END-USER LICENCE AGREEMENT FOR CEM SELECT ENTRANCE ASSESSMENT SERVICES PROVIDED BY
CEM (CENTRE FOR EVALUATION AND MONITORING) (“AGREEMENT”)
THIS AGREEMENT IS MADE BETWEEN THE END USER OF THIS SOFTWARE IDENTIFIED ON THE
REGISTRATION FORM ACCOMPANYING THIS LICENCE (THE “CLIENT”) AND THE CHANCELLOR,MASTERS AND SCHOLARS OF THE UNIVERSITY OF CAMBRIDGE ACTING THROUGH ITSDEPARTMENTS THE UNIVERSITY OF CAMBRIDGE LOCAL EXAMINATIONS SYNDICATE OF THE
TRIANGLE BUILDING SHAFTESBURY ROAD CAMBRIDGE CB2 8EA, AND CAMBRIDGE UNIVERSITYPRESS OF THE UNIVERSITY PRINTING HOUSE, SHAFTESBURY ROAD CAMBRIDGE CB2 8BS (THE“CENTRE FOR EVALUATION AND MONITORING” OR “CEM”).
WHEREAS:
A. By submitting to CEM the Registration Form ("Order"), the Client agrees to purchase alicence from CEM to use one or more of the assessment systems belonging to CEM tofacilitate computer-based assessment including (if applicable):i.

any associated software components, media, printed materials, and "online" orelectronic documentation which will be administered by the Client in the form of atest that are the subject of the Order (henceforth referred to as the “Assessment”);
and

ii.

access to online or downloadable analysis of assessment data and other data
provided by the Client, including additional guidance material that are the subject of
the Order (henceforth referred to as the “Reports”).

B. On the terms set out in this Agreement, CEM agrees to grant a licence ("Licence") to the
Client to install the systems that are the subject to the Order ("Systems") including therelevant Assessment and Reports.
C. In placing an Order with CEM for any of CEM’s Systems, the Client understands that in doing
so, the Client enters into a legally binding contract with CEM in respect of theLicence. Incorporated into this Agreement are the terms of the Order.
TERMS AND CONDITIONS OF LICENCE:
1. CEM hereby grants to the Client the right to install and use multiple copies of theAssessment on the Client’s computers running validly licensed copies of the operating
system for which the Assessment was designed.
2. CEM reserves the right to perform credit checks on the Client at any point before or after the
Agreement Start Date (as may be applicable). Should the credit check on the Client not be, in
CEM’s sole opinion, favourable, CEM shall be entitled to terminate the Agreement withimmediate effect upon notice in writing to the Client if the Agreement has alreadycommenced.
3. The Client purchases access to the Assessment described herein on the understanding thatsome of the materials that are used to form the Assessment have been previously disclosed
to:(a) candidates who previously undertook previous entrance tests ("Previous
Users") supplied by CEM and;

CEM Select End User Licence Agreement 1st March 2021

(b) individuals responsible for the administration of the previous entrance tests
in which some of the materials from the Assessment were contained.
4. For the avoidance of doubt, the Client acknowledges that the Previous Users who haveaccessed materials which may form part of the Assessment are not under any specificobligation of confidentiality to CEM, or to the Client in regard to these materials and are
therefore at liberty to further disclose and/or discuss any information in regard to thesematerials which they may have accessed and which they may have committed to memory,with any third party they choose and through any medium. The Client acknowledges that
this is outside of the control of CEM.
5. The Client acknowledges to CEM that it is aware the Assessment will also be licenced for use
by a number of other Clients.
6. CEM agrees to provide the Assessment and Reports as detailed in the Client’s Order inaccordance with the terms and conditions of this Agreement. CEM will use its reasonableendeavours to ensure that the Assessment is provided under the best care, skill anddiligence and in accordance with best industry practice as outlined by the guidelines of the
British Educational Research Association (BERA), and in accordance with CEM’s ethicalresearch framework, and in accordance with all applicable laws and regulations, and in
consultation with the Clients.
7. In consideration of the rights granted to the Client hereunder, the Client undertakes andagrees to make payment to CEM of the Licence Fee detailed in the Order, within thirty (30)days of the date of invoice.
8. The Client acknowledges and agrees that any and all Intellectual Property Rights held in the
System, Assessment and Reports including but not limited to all copyright therein, shallremain the sole and exclusive property of CEM. For the purposes of this Agreement"Intellectual Property Rights" means all patents, rights to inventions, copyright and related
rights, trade marks, business names and domain names, rights in get-up, goodwill and theright to sue for passing off or unfair competition, rights in designs, rights in computer
software, database rights, rights to use, and protect the confidentiality of, confidential
information (including know-how) and all other intellectual property rights which subsist or
will subsist now or in the future in any part of the world.
9. CEM shall at its own expense obtain written permission for the inclusion of any copyrightmaterial in the Assessment or Reports, and shall be responsible for the payment of all fees
charged for the use of such material subject to copyright.
10. CEM warrants to the Client that the Intellectual Property Rights in the Assessment andReports, so far as it is aware and to the best of its knowledge and belief, do not infringe therights of any third party and that no third party has threatened or is currently threatening
proceedings in respect of such infringement, and none of its Intellectual Property Rights in
the Assessment or Reports is the subject of any actual or, so far as it is aware, threatenedchallenge, opposition or revocation proceedings.
11. The Parties agree at all times to handle personal information of the candidates strictly inaccordance with the Data Protection Legislation which for the purposes of this Agreementmeans the Data Protection Act 2018, the Regulation EU/2016/679 of the European
Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) andCEM Select End User Licence Agreement 1st March 2021

