CEM Monitoring Systems End User Licence Agreement 1st March 2022

END-USER LICENCE AGREEMENT FOR MONITORING SYSTEMSPROVIDED BY CEM (CENTRE FOR EVALUATION AND MONITORING).
________________________________________________________
CLAUSE
1. Commencement and Duration........................................................................................................ 2
2. The Licence ...................................................................................................................................... 2
3. The Licence Fee ............................................................................................................................... 2
4. Opt-Out ........................................................................................................................................... 3
5. Set-off and Withholding Tax ........................................................................................................... 4
6. Intellectual Property........................................................................................................................ 4
7. Data Protection ............................................................................................................................... 5
8. Freedom of Information.................................................................................................................. 5
9. Confidentiality……………….…………………………………………………………………………………………………………..6
10. Liability of the Parties...................................................................................................................... 6
11. CEM Systems ................................................................................................................................... 7
12. Publicity ........................................................................................................................................... 7
13. Termination ..................................................................................................................................... 7
14. Modern Anti-Slavery ....................................................................................................................... 8
15. Anti-Bribery ..................................................................................................................................... 9
16. Severability ...................................................................................................................................... 9
17. Rights of Third Parties ..................................................................................................................... 9
18. No Partnership ................................................................................................................................ 9
19. Assignment and Novation ............................................................................................................... 9
20. Amendments and Variations ................................................................................................... …...10
21. Entire Agreement….………………………………………………………………………………………………………………….10
22. Governing Law and Jurisdiction…………………………………………………………………………………………………10
23. Notices……..……………………………………………………………………………………………………………………………….10
Schedule 1 Definitions and Interpretation………………………………………………………………………………………..12
Schedule 2 Data Sharing………………………………………………………………………………………………………………..…15
Schedule 3 Standard Contractual Clauses………………………………………………………………………………………...20

1

CEM Monitoring Systems End User Licence Agreement 1st March 2022
This agreement (the “Agreement”) is made between:(1) The end user of the Licence (the “Client”); and(2) The Chancellor, Masters and Scholars of the University of Cambridge, acting through its
department Cambridge University Press & Assessment of the Triangle Building, Shaftesbury Road
Cambridge, CB2 8EA (hereinafter to be referred to as “Centre for Evaluation and Monitoring” or“CEM”);(each a “Party”, and together the “Parties”).
WHEREAS:
A. By placing an Order, the Client agrees to purchase the Licence from CEM or a CEM Affiliate
and understands that in doing so enters into a legally binding agreement with CEM in respectof the Licence.
B. On the terms set out in this Agreement, CEM agrees to grant the Licence to the Client.

1.

COMMENCEMENT AND DURATIONThis Agreement shall commence on the Agreement Start Date and shall remain in full force and effectindefinitely, unless terminated earlier in accordance with the provisions of clause 13 (Termination) or
unless the Client opts out in accordance with clause 4 (Opt-out).
2.

3.

THE LICENCE
2.1.

CEM hereby grants to the Client the right to install the CEM Systems and use multiple copiesof the CEM Assessment Product only on such of the Client’s computers that are runningvalidly licensed copies of the operating system for which the CEM Assessment Product was
designed.

2.2.

CEM hereby grants to the Client the right to access online or download multiple copies of
the CEM Reports for use by the Client, in accordance with the terms of this Agreement.

2.3.

CEM provides the Client with a non-exclusive, non-transferable, revocable, royalty-freelicence, without the right to sub-licence, to use the CEM IPR during the term of thisAgreement for the purposes set out herein.

2.4.

CEM agrees to provide the CEM Assessment Product as detailed in the Client’s Order inaccordance with the terms and conditions of this Agreement. CEM will use its reasonableendeavours to ensure that the CEM Assessment Product is provided under the best care,skill and diligence and in accordance with best industry practice as outlined by the guidelinesof the British Educational Research Association (BERA), and in accordance with CEM’s ethicalresearch framework, and in accordance with all applicable laws and regulations, and in
consultation with the Client.

THE LICENCE FEE
3.1.

In consideration of the rights granted to the Client hereunder, the Client undertakes andagrees to pay the Licence Fee. The Licence Fee is stated exclusive of any taxes or imposts.
2

CEM Monitoring Systems End User Licence Agreement 1st March 2022

4.

3.2.

Notwithstanding clause 3.1 or any other provision of this Agreement, CEM or a CEM Affiliate
reserves the right to charge VAT to the Client where VAT is chargeable in addition to any
other taxes that CEM or a CEM Affiliate may be entitled to charge to the Client.

3.3.

The Client will be obliged when placing the Order to provide an estimate of the number of
pupils who will sit the CEM Assessment. The Client will be given an opportunity before CEMor a CEM Affiliate issues its invoice to revise the estimate within the Order downwards by up
to 20% or upwards (without limit). The Client must give prompt written notice of any such
revision on receiving CEM’s or a CEM Affiliate’s request for confirmation of the relevant
number of pupils.

3.4.

In the event that the number of pupils actually sitting the CEM Assessment is higher than
the number of pupils included in the Order, the Client accepts that the Licence Fee will becalculated based on the actual number of pupils sitting the CEM Assessment.

3.5.

In the event that the number of pupils actually sitting the CEM Assessment is lower than theestimated number of pupils included in the Order, the Licence Fee will be calculated basedon the estimated number of pupils in the Order (as revised by any notice given by the Clientin accordance with this clause 3).

3.6.

In the event that no pupils sit the CEM Assessment, the Licence Fee will be calculated basedon the estimated number of pupils in the Order (as revised by any notice given by the Clientin accordance with this clause 3), subject however to the terms of clause 13 (Termination)
if this occurrence is due to the termination of this Agreement.

3.7.

Notwithstanding any other provision of this Agreement, CEM may increase the Licence Feewith effect from the 1st day of March in any calendar year, and CEM or a CEM Affiliate shallgive the Client reasonable notice in writing of the proposed change.

3.8.

Where an Order expresses that a CEM Assessment Product is a trial, the Client shall not needto pay a Licence Fee. CEM shall be entitled to utilise any data submitted by the Client in theprocess of using the trial for the purpose of improving, amending, assessing, analysing,creating and otherwise for the purpose of offering the CEM Assessment Product. During a
trial, the Client accepts that the CEM Assessment Product is not a finished product and is nota “sale of goods or services”, and therefore no implied terms under the Sale of Goods andServices Act 1982 shall apply.

3.9.

In the event of (a) late payment or non-payment of the Licence Fee or other sums payable
by the Client under this Agreement or (b) any other material breach of this Agreement, andwithout prejudice to any other right or remedy CEM may be entitled to, CEM may: (i) seek
the remedies under the Late Payment of Commercial Debts (Interest) Act 1998; and/or (ii)
immediately terminate this Agreement by giving notice in writing to the Client, including,but not limited to, the termination of the Client’s access to the CEM Assessment Product or
the provision of the CEM Assessment Product.

