Data Processing and Transfer Agreements to comply with the General Data
Protection Regulation (GDPR), UK Data Protection Law (United Kingdom),
FDPA (Switzerland), CCPA/CPRA (California), PDPL (UAE), PIPL (China) andother data protection laws, and Confidentiality of Trade Secrets
The Data Processing and Transfer Agreements contained herein shall automatically
become essential part to any contractual arrangement or agreement (in the following“Main-Agreement” or similar) that is concluded between our company (in the following“Provider”, “Exporter”, “Business”, “Personal Information Handler”, “Us”, “Our” or similar), as
specified in the imprint of this or one of our website(s) oremail(s) and/or in theMain-Agreement, and your company (in the following “Business Partner” “Contractor”,„Overseas Recipient“, “Vendor”, “Client”, “Importer”, “You” or mentioned with a similarterm) as specified in the Main-Agreement, or in case the Main-Agreement is concluded
verbally, by implicit acts or otherwise, the natural or legal person, agency or other bodythat is our contractual partner, but only in case processing or transfer of personal data (inthe following “Data”) is part of or essential to the Main-Agreement and if data subjects
that are subject to processing are based in a country that we implemented agreements
for in this Set of Agreements, or otherwise protected under the respective laws and if
trade and business secrets are processed or exchanged between you and us.
Based on the individual business relationship between you and us, if you agree to or are
notified of this Set of Agreements, which may be by email or by means of a link, or if it isincorporated into the Main-Agreement, the following shall automatically apply (1) the "EUStandard Contractual Clauses 2021/915 BETWEEN CONTROLLERS AND PROCESSORS" if aprocessing relationship exists or is to be established between the parties and both partiesare located within the European Union or the EEA, and/or (2) the "EU Standard
Contractual Clauses 2021/914 MODULE ONE: Transfer Controller to Controller" if one of theparties is established outside the European Union or the EEA and receives Data as aController from the other party, and the other party is also a Controller and is establishedin the European Union or the EEA, or Data of Data Subjects from the European Union or
the EEA are transferred, and/or (3) the "EU Standard Contractual Clauses 2021/914
MODULE TWO: Transfer Controller to Processor" if the Processor is established outside theEuropean Union or the EEA and Data is transferred by the other party as a Controller
which is established in the European Union or the EEA, or Data of Data Subjects from thePage 1
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

European Union or the EEA are transferred, and/or (4) the "EU Standard Contractual
Clauses 2021/914 MODULE THREE: Transfer Processor to Processor" if the Data Transferer
acts as a Processor for another Controller or a Processor from the European Union or the
EEA, and transfers Data to the other party as another Processor, or Data of Data Subjects
from the European Union or the EEA are transferred, and/or (5) the "EU Standard
Contractual Clauses 2021/914 MODULE FOUR: Transfer Processor to Controller" if the Data
Transferer acts as a Processor for another Controller or a Processor from the European
Union or the EEA, and transfers Data to the other party as a Controller outside theEuropean Union or the EEA, or Data of Data Subjects from the European Union or the EEA
are transferred, and/or (6) the "International Data Transfer Agreement (United Kingdom)" if
the Data Transferer is based in the United Kingdom and transfers Data to the other party
outside the United Kingdom, or Data of Data Subjects from the United Kingdom aretransferred, and/or (7) the "International Data Transfer Addendum to the European
Commission’s Standard Contractual Clauses for International Data Transfers (United
Kingdom)", if the Data Transferer is based in the United Kingdom and transfers Data to theother party outside the United Kingdom, and the EU Standard Contractual Clauses havealready been concluded without using this Set of Agreements, and/or (8) the "Data
Processing Agreement for the United Kingdom", if a processing relationship exists or is tobe established between the parties and both parties are located within the United
Kingdom, and/or (9) the "CCPA-CPRA CONTRACTOR AGREEMENT" if Consumer Data from
California, or Data previously transferred to California, is being (back)transferred, and/or(10) the "Confidentiality and Data Protection Agreement for Vendors" if your company is avendor but not a Processor of our company, and/or (11) based on separately executed
declarations of intent by both parties, the "Confidentiality and Data Protection Agreement
for Customers" if your company is a customer of ours, and no Standard Contractual
Clauses or other agreement contained in this Set of Agreements is applicable to ourbusiness relationship, and/or (12) the "Data Processing Agreement, Joint Controllership
Agreement and Cross-Border Personal Data Transfer and Sharing Agreement for theUnited Arab Emirates", if Data from the United Arab Emirates, or Data previouslytransferred to the United Arab Emirates,

is being (back)transferred, and/or (13) the"Standard Contract for Outbound Cross-border Transfer of Personal Information (People’s
Republic of China) (Contract Language: Chinese)", if Personal Information is transferredfrom the People's Republic of China to an Overseas Recipient, or Personal Information of
Personal Information Subjects from the People’s Republic of China are transferred, and/or
Page 2
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(14) the "Data Processing Agreement and National Joint Controllership Agreement tocomply with PIPL (People’s Republic of China) (Contract Language: Chinese)", if aprocessing relationship exists or is to be established between the parties and both partiesare located within the People's Republic of China.

The following contracts and appendixes are included in this Set of Agreements:
APPENDIX 1 – SCCs 2021/915 BETWEEN CONTROLLERS AND PROCESSORSAPPENDIX 2 – SCCs 2021/914 MODULE ONE: Transfer Controller to Controller
APPENDIX 3 – SCCs 2021/914 MODULE TWO: Transfer Controller to Processor
APPENDIX 4 – SCCs 2021/914 MODULE THREE: Transfer Processor to Processor
APPENDIX 5 – SCCs 2021/914 MODULE FOUR: Transfer Processor to Controller
APPENDIX 6 – SUB-PROCESSORSAPPENDIX 7 – LIST OF PARTIESAPPENDIX 8 – DESCRIPTION OF THE PROCESSING OR THE TRANSFER
APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES
APPENDIX 10 – COMPETENT SUPERVISORY AUTHORITY
APPENDIX 11 – Confidentiality and Data Protection Agreement for Vendors
APPENDIX 12 – Confidentiality and Data Protection Agreement for Customers
APPENDIX 13 – International Data Transfer Agreement (United Kingdom)
APPENDIX 14 – International Data Transfer Addendum to the European Commission’s Standard Contractual
Clauses for International Data Transfers (United Kingdom)
APPENDIX 15 – Data Processing Agreement for the United Kingdom
APPENDIX 16 – CCPA-CPRA CONTRACTOR AGREEMENTAPPENDIX 17 – Data Processing Agreement, Joint Controllership Agreement and Cross-Border Personal Data
Transfer and Sharing Agreement for the United Arab Emirates
APPENDIX 18 – Standard Contract for Outbound Cross-border Transfer of Personal Information (People’s Republicof China)
APPENDIX 19 – Standard Contract for Outbound Cross-border Transfer of Personal Information (People’s Republicof China) (Contract Language: Chinese)
APPENDIX 20 – Data Processing Agreement and National Joint Controllership Agreement to comply with PIPL
(People’s Republic of China) (Contract Language: English)

Page 3
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

The applicable Standard Contractual Clauses or Agreements contained herein shallgovern the relationship between you and us in regards to the processing of any Personal
Data from Data Subjects that are based or resident in countries or regions where the
GDPR, UK Data Protection Law, FDPA, CCPA/CPRA or other laws contained in this Set ofAgreements are applicable (“Personal Data Processing”), and shall prevail over any
conflicting or inconsistent provisions pertaining to Personal Data Processing in any
commitment, obligation, arrangement, contract or agreement between you and us,
unless and until the Standard Contractual Clauses or other agreements contained herein
are superseded by any new laws or regulations enacted by the competent legislators(collectively, the “New Laws”), wherein such New Laws shall, from the date of theirapplicability, apply automatically in place of the respective Contractual Clauses to
Personal Data Processing between you and us, unless either party notifies the other party
in writing of its objection thereto within 30 days from the official publication date of the
New Laws.

