the California Consumer Privacy Act, codified atCal. Civ. Code §1798.100 et seq., as amended by theCalifornia Privacy Rights Act and as may be further amended(“CCPA” or the “Act”) imposes on Computacenter certain
obligations with respect to Personal Information;
WHEREAS, Computacenter seeks to amend the Services
Agreement to ensure that Subcontractor will: (a) process
Personal Information consistent with Computacenter’s
obligations under the Act, and (b) cooperate with
Computacenter in its efforts to respond to requests byConsumers to exercise their rights under the CCPA and tootherwise comply with CCPA;
WHEREAS, in order to comply with Computacenter’s
contractual obligations to its customers, Computacenter
wishes to set forth certain provisions concerning personal
data of citizens in the European Union, European Economic
Area, or the United Kingdom, should such personal data beprocessed as part of the Services – including provisions
applicable to the UK Data Protection Act 2018 and the GDPR
as it forms part of UK law by virtue of Section 3 of theEuropean Union (Withdrawal) Act 2018 (“UK GDPR”); (iii)
Regulation (EU) 2016/679 of the European Parliament and ofthe Council of April 27, 2016 on the protection of natural
persons with regard to the processing of personal data and on
the free movement of such data, and repealing Directive
95/46/EC ( “EU GDPR”); and (iv) the EU e-Privacy Directive(Directive 2002/58/EC); in each case as may be amended,superseded or replaced from time to time;
NOW THEREFORE, for good and valuable consideration, thesufficiency of which hereby is acknowledged, the Parties
agree to amend the Services Agreement as follows:
ADDENDUM
The following section is added to each Services Agreement
entered into between the Parties. From and after the Effective

Version 08312023

B.

Restrictions On Subcontractor’s Processing Of
Personal Information: Notwithstanding anything in theServices Agreement or any applicable Subcontractor
privacy policy to the contrary Subcontractor (including itsagents, Subcontractors, or subcontractors) shall:i.

only Process Personal Information for thelimited purposes of providing Services toComputacenter as described in theServices Agreement, as amended;ii.

not Sell Personal Information;iii.

not disclose any Personal Information to
any subcontractor, or permit any
subcontractor to create or receive Personal
Information on Subcontractor’s behalf,
unless and until (1) it first obtains consent
from Computacenter and (2) thePage 1 of 3

subcontractor agrees, by contract, to thesame restrictions and prohibitions on theprocessing of Personal Information that thisAddendum imposes on Subcontractor; andiv.

C.

minimum security requirements set out inhttps://www.computacenter.com/dataprotection/supplierstandardtoms/ in place to safeguard
against any unauthorized or unlawful access,loss, destruction, alteration, theft, use or
disclosure of the Personal Information (each a"Security Incident") and shall only involve
employees to process Personal Information
under Services Agreement who have had
sufficient and adequate training pertinent to thecare and handling of Personal Information;

assist Computacenter in its response to a
Consumer request to exercise rights under
the CCPA as more fully described inSection c below.

Consumer and Data Subject Requests To Exercise
Rights under CCPA or GDPR, as applicable:
ii.
i.

ii.

D.

1.

inform the Consumer that he/sheshould submit the request directlyto Computacenter via thefollowing contact information:
dataprivacy@computacenter.com; and2.

inform Computacenter, via
dataprivacy@computacenter.com, that such request was madeand provide Computacenter witha copy of such Consumer
request.

Within ten (10) business days of receivinga request from Computacenter forassistance with responding to a Consumer
request to exercise one or more rights
under CCPA or GDPR, Subcontractor shallprovide assistance as necessary for
Computacenter to respond to theConsumer’s request in accordance withapplicable law.

Data Destruction:a.

E.

If Subcontractor receives a request toexercise rights of individuals related
Personal Information, then Subcontractor
shall within ten (10) business days ofreceipt of such request:

Within thirty days of termination of the Services
Agreement, Subcontractor shall destroy all
Personal Information in its possession orcontrol. Upon request Subcontractor shallprovide Computacenter with a certificate ofdestruction.

Data Security: Notwithstanding anything in the Services
Agreement or any applicable Subcontractor privacy
policy to the contrary Subcontractor (including its agents,Subcontractors, or subcontractors) shall:i.

have appropriate operational and technologicalprocesses and procedures (which as aminimum shall include those described theServices Agreement together with standards
materially equivalent to Computacenter’sVersion 08312023

promptly notify Computacenter without undue
delay in any event within twenty four (24) hours:
a.

b.

F.

regarding any request for disclosure ofComputacenter Personal Information by alaw enforcement authority, if legallypossible prior to any such disclosure;
upon becoming aware of a Security
Incident, and shall provide timely
informationandcooperation
asComputacenter may reasonably require.
Subcontractor shall further take all suchmeasures and actions as are necessary toremedy or mitigate the effects of theSecurity
Incident and shall keep
Computacenter
informedofall
developments in connection with theSecurity Incident.