OPT-OUT

4.1 Where the Client purchases the CEM Assessment Product, the Client may notify CEM in writing
not later than the Annual Opt-out Notice Cut-off Date that it wishes to opt-out of receiving access3

CEM Monitoring Systems End User Licence Agreement 1st March 2022
to the subsequent year of the CEM Assessment or that it wishes to reduce the number of pupils
for the subsequent year of the CEM Assessment.
4.2 Where the Client purchases the CEM Assessment Product after the Annual Opt-out Notice Cut-off
date the Client shall have eight weeks from the date of purchase to notify CEM in writing that it
wishes to opt-out of receiving access to the subsequent year of the CEM Assessment.
4.3 Where the Client has given notice to opt-out in accordance with clause 4.1 or clause 4.2, theClient’s access to the CEM Assessment Product shall cease on the Access Termination Date.
5.

SET-OFF AND WITHHOLDING TAX
5.1.

All amounts due from the Client under this Agreement shall be paid by the Client to CEM or
to a CEM Affiliate in full without any set-off, deduction or withholding, other than any
deduction or withholding of tax as required by law.

5.2.

Where the Client is obliged to deduct or withhold any parts of the monies due to CEM or toa CEM Affiliate, in accordance with clause 6.2, the sum due and owing to CEM or a CEM
Affiliate shall be increased to the extent that the sum received by CEM or a CEM Affiliate
shall be the same as the sum that would have been received had there been no suchdeduction or withholding of tax. The Client must account to the relevant authorities in atimely manner all monies required to be withheld from CEM or a CEM Affiliate, and provide
CEM or a CEM Affiliate with an official receipt from the authority of the same within 30 daysof that payment.

6.

INTELLECTUAL PROPERTY
6.1 The Client acknowledges and agrees that any and all of the CEM IPR, are and shall remain thesole and exclusive property of CEM. The Client may not reproduce or use the CEM IPR otherthan as set out in this Agreement or as specified in writing by CEM. For the purposes of thisAgreement.
6.2

CEM shall at its own expense obtain written permission for the inclusion of any copyrightmaterial in the CEM Assessment Product and shall be responsible for the payment of all fees
charged for the use of such material subject to copyright.

6.3

CEM warrants to the Client that the Intellectual Property Rights in the CEM Assessment
Product, so far as it is aware and to the best of its knowledge and belief, do not infringe therights of any third party and that no third party has threatened or is currently threatening
proceedings in respect of such infringement, and none of its Intellectual Property Rights in
the CEM Assessment Product is the subject of any actual or, so far as it is aware, threatenedchallenge, opposition or revocation proceedings.

6.4

The Client undertakes that under no circumstance shall the Client:(a) copy, reproduce or create derivative works from the CEM Assessment Productunless otherwise expressly permitted by this Agreement;(b) provide access to the CEM Assessment Product to any a third party, other thanas contemplated under this Agreement, without the express written permissionof CEM.

4

CEM Monitoring Systems End User Licence Agreement 1st March 2022
(c)

(d)
(e)
(f)
(g)
(h)
(i)
7.

provide access to or share the CEM Assessment Product with any third party
other than as contemplated under this Licence. It is acknowledged and agreed
by CEM that the Client shall be allowed to share the CEM Assessment Productwith third parties with whom it is strictly necessary in order to allow the Client
to make full use of the CEM Assessment Product as contemplated under thisAgreement, which shall include, but not be limited to bodies representing
parents, local authorities, the Client’s parent company/trust, external
inspectors and education consultants employed by the Client;
sublicense, rent, sell or lease any portion of the CEM Assessment Product;
alter, modify, disassemble, reverse engineer all or any part of the CEM
Assessment Product;translate, merge, adapt or modify all or any part of the CEM Assessment
Product;
infringe the CEM IPR or those of any third party in relation to their use of the
CEM Assessment Product;
use the CEM Assessment Product in a way that could damage, disable,
overburden, impair or compromise CEM’s systems or security or interfere withother users; nor
use the CEM Assessment Product in any manner not authorised by these terms.

DATA PROTECTION
7.1 The Parties agree at all times to handle personal information of the candidates strictly inaccordance with the Data Protection Legislation. Each Party shall have the rights andobligations subscribed to it under the Data Sharing Schedule 2 set out below.

8.

7.2

Both Parties will act as Data Controller in respect of any personal data entered into the
System or otherwise supplied to CEM for the purpose of this Agreement and will do so inaccordance with the terms of the Data Sharing Schedule 2.

7.3

Both Parties agree they are responsible for ensuring they have a lawful basis for sharing anyof the personal data provided to CEM as part of the System.

7.4

The Client agrees that it shall inform all of its candidates that sit a CEM Assessment how theirdata is used by reference to the CEM privacy statement as published on the CEM.org
website.
FREEDOM OF INFORMATION

8.1.

The Client hereby acknowledges that CEM is subject to the requirements of the Information
Legislation and the Client agrees to assist and co-operate with CEM (at their own expense)to enable CEM to comply with these information disclosure requirements.

8.2.

Further, in the event that the Client is also subject to Information Legislation, CEM agrees toassist and co-operate with the Client (at their own expense) to enable the Client to comply
with these information disclosure requirements.

8.3.

In the event that the Client receives an information disclosure request regarding CEM or any
information the Client holds arising out or in connection with this Agreement, the Client shall5

CEM Monitoring Systems End User Licence Agreement 1st March 2022
promptly notify CEM with details of the request and shall take CEM’s representations into
consideration while deciding the response to that particular request.
8.4.

Any disclosure made by either Party pursuant to such Party’s obligations under theprovisions of Information Legislation, shall not constitute a breach of this Agreement.

8.5.

CEM shall not be liable for any loss, damage, harm or other detriment however caused
arising from the disclosure (pursuant to the obligations of Information Legislation) of any
information relating to this Agreement or the Client.

8.6.

The provisions of this clause 8 shall apply during the continuance of this Agreement andindefinitely after its expiry or termination.

9. CONFIDENTIALITY
9.1

Each Party undertakes that it shall not disclose the other party’s Confidential Information,
except as permitted by clause 9.2.

9.2

Each Party may disclose the other party's Confidential Information:(a) to its employees, officers, representatives, contractors, subcontractors or advisers whoneed to know such information for the purposes of exercising the party's rights or carryingout its obligations under or in connection with this Agreement. Each party shall ensurethat its employees, officers, representatives, contractors, subcontractors or advisers towhom it discloses the other party's Confidential Information comply with this clause 9;and(b) as may be required by law, a court of competent jurisdiction or any governmental or
regulatory authority.