all applicable laws and regulations relating to processing of personal data and privacy
including where applicable the guidance and codes of practice issued by the Information
Commissioner. Each Party shall have the rights and obligations subscribed to it under the
Data Sharing Schedule set out below.
12. Both parties will act as Data Controller in respect of any personal data entered into the
System or otherwise supplied to CEM for the purpose of this Agreement and will do so inaccordance with the terms of the Data Sharing Schedule.
13. Both parties agree they are responsible for ensuring they have a lawful basis for sharing anyof the personal data provided to CEM as part of the System.
14. The Client hereby acknowledges that CEM is subject to the requirements of the Freedom ofInformation Act 2000 (“FOIA”), the Environmental Information Regulations 1992 (“EIR”) or
any other applicable legislation or codes governing access to information (together,“Information Legislation”) and the Client agrees to assist and co-operate with CEM (at theirown expense) to enable CEM to comply with these information disclosure requirements.
Further, in the event that the Client is also subject to Information Legislation, CEM agrees toassist and co-operate with the Client (at their own expense) to enable the Client to comply
with these information disclosure requirements. In the event that the Client receives aninformation disclosure request regarding CEM or any information the Client holds arising out
or in connection with this Agreement, the Client shall promptly notify CEM with details of
the request and shall take CEM’s representations into consideration while deciding the
response to that particular request. Any disclosure made by either Party pursuant to such
Party’s obligations under the provisions of Information Legislation, shall not constitute a
breach of this Agreement. CEM shall not be liable for any loss, damage, harm or other
detriment however caused arising from the disclosure (pursuant to the obligations ofInformation Legislation) of any information relating to this Agreement or the Client. The
provisions of this clause 14 shall apply during the continuance of this Agreement andindefinitely after its expiry or termination.
15. The following sets out the entire financial liability of CEM to the Client in respect of any
breach by CEM of this Agreement, non or incomplete performance or contemplated
performance by CEM of this Agreement, negligence for which CEM is liable, and any
representation or statement arising under or in connection with this Agreement or by or on
behalf of CEM:(a) in respect of all other losses and claims, the aggregate liability of CEM for any breach,negligence and/or liability arising in any other way out of the subject matter of thisAgreement or the performance of the Assessment will not exceed in total the amounts
actually received by CEM from the Client for the licence of the Assessment software
under this Agreement; and(b) CEM shall in no circumstances be liable for any loss of profits, loss of business or
production, depletion of goodwill, loss of or corruption to data, and/or any indirect loss.
16. CEM will in no event be liable for any statement or representation about the Client, theirbusiness, products or services made or communicated in or by any item, material or work
approved by the Clients in writing.

CEM Select End User Licence Agreement 1st March 2021

17. For clarity, nothing in this Agreement limits or excludes either Party’s liability for death or
personal injury caused by such Party’s negligence or any fraud or for any sort of liability thatby law cannot be limited or excluded.
18. The Client undertakes that under no circumstance shall the Client:(a) copy, reproduce or create derivative works from the System, Assessment and/or
Reports;(b) provide access to the System and/or Assessment to any a third party, other than as
contemplated under this Licence, without the express written permission of CEM;(c) provide access to or share the Reports with any third party other than as contemplated
under this Licence. It is acknowledged and agreed by CEM that the Client shall beallowed to share the Reports with third parties with whom it is strictly necessary inorder to allow the Client to make full use of the Reports as contemplated under thisAgreement, which shall include, but not be limited to bodies representing parents, local
authorities, the Client’s parent company/trust, external inspectors and education
consultants employed by the Client;(d) sublicense, rent, sell or lease any portion of the System, Assessment and/or Reports;(e) alter, modify, disassemble, reverse engineer all or any part of the System, Assessment
and/or Reports;(f) translate, merge, adapt or modify all or any part of the System, Assessment, and orReports;(g) infringe CEM’s Intellectual Property Rights or those of any third party in relation to theiruse of the System, Assessment and/or Reports;(h) use the System, Assessment and/or Reports in a way that could damage, disable,
overburden, impair or compromise CEM’s systems or security or interfere with otherusers; nor(i) use the System, Assessment and/or Reports in any manner not authorised by theseterms.
19. The Client hereby acknowledges that certain elements of the System, Assessment andReports may at any time be in the process of being developed. The System, Assessment
and/or Reports may subsequently be substantially modified or withdrawn at the sole
discretion of CEM.
20. The Client’s installation and use of the System, Assessment and/or Reports is at the Client’ssole discretion and risk and may produce unintended or erroneous results and may containbugs, errors and other problems that could cause system or other failures and data loss. The
Client accepts that the System, Assessment and/or Reports are provided to the Client “as is”
without any warranty, and CEM expressly disclaims any and all warranties, including, but notlimited to, warranties of merchantability, fitness for a particular purpose or error free
operation.
21. CEM is not obligated to provide updates to the System, Assessment and/or Reports.
However, in the event CEM elects in its sole discretion to provide updates to the System,
Assessment and/or Reports, such updates shall be deemed to constitute part of the System,
Assessment and/or Reports and shall therefore be subject to these terms.
22. The Client warrants to CEM it shall at no point:

CEM Select End User Licence Agreement 1st March 2021

(a) take any action which is intended, or could reasonably be expected, to harm in any way
the reputation of CEM or any part of it; or(b) take any action which is intended, or could reasonably be expected to lead to any
unwanted or unfavourable publicity for CEM or any part of it.
23. The Client may terminate this Agreement at any time by written notice to CEM and thefollowing provisions shall apply:(a) If the Client terminates this Agreement not more than thirty (30) days from the date itplaced the Order and the installation and/or use by the Client of the Assessment has notcommenced during such period, the Client shall not be liable to make any payment to
CEM;(b) If the Client terminates this Agreement more than thirty (30) days but not more thansixty (60) days from the date it placed the Order and the installation and/or use by the
Client of the Assessment has not commenced during such period, the Client shall pay to
CEM a withdrawal fee of £50;(c) If the Client terminates this Agreement more than sixty (60) days from the date it placed
the Order or after the installation and/or use by the Client of the Assessment hascommenced, the Client shall pay to CEM the registration fee and price of any
Assessment used pursuant to the Order;(d) Any payments to be made by the Client to CEM pursuant to this Clause 23 shall be madewithin thirty (30) days of the date of invoice issued by CEM.
24. Unless terminated earlier in accordance with clause 23, this Agreement shall terminate on
31st December 2022.
25. In the event that any Court or other competent authority decides that any provision of thisAgreement is void or otherwise ineffective in whole or in part then any other part and theother terms and conditions of this Agreement shall continue in full force and effect.
26. The parties do not intend that any term of this Agreement shall be enforceable solely byvirtue of the Contracts (Rights of Third Parties) Act 1999 by any person who is not a party tothis Agreement.
27. The Client shall:(a)comply with the anti-slavery policy of the University of Cambridge as set out at
http://www.registrarysoffice.admin.cam.ac.uk/governance-and-strategy/anti-slavery-andanti-trafficking and as amended from time to time;(b)
not engage in any activity, practice or conduct that would constitute an offence
under sections 1, 2 or 4 of the Modern Slavery Act 2015 if such activity, practice or conduct
was carried out in the UK;(c)include in all its contracts with its subcontractors and supplier’s anti-slavery andanti-human trafficking terms that are at least as onerous as those set out in this Clause 27;
and

CEM Select End User Licence Agreement 1st March 2021

(d)promptly report to CEM any suspected or known slavery or human trafficking inconnection with the performance of this Agreement, any breach or potential breach of thisClause 27 or any breach or potential breach of CEM’s anti-slavery policy.
28. The Client represents that:(a)it, its officers and its employees have not been convicted of any offence under theModern Slavery Act 2015 or any equivalent offence in any jurisdiction involving
slavery and human trafficking;(b)neither it, its officers or its employees have been or are subject to any investigation,
inquiry or enforcement proceedings by any governmental, administrative or
regulatory body regarding any offence in any jurisdiction involving slavery or humantrafficking; and(c)it has and shall maintain in place throughout the term of this Agreement its own
policies, training and procedures, to ensure compliance with Clauses 27, this Clause
28, and Clauses 29 and 30.

29. The Client shall ensure it performs adequate due diligence procedures for its direct
subcontractors and suppliers in connection with the performance of this Agreement, toensure there is no slavery or human trafficking in the contractual chain.
30. The parties represent to one another that:(a)they have not committed any offence under the UK Bribery Act 2010 or done anyof the following (referred to hereafter as “Prohibited Acts”):(b)offered, given or agreed to give any representative of the other party any gift orconsideration of any kind as an inducement or reward for doing or not doing or forhaving done or not having done any act in relation to the obtaining of performanceof this Agreement or any other agreement with the other party or for showing or
not showing favour or disfavour to any person in relation to this Agreement or any
other agreement with the other party; or(c)in connection with this Agreement paid or agreed to pay any commission otherthan a payment, particulars of which (including the terms and conditions of theagreement for its payment) have been disclosed in writing to the other party; and(d)they have in place adequate procedures to prevent bribery and corruption, as
contemplated by section 7 of the UK Bribery Act 2010.

31. Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or
joint venture between the Parties, constitute any Party the agent of another Party, or
authorise any Party to make or enter into any commitments for or on behalf of any otherParty.
32. CEM reserves the right to at any time assign or novate any or all of its rights and/or
obligations under this Agreement. The Client may only assign or novate any or all of theirrights and/or obligations upon written confirmation by CEM, which CEM shall not be obliged
to approve.
33. CEM has the right to vary the terms of this Agreement from time to time on giving the Client
at least 60 days' notice in writing.