Page 4
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 1 – SCCs 2021/915 BETWEEN CONTROLLERS AND
PROCESSORSSTANDARD CONTRACTUAL CLAUSES 2021/915 BETWEENCONTROLLERS AND PROCESSORS
Clause 1
Purpose and scopea)

The purpose of these Standard Contractual Clauses (the “Clauses”) is to ensurecompliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of suchdata, and repealing Directive 95/46/EC (General Data Protection Regulation).

(b) The controllers and processors listed in Annex I have agreed to these Clauses in orderto ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or
Article 29(3) and (4) of Regulation (EU) 2018/1725.
(c) These Clauses apply to the processing of personal data as specified in Annex II.
(d) Annexes I to IV are an integral part of the Clauses.
(e) These Clauses are without prejudice to obligations to which the controller is subject
by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
(f)

These Clauses do not by themselves ensure compliance with obligations related tointernational transfers in accordance with Chapter V of Regulation (EU) 2016/679
and/or Regulation (EU) 2018/1725.
Clause 2
Invariability of the Clauses(a) The Parties undertake not to modify the Clauses, except for adding information to theAnnexes or updating information in them.
(b) This does not prevent the Parties from including the standard contractual clauses laid
down in these Clauses in a broader contract, or from adding other clauses oradditional safeguards provided that they do not directly or indirectly contradict theClauses or detract from the fundamental rights or freedoms of data subjects.
Clause 3
Interpretation(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation(EU) 2018/1725 respectively, those terms shall have the same meaning as in that
Regulation.

Page 5
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation(EU) 2016/679 or Regulation (EU) 2018/1725 respectively.
(c) These Clauses shall not be interpreted in a way that runs counter to the rights andobligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a
way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4
Hierarchy
In the event of a contradiction between these Clauses and the provisions of relatedagreements between the Parties existing at the time when these Clauses are agreed orentered into thereafter, these Clauses shall prevail.
Clause 5
Docking clause(a) Any entity that is not a Party to these Clauses may, with the agreement of all theParties, accede to these Clauses at any time as a controller or a processor bycompleting the Annexes and signing Annex I.
(b) Once the Annexes in (a) are completed and signed, the acceding entity shall betreated as a Party to these Clauses and have the rights and obligations of a controller
or a processor, in accordance with its designation in Annex I.
(c) The acceding entity shall have no rights or obligations resulting from these Clauses
from the period prior to becoming a Party.
Clause 6
Description of the processing(s)The details of the processing operations, in particular the categories of personal data andthe purposes of processing for which the personal data is processed on behalf of thecontroller, are specified in Annex II.
Clause 7
Obligations of the Parties
7.1. Instructions(a) The processor shall process personal data only on documented instructions from thecontroller, unless required to do so by Union or Member State law to which theprocessor is subject. In this case, the processor shall inform the controller of that legal
requirement before processing, unless the law prohibits this on important grounds ofpublic interest. Subsequent instructions may also be given by the controller
throughout the duration of the processing of personal data. These instructions shallalways be documented.
Page 6
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) The processor shall immediately inform the controller if, in the processor’s opinion,
instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation(EU) 2018/1725 or the applicable Union or Member State data protection provisions.
7.2. Purpose limitation
The processor shall process the personal data only for the specific purpose(s) of theprocessing, as set out in Annex II, unless it receives further instructions from thecontroller.
7.3. Duration of the processing of personal data
Processing by the processor shall only take place for the duration specified in Annex II.
7.4. Security of processing(a) The processor shall at least implement the technical and organisational measures
specified in Annex III to ensure the security of the personal data. This includes
protecting the data against a breach of security leading to accidental or unlawfuldestruction, loss, alteration, unauthorised disclosure or access to the data (personal
data breach). In assessing the appropriate level of security, the Parties shall take due
account of the state of the art, the costs of implementation, the nature, scope, context
and purposes of processing and the risks involved for the data subjects.
(b) The processor shall grant access to the personal data undergoing processing tomembers of its personnel only to the extent strictly necessary for implementing,managing and monitoring of the contract. The processor shall ensure that persons
authorised to process the personal data received have committed themselves toconfidentiality or are under an appropriate statutory obligation of confidentiality.
7.5. Sensitive data
If the processing involves personal data revealing racial or ethnic origin, political opinions,religious or philosophical beliefs, or trade union membership, genetic data or biometricdata for the purpose of uniquely identifying a natural person, data concerning health or aperson’s sex life or sexual orientation, or data relating to criminal convictions and offences(“sensitive data”), the processor shall apply specific restrictions and/or additionalsafeguards.
7.6. Documentation and compliance(a) The Parties shall be able to demonstrate compliance with these Clauses.
(b) The processor shall deal promptly and adequately with inquiries from the controller
about the processing of data in accordance with these Clauses.
(c) The processor shall make available to the controller all information necessary todemonstrate compliance with the obligations that are set out in these Clauses andstem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the
Page 7
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

controller’s request, the processor shall also permit and contribute to audits of theprocessing activities covered by these Clauses, at reasonable intervals or if there areindications of non-compliance. In deciding on a review or an audit, the controller may
take into account relevant certifications held by the processor.
(d) The controller may choose to conduct the audit by itself or mandate an independent
auditor. Audits may also include inspections at the premises or physical facilities ofthe processor and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in this Clause, including the resultsof any audits, available to the competent supervisory authority/ies on request.
7.7. Use of sub-processors(a) GENERAL WRITTEN AUTHORISATION: The processor has the controller’s generalauthorisation for the engagement of sub-processors from an agreed list. The
processor shall specifically inform in writing the controller of any intended changes ofthat list through the addition or replacement of sub-processors at least 30 days inadvance, thereby giving the controller sufficient time to be able to object to suchchanges prior to the engagement of the concerned sub-processor(s). The processor
shall provide the controller with the information necessary to enable the controller toexercise the right to object.
(b) Where the processor engages a sub-processor for carrying out specific processing
activities (on behalf of the controller), it shall do so by way of a contract which imposeson the sub-processor, in substance, the same data protection obligations as the ones
imposed on the data processor in accordance with these Clauses. The processor shallensure that the sub-processor complies with the obligations to which the processor issubject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation(EU) 2018/1725.
(c) At the controller’s request, the processor shall provide a copy of such a sub-processor
agreement and any subsequent amendments to the controller. To the extent
necessary to protect business secret or other confidential information, including
personal data, the processor may redact the text of the agreement prior to sharing
the copy.
(d) The processor shall remain fully responsible to the controller for the performance ofthe sub-processor’s obligations in accordance with its contract with the processor.
The processor shall notify the controller of any failure by the sub- processor to fulfill its
contractual obligations.
(e) The processor shall agree a third party beneficiary clause with the sub-processor
whereby - in the event the processor has factually disappeared, ceased to exist in law
or has become insolvent - the controller shall have the right to terminate thesub-processor contract and to instruct the sub-processor to erase or return the
personal data.