9.3

Without prejudice to the generality of the foregoing, the Client understands and accepts that
information consisting of the raw scores of candidates that have taken a CEM Assessment or
the average raw scores for the entire cohort would if disclosed reveal CEM’s Confidential
Information and that disclosure of these test scores is therefore restricted by the undertaking
given by the Client in clause 9.1.

9.4

The provisions of this clause 9 shall continue to apply after termination or expiry of thisAgreement.

10. LIABILTY OF THE PARTIES
10.1

The following sets out the entire financial liability of CEM to the Client in respect of any breachby CEM of this Agreement, non-performance or incomplete performance or contemplated
performance by CEM of this Agreement, negligence for which CEM is liable, and any
representation or statement arising under or in connection with this Agreement or by or on
behalf of CEM:(a) CEM shall in no circumstances be liable for any loss of profits, loss of businessor production, depletion of goodwill, loss of or corruption to data, and/or any
other indirect loss; and(b) in respect of all other losses and claims, the aggregate liability of CEM for any
breach, negligence and/or liability arising in any other way out of the subject
6

CEM Monitoring Systems End User Licence Agreement 1st March 2022
matter of this Agreement or the performance of the Assessment will not exceed
in total the amounts actually received by CEM from the Client for the use of theLicence under this Agreement.
10.2 CEM will in no event be liable for any statement or representation about the Client, theirbusiness, products or services made or communicated in or by any item, material or work
approved by the Client in writing.
10.3 For clarity, nothing in this Agreement limits or excludes either Party’s liability for death or
personal injury caused by such Party’s negligence or any fraud or for any sort of liability thatby law cannot be limited or excluded.

11 CEM SYSTEMS
11.1 The Client hereby acknowledges that certain elements of the CEM Assessment Product may
at any time be in the process of being developed and CEM does not guarantee access on
demand. The CEM Assessment Product may subsequently be substantially modified orwithdrawn at the sole discretion of CEM.
11.2 The Client’s installation of the CEM Systems and use of the CEM Assessment Product are at
the Client’s sole discretion and risk and may produce unintended or erroneous results andmay contain bugs, errors and other problems that could cause system or other failures anddata loss. The Client accepts that the CEM Systems and the CEM Assessment Product areprovided to the Client "as is" without any warranty, and CEM expressly disclaims any and all
warranties, including, but not limited to, warranties of merchantability, fitness for aparticular purpose or error free operation.
11.3 CEM is not obligated to provide Updates to the Client. However, in the event CEM elects in
its sole discretion to provide Updates to the Client, such Updates shall be deemed toconstitute part of the CEM Assessment Product and shall therefore be subject to theseterms.

12. PUBLICITYThe Client warrants to CEM it shall at no point:(a) take any action which is intended, or could reasonably be expected, to harm in
any way the reputation of CEM or any part of it; or(b) take any action which is intended, or could reasonably be expected to lead toany unwanted or unfavourable publicity for CEM or any part of it.
13.

TERMINATION

13.1

Subject to clauses 13.4, 13.5 and 13.6, from the date the Client placed the Order andpurchased the Licence, the Client may terminate this Agreement by written notice to CEM.

13.2

If either Party has given notice to terminate this Agreement in accordance with this clause 13,
this Agreement shall terminate on the date the Client notified CEM.

7

CEM Monitoring Systems End User Licence Agreement 1st March 2022
13.3

CEM reserves the right to perform credit checks on the Client at any point before or after the
Agreement Start Date (as may be applicable). Should the credit check on the Client not be, in
CEM’s sole opinion, favourable, CEM shall be entitled to terminate the Agreement withimmediate effect upon notice in writing to the Client if the Agreement has alreadycommenced.

13.4

If the Client terminates this Agreement in less than thirty (30) days from the date it placed theOrder and has neither installed the CEM System nor used the CEM Assessment Product, no
fee shall be payable by the Client.

13.5

If the Client terminates this Agreement on any date falling between thirty (30) and sixty (60)days of placing the Order and has neither installed the CEM System nor used the CEM
Assessment Product, a fee of £50 shall be payable by the Client.

13.6

If the Client terminates this Agreement more than sixty (60) days from the date it placed theOrder or has installed the CEM System and used the CEM Assessment Product, the Client shall
pay to CEM or to a CEM Affiliate the full price for the services ordered by it pursuant to theOrder.

13.7

Any payments to be made by the Client to CEM or to a CEM Affiliate pursuant to this clause
13 or under any provision of this Agreement shall be made upon receipt by the Client of an
invoice from CEM or from a CEM Affiliate and within the period of time specified in the invoice.

14. MODERN ANTI-SLAVERY
14.1 The Client shall:(a) comply with the anti-slavery policy of the University of Cambridge as set out at
http://www.registrarysoffice.admin.cam.ac.uk/governance-and-strategy/antislavery-and-anti-trafficking and as amended from time to time;(b) not engage in any activity, practice or conduct that would constitute an offence
under sections 1, 2 or 4 of the Modern Slavery Act 2015 if such activity, practiceor conduct was carried out in the UK;(c)include in all its contracts with its subcontractors and suppliers’ anti-slavery andanti-human trafficking terms that are at least as onerous as those set out in thisclause 14; and(d) promptly report to CEM any suspected or known slavery or human trafficking inconnection with the performance of this Agreement, any breach or potential
breach of this clause 14 (Modern Anti-Slavery) or any breach or potential breachof CEM’s anti-slavery policy.
14.2 The Client represents that:(a)it, its officers and its employees have not been convicted of any offence under
the Modern Slavery Act 2015 or any equivalent offence in any jurisdiction
involving slavery and human trafficking;(b)neither it, its officers or its employees have been or are subject to any
investigation, inquiry or enforcement proceedings by any governmental,
administrative or regulatory body regarding any offence in any jurisdiction
involving slavery or human trafficking; and(c)it has and shall maintain in place throughout the term of this Agreement its own
policies, training and procedures, to ensure compliance with clauses 14(Modern Anti-Slavery) and 15 (Anti-Bribery).
8

CEM Monitoring Systems End User Licence Agreement 1st March 2022

14.3 The Client shall ensure it performs adequate due diligence procedures for its direct
subcontractors and suppliers in connection with the performance of this Agreement, toensure there is no slavery or human trafficking in the contractual chain.

15.

ANTI-BRIBERY
15.1 The Parties represent to one another that:(a)they have not committed any offence under the UK Bribery Act 2010 or done
any of the following (referred to hereafter as “Prohibited Acts”):(b)offered, given or agreed to give any Representative of the other Party any giftor consideration of any kind as an inducement or reward for doing or not doingor for having done or not having done any act in relation to the obtaining of
performance of this Agreement or any other agreement with the other Party or
for showing or not showing favour or disfavour to any person in relation to thisAgreement or any other agreement with the other Party; or(c)in connection with this Agreement paid or agreed to pay any commission otherthan a payment, particulars of which (including the terms and conditions of theagreement for its payment) have been disclosed in writing to the other Party;
and(d)they have in place adequate procedures to prevent bribery and corruption, as
contemplated by section 7 of the UK Bribery Act 2010.