CEM Select End User Licence Agreement 1st March 2021

34. This Agreement constitutes the entire agreement between the parties with respect to thesubject matter of this Agreement and supersedes all previous agreements, arrangements orundertakings between the parties relating to the subject matter of this Agreement and any
representations or warranties previously given or made to it.
35. This Agreement is governed by and interpreted in accordance with English law. Any disputes
or claims relating to this Agreement shall be subject to the exclusive jurisdiction of the
English Courts.
36. Any notice given to the Client by CEM under or in connection with this Agreement will beeffective if:(c) posted on CEM's website and/or in a prominent position on the System; or(d) sent to the Client at the address or email address given in the Order or such other address
as the Client may notify to CEM.
37. Any notice given by the Client to CEM under or in connection with this Agreement will beeffective if sent to one of the following addresses:
Address: The Triangle Building, Shaftesbury Road, Cambridge CB2 8EA; or
Email: eaoperations@cem.org
38. A notice is given by either party in accordance with Clause 31 or Clause 32 shall be deemed tohave been received:
i.
ii.
iii.
iv.

if delivered by hand, at the time the notice is left at the address;
if sent from the UK by pre-paid first-class post or other next working day delivery service,
at 09.00am on the second working day after posting;if sent by pre-paid airmail, at 09.00am on the seventh working day after posting; orif sent by email, at the time of transmission provided that if this would occur outsidebusiness hours in the UK it shall be deferred until business hours resume.

39. During each Test Cycle (1st September – 31st August) CEM shall compile all information
available and to which it has lawful access and the right to process, regarding all Candidates
sitting the same Assessment within the Test Group (being group of Clients using the same CEM
Select Assessment). CEM shall make reasonable efforts to identify any Candidate CEM believes
to have, or to be likely to have, sat the same Assessment at more than one school within the
Test Group (“Duplicate Candidate”).
40. Where CEM is confident a Duplicate Candidate has been identified, the relevant Clients shallbe provided with only the results of such Duplicate Candidate’s first attempt at theAssessment, but shall confirm to the Clients affected where this has been done.
41. Where CEM has concerns that there may be a Duplicate Candidate, but this cannot be verified,
CEM shall inform the relevant Clients and the relevant Clients may decide which results should
be used.
42. The Client acknowledges and agrees that CEM cannot guarantee that its checks for Duplicate
Candidates will be accurate and thus CEM provides no warranties in respect of these checks
and accepts no responsibility or liability for any Duplicate Candidate not identified in thecourse of these checks.

CEM Select End User Licence Agreement 1st March 2021

DATA SHARINGSCHEDULE
Data Controller to Data Controller

1. DEFINITIONS AND INTERPRETATION
1.1

In this Schedule, the following words have the following meanings:
Agreed Purposes: the purposes set out in the Annex to this Schedule;
Data Subject Request: means a request made by a Data Subject to exercise any rights ofData Subjects under Data Protection Legislation;
Data Protection Legislation: (as applicable) the Data Protection Act 2018; Regulation (EU)2016/679 (the “GDPR”); and any laws, regulations and/or secondary legislationtransposing the GDPR into English law or with similar subject matter, including any
successor legislation to the Data Protection Act 2018;
Data Sharing: the transfer of the Shared Personal Data;
Shared Data Breach: any security breach or other action or inaction leading to theaccidental or unlawful destruction, loss, alteration, unauthorised disclosure or access toShared Personal Data;
Shared Personal Data: any personal data shared between the Parties in connection with
the Agreement.

1.2

Where used in this Schedule, the terms Data Controller, Data Processor, Data Subject,
Personal Data and processing and Special Category Data all have the meanings given to
those terms in the Data Protection Legislation.

1.3

This Schedule is intended to be legally binding and shall prevail over all other agreements,
arrangements and understandings between the Parties relating to the Data Sharing,whether made before or after the date of this Schedule and notwithstanding any wording
to the contrary in such agreements, arrangements and understandings between theParties.

1.4

In case of any conflict or inconsistency between the provisions of this Schedule and themain terms of the Agreement, the provisions contained in this Schedule shall prevail.

1.5

A reference to a statute or statutory provision includes all subordinate legislation madeunder it from time to time, and is a reference to it as amended, extended or re-enacted
from time to time (“Replacement Law”). References to terms defined in a statute or

CEM Select End User Licence Agreement 1st March 2021

statutory provision shall be replaced with or incorporate (as the case may be) references
to the equivalent terms defined in any Replacement Laws, once in force and applicable.
1.6

2.

To the extent that a term of this Schedule requires the performance by a party of an
obligation “in accordance with Data Protection Legislation” (or similar), unless otherwise
expressly agreed in this Schedule, this requires performance in accordance with therelevant requirements of such Data Protection Legislation as is in force and applicable atthe time of performance (if any).
PURPOSE

2.1

In relation to the Shared Personal Data, each of the Parties agrees that it is a Data
Controller.

2.2

During the term of this Agreement, the Parties shall share with each other certain
Personal Data as detailed in the Privacy Notice. The Data Sharing is necessary to support
the Agreed Purposes of both Parties.

2.3

The parties shall only use the Shared Personal Data for lawful purposes in connection with
the Agreed Purpose and not process the Shared Personal Data in a way that is
incompatible with the Agreed Purpose or Data Protection Legislation.