Page 8
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

7.8. International transfers(a) Any transfer of data to a third country or an international organisation by theprocessor shall be done only on the basis of documented instructions from thecontroller or in order to fulfill a specific requirement under Union or Member State law
to which the processor is subject and shall take place in compliance with Chapter V ofRegulation (EU) 2016/679 or Regulation (EU) 2018/1725.
(b) The controller agrees that where the processor engages a sub-processor inaccordance with Clause 7.7. for carrying out specific processing activities (on behalf ofthe controller) and those processing activities involve a transfer of personal data
within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the
sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 byusing standard contractual clauses adopted by the Commission in accordance with of
Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of thosestandard contractual clauses are met.
Clause 8
Assistance to the controller(a) The processor shall promptly notify the controller of any request it has received fromthe data subject. It shall not respond to the request itself, unless authorised to do soby the controller.
(b) The processor shall assist the controller in fulfilling its obligations to respond to data
subjects’ requests to exercise their rights, taking into account the nature of theprocessing. In fulfilling its obligations in accordance with (a) and (b), the processor
shall comply with the controller’s instructions(c) In addition to the processor’s obligation to assist the controller pursuant to Clause
8(b), the processor shall furthermore assist the controller in ensuring compliance withthe following obligations, taking into account the nature of the data processing andthe information available to the processor:(1)

the obligation to carry out an assessment of the impact of the envisaged
processing operations on the protection of personal data (a ‘data protection
impact assessment’) where a type of processing is likely to result in a high risk to
the rights and freedoms of natural persons;(2) the obligation to consult the competent supervisory authority/ies prior toprocessing where a data protection impact assessment indicates that theprocessing would result in a high risk in the absence of measures taken by thecontroller to mitigate the risk;(3) the obligation to ensure that personal data is accurate and up to date, by
informing the controller without delay if the processor becomes aware that thepersonal data it is processing is inaccurate or has become outdated;(4) the obligations in Article 32 of Regulation (EU) 2016/679.

Page 9
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(d) The Parties shall set out in Annex III the appropriate technical and organisational
measures by which the processor is required to assist the controller in the applicationof this Clause as well as the scope and the extent of the assistance required.
Clause 9
Notification of personal data breachIn the event of a personal data breach, the processor shall cooperate with and assist thecontroller for the controller to comply with its obligations under Articles 33 and 34 ofRegulation (EU) 2016/679 or under Articles 34 and 35 of Regulation (EU) 2018/1725, whereapplicable, taking into account the nature of processing and the information available tothe processor.
9.1. Data breach concerning data processed by the controller
In the event of a personal data breach concerning data processed by the controller, theprocessor shall assist the controller:(a) in notifying the personal data breach to the competent supervisory authority/ies,
without undue delay after the controller has become aware of it, where
relevant/(unless the personal data breach is unlikely to result in a risk to the rights andfreedoms of natural persons);(b) in obtaining the following information which, pursuant to Article 33(3) of Regulation(EU) 2016/679 shall be stated in the controller’s notification, and must at least include:(1)

the nature of the personal data including where possible, the categories andapproximate number of data subjects concerned and the categories andapproximate number of personal data records concerned;(2) the likely consequences of the personal data breach;(3) the measures taken or proposed to be taken by the controller to address the
personal data breach, including, where appropriate, measures to mitigate its
possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the sametime, the initial notification shall contain the information then available andfurther information shall, as it becomes available, subsequently be provided
without undue delay.
(c) in complying, pursuant to Article 34 of Regulation (EU) 2016/679 with the obligation tocommunicate without undue delay the personal data breach to the data subject,when the personal data breach is likely to result in a high risk to the rights andfreedoms of natural persons.
9.2. Data breach concerning data processed by the processor
In the event of a personal data breach concerning data processed by the processor, theprocessor shall notify the controller without undue delay after the processor having
become aware of the breach. Such notification shall contain, at least:
Page 10
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(a) a description of the nature of the breach (including, where possible, the categories
and approximate number of data subjects and data records concerned);(b) the details of a contact point where more information concerning the personal data
breach can be obtained;(c) its likely consequences and the measures taken or proposed to be taken to address
the breach, including to mitigate its possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the sametime, the initial notification shall contain the information then available and further
information shall, as it becomes available, subsequently be provided without undue
delay.
The Parties shall set out in Annex III all other elements to be provided by theprocessor when assisting the controller in the compliance with the controller’s
obligations under Articles 33 and 34 of Regulation (EU) 2016/679.
Clause 10
Non-compliance with the Clauses and termination(a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation(EU) 2018/1725, in the event that the processor is in breach of its obligations underthese Clauses, the controller may instruct the processor to suspend the processing of
personal data until the latter complies with these Clauses or the contract isterminated. The processor shall promptly inform the controller in case it is unable tocomply with these Clauses, for whatever reason.
(b) The controller shall be entitled to terminate the contract insofar as it concerns
processing of personal data in accordance with these Clauses if:(1)

the processing of personal data by the processor has been suspended by thecontroller pursuant to point (a) and if compliance with these Clauses is notrestored within a reasonable time and in any event within one month following
suspension;(2) the processor is in substantial or persistent breach of these Clauses or its
obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;(3) the processor fails to comply with a binding decision of a competent court or thecompetent supervisory authority/ies regarding its obligations pursuant to these
Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
(c) The processor shall be entitled to terminate the contract insofar as it concerns
processing of personal data under these Clauses where, after having informed thecontroller that its instructions infringe applicable legal requirements in accordancewith Clause 7.1 (b), the controller insists on compliance with the instructions.
(d)Following termination of the contract, the processor shall, at the choice of thecontroller, delete all personal data processed on behalf of the controller and certify to thecontroller that it has done so, or, return all the personal data to the controller and delete
existing copies unless Union or Member State law requires storage of the personal data.
Page 11
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Until the data is deleted or returned, the processor shall continue to ensure compliancewith these Clauses.

Page 12
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX I
List of parties
SEE APPENDIX 7

Page 13
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX II
Description of the processing
SEE APPENDIX 8

Page 14
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX III
Technical and organisational measures including technical and organisational
measures to ensure the security of the data
EXPLANATORY NOTE:
The technical and organisational measures need to be described concretely and not
in a generic manner.
Description of the technical and organisational security measures implemented by
the processor(s) (including any relevant certifications) to ensure an appropriate levelof security, taking into account the nature, scope, context and purpose of theprocessing, as well as the risks for the rights and freedoms of natural persons.
Examples of possible measures:
SEE APPENDIX 9Page 15
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX IV
List of sub-processors
EXPLANATORY NOTE:This Annex needs to be completed in case of specific authorisation of sub-processors(Clause 7.7(a), Option 1).