16.

SEVERABILITY

In the event that any Court or other competent authority decides that any provision of this Agreement
is void or otherwise ineffective in whole or in part then any other part and the other terms andconditions of this Agreement shall continue in full force and effect.
17.

RIGHTS OF THIRD PARTIESThe Parties do not intend that any term of this Agreement shall be enforceable solely by virtue of theContracts (Rights of Third Parties) Act 1999 by any person who is not a party to this Agreement.
18.

NO PARTNERSHIP

Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint
venture between the Parties, constitute any Party the agent of another Party, or authorise any Party
to make or enter into any commitments for or on behalf of any other Party.
19.

ASSIGNMENT AND NOVATION

CEM reserves the right to at any time assign or novate any or all of its rights and/or obligations under
this Agreement. The Client may only assign or novate any or all of their rights and/or obligations upon
written confirmation by CEM, which CEM shall not be obliged to approve.

9CEM Monitoring Systems End User Licence Agreement 1st March 2022
20.

AMENDMENTS AND VARIATIONS

20.1

CEM has the right to amend and vary the terms of this Agreement from time to time.

20.2 Notwithstanding clause 20.1, CEM will only notify the Client in writing where there is aMaterial Change, provided however, that CEM shall not be held liable for a failure to notify the
Client of a Material Change.
20.3 The Client hereby acknowledges that all amendments and variations of this Agreement shallbe published by CEM on the CEM.org website and that the Client has an obligation to monitor theCEM.org website for all amendments and variations of this Agreement.

21.

ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the Parties with respect to the subject
matter of this Agreement and supersedes all previous agreements, arrangements or undertakings
between the Parties relating to the subject matter of this Agreement and any representations or
warranties previously given or made to it.
22.

GOVERNING LAW AND JURIDICTION

This Agreement is governed by and interpreted in accordance with English law. Any disputes or claims
relating to this Agreement shall be subject to the exclusive jurisdiction of the English Courts.
23.

NOTICES

23.1

Any notice given to the Client by CEM under or in connection with this Agreement will beeffective if:(a)posted on CEM's website and/or in a prominent position on the CEM System;or(b)sent to the Client at the address or email address given in the Order or suchother address as the Client may notify to CEM.
Any notice given by the Client to CEM under or in connection with this Agreement will beeffective if sent to one of the following addresses:
Address: The Triangle Building, Shaftesbury Road, Cambridge CB2 8EA; or
Email: Primary products - primary.support@cem.org
Secondary products - secondary.support@cem.org
Post 16 products - alis@cem.org

23.2

A notice is given by either party in accordance with clause 23 shall be deemed to have been
received:(a)if delivered by hand, at the time the notice is left at the address;(b)
if sent from the UK by pre-paid first-class post or other next working day
delivery service, at 09.00am on the second working day after posting;(c)if sent by pre-paid airmail, at 09.00am on the seventh working day after posting;or
10

CEM Monitoring Systems End User Licence Agreement 1st March 2022(d)

if sent by email, at the time of transmission provided that if this would occur
outside business hours in the UK it shall be deferred until business hours
resume.

11

CEM Monitoring Systems End User Licence Agreement 1st March 2022
SCHEDULE 1 – DEFINITIONS AND INTERPRETATION
1.

DEFINITIONS AND INTERPRETATION

The following definitions and rules of interpretation apply in this Agreement:
1.1

Definitions:“Access Termination Date” means, for the time being, the 31st day of December in eachcalendar year.
“Agreement Start Date” means the date on which the Client places the Order andpurchases the Licence.
“Annual Opt-out Notice Cut-off Date” means, for the time being, the 1st day of February
in each calendar year.
“CEM Affiliate” means any agent and/or other third-party licensed to sell any of the CEM
Assessment Products.
“CEM Assessment” means the test materials that are administered by the Client and thatare derived from the CEM Assessment Product.
"CEM Assessment Collateral” means all information relating to the development,
performance and/or marking of CEM Assessments (whether past, present or futureassessments), including all question papers, answer sheets, mark schemes and modelanswers, question banks and specifications; the process for standardising the results of
CEM Assessments; and all guidance relating to CEM Assessments provided by CEM inorder to support its customers.
“CEM Assessment Product” means any one or more of the following CEM computerbased assessment products:
i.
ii.
iii.

ASPECTS, BASE, PIPs Baseline, PIPS and/or InCAS (a “Primary Product”);
MidYIS, Yellis (a “Secondary Product”);
Alis, CEM IBE (a “Post-16 Product”),

together with the CEM Reports, as accessed via the CEM Systems and as replaced or
updated from time to time.
“CEM IPR” means any and all Intellectual Property Rights held in the CEM Systems, CEM
Assessment Product and CEM Reports (excluding data provided or owned by the Client)including but not limited to all copyright therein.
“CEM Reports” means access to online or downloadable analysis of assessment data andother data provided by the Client, including additional guidance material that are thesubject of the Order.
“CEM Systems” means the online systems installed or accessed by the Client that are
subject to the terms and conditions of the Licence and that provide access to the relevant
CEM Assessment Product.
“Confidential Information” means all information of a confidential nature (in whateverform) which is disclosed by either party and includes:(a) any know-how, trade secrets, financial, commercial, technical, tactical or strategic
information of any kind;12

CEM Monitoring Systems End User Licence Agreement 1st March 2022(b)
where CEM is the disclosing party, information consisting of CEM Assessment
Collateral;(c)

all information produced or developed in the performance of this Agreement;(d) all information agreed to be, or marked as, confidential;(e) any information the receiving party knows, or could reasonably be expected to know,
is confidential; or(f)the terms and existence of this Agreement.