3. DATA PROTECTION COMPLIANCE
3.1

Each Party shall comply with all the obligations imposed on a controller under the Data
Protection Legislation. Any material breach of the Data Protection Legislation by a Partyin connection with the Data Sharing shall constitute a material breach of this Schedule.

3.2

Each Party shall:(a) process the Shared Personal Data fairly and lawfully, each of them as a Data
Controller;(b) for each Agreed Purpose, ensure that it processes the Shared Personal Data on thebasis of one of the legal grounds set out in Article 6 of the GDPR (Lawfulness ofProcessing) or Article 9 of the GDPR (Processing of special categories of personaldata) (as applicable);(c) inform, or otherwise make information available to the Data Subjects of the purposes
for which it will process Personal Data and provide or make available all informationthat it must provide in accordance with its own applicable law to ensure that Data
Subjects understand how their Personal Data will be processed by that Party;(d) ensure that it has in place appropriate technical and organisational measures toprotect against unauthorised or unlawful processing of Personal Data and against
accidental loss or destruction of, or damage to, Personal Data;

CEM Select End User Licence Agreement 1st March 2021

(e) not transfer any personal data outside the European Economic Area otherwise thanin compliance with the Data Protection Legislation.

4. COOPERATION BETWEEN THE PARTIES
4.1

Each Party shall assist the other in complying with all applicable requirements of the Data
Protection Legislation. In particular, in connection with the Shared Personal Data, eachParty shall:(a) ensure that any notices given to Data Subjects in relation to the Shared Personal Data
are provided in a manner and according to timing that is compliant with Data
Protection Legislation;(b) inform the other Party if any Personal Data has been transferred to the other Partyin error or otherwise in breach of the Data Protection Legislation, requesting theimmediate deletion of such inappropriately transferred Personal Data;(c) if legally required, inform the other Party about the receipt of a complaint or Data
Subject Request from any Data Subject regarding the Shared Personal Data;(d) deal at its discretion with all Data Subject Requests and complaints that it receives
directly from a Data Subject or the person making the complaint. For the avoidanceof doubt, a Data Subject Request made to one Party in its capacity as Data Controller
shall not oblige the other Party to disclose any Personal Data it holds independently
in its capacity as a Data Controller;(e) if legally required, inform the other Party without delay if a Data Subject requests theerasure of any Shared Personal Data. For the avoidance of doubt, where one Party is
obliged to erase any Shared Personal Data, the other Party shall not be obliged toerase the same Shared Personal Data if that other Party may lawfully continue to holdand process such Shared Personal Data;(f) provide reasonable and prompt assistance to the other Party as is necessary toenable it to comply with a Data Subject Request and/or to respond to any otherqueries or complaints received from Data Subjects or supervisory authorities orregulators and, in each case related to the Shared Personal Data;(g) provide the other Party with such information as the other Party reasonably requires
for maintaining the records it is required to maintain by the Data Protection
Legislation; and(h) provide the other Party with contact details of at least one employee as point ofcontact and responsible manager for all issues arising out of the Data Protection
Legislation, including the procedures to be followed in the event of a Shared Data
Breach.

CEM Select End User Licence Agreement 1st March 2021

5. DATA BREACHES
5.1

In respect of each Shared Data Breach, each Party shall:(a) promptly notify the other Party of the Shared Data Breach;(b) provide the other Party without undue delay (wherever possible, no later than 48
hours after becoming aware of the Shared Data Breach) with such details as the otherParty reasonably requires regarding the Shared Personal Data.

5.2

To the extent permitted by applicable laws, neither Party shall:(a) notify a supervisory or regulatory authority of any Shared Data Breach;(b) issue a public statement or otherwise notify any Data Subject of such Shared Data
Breach,without first consulting with, and obtaining the consent (not to be unreasonably withheld
or delayed) of, the other Party.

6. DELETION OR RETURN OF SHARED DATA
6.1

Neither Party shall retain or process the Shared Personal Data for longer than is necessary
in connection with carrying out the Agreed Purpose.

6.2

Notwithstanding clause 6.1, the Parties shall continue to retain Shared Personal Data inaccordance with any statutory or professional retention periods applicable in theirrespective countries and/or industry.

CEM Select End User Licence Agreement 1st March 2021

Annex

1.

AGREED PURPOSES
For the purposes of this agreement, Agreed Purposes refer to the following purposes:(a)

CEM to provide the services under this Agreement to the Client;(b)

without prejudice to paragraph (a) above, CEM to (i) develop assessments and other CEM
services and improve on their quality and integrity, including the collection of statistics andother information relating to such assessments and other services for CEM’s future use and(ii) carry out marketing and market research, and provide training in order to improve on
the delivery of assessments and other services;(c)the Client to benefit from the services provided to it under this Agreement:(d)without prejudice to paragraph (c) above, the Client to offer, and enable pupils, to take
CEM’s assessments; and(e)the Parties to comply with their legal and regulatory obligations and to assist each other in
relation to any exercise by a pupil of their rights as a data subject.