The controller has authorised the use of the following sub-processors:
SEE APPENDIX 6

Page 16
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 2 – SCCs 2021/914 MODULE ONE: Transfer Controller toController

STANDARD CONTRACTUAL CLAUSES 2021/914
MODULE ONE: Transfer Controller to Controller
Clause 1
Purpose and scope(a) The purpose of these contractual clauses is to ensure compliance with therequirements of Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons with regard to theprocessing of personal data and on the free movement of such data (General Data
Protection Regulation) for the transfer of personal data to a third country.
(b) The Parties:i)the natural or legal person(s), public authority/ies, agency/ies or other body/ies(hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A(hereinafter each “data exporter”), andii)

the entity/ies in a third country receiving the personal data from the data
exporter, directly or indirectly via another entity also Party to these Clauses, as
listed in Annex I.A (hereinafter each “data importer”) have agreed to thesecontractual clauses (“Clauses”).

(c) These Clauses apply with respect to the transfer of personal data as specified in
Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an
integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses(a) These Clauses set out appropriate safeguards, including enforceable data subject
rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) ofRegulation (EU) 2016/679 and, with respect to data transfers from controllers toprocessors and/or processors to processors, standard contractual clauses pursuant to
Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except toselect the appropriate Module(s) or to add or update information in the Appendix.
This does not prevent the Parties from including the standard contractual clauses laid
down in these Clauses in a wider contract and/or to add other clauses or additionalsafeguards, provided that they do not contradict, directly or indirectly, these Clauses
or prejudice the fundamental rights or freedoms of data subjects.

Page 17
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) These Clauses are without prejudice to obligations to which the data exporter issubject by virtue of Regulation (EU) 2016/679.

Clause 3
Third-party beneficiaries(a) The data subjects can enforce against the data exporter and/or data importer these
Clauses, with the following exceptions:i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;ii)

Clause 8.5 (e) and Clause 8.9 (b)[iii) not applicable]
iv)

Clause 12 (a) and (d);v)

Clause 13;vi)

Clause 15.1 (c), (d) and (e);vii) Clause 16 (e);viii) Clause 18 (a) and (b);(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU)2016/679.
Clause 4
Interpretation(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, thoseterms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation(EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights andobligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy

In the event of a contradiction between these Clauses and the provisions of other relatedagreements between the Parties, existing at the time these Clauses are agreed or enteredinto thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)The details of the transfer(s), and in particular the categories of personal data that aretransferred and the purpose(s) for which they are transferred, are specified in Annex I.B
hereunder.
Page 18
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 7
Docking clause(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties,
accede to these Clauses at any time, either as a data exporter or as a data importer, bycompleting the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shallbecome a Party to these Clauses and have the rights and obligations of a data
exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses
from the period prior to becoming a Party.
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data
importer is able, through the implementation of appropriate technical and organisational
measures, to satisfy its obligations under these Clauses.
8.1. Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of thetransfer, as set out in Annex I. B. It may only process the personal data for anotherpurpose:i)where it has obtained the data subject’s prior consent;ii)

where necessary for the establishment, exercise or defence of legal claims in thecontext of specific administrative, regulatory or judicial proceedings; oriii) where necessary in order to protect the vital interests of the data subject or of anothernatural person.
8.2. Transparency(a) In order to enable data subjects to effectively exercise their rights pursuant to Clause
10, the data importer shall inform them, either directly or through the data exporter:i)of its identity and contact details;ii)of the categories of personal data processed;iii)

of the right to obtain a copy of these Clauses;iv)

where it intends to onward transfer the personal data to any third party/ies, of therecipient or categories of recipients (as appropriate with a view to providing
meaningful information), the purpose of such onward transfer and the groundtherefore pursuant to Clause 8.7.

(b) Paragraph (a) shall not apply where the data subject already has the information,
including when such information has already been provided by the data exporter, orPage 19
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

providing the information proves impossible or would involve a disproportionate
effort for the data importer. In the latter case, the data importer shall, to the extent
possible, make the information publicly available.
(c) On request, the Parties shall make a copy of these Clauses, including the Appendix ascompleted by them, available to the data subject free of charge. To the extent
necessary to protect business secrets or other confidential information, including
personal data, the Parties may redact part of the text of the Appendix prior to sharing
a copy, but shall provide a meaningful summary where the data subject would
otherwise not be able to understand its content or exercise his/her rights. On request,
the Parties shall provide the data subject with the reasons for the redactions, to theextent possible without revealing the redacted information.
(d) Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter
under Articles 13 and 14 of Regulation (EU) 2016/679.
8.3. Accuracy and data minimisation(a) Each Party shall ensure that the personal data is accurate and, where necessary, kept
up to date. The data importer shall take every reasonable step to ensure that personal
data that is inaccurate, having regard to the purpose(s) of processing, is erased or
rectified without delay.
(b) If one of the Parties becomes aware that the personal data it has transferred or
received is inaccurate, or has become outdated, it shall inform the other Party without
undue delay.
(c) The data importer shall ensure that the personal data is adequate, relevant andlimited to what is necessary in relation to the purpose(s) of processing.
8.4. Storage limitation
The data importer shall retain the personal data for no longer than necessary for the
purpose(s) for which it is processed. It shall put in place appropriate technical ororganisational measures to ensure compliance with this obligation, including erasureor anonymisation of the data and all back-ups at the end of the retention period.
8.5. Security of processing(a) The data importer and, during transmission, also the data exporter shall implement
appropriate technical and organisational measures to ensure the security of thepersonal data, including protection against a breach of security leading to accidental
or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter‘personal data breach’). In assessing the appropriate level of security, they shall takedue account of the state of the art, the costs of implementation, the nature, scope,
context and purpose(s) of processing and the risks involved in the processing for thedata subject. The Parties shall in particular consider having recourse to encryption or
pseudonymisation, including during transmission, where the purpose of processing
can be fulfilled in that manner.
Page 20
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) The Parties have agreed on the technical and organisational measures set out inAnnex II. The data importer shall carry out regular checks to ensure that thesemeasures continue to provide an appropriate level of security.
(c) The data importer shall ensure that persons authorised to process the personal data
have committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality.
(d) In the event of a personal data breach concerning personal data processed by thedata importer under these Clauses, the data importer shall take appropriate
measures to address the personal data breach, including measures to mitigate its
possible adverse effects.
(e) In case of a personal data breach that is likely to result in a risk to the rights andfreedoms of natural persons, the data importer shall without undue delay notify both
the data exporter and the competent supervisory authority pursuant to Clause 13.
Such notification shall contain i) a description of the nature of the breach (including,where possible, categories and approximate number of data subjects and personal
data records concerned), ii) its likely consequences, iii) the measures taken or
proposed to address the breach, and iv) the details of a contact point from whom
more information can be obtained. To the extent it is not possible for the data
importer to provide all the information at the same time, it may do so in phases
without undue further delay.
(f)

In case of a personal data breach that is likely to result in a high risk to the rights andfreedoms of natural persons, the data importer shall also notify without undue delay
the data subjects concerned of the personal data breach and its nature, if necessary
in cooperation with the data exporter, together with the information referred to inparagraph (e), points ii) to iv), unless the data importer has implemented measures tosignificantly reduce the risk to the rights or freedoms of natural persons, ornotification would involve disproportionate efforts. In the latter case, the data
importer shall instead issue a public communication or take a similar measure to
inform the public of the personal data breach.

(g) The data importer shall document all relevant facts relating to the personal data
breach, including its effects and any remedial action taken, and keep a record thereof.