“Data Controller” has the meaning given to it in the Data Protection Legislation.
“Data Protection Legislation” means the Data Protection Act 2018, the Regulation
EU/2016/679 of the European Parliament and of the Council of 27 April 2016 (the General
Data Protection Regulation) and all applicable laws and regulations relating to processingof personal data and privacy including where applicable the guidance and codes ofpractice issued by the Information Commissioner.
“Information Legislation” means the Freedom of Information Act 2000 (“FOIA”), theEnvironmental Information Regulations 1992 (“EIR”) or any other applicable legislationor codes governing access to information.
“Intellectual Property Rights" means all patents, rights to inventions, copyright andrelated rights, trade marks, business names and domain names, rights in get-up, goodwill
and the right to sue for passing off or unfair competition, rights in designs, rights incomputer software, database rights, rights to use, and protect the confidentiality of, theConfidential Information and all other intellectual property rights, whether registered ornot, which subsist or will subsist now or in the future in any part of the world.
“Licence” means the software licence granted by CEM to the Client on the terms andconditions herein to use one or more of the CEM Assessment Products and to install andaccess the CEM Systems.
“Licence Fee” means the fee payable by the Client to CEM or to a CEM Affiliate inaccordance with clause 3.1.
“Material Change” means any change to the terms of this Agreement that would bereasonably considered to adversely affect the Client.
“Minor Change” means any change to the terms of this Agreement that is not a Material
Change.
“Order” means the purchase of the Licence as effected via the CEM.org website andsubject to the terms and conditions herein.
“Updates” means, depending on the context, any changes, amendments, or upgrades to
the CEM Systems and/or the CEM Assessment Product.
1.2

Headings. Clause, Schedule and paragraph headings shall not affect the interpretation ofthis Agreement.

1.3

Definition of person. A person includes a natural person, corporate or unincorporated
body (whether or not having separate legal personality)

13

CEM Monitoring Systems End User Licence Agreement 1st March 2022
1.4

Clause and paragraph references. References to Clauses and Schedules are to the clauses
and schedules of this Agreement and references to Paragraphs are to paragraphs of therelevant Schedule.

1.5

Schedules. The Schedules form part of this Agreement and shall have effect as if set out
in full in the body of this Agreement. Any reference to this Agreement includes the
Schedules.

1.6

Company. A reference to a company shall include any company, corporation or otherbody corporate, wherever and however incorporated or established.

1.7

Singular and plural. Unless the context otherwise requires, words in the singular shall
include the plural and in the plural shall include the singular.

1.8

Gender. Unless the context otherwise requires, a reference to one gender shall include areference to the other genders.

1.9

Party. A reference to any party shall include that party's personal representatives,
successors and permitted assigns.

1.10

Statute. A reference to a statute or statutory provision is a reference to it as amended,
extended or re-enacted from time to time.

1.11

Subordinate legislation. A reference to a statute or statutory provision shall include all
subordinate legislation made from time to time under that statute or statutory provision.

1.12

Writing and written. A reference to writing or written includes fax and email.

1.13

Negative obligations. Any obligation on a party not to do something includes anobligation not to allow that thing to be done.

1.14

Inclusionary language. Any words following the terms including, include, in particular or
any similar expression shall be construed as illustrative and shall not limit the sense of
the words, description, definition, phrase or term preceding those terms.

14

CEM Monitoring Systems End User Licence Agreement 1st March 2022

SCHEDULE 2 – DATA SHARING
Data Controller to Data Controller
1.

DEFINITIONS AND INTERPRETATION
1.1

In this Schedule 2, the following words have the following meanings:
Adequacy Decision: decision by the European Commission subject to article 45 GDPR.
Agreed Purposes: the purposes set out in the Annex to this Schedule;
Data Subject Request: means a request made by a Data Subject to exercise any rights ofData Subjects under Data Protection Legislation;
Data Protection Legislation: (as applicable) the Data Protection Act 2018; Regulation (EU)2016/679 (the “GDPR”); and any laws, regulations and/or secondary legislationtransposing the GDPR into English law or with similar subject matter, including any
successor legislation to the Data Protection Act 2018;
Data Sharing: the transfer of the Shared Personal Data;
EEA: European Economic Area.
Shared Data Breach: any security breach or other action or inaction leading to theaccidental or unlawful destruction, loss, alteration, unauthorised disclosure or access toShared Personal Data;
Shared Personal Data: any personal data shared between the Parties in connection with
the Agreement.
Standard Contractual Clauses: standard contractual clauses for the transfer of personal
data from the EEA to third countries (controller to controller transfers) as set out in theCommission Decision 2004/915/EC of 27 December 2004 amending Decision
2001/497/EC.

1.2

Where used in this Schedule 2, the terms Data Controller, Data Processor, Data Subject,
Personal Data and processing and Special Category Data all have the meanings given to
those terms in the Data Protection Legislation.

1.3

This Schedule 2 is intended to be legally binding and shall prevail over all otheragreements, arrangements and understandings between the Parties relating to the Data
Sharing, save for Schedule 1, whether made before or after the date of this Schedule 2
and notwithstanding any wording to the contrary in such agreements, arrangements andunderstandings between the Parties.

1.4

In case of any conflict or inconsistency between the provisions of this Agreement, thisshall be the order on precedence: Schedule 2; Schedule 1; main terms of the Agreement.
15

CEM Monitoring Systems End User Licence Agreement 1st March 2022

1.5

A reference to a statute or statutory provision includes all subordinate legislation madeunder it from time to time, and is a reference to it as amended, extended or re-enacted
from time to time (“Replacement Law”). References to terms defined in a statute or
statutory provision shall be replaced with or incorporate (as the case may be) references
to the equivalent terms defined in any Replacement Laws, once in force and applicable.

1.6

To the extent that a term of this Schedule 1 requires the performance by a party of an
obligation “in accordance with Data Protection Legislation” (or similar), unless otherwise
expressly agreed in this Schedule 2, this requires performance in accordance with therelevant requirements of such Data Protection Legislation as is in force and applicable atthe time of performance (if any).

2.

PURPOSE
2.1

In relation to the Shared Personal Data, each of the Parties agrees that it is a Data
Controller.

2.2

During the term of this Agreement, the Parties shall share with each other certain Personal
Data. The Data Sharing is necessary to support the Agreed Purposes of both Parties.

2.3

The parties shall only use the Shared Personal Data for lawful purposes in connection with
the Agreed Purposes and not process the Shared Personal Data in a way that is
incompatible with the Agreed Purposes or Data Protection Legislation.

3.

DATA PROTECTION COMPLIANCE
3.1

Each Party shall comply with all the obligations imposed on a controller under the Data
Protection Legislation. Any material breach of the Data Protection Legislation by a Partyin connection with the Data Sharing shall constitute a material breach of this Schedule 2.

3.2

Each Party shall:(a) process the Shared Personal Data fairly and lawfully, each of them as a Data
Controller;(b) for each Agreed Purpose, ensure that it processes the Shared Personal Data on thebasis of one of the legal grounds set out in Article 6 of the GDPR (Lawfulness ofProcessing) or Article 9 of the GDPR (Processing of special categories of personaldata) (as applicable);(c) inform, or otherwise make information available to the Data Subjects of the purposes
for which it will process Personal Data and provide or make available all informationthat it must provide in accordance with its own applicable law to ensure that Data
Subjects understand how their Personal Data will be processed by that Party;(d) ensure that it has in place appropriate technical and organisational measures toprotect against unauthorised or unlawful processing of Personal Data and against
accidental loss or destruction of, or damage to, Personal Data;(e) not transfer any personal data outside the European Economic Area otherwise thanin compliance with the Data Protection Legislation.