CEM Select End User Licence Agreement 1st March 2021

THIS SCHEDULE 2 ONLY APPLIES IN THE EVENT THAT CLIENT RECEIVES SHARED PERSONALDATA OUTSIDE THE EEA OR OUTSIDE A TERRITORY OR ORGANISATION NOT SUBJECTTO AN ADEQUACY DECISION BY THE EUROPEAN COMMISSION.

Standard contractual clauses for the transfer of personal data from the Community to third
countries (controller to controller transfers)
Data transfer agreement

betweenCEM
hereinafter “data exporter”
andThe Client
hereinafter “data importer”
each a “party”; together “the parties”.

Definitions
For the purposes of the clauses:(a)“personal data”, “special categories of data/sensitive data”, “process/processing”,“controller”, “processor”, “data subject” and “supervisory authority/authority” shall have the same
meaning as in Directive 95/46/EC of 24 October 1995 (whereby “the authority” shall mean thecompetent data protection authority in the territory in which the data exporter is established);(b)“the data exporter” shall mean the controller who transfers the personal data;(c)“the data importer” shall mean the controller who agrees to receive from the data exporter
personal data for further processing in accordance with the terms of these clauses and who is not
subject to a third country’s system ensuring adequate protection;(d)“clauses” shall mean these contractual clauses, which are a free-standing document that does
not incorporate commercial business terms established by the parties under separate commercial
arrangements.
The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms
an integral part of the clauses.
I.

Obligations of the data exporter

The data exporter warrants and undertakes that:

CEM Select End User Licence Agreement 1st March 2021

(a)The personal data have been collected, processed and transferred in accordance with the laws
applicable to the data exporter.
(b)
It has used reasonable efforts to determine that the data importer is able to satisfy its legal
obligations under these clauses.
(c)
It will provide the data importer, when so requested, with copies of relevant data protection
laws or references to them (where relevant, and not including legal advice) of the country in which
the data exporter is established.
(d)
It will respond to enquiries from data subjects and the authority concerning processing of thepersonal data by the data importer, unless the parties have agreed that the data importer will so
respond, in which case the data exporter will still respond to the extent reasonably possible and with
the information reasonably available to it if the data importer is unwilling or unable to respond.
Responses will be made within a reasonable time.
(e)
It will make available, upon request, a copy of the clauses to data subjects who are third party
beneficiaries under clause III, unless the clauses contain confidential information, in which case it may
remove such information. Where information is removed, the data exporter shall inform data subjects
in writing of the reason for removal and of their right to draw the removal to the attention of theauthority. However, the data exporter shall abide by a decision of the authority regarding access tothe full text of the clauses by data subjects, as long as data subjects have agreed to respect theconfidentiality of the confidential information removed. The data exporter shall also provide a copyof the clauses to the authority where required.
II.

Obligations of the data importer

The data importer warrants and undertakes that:(a)
It will have in place appropriate technical and organisational measures to protect the personal
data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure
or access, and which provide a level of security appropriate to the risk represented by the processing
and the nature of the data to be protected.
(b)
It will have in place procedures so that any third party it authorises to have access to thepersonal data, including processors, will respect and maintain the confidentiality and security of thepersonal data. Any person acting under the authority of the data importer, including a data processor,
shall be obligated to process the personal data only on instructions from the data importer. This
provision does not apply to persons authorised or required by law or regulation to have access to thepersonal data.
(c)
It has no reason to believe, at the time of entering into these clauses, in the existence of any
local laws that would have a substantial adverse effect on the guarantees provided for under theseclauses, and it will inform the data exporter (which will pass such notification on to the authority
where required) if it becomes aware of any such laws.
(d)
It will process the personal data for purposes described in Annex B, and has the legal authority
to give the warranties and fulfil the undertakings set out in these clauses.
(e)
It will identify to the data exporter a contact point within its organisation authorised torespond to enquiries concerning processing of the personal data, and will cooperate in good faith withthe data exporter, the data subject and the authority concerning all such enquiries within a reasonable

CEM Select End User Licence Agreement 1st March 2021

time. In case of legal dissolution of the data exporter, or if the parties have so agreed, the data
importer will assume responsibility for compliance with the provisions of clause I(e).
(f)
At the request of the data exporter, it will provide the data exporter with evidence of financial
resources sufficient to fulfil its responsibilities under clause III (which may include insurance coverage).
(g)Upon reasonable request of the data exporter, it will submit its data processing facilities, data
files and documentation needed for processing to reviewing, auditing and/or certifying by the data
exporter (or any independent or impartial inspection agents or auditors, selected by the data exporterand not reasonably objected to by the data importer) to ascertain compliance with the warranties andundertakings in these clauses, with reasonable notice and during regular business hours. The request
will be subject to any necessary consent or approval from a regulatory or supervisory authority within
the country of the data importer, which consent or approval the data importer will attempt to obtainin a timely fashion.
(h)It will process the personal data, at its option, in accordance with:(i)the data protection laws of the country in which the data exporter is established, or(ii)
the relevant provisions (1) of any Commission decision pursuant to Article 25(6) of
Directive 95/46/EC, where the data importer complies with the relevant provisions of such anauthorisation or decision and is based in a country to which such an authorisation or decisionpertains, but is not covered by such authorisation or decision for the purposes of thetransfer(s) of the personal data (2), or(iii)

the data processing principles set forth in Annex A.