Cross-Border Transfer: The parties agree that when
the transfer of Personal Information from Computacenterto Subcontractor is a Restricted Transfer, it shall be
subject to the appropriate Standard Contractual Clauses
as follows:a. In relation to Personal Information that is
protected by the EU GDPR, the EU SCCs will
apply as completed as follows:i. The EU C-to-P Transfer Clauses.
Where Computacenter is a controller
and a data exporter of PersonalInformation and Subcontractor is aprocessor and data importer in respectof that Personal Information, then theParties shall comply with the EU C-toP Transfer Clauses, and/orii. The EU P-to-P Transfer Clauses.
Where Computacenter is a processor
acting on behalf of a controller and adata exporter of Personal Informationand Subcontractor is a processor anddata importer in respect of that
Personal Information, the Parties shallcomply with the terms of the EU P-toP Transfer Clauses.
b. In relation to Personal Information that is
protected by the UK GDPR, the UK SCCs will
apply completed as follows:i.
Where Computacenter and the
Subcontractor are lawfully permitted to rely

Page 2 of 3

on the EU SCCs for transfers of Personal
Information from the United Kingdom
subject to completion of a “UK Addendum
to the EU Standard Contractual Clauses”(“UK Addendum”) issued by the Information
Commissioner’s Office under s.119A(1) ofthe Data Protection Act 2018, then:
1.
TheEUSCCs,
completed as set out above inclause (a) of this Data Privacy
Addendum shall also apply totransfers of such Personal
Information, subject to sub-clause(2) below; and2.
The UK Addendum shallbe deemed executed between
Computacenter
andtheSubcontractor, and the EU SCCs
shall be deemed amended as
specified by the UK Addendum inrespect of the transfer of such
Personal Information;

G. Audit:
Upon provision of reasonable notice toSubcontractor, Computacenter (or any third party
selected by Computacenter) may undertake anassessment and audit of Subcontractor’s compliancewith this Data Privacy Agreement no more than once peryear or as otherwise necessary in the event
Computacenter identifies a reasonable basis for more
frequent assessments such as a governmental request
for information, a specific obligation arising underapplicable law, a Security Incident, or if Computacenterhas a good faith basis to believe Subcontractor has notcomplied with this Data Privacy Addendum. In addition,
Subcontractor shall conduct a comprehensive
independent third-party audit of its privacy and data
security measures at least once per year as long as
Subcontractor
processes
PersonalInformation.
Subcontractor will promptly implement any required
safeguards as identified by a third-party auditor orComputacenter.
H.

Indemnification:
Notwithstanding anything in theServices Agreement or any applicable Subcontractor
privacy policy to the contrary Subcontractor (including its
agents, Subcontractors, or subcontractors) shallindemnify, defend, and hold harmless Computacenterand its affiliates, subsidiaries, successors and assigns(and their officers, directors, employees, sublicensees,customers and agents) from and against any and all
claims, losses, demands, liabilities, damages,
settlements, expenses and costs (including attorneys’
fees and costs), arising from, in connection with, or basedon allegations of, any Security Incident or
Subcontractor’s (or its Sub-processors’) failure to comply
with any of its obligations set forth in this Data Privacy
Addendum. This indemnification obligation is not subject
to any limitation of liability.

I.

Governing Law: Notwithstanding anything to thecontrary in the Services Agreement, this Data Privacy
Addendum and any disputes arising therefrom, will begoverned by the laws of the State of California, without
regard to their conflict of law provisions.

ii.
If sub-clause (b)(i) doesn’t apply,
then Computacenter and the Subcontractor
shall cooperate in good faith to implement
appropriate safeguards for transfers ofsuch Personal Information as required orpermitted by the UK GDPR without unduedelay.
The Standard Contractual Clauses shall constitute a
separate agreement between each Computacenter
Affiliate acting as a data exporter and Subcontractor
acting as data importer.
Subcontractor shall not participate in (nor permit any
Sub-processor to participate in) any other RestrictedTransfers of Personal Information (whether as anexporter or an importer of the Personal Information)
unless: (i) it has first obtained Computacenter’s priorwritten consent which, where Computacenter is aprocessor on behalf of a third party controller, shallreflect the controller's instructions; and (ii) theRestricted Transfer is made in full compliance withthe applicable data protection laws and pursuant toStandard Contractual Clauses implemented
between the relevant exporter and importer of the
Personal Information.
To the extent of any inconsistency between this Data
Privacy Addendum and the Standard ContractualClauses, the Standard Contractual Clauses shallprevail. Subcontractor agrees to promptly undertaketo amend this Data Privacy Addendum if
Computacenter considers it necessary toincorporate an updated data transfer mechanism tomaintain compliance with applicable data protection
laws.

Version 08312023

Page 3 of 3