16

CEM Monitoring Systems End User Licence Agreement 1st March 2022
4.

COOPERATION BETWEEN THE PARTIES
4.1

5.

Each Party shall assist the other in complying with all applicable requirements of the Data
Protection Legislation. In particular, in connection with the Shared Personal Data, eachParty shall:(a) ensure that any notices given to Data Subjects in relation to the Shared Personal Data
are provided in a manner and according to timing that is compliant with Data
Protection Legislation;(b) inform the other Party if any Personal Data has been transferred to the other Partyin error or otherwise in breach of the Data Protection Legislation, requesting theimmediate deletion of such inappropriately transferred Personal Data;(c) if legally required, inform the other Party about the receipt of a complaint or Data
Subject Request from any Data Subject regarding the Shared Personal Data;(d) deal at its discretion with all Data Subject Requests and complaints that it receives
directly from a Data Subject or the person making the complaint. For the avoidanceof doubt, a Data Subject Request made to one Party in its capacity as Data Controller
shall not oblige the other Party to disclose any Personal Data it holds independently
in its capacity as a Data Controller;(e) if legally required, inform the other Party without delay if a Data Subject requests theerasure of any Shared Personal Data. For the avoidance of doubt, where one Party is
obliged to erase any Shared Personal Data, the other Party shall not be obliged toerase the same Shared Personal Data if that other Party may lawfully continue to holdand process such Shared Personal Data;(f) provide reasonable and prompt assistance to the other Party as is necessary toenable it to comply with a Data Subject Request and/or to respond to any otherqueries or complaints received from Data Subjects or supervisory authorities orregulators and, in each case related to the Shared Personal Data;(g) provide the other Party with such information as the other Party reasonably requires
for maintaining the records it is required to maintain by the Data Protection
Legislation; and(h) provide the other Party with contact details of at least one employee as point ofcontact and responsible manager for all issues arising out of the Data Protection
Legislation, including the procedures to be followed in the event of a Shared Data
Breach.
DATA BREACHES

5.1

In respect of each Shared Data Breach, each Party shall:(a) promptly notify the other Party of the Shared Data Breach;(b) provide the other Party without undue delay (wherever possible, no later than 48
hours after becoming aware of the Shared Data Breach) with such details as the otherParty reasonably requires regarding the Shared Personal Data.

5.2

To the extent permitted by applicable laws, neither Party shall:(a) notify a supervisory or regulatory authority of any Shared Data Breach;(b) issue a public statement or otherwise notify any Data Subject of such Shared Data
Breach,without first consulting with, and obtaining the consent (not to be unreasonably withheld
or delayed) of, the other Party.
17

CEM Monitoring Systems End User Licence Agreement 1st March 2022

6.

DELETION OR RETURN OF SHARED DATA
6.1

Neither Party shall retain or process the Shared Personal Data for longer than is necessary
in connection with carrying out the Agreed Purposes.

6.2

Notwithstanding clause 6.1, the Parties shall continue to retain Shared Personal Data inaccordance with any statutory or professional retention periods applicable in theirrespective countries and/or industry.

7.

INTERNATIONAL TRANSFERS
7.1

In the event that CEM transfers Shared Personal Data to the Client outside the EEA or thetransfer is not covered by an Adequacy Decision, both Parties shall be bound by theStandard Contractual Clauses as set out in Schedule 3 of this Agreement. If the Standard
Contractual Clauses contradict any other part of this Agreement, including its Schedules
and Annexes, the Standard Contractual Clauses shall prevail.

18

CEM Monitoring Systems End User Licence Agreement 1st March 2022
Annex

1.

AGREED PURPOSES
For the purposes of this agreement, Agreed Purposes refer to the following purposes:(a) CEM to provide the services under this Agreement to the Client;(b) without prejudice to paragraph (a) above, CEM to (i) develop assessments and other CEM
services and improve on their quality and integrity, including the collection of statistics andother information relating to such assessments and other services for CEM’s future use and(ii) carry out marketing and market research, and provide training in order to improve on thedelivery of assessments and other services;(c) the Client to benefit from the services provided to it under this Agreement;(d) without prejudice to paragraph (c) above, the Client to offer, and enable pupils, to take
CEM’s assessments; and(e) the Parties to comply with their legal and regulatory obligations and to assist each other in
relation to any exercise by a pupil of their rights as a data subject.

19

CEM Monitoring Systems End User Licence Agreement 1st March 2022
SCHEDULE 3 – STANDARD CONTRACTUAL CLAUSESTHIS SCHEDULE 3 ONLY APPLIES IN THE EVENT THAT CLIENT RECEIVES SHARED PERSONALDATA OUTSIDE THE EEA OR OUTSIDE A TERRITORY OR ORGANISATION NOTSUBJECT TO AN ADEQUACY DECISION BY THE EUROPEAN COMMISSION.

Standard contractual clauses for the transfer of personal data from the Community to
third countries (controller to controller transfers)
Data transfer agreement

betweenCEM
hereinafter “data exporter”
andThe Client
hereinafter “data importer”
each a “party”; together “the parties”.

Definitions
For the purposes of the clauses:(a) “personal data”, “special categories of data/sensitive data”, “process/processing”,“controller”, “processor”, “data subject” and “supervisory authority/authority” shallhave the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby “theauthority” shall mean the competent data protection authority in the territory in which
the data exporter is established);(b) “the data exporter” shall mean the controller who transfers the personal data;(c) “the data importer” shall mean the controller who agrees to receive from the data
exporter personal data for further processing in accordance with the terms of theseclauses and who is not subject to a third country’s system ensuring adequate
protection;(d) “clauses” shall mean these contractual clauses, which are a free-standing documentthat does not incorporate commercial business terms established by the parties under
separate commercial arrangements.
The details of the transfer (as well as the personal data covered) are specified in Annex B,
which forms an integral part of the clauses.

20

CEM Monitoring Systems End User Licence Agreement 1st March 2022
I.

Obligations of the data exporter

The data exporter warrants and undertakes that:(a) The personal data have been collected, processed and transferred in accordancewith the laws applicable to the data exporter.
(b) It has used reasonable efforts to determine that the data importer is able to satisfy its
legal obligations under these clauses.
(c) It will provide the data importer, when so requested, with copies of relevant dataprotection laws or references to them (where relevant, and not including legal advice)of the country in which the data exporter is established.
(d) It will respond to enquiries from data subjects and the authority concerning
processing of the personal data by the data importer, unless the parties have agreed
that the data importer will so respond, in which case the data exporter will still respondto the extent reasonably possible and with the information reasonably available to it
if the data importer is unwilling or unable to respond. Responses will be made withina reasonable time.
(e) It will make available, upon request, a copy of the clauses to data subjects who arethird party beneficiaries under clause III, unless the clauses contain confidential
information, in which case it may remove such information. Where information isremoved, the data exporter shall inform data subjects in writing of the reason forremoval and of their right to draw the removal to the attention of the authority.
However, the data exporter shall abide by a decision of the authority regarding accessto the full text of the clauses by data subjects, as long as data subjects have agreed
to respect the confidentiality of the confidential information removed. The data
exporter shall also provide a copy of the clauses to the authority where required.
II.