Data importer to indicate which option it selects: Option (iii), principles set forth in Annex A.
Initials of data importer: Electronically accepted;(i)
It will not disclose or transfer the personal data to a third party data controller located outside
the European Economic Area (EEA) unless it notifies the data exporter about the transfer; and(i)the third party data controller processes the personal data in accordance with aCommission decision finding that a third country provides adequate protection, or(ii)
the third party data controller becomes a signatory to these clauses or another datatransfer agreement approved by a competent authority in the EU, or(iii)
data subjects have been given the opportunity to object, after having been informedof the purposes of the transfer, the categories of recipients and the fact that the countries towhich data is exported may have different data protection standards, or

1“Relevant provisions” means those provisions of any authorisation or decision except for the enforcement
provisions of any authorisation or decision (which shall be governed by these clauses).
2
However, the provisions of Annex A.5 concerning rights of access, rectification, deletion and objection must
be applied when this option is chosen and take precedence over any comparable provisions of the Commission
Decision selected.

CEM Select End User Licence Agreement 1st March 2021

(iv)with regard to onward transfers of sensitive data, data subjects have given theirunambiguous consent to the onward transfer.

III.

Liability and third party rights(a)Each party shall be liable to the other parties for damages it causes by any breach of theseclauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e.
damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party
shall be liable to data subjects for damages it causes by any breach of third party rights under theseclauses. This does not affect the liability of the data exporter under its data protection law.
(b)
The parties agree that a data subject shall have the right to enforce as a third party beneficiary
this clause and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against thedata importer or the data exporter, for their respective breach of their contractual obligations, withregard to his personal data, and accept jurisdiction for this purpose in the data exporter’s country of
establishment. In cases involving allegations of breach by the data importer, the data subject mustfirst request the data exporter to take appropriate action to enforce his rights against the data
importer; if the data exporter does not take such action within a reasonable period (which undernormal circumstances would be one month), the data subject may then enforce his rights against thedata importer directly. A data subject is entitled to proceed directly against a data exporter that has
failed to use reasonable efforts to determine that the data importer is able to satisfy its legal
obligations under these clauses (the data exporter shall have the burden to prove that it took
reasonable efforts).
IV.

Law applicable to the clauses

These clauses shall be governed by the law of the country in which the data exporter is established,with the exception of the laws and regulations relating to processing of the personal data by the data
importer under clause II(h), which shall apply only if so selected by the data importer under thatclause.
V.

Resolution of disputes with data subjects or the authority(a)
In the event of a dispute or claim brought by a data subject or the authority concerning theprocessing of the personal data against either or both of the parties, the parties will inform each otherabout any such disputes or claims, and will cooperate with a view to settling them amicably in a timely
fashion.
(b)
The parties agree to respond to any generally available non-binding mediation procedure
initiated by a data subject or by the authority. If they do participate in the proceedings, the parties
may elect to do so remotely (such as by telephone or other electronic means). The parties also agree
to consider participating in any other arbitration, mediation or other dispute resolution proceedings
developed for data protection disputes.

(c)Each party shall abide by a decision of a competent court of the data exporter’s country of
establishment or of the authority which is final and against which no further appeal is possible.

CEM Select End User Licence Agreement 1st March 2021

VI.

Termination(a)
In the event that the data importer is in breach of its obligations under these clauses, then thedata exporter may temporarily suspend the transfer of personal data to the data importer until thebreach is repaired or the contract is terminated.
(b)

In the event that:(i)the transfer of personal data to the data importer has been temporarily suspended
by the data exporter for longer than one month pursuant to paragraph (a);(ii)
compliance by the data importer with these clauses would put it in breach of its legal
or regulatory obligations in the country of import;(iii)
the data importer is in substantial or persistent breach of any warranties orundertakings given by it under these clauses;(iv)
a final decision against which no further appeal is possible of a competent court ofthe data exporter’s country of establishment or of the authority rules that there has been abreach of the clauses by the data importer or the data exporter; or(v)
a petition is presented for the administration or winding up of the data importer,whether in its personal or business capacity, which petition is not dismissed within theapplicable period for such dismissal under applicable law; a winding up order is made; areceiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data
importer is an individual; a company voluntary arrangement is commenced by it; or any
equivalent event in any jurisdiction occurs then the data exporter, without prejudice to any
other rights which it may have against the data importer, shall be entitled to terminate theseclauses, in which case the authority shall be informed where required. In cases covered by (i),(ii), or (iv) above the data importer may also terminate these clauses.

(c)Either party may terminate these clauses if (i) any Commission positive adequacy decision
under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country(or a sector thereof) to which the data is transferred and processed by the data importer, or (ii)
Directive 95/46/EC (or any superseding text) becomes directly applicable in such country.
(d)
The parties agree that the termination of these clauses at any time, in any circumstances andfor whatever reason (except for termination under clause VI(c)) does not exempt them from theobligations and/or conditions under the clauses as regards the processing of the personal datatransferred.

VII.

Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, in which casethey will inform the authority where required. This does not preclude the parties from adding
additional commercial clauses where required.