8.6. Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, politicalopinions, religious or philosophical beliefs, or trade union membership, genetic data, or
biometric data for the purpose of uniquely identifying a natural person, data concerning
health or a person’s sex life or sexual orientation, or data relating to criminal convictions oroffences (hereinafter ‘sensitive data’), the data importer shall apply specific restrictions
and/or additional safeguards adapted to the specific nature of the data and the risks
involved. This may include restricting the personnel permitted to access the personaldata, additional security measures (such as pseudonymisation) and/or additional
restrictions with respect to further disclosure.
Page 21
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

8.7. Onward transfers
The data importer shall not disclose the personal data to a third party located outside theEuropean Union (in the same country as the data importer or in another third country,
hereinafter ‘onward transfer’) unless the third party is or agrees to be bound by these
Clauses, under the appropriate Module. Otherwise, an onward transfer by the data
importer may only take place if:i)

it is to a country benefitting from an adequacy decision pursuant to Article 45 ofRegulation (EU) 2016/679 that covers the onward transfer;ii)

the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47
of Regulation (EU) 2016/679 with respect to the processing in question;iii) the third party enters into a binding instrument with the data importer ensuring thesame level of data protection as under these Clauses, and the data importer provides
a copy of these safeguards to the data exporter;iv) it is necessary for the establishment, exercise or defence of legal claims in the context
of specific administrative, regulatory or judicial proceedings;v)

it is necessary in order to protect the vital interests of the data subject or of anothernatural person; orvi) where none of the other conditions apply, the data importer has obtained the explicit
consent of the data subject for an onward transfer in a specific situation, after having
informed him/her of its purpose(s), the identity of the recipient and the possible risksof such transfer to him/her due to the lack of appropriate data protection safeguards.
In this case, the data importer shall inform the data exporter and, at the request of thelatter, shall transmit to it a copy of the information provided to the data subject.
Any onward transfer is subject to compliance by the data importer with all the othersafeguards under these Clauses, in particular purpose limitation.
8.8. Processing under the authority of the data importer
The data importer shall ensure that any person acting under its authority, including aprocessor, processes the data only on its instructions.
8.9. Documentation and compliance(a) Each Party shall be able to demonstrate compliance with its obligations under these
Clauses. In particular, the data importer shall keep appropriate documentation of theprocessing activities carried out under its responsibility.
(b) The data importer shall make such documentation available to the competentsupervisory authority on request.
[Clause 9 not applicable]

Page 22
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 10
Data subject rights(a) The data importer, where relevant with the assistance of the data exporter, shall deal
with any enquiries and requests it receives from a data subject relating to theprocessing of his/her personal data and the exercise of his/her rights under these
Clauses without undue delay and at the latest within one month of the receipt of theenquiry or request. The data importer shall take appropriate measures to facilitatesuch enquiries, requests and the exercise of data subject rights. Any information
provided to the data subject shall be in an intelligible and easily accessible form, using
clear and plain language.
(b) In particular, upon request by the data subject the data importer shall, free of charge:i)

provide confirmation to the data subject as to whether personal data concerning
him/her is being processed and, where this is the case, a copy of the data relating
to him/her and the information in Annex I; if personal data has been or will be
onward transferred, provide information on recipients or categories of recipients(as appropriate with a view to providing meaningful information) to which thepersonal data has been or will be onward transferred, the purpose of such onward
transfers and their ground pursuant to Clause 8.7; and provide information on
the right to lodge a complaint with a supervisory authority in accordance with
Clause 12(c)(i);

ii)

rectify inaccurate or incomplete data concerning the data subject;iii)

erase personal data concerning the data subject if such data is being or has beenprocessed in violation of any of these Clauses ensuring third-party beneficiaryrights, or if the data subject withdraws the consent on which the processing isbased.

(c) Where the data importer processes the personal data for direct marketing purposes,
it shall cease processing for such purposes if the data subject objects to it.
(d) The data importer shall not make a decision based solely on the automatedprocessing of the personal data transferred (hereinafter ‘automated decision’), which
would produce legal effects concerning the data subject or similarly significantly
affect him/her, unless with the explicit consent of the data subject or if authorised to
do so under the laws of the country of destination, provided that such laws lays down
suitable measures to safeguard the data subject’s rights and legitimate interests. In
this case, the data importer shall, where necessary in cooperation with the data
exporter:i)

inform the data subject about the envisaged automated decision, the envisaged
consequences and the logic involved; andii)

implement suitable safeguards, at least by enabling the data subject to contest
the decision, express his/her point of view and obtain review by a human being.

(e) Where requests from a data subject are excessive, in particular because of theirrepetitive character, the data importer may either charge a reasonable fee taking into

Page 23
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

account the administrative costs of granting the request or refuse to act on therequest.
(f)

The data importer may refuse a data subject’s request if such refusal is allowed under
the laws of the country of destination and is necessary and proportionate in a
democratic society to protect one of the objectives listed in Article 23(1) of Regulation(EU) 2016/679.

(g) If the data importer intends to refuse a data subject’s request, it shall inform the data
subject of the reasons for the refusal and the possibility of lodging a complaint withthe competent supervisory authority and/or seeking judicial redress.

Clause 11
Redress(a) The data importer shall inform data subjects in a transparent and easily accessible
format, through individual notice or on its website, of a contact point authorised tohandle complaints. It shall deal promptly with any complaints it receives from a data
subject.
(b) In case of a dispute between a data subject and one of the Parties as regards
compliance with these Clauses, that Party shall use its best efforts to resolve the issue
amicably in a timely fashion. The Parties shall keep each other informed about suchdisputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3,
the data importer shall accept the decision of the data subject to:i)lodge a complaint with the supervisory authority in the Member State of his/her
habitual residence or place of work, or the competent supervisory authority
pursuant to Clause 13;ii)

refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body,organisation or association under the conditions set out in Article 80(1) of Regulation(EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or
Member State law.
(f)

The data importer agrees that the choice made by the data subject will not prejudice
his/her substantive and procedural rights to seek remedies in accordance withapplicable laws.
Clause 12
Liability(a) Each Party shall be liable to the other Party/ies for any damages it causes the otherParty/ies by any breach of these Clauses.

Page 24
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) Each Party shall be liable to the data subject, and the data subject shall be entitled toreceive compensation, for any material or non-material damages that the Party
causes the data subject by breaching the third-party beneficiary rights under these
Clauses. This is without prejudice to the liability of the data exporter under Regulation(EU) 2016/679.
(c) Where more than one Party is responsible for any damage caused to the data subject
as a result of a breach of these Clauses, all responsible Parties shall be jointly andseverally liable and the data subject is entitled to bring an action in court against anyof these Parties.
(d) The Parties agree that if one Party is held liable under paragraph (c), it shall beentitled to claim back from the other Party/ies that part of the compensation
corresponding to its/their responsibility for the damage.
(e) The data importer may not invoke the conduct of a processor or sub-processor to
avoid its own liability.
Clause 13
Supervision(a) [Where the data exporter is established in an EU Member State:] The supervisory
authority with responsibility for ensuring compliance by the data exporter with
Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shallact as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with its
Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation(EU) 2016/679:] The supervisory authority of the Member State in which therepresentative within the meaning of Article 27(1) of Regulation (EU) 2016/679 isestablished, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with its
Article 3(2) without however having to appoint a representative pursuant to Article27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member
States in which the data subjects whose personal data is transferred under these
Clauses in relation to the offering of goods or services to them, or whose behaviour ismonitored, are located, as indicated in Annex I.C, shall act as competent supervisory
authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with thecompetent supervisory authority in any procedures aimed at ensuring compliancewith these Clauses. In particular, the data importer agrees to respond to enquiries,
submit to audits and comply with the measures adopted by the supervisory authority,
including remedial and compensatory measures. It shall provide the supervisory
authority with written confirmation that the necessary actions have been taken.