Obligations of the data importer
The data importer warrants and undertakes that:(a) It will have in place appropriate technical and organisational measures to protect thepersonal data against accidental or unlawful destruction or accidental loss, alteration,
unauthorised disclosure or access, and which provide a level of security appropriate
to the risk represented by the processing and the nature of the data to be protected.
(b) It will have in place procedures so that any third party it authorises to have access tothe personal data, including processors, will respect and maintain the confidentiality
and security of the personal data. Any person acting under the authority of the data
importer, including a data processor, shall be obligated to process the personal data
only on instructions from the data importer. This provision does not apply to persons
authorised or required by law or regulation to have access to the personal data.
(c) It has no reason to believe, at the time of entering into these clauses, in the existenceof any local laws that would have a substantial adverse effect on the guarantees
provided for under these clauses, and it will inform the data exporter (which will passsuch notification on to the authority where required) if it becomes aware of any suchlaws.
(d) It will process the personal data for purposes described in Annex B, and has the legal
authority to give the warranties and fulfil the undertakings set out in these clauses.
(e) It will identify to the data exporter a contact point within its organisation authorised torespond to enquiries concerning processing of the personal data, and will cooperate
in good faith with the data exporter, the data subject and the authority concerning all
such enquiries within a reasonable time. In case of legal dissolution of the data
exporter, or if the parties have so agreed, the data importer will assume responsibility
for compliance with the provisions of clause I(e).

21CEM Monitoring Systems End User Licence Agreement 1st March 2022(f) At the request of the data exporter, it will provide the data exporter with evidence offinancial resources sufficient to fulfil its responsibilities under clause III (which may
include insurance coverage).
(g) Upon reasonable request of the data exporter, it will submit its data processing
facilities, data files and documentation needed for processing to reviewing, auditing
and/or certifying by the data exporter (or any independent or impartial inspection
agents or auditors, selected by the data exporter and not reasonably objected to by
the data importer) to ascertain compliance with the warranties and undertakings inthese clauses, with reasonable notice and during regular business hours. The request
will be subject to any necessary consent or approval from a regulatory or supervisory
authority within the country of the data importer, which consent or approval the data
importer will attempt to obtain in a timely fashion.
(h) It will process the personal data, at its option, in accordance with:(i) the data protection laws of the country in which the data exporter isestablished, or(ii) the relevant provisions (1) of any Commission decision pursuant to Article
25(6) of Directive 95/46/EC, where the data importer complies with the relevant
provisions of such an authorisation or decision and is based in a country to whichsuch an authorisation or decision pertains, but is not covered by such
authorisation or decision for the purposes of the transfer(s) of the personal data(2), or(iii) the data processing principles set forth in Annex A.
Data importer to indicate which option it selects: Option (iii), principles set forth inAnnex A.
Initials of data importer: Electronically accepted;(i) It will not disclose or transfer the personal data to a third party data controller locatedoutside the European Economic Area (EEA) unless it notifies the data exporter about
the transfer; and(i)the third party data controller processes the personal data inaccordance with a Commission decision finding that a third country provides
adequate protection, or(ii)
the third party data controller becomes a signatory to these clauses oranother data transfer agreement approved by a competent authority in the EU,or(iii)
data subjects have been given the opportunity to object, after having
been informed of the purposes of the transfer, the categories of recipients andthe fact that the countries to which data is exported may have different dataprotection standards, or(iv)with regard to onward transfers of sensitive data, data subjects have given theirunambiguous consent to the onward transfer
III.

Liability and third party rights(a)Each party shall be liable to the other parties for damages it causes by any
breach of these clauses. Liability as between the parties is limited to actual damage
suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous

1“Relevant provisions” means those provisions of any authorisation or decision except for the enforcement
provisions of any authorisation or decision (which shall be governed by these clauses).
2
However, the provisions of Annex A.5 concerning rights of access, rectification, deletion and objection must
be applied when this option is chosen and take precedence over any comparable provisions of the Commission
Decision selected.

22

CEM Monitoring Systems End User Licence Agreement 1st March 2022
conduct) are specifically excluded. Each party shall be liable to data subjects fordamages it causes by any breach of third party rights under these clauses. This does
not affect the liability of the data exporter under its data protection law.
(b)
The parties agree that a data subject shall have the right to enforce as a third
party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i),III(a), V, VI(d) and VII against the data importer or the data exporter, for their respective
breach of their contractual obligations, with regard to his personal data, and accept
jurisdiction for this purpose in the data exporter’s country of establishment. In cases
involving allegations of breach by the data importer, the data subject must first request
the data exporter to take appropriate action to enforce his rights against the data
importer; if the data exporter does not take such action within a reasonable period (which
under normal circumstances would be one month), the data subject may then enforce
his rights against the data importer directly. A data subject is entitled to proceed directlyagainst a data exporter that has failed to use reasonable efforts to determine that thedata importer is able to satisfy its legal obligations under these clauses (the data exporter
shall have the burden to prove that it took reasonable efforts).
IV.

Law applicable to the clauses

These clauses shall be governed by the law of the country in which the data exporter isestablished, with the exception of the laws and regulations relating to processing of thepersonal data by the data importer under clause II(h), which shall apply only if so selected by
the data importer under that clause.
V.

Resolution of disputes with data subjects or the authority(a)
In the event of a dispute or claim brought by a data subject or the authority
concerning the processing of the personal data against either or both of the parties, theparties will inform each other about any such disputes or claims, and will cooperate witha view to settling them amicably in a timely fashion.
(b)
The parties agree to respond to any generally available non-binding mediation
procedure initiated by a data subject or by the authority. If they do participate in theproceedings, the parties may elect to do so remotely (such as by telephone or otherelectronic means). The parties also agree to consider participating in any otherarbitration, mediation or other dispute resolution proceedings developed for dataprotection disputes.
(c)Each party shall abide by a decision of a competent court of the data exporter’s
country of establishment or of the authority which is final and against which no further
appeal is possible.

23

CEM Monitoring Systems End User Licence Agreement 1st March 2022
VI.