CEM Select End User Licence Agreement 1st March 2021

VIII.

Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree that
Annex B may contain confidential business information which they will not disclose to third parties,
except as required by law or in response to a competent regulatory or government agency, or as
required under clause I(e). The parties may execute additional annexes to cover additional transfers,
which will be submitted to the authority where required. Annex B may, in the alternative, be drafted
to cover multiple transfers.

Dated: same as the Agreement. In the event that this Schedule 2 has been accepted, or deemed to be
accepted, by the Client after the start date of the Agreement, this Schedule 2 shall be deemed to havestarted at the same time as the Agreement, with retroactive effect.

CEM Select End User Licence Agreement 1st March 2021

ANNEX ADATA PROCESSING PRINCIPLES

1.
Purpose limitation: Personal data may be processed and subsequently used or further
communicated only for purposes described in Annex B or subsequently authorised by the data subject.
2.
Data quality and proportionality: Personal data must be accurate and, where necessary, kept
up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes
for which they are transferred and further processed.
3.
Transparency: Data subjects must be provided with information necessary to ensure fair
processing (such as information about the purposes of processing and about the transfer), unless suchinformation has already been given by the data exporter.
4.
Security and confidentiality: Technical and organisational security measures must be taken by
the data controller that are appropriate to the risks, such as against accidental or unlawful destructionor accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any
person acting under the authority of the data controller, including a processor, must not process thedata except on instructions from the data controller.
5.
Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive
95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal
information about them that an organisation holds, except for requests which are manifestly abusive,
based on unreasonable intervals or their number or repetitive or systematic nature, or for whichaccess need not be granted under the law of the country of the data exporter. Provided that theauthority has given its prior approval, access need also not be granted when doing so would be likely
to seriously harm the interests of the data importer or other organisations dealing with the data
importer and such interests are not overridden by the interests for fundamental rights and freedomsof the data subject. The sources of the personal data need not be identified when this is not possible
by reasonable efforts, or where the rights of persons other than the individual would be violated. Data
subjects must be able to have the personal information about them rectified, amended, or deleted
where it is inaccurate or processed against these principles. If there are compelling grounds to doubt
the legitimacy of the request, the organisation may require further justifications before proceeding torectification, amendment or deletion. Notification of any rectification, amendment or deletion to third
parties to whom the data have been disclosed need not be made when this involves a disproportionate
effort. A data subject must also be able to object to the processing of the personal data relating to
him if there are compelling legitimate grounds relating to his particular situation. The burden of proof
for any refusal rests on the data importer, and the data subject may always challenge a refusal before
the authority.
6.
Sensitive data: The data importer shall take such additional measures (e.g. relating to security)
as are necessary to protect such sensitive data in accordance with its obligations under clause II.
7.
Data used for marketing purposes: Where data are processed for the purposes of direct
marketing, effective procedures should exist allowing the data subject at any time to “opt-out” fromhaving his data used for such purposes.

CEM Select End User Licence Agreement 1st March 2021

8.
Automated decisions: For purposes hereof “automated decision” shall mean a decision by thedata exporter or the data importer which produces legal effects concerning a data subject orsignificantly affects a data subject and which is based solely on automated processing of personal dataintended to evaluate certain personal aspects relating to him, such as his performance at work,
creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions
concerning data subjects, except when:(a)(i) such decisions are made by the data importer in entering into or performing acontract with the data subject, and(ii) the data subject is given an opportunity to discuss the results of a relevant
automated decision with a representative of the parties making such decision orotherwise to make representations to that parties.

or(b)where otherwise provided by the law of the data exporter.

CEM Select End User Licence Agreement 1st March 2021

ANNEX B
DESCRIPTION OF THE TRANSFER
Data subjects
The personal data transferred concern the following categories of data subjects:
Students (including under 13 years old) and data subjects acting on behalf of the data exporter suchas employees or contractors.
Purposes of the transfer(s)The transfer is made for the following purposes
As set out in the Agreement/s between the parties.
Categories of data
The personal data transferred concern the following categories of data:
Full names, sex, identification numbers (such as candidate number), centre/school details, exam
details, candidate answers, contact details, native language, year group, date of birth, class name,place of birth, free school meals status, previous school, average GCSE score or similar, subject choices
for A Level or other exam, test venue, application to other grammar school, special arrangements andany other information that may be required in connection with the purposes of the transfers.
Recipients
The personal data transferred may be disclosed only to the following recipients or categories ofrecipients:
As per the agreement/s between the parties or otherwise as the parties see fit in accordance with
their own privacy policies and applicable legislation.
Sensitive data (if appropriate)
The personal data transferred concern the following categories of sensitive data:
Some special category data such as disabilities may be inferred by special arrangements. Ethnic
background may be processed as well.
Data protection registration information of data exporter (where applicable)
UK ICO registration number: Z6641083
Additional useful information (storage limits and other relevant information)
As set out in the Agreements that govern the relationship between the parties.
Contact points for data protection enquiries
Data importer

Data exporter

Client shall provide this to CEM as soon as thisSchedule 2 is accepted or deemed to be
accepted.

data.protection@cambridgeassessment.org.uk

CEM Select End User Licence Agreement 1st March 2021