Page 25
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 14
Local laws and practices affecting compliance with the Clauses(a) The Parties warrant that they have no reason to believe that the laws and practices inthe third country of destination applicable to the processing of the personal data by
the data importer, including any requirements to disclose personal data or measuresauthorising access by public authorities, prevent the data importer from fulfilling its
obligations under these Clauses. This is based on the understanding that laws andpractices that respect the essence of the fundamental rights and freedoms and do
not exceed what is necessary and proportionate in a democratic society to safeguard
one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not incontradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken
due account in particular of the following elements:i)the specific circumstances of the transfer, including the length of the processing
chain, the number of actors involved and the transmission channels used;
intended onward transfers; the type of recipient; the purpose of processing; thecategories and format of the transferred personal data; the economic sector inwhich the transfer occurs; the storage location of the data transferred;ii)

the laws and practices of the third country of destination– including thoserequiring the disclosure of data to public authorities or authorising access bysuch authorities – relevant in light of the specific circumstances of the transfer,and the applicable limitations and safeguards;iii)

any relevant contractual, technical or organisational safeguards put in place tosupplement the safeguards under these Clauses, including measures applied
during transmission and to the processing of the personal data in the country ofdestination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b),it has made its best efforts to provide the data exporter with relevant information andagrees that it will continue to cooperate with the data exporter in ensuring
compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make itavailable to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed
to these Clauses and for the duration of the contract, it has reason to believe that it isor has become subject to laws or practices not in line with the requirements underparagraph (a), including following a change in the laws of the third country or ameasure (such as a disclosure request) indicating an application of such laws inpractice that is not in line with the requirements in paragraph (a).
(f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise
has reason to believe that the data importer can no longer fulfill its obligations underthese Clauses, the data exporter shall promptly identify appropriate measures (e.g.
technical or organisational measures to ensure security and confidentiality) to be

Page 26
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

adopted by the data exporter and/or data importer to address the situation. The data
exporter shall suspend the data transfer if it considers that no appropriate safeguards
for such transfer can be ensured, or if instructed by the competent supervisory
authority to do so. In this case, the data exporter shall be entitled to terminate thecontract, insofar as it concerns the processing of personal data under these Clauses. If
the contract involves more than two Parties, the data exporter may exercise this rightto termination only with respect to the relevant Party, unless the Parties have agreed
otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and(e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1. Notification(a) The data importer agrees to notify the data exporter and, where possible, the data
subject promptly (if necessary with the help of the data exporter) if it:i)receives a legally binding request from a public authority, including judicial
authorities, under the laws of the country of destination for the disclosure of
personal data transferred pursuant to these Clauses; such notification shall
include information about the personal data requested, the requesting authority,
the legal basis for the request and the response provided; orii)becomes aware of any direct access by public authorities to personal datatransferred pursuant to these Clauses in accordance with the laws of the countryof destination; such notification shall include all information available to theimporter.

(b) If the data importer is prohibited from notifying the data exporter and/or the data
subject under the laws of the country of destination, the data importer agrees to use
its best efforts to obtain a waiver of the prohibition, with a view to communicating as
much information as possible, as soon as possible. The data importer agrees todocument its best efforts in order to be able to demonstrate them on request of thedata exporter.
(c) Where permissible under the laws of the country of destination, the data importer
agrees to provide the data exporter, at regular intervals for the duration of thecontract, with as much relevant information as possible on the requests received (inparticular, number of requests, type of data requested, requesting authority/ies,
whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c)for the duration of the contract and make it available to the competent supervisory
authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer
pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it
is unable to comply with these Clauses.
Page 27
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

15.2. Review of legality and data minimisation(a) The data importer agrees to review the legality of the request for disclosure, inparticular whether it remains within the powers granted to the requesting publicauthority, and to challenge the request if, after careful assessment, it concludes that
there are reasonable grounds to consider that the request is unlawful under the lawsof the country of destination, applicable obligations under international law andprinciples of international comity. The data importer shall, under the same conditions,pursue possibilities of appeal. When challenging a request, the data importer shallseek interim measures with a view to suspending the effects of the request until thecompetent judicial authority has decided on its merits. It shall not disclose thepersonal data requested until required to do so under the applicable procedural rules.
These requirements are without prejudice to the obligations of the data importer
under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to therequest for disclosure and, to the extent permissible under the laws of the country ofdestination, make the documentation available to the data exporter. It shall also makeit available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information
permissible when responding to a request for disclosure, based on a reasonableinterpretation of the request.
Clause 16
Non-compliance with the Clauses and termination(a) The data importer shall promptly inform the data exporter if it is unable to comply
with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply
with these Clauses, the data exporter shall suspend the transfer of personal data to
the data importer until compliance is again ensured or the contract is terminated.
This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns theprocessing of personal data under these Clauses, where:i)the data exporter has suspended the transfer of personal data to the data
importer pursuant to paragraph (b) and compliance with these Clauses is notrestored within a reasonable time and in any event within one month ofsuspension;ii)

the data importer is in substantial or persistent breach of these Clauses; oriii)

the data importer fails to comply with a binding decision of a competent court orsupervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such noncompliance. Where the contract involves more than two Parties, the data

Page 28
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

exporter may exercise this right to termination only with respect to the relevant
Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract
pursuant to paragraph (c) shall at the choice of the data exporter immediately be
returned to the data exporter or deleted in its entirety. The same shall apply to any
copies of the data. The data importer shall certify the deletion of the data to the data
exporter. Until the data is deleted or returned, the data importer shall continue toensure compliance with these Clauses. In case of local laws applicable to the data
importer that prohibit the return or deletion of the transferred personal data, the data
importer warrants that it will continue to ensure compliance with these Clauses andwill only process the data to the extent and for as long as required under that local
law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) theEuropean Commission adopts a decision pursuant to Article 45(3) of Regulation (EU)2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii)
Regulation (EU) 2016/679 becomes part of the legal framework of the country towhich the personal data is transferred. This is without prejudice to other obligations
applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided
such law allows for third- party beneficiary rights. The Parties agree that this shall be thelaw of Germany.
Clause 18
Choice of forum and jurisdiction(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU
Member State.
(b) The Parties agree that those shall be the courts of Germany.
(c) A data subject may also bring legal proceedings against the data exporter and/or data
importer before the courts of the Member State in which he/she has his/her habitualresidence.
(d)

The Parties agree to submit themselves to the jurisdiction of such courts.