Termination(a)
In the event that the data importer is in breach of its obligations under theseclauses, then the data exporter may temporarily suspend the transfer of personal data
to the data importer until the breach is repaired or the contract is terminated.
(b)
In the event that:(i)the transfer of personal data to the data importer has been temporarilysuspended by the data exporter for longer than one month pursuant toparagraph (a);(ii)
compliance by the data importer with these clauses would put it inbreach of its legal or regulatory obligations in the country of import;(iii)
the data importer is in substantial or persistent breach of any warranties
or undertakings given by it under these clauses;(iv)
a final decision against which no further appeal is possible of acompetent court of the data exporter’s country of establishment or of theauthority rules that there has been a breach of the clauses by the data importeror the data exporter; or(v)
a petition is presented for the administration or winding up of the data
importer, whether in its personal or business capacity, which petition is notdismissed within the applicable period for such dismissal under applicable law;a winding up order is made; a receiver is appointed over any of its assets; atrustee in bankruptcy is appointed, if the data importer is an individual; acompany voluntary arrangement is commenced by it; or any equivalent eventin any jurisdiction occurs then the data exporter, without prejudice to any otherrights which it may have against the data importer, shall be entitled to terminate
these clauses, in which case the authority shall be informed where required. In
cases covered by (i), (ii), or (iv) above the data importer may also terminate
these clauses.
(c)Either party may terminate these clauses if (i) any Commission positive
adequacy decision under Article 25(6) of Directive 95/46/EC (or any superseding text)
is issued in relation to the country (or a sector thereof) to which the data is transferredand processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text)
becomes directly applicable in such country.
(d)
The parties agree that the termination of these clauses at any time, in any
circumstances and for whatever reason (except for termination under clause VI(c))
does not exempt them from the obligations and/or conditions under the clauses asregards the processing of the personal data transferred.

VII.

Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, inwhich case they will inform the authority where required. This does not preclude the parties
from adding additional commercial clauses where required.
VIII.

Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree
that Annex B may contain confidential business information which they will not disclose to third
parties, except as required by law or in response to a competent regulatory or government
agency, or as required under clause I(e). The parties may execute additional annexes to coveradditional transfers, which will be submitted to the authority where required. Annex B may, inthe alternative, be drafted to cover multiple transfers.

24

CEM Monitoring Systems End User Licence Agreement 1st March 2022
Dated: start date of the Agreement.

25

CEM Monitoring Systems End User Licence Agreement 1st March 2022
ANNEX ADATA PROCESSING PRINCIPLES

1.
Purpose limitation: Personal data may be processed and subsequently used or further
communicated only for purposes described in Annex B or subsequently authorised by the data
subject.
2.
Data quality and proportionality: Personal data must be accurate and, where
necessary, kept up to date. The personal data must be adequate, relevant and not excessive
in relation to the purposes for which they are transferred and further processed.
3.
Transparency: Data subjects must be provided with information necessary to ensure
fair processing (such as information about the purposes of processing and about the transfer)
unless such information has already been given by the data exporter.
4.
Security and confidentiality: Technical and organisational security measures must be
taken by the data controller that are appropriate to the risks, such as against accidental or
unlawful destruction or accidental loss, alteration, unauthorised disclosure or access,presented by the processing. Any person acting under the authority of the data controller,
including a processor, must not process the data except on instructions from the data
controller.
5.
Rights of access, rectification, deletion and objection: As provided in Article 12 of
Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided withthe personal information about them that an organisation holds, except for requests which are
manifestly abusive, based on unreasonable intervals or their number or repetitive orsystematic nature, or for which access need not be granted under the law of the country of thedata exporter. Provided that the authority has given its prior approval, access need also not
be granted when doing so would be likely to seriously harm the interests of the data importeror other organisations dealing with the data importer and such interests are not overridden by
the interests for fundamental rights and freedoms of the data subject. The sources of thepersonal data need not be identified when this is not possible by reasonable efforts, or where
the rights of persons other than the individual would be violated. Data subjects must be able
to have the personal information about them rectified, amended, or deleted where it isinaccurate or processed against these principles. If there are compelling grounds to doubt thelegitimacy of the request, the organisation may require further justifications before proceeding
to rectification, amendment or deletion. Notification of any rectification, amendment or deletionto third parties to whom the data have been disclosed need not be made when this involves a
disproportionate effort. A data subject must also be able to object to the processing of thepersonal data relating to him if there are compelling legitimate grounds relating to his particularsituation. The burden of proof for any refusal rests on the data importer, and the data subject
may always challenge a refusal before the authority.
6.
Sensitive data: The data importer shall take such additional measures (e.g. relating tosecurity) as are necessary to protect such sensitive data in accordance with its obligations
under clause II.
7.
Data used for marketing purposes: Where data are processed for the purposes of
direct marketing, effective procedures should exist allowing the data subject at any time to“opt-out” from having his data used for such purposes.
8.
Automated decisions: For purposes hereof “automated decision” shall mean a decisionby the data exporter or the data importer which produces legal effects concerning a data
subject or significantly affects a data subject and which is based solely on automatedprocessing of personal data intended to evaluate certain personal aspects relating to him,
26

CEM Monitoring Systems End User Licence Agreement 1st March 2022
such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer
shall not make any automated decisions concerning data subjects, except when:(a)(i) such decisions are made by the data importer in entering into or performing
a contract with the data subject, and(ii) (the data subject is given an opportunity to discuss the results of a relevant
automated decision with a representative of the parties making such decisionor otherwise to make representations to that parties.
or(b)where otherwise provided by the law of the data exporter.

27

CEM Monitoring Systems End User Licence Agreement 1st March 2022
ANNEX BDESCRIPTION OF THE TRANSFER

Data subjects
The personal data transferred concern the following categories of data subjects:
Students (including under 13 years old) and data subjects acting on behalf of the data exportersuch as employees or contractors.
Purposes of the transfer(s)The transfer is made for the following purposes
As set out in the Agreement/s between the parties.
Categories of data
The personal data transferred concern the following categories of data:
Full names, sex, identification numbers (such as candidate number), centre/school details,
exam details, candidate answers, contact details, native language, year group, date of birth,class name, place of birth, free school meals status, previous school, average GCSE score orsimilar, subject choices for A Level or other exam, test venue, application to other grammar
school, special arrangements and any other information that may be required in connection
with the purposes of the transfers.
Recipients
The personal data transferred may be disclosed only to the following recipients or categories
of recipients:
As per the agreement/s between the parties or otherwise as the parties see fit in accordancewith their own privacy policies and applicable legislation.
Sensitive data (if appropriate)
The personal data transferred concern the following categories of sensitive data:
Some special category data such as disabilities may be inferred by special arrangements.
Ethnic background may be processed as well.
Data protection registration information of data exporter (where applicable)
UK ICO registration number: Z6641083
Additional useful information (storage limits and other relevant information)
As set out in the agreements that govern the relationship between the parties.
Contact points for data protection enquiries
Data importer

Data exporter

As provided by data importer to data exporter as soon as the Licence is accepted
privacy@cambridge.org

28