Page 29
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20ΑΝΝΕΧ I
A. LIST OF PARTIESSEE APPENDIX 7

Page 30
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

B. DESCRIPTION OF TRANSFERSEE APPENDIX 8

Page 31
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

C. COMPETENT SUPERVISORY AUTHORITY
SEE APPENDIX 10

Page 32
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX IITECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data
importer(s) (including any relevant certifications) to ensure an appropriate level of security,
taking into account the nature, scope, context and purpose of the processing, and therisks for the rights and freedoms of natural persons.
SEE APPENDIX 9Page 33
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 3 – SCCs 2021/914 MODULE TWO: Transfer Controller toProcessor

STANDARD CONTRACTUAL CLAUSES 2021/914
MODULE TWO: Transfer Controller to Processor
Clause 1
Purpose and scope(a) The purpose of these contractual clauses is to ensure compliance with therequirements of Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons with regard to theprocessing of personal data and on the free movement of such data (General Data
Protection Regulation) for the transfer of personal data to a third country.
(b) The Parties:i)the natural or legal person(s), public authority/ies, agency/ies or other body/ies(hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A(hereinafter each “data exporter”), andii)

the entity/ies in a third country receiving the personal data from the data
exporter, directly or indirectly via another entity also Party to these Clauses, as
listed in Annex I.A (hereinafter each “data importer”)

have agreed to these contractual clauses (“Clauses”).
(c) These Clauses apply with respect to the transfer of personal data as specified in
Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an
integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses(a) These Clauses set out appropriate safeguards, including enforceable data subject
rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) ofRegulation (EU) 2016/679 and, with respect to data transfers from controllers toprocessors and/or processors to processors, standard contractual clauses pursuant to
Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except toselect the appropriate Module(s) or to add or update information in the Appendix.
This does not prevent the Parties from including the standard contractual clauses laid
down in these Clauses in a wider contract and/or to add other clauses or additionalsafeguards, provided that they do not contradict, directly or indirectly, these Clauses
or prejudice the fundamental rights or freedoms of data subjects.
Page 34
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) These Clauses are without prejudice to obligations to which the data exporter issubject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries(a) The data subjects can enforce against the data exporter and/or data importer these
Clauses, with the following exceptions:i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;ii)

Clause 8.1(b), 8.9(a), (c), (d) and (e);iii)

Clause 9(a), (c), (d) and (e);iv)

Clause 12(a), (d) and (f);v)

Clause 13;vi)

Clause 15.1 (c), (d) and (e);vii) Clause 16 (e);viii) Clause 18 (a) and (b);(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU)2016/679.
Clause 4
Interpretation(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, thoseterms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation(EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights andobligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy

In the event of a contradiction between these Clauses and the provisions of other relatedagreements between the Parties, existing at the time these Clauses are agreed or enteredinto thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)The details of the transfer(s), and in particular the categories of personal data that aretransferred and the purpose(s) for which they are transferred, are specified in Annex I.B
hereunder.

Page 35
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 7
Docking clause(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties,
accede to these Clauses at any time, either as a data exporter or as a data importer, bycompleting the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shallbecome a Party to these Clauses and have the rights and obligations of a data
exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses
from the period prior to becoming a Party.
Clause 8
Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data
importer is able, through the implementation of appropriate technical and organisational
measures, to satisfy its obligations under these Clauses.

8.1. Instructions(a) The data importer shall process the personal data only on documented instructions
from the data exporter. The data exporter may give such instructions throughout the
duration of the contract.
(b) The data importer shall immediately inform the data exporter if it is unable to follow
those instructions.
8.2. Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of thetransfer, as set out in Annex I. B, unless on further instructions from the data exporter.
8.3. Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix
as completed by the Parties, available to the data subject free of charge. To the extent
necessary to protect business secrets or other confidential information, including themeasures described in Annex II and personal data, the data exporter may redact part of
the text of the Appendix to these Clauses prior to sharing a copy, but shall provide ameaningful summary where the data subject would otherwise not be able to understandthe its content or exercise his/her rights. On request, the Parties shall provide the data
subject with the reasons for the redactions, to the extent possible without revealing thePage 36
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

redacted information. This Clause is without prejudice to the obligations of the data
exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4. Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or
has become outdated, it shall inform the data exporter without undue delay. In this case,the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5. Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex
I.B. After the end of the provision of the processing services, the data importer shall, at the
choice of the data exporter, delete all personal data processed on behalf of the data
exporter and certify to the data exporter that it has done so, or return to the data exporter
all personal data processed on its behalf and delete existing copies. Until the data isdeleted or returned, the data importer shall continue to ensure compliance with these
Clauses. In case of local laws applicable to the data importer that prohibit return ordeletion of the personal data, the data importer warrants that it will continue to ensurecompliance with these Clauses and will only process it to the extent and for as long as
required under that local law. This is without prejudice to Clause 14, in particular therequirement for the data importer under Clause 14(e) to notify the data exporter
throughout the duration of the contract if it has reason to believe that it is or has become
subject to laws or practices not in line with the requirements under Clause 14(a).
8.6. Security of processing(a) The data importer and, during transmission, also the data exporter shall implement
appropriate technical and organisational measures to ensure the security of the data,
including protection against a breach of security leading to accidental or unlawfuldestruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter‘personal data breach’). In assessing the appropriate level of security, the Parties shalltake due account of the state of the art, the costs of implementation, the nature,
scope, context and purpose(s) of processing and the risks involved in the processing
for the data subjects. The Parties shall in particular consider having recourse to
encryption or pseudonymisation, including during transmission, where the purposeof processing can be fulfilled in that manner. In case of pseudonymisation, theadditional information for attributing the personal data to a specific data subject shall,where possible, remain under the exclusive control of the data exporter. In complying
with its obligations under this paragraph, the data importer shall at least implement
the technical and organisational measures specified in Annex II. The data importer
shall carry out regular checks to ensure that these measures continue to provide anappropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel
only to the extent strictly necessary for the implementation, management andPage 37
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

monitoring of the contract. It shall ensure that persons authorised to process the
personal data have committed themselves to confidentiality or are under anappropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by thedata importer under these Clauses, the data importer shall take appropriate
measures to address the breach, including measures to mitigate its adverse effects.
The data importer shall also notify the data exporter without undue delay after having
become aware of the breach. Such notification shall contain the details of a contact
point where more information can be obtained, a description of the nature of thebreach (including, where possible, categories and approximate number of data
subjects and personal data records concerned), its likely consequences and themeasures taken or proposed to address the breach including, where appropriate,measures to mitigate its possible adverse effects. Where, and in so far as, it is notpossible to provide all information at the same time, the initial notification shallcontain the information then available and further information shall, as it becomes
available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data
exporter to comply with its obligations under Regulation (EU) 2016/679, in particular
to notify the competent supervisory authority and the affected data subjects, taking
into account the nature of processing and the information available to the data
importer.
8.7. Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, politicalopinions, religious or philosophical beliefs, or trade union membership, genetic data, or
biometric data for the purpose of uniquely identifying a natural person, data concerning
health or a person’s sex life or sexual orientation, or data relating to criminal convictions
and offences (hereinafter ‘sensitive data’), the data importer shall apply the specificrestrictions and/or additional safeguards described in Annex I.B.
8.8. Onward transfers
The data importer shall only disclose the personal data to a third party on documented
instructions from the data exporter. In addition, the data may only be disclosed to a third
party located outside the European Union (in the same country as the data importer or inanother third country, hereinafter ‘onward transfer’) if the third party is or agrees to bebound by these Clauses, under the appropriate Module, or if:i)the onward transfer is to a country benefitting from an adequacy decision pursuant to
Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;ii)

the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47
Regulation of (EU) 2016/679 with respect to the processing in question;iii) the onward transfer is necessary for the establishment, exercise or defense of legal
claims in the context of specific administrative, regulatory or judicial proceedings; orPage 38
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

iv) the onward transfer is necessary in order to protect the vital interests of the data
subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the othersafeguards under these Clauses, in particular purpose limitation.
8.9. Documentation and compliance(a) The data importer shall promptly and adequately deal with enquiries from the data
exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular,
the data importer shall keep appropriate documentation on the processing activities
carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary
to demonstrate compliance with the obligations set out in these Clauses and at thedata exporter’s request, allow for and contribute to audits of the processing activities
covered by these Clauses, at reasonable intervals or if there are indications of noncompliance. In deciding on a review or audit, the data exporter may take into accountrelevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an
independent auditor. Audits may include inspections at the premises or physicalfacilities of the data importer and shall, where appropriate, be carried out withreasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including
the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors(a) GENERAL WRITTEN AUTHORISATION: The data importer has the data exporter’s
general authorisation for the engagement of sub-processor(s) from an agreed list. The
data importer shall specifically inform the data exporter in writing of any intended
changes to that list through the addition or replacement of sub-processors at least 30
days in advance, thereby giving the data exporter sufficient time to be able to object
to such changes prior to the engagement of the sub-processor(s). The data importer
shall provide the data exporter with the information necessary to enable the data
exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing
activities (on behalf of the data exporter), it shall do so by way of a written contractthat provides for, in substance, the same data protection obligations as those binding
the data importer under these Clauses, including in terms of third-party beneficiaryrights for data subjects. The Parties agree that, by complying with this Clause, thedata importer fulfils its obligations under Clause 8.8. The data importer shall ensurethat the sub-processor complies with the obligations to which the data importer issubject pursuant to these Clauses.
Page 39
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(c) The data importer shall provide, at the data exporter’s request, a copy of such a
sub-processor agreement and any subsequent amendments to the data exporter. To
the extent necessary to protect business secrets or other confidential information,
including personal data, the data importer may redact the text of the agreement prior
to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the
performance of the sub-processor’s obligations under its contract with the data
importer. The data importer shall notify the data exporter of any failure by the
sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor
whereby – in the event the data importer has factually disappeared, ceased to exist inlaw or has become insolvent – the data exporter shall have the right to terminate thesub-processor contract and to instruct the sub-processor to erase or return the
personal data.
Clause 10
Data subject rights(a) The data importer shall promptly notify the data exporter of any request it hasreceived from a data subject. It shall not respond to that request itself unless it has
been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respondto data subjects’ requests for the exercise of their rights under Regulation (EU)2016/679. In this regard, the Parties shall set out in Annex II the appropriate technicaland organisational measures, taking into account the nature of the processing, bywhich the assistance shall be provided, as well as the scope and the extent of theassistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shallcomply with the instructions from the data exporter.
Clause 11
Redress(a) The data importer shall inform data subjects in a transparent and easily accessible
format, through individual notice or on its website, of a contact point authorised tohandle complaints. It shall deal promptly with any complaints it receives from a data
subject.
(b) In case of a dispute between a data subject and one of the Parties as regards
compliance with these Clauses, that Party shall use its best efforts to resolve the issue
amicably in a timely fashion. The Parties shall keep each other informed about suchdisputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3,
the data importer shall accept the decision of the data subject to:Page 40
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

i)lodge a complaint with the supervisory authority in the Member State of his/her
habitual residence or place of work, or the competent supervisory authority
pursuant to Clause 13;ii)

refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body,organisation or association under the conditions set out in Article 80(1) of Regulation(EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or
Member State law.
(f)

The data importer agrees that the choice made by the data subject will not prejudice
his/her substantive and procedural rights to seek remedies in accordance withapplicable laws.

Clause 12
Liability(a) Each Party shall be liable to the other Party/ies for any damages it causes the otherParty/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall beentitled to receive compensation, for any material or non-material damages the data
importer or its sub-processor causes the data subject by breaching the third-party
beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject,
and the data subject shall be entitled to receive compensation, for any material or
non-material damages the data exporter or the data importer (or its sub- processor)
causes the data subject by breaching the third-party beneficiary rights under these
Clauses. This is without prejudice to the liability of the data exporter and, where thedata exporter is a processor acting on behalf of a controller, to the liability of thecontroller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) fordamages caused by the data importer (or its sub-processor), it shall be entitled toclaim back from the data importer that part of the compensation corresponding to
the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject
as a result of a breach of these Clauses, all responsible Parties shall be jointly andseverally liable and the data subject is entitled to bring an action in court against anyof these Parties.
(f)

The Parties agree that if one Party is held liable under paragraph (e), it shall beentitled to claim back from the other Party/ies that part of the compensation
corresponding to its/their responsibility for the damage.

(g) The data importer may not invoke the conduct of a sub-processor to avoid its own
liability.
Page 41
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 13
Supervision(a) [Where the data exporter is established in an EU Member State:] The supervisory
authority with responsibility for ensuring compliance by the data exporter with
Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shallact as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with its
Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation(EU) 2016/679:] The supervisory authority of the Member State in which therepresentative within the meaning of Article 27(1) of Regulation (EU) 2016/679 isestablished, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with its
Article 3(2) without however having to appoint a representative pursuant to Article27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member
States in which the data subjects whose personal data is transferred under these
Clauses in relation to the offering of goods or services to them, or whose behaviour ismonitored, are located, as indicated in Annex I.C, shall act as competent supervisory
authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with thecompetent supervisory authority in any procedures aimed at ensuring compliancewith these Clauses. In particular, the data importer agrees to respond to enquiries,
submit to audits and comply with the measures adopted by the supervisory authority,
including remedial and compensatory measures. It shall provide the supervisory
authority with written confirmation that the necessary actions have been taken.
Clause 14
Local laws and practices affecting compliance with the Clauses(a) The Parties warrant that they have no reason to believe that the laws and practices inthe third country of destination applicable to the processing of the personal data by
the data importer, including any requirements to disclose personal data or measuresauthorising access by public authorities, prevent the data importer from fulfilling its
obligations under these Clauses. This is based on the understanding that laws andpractices that respect the essence of the fundamental rights and freedoms and do
not exceed what is necessary and proportionate in a democratic society to safeguard
one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not incontradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken
due account in particular of the following elements:

Page 42
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

i)

the specific circumstances of the transfer, including the length of the processing
chain, the number of actors involved and the transmission channels used;
intended onward transfers; the type of recipient; the purpose of processing; thecategories and format of the transferred personal data; the economic sector inwhich the transfer occurs; the storage location of the data transferred;ii)

the laws and practices of the third country of destination– including thoserequiring the disclosure of data to public authorities or authorising access bysuch authorities – relevant in light of the specific circumstances of the transfer,and the applicable limitations and safeguards;iii)

any relevant contractual, technical or organisational safeguards put in place tosupplement the safeguards under these Clauses, including measures applied
during transmission and to the processing of the personal data in the country ofdestination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b),it has made its best efforts to provide the data exporter with relevant information andagrees that it will continue to cooperate with the data exporter in ensuring
compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make itavailable to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed
to these Clauses and for the duration of the contract, it has reason to believe that it isor has become subject to laws or practices not in line with the requirements underparagraph (a), including following a change in the laws of the third country or ameasure (such as a disclosure request) indicating an application of such laws inpractice that is not in line with the requirements in paragraph (a).
(f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise
has reason to believe that the data importer can no longer fulfill its obligations underthese Clauses, the data exporter shall promptly identify appropriate measures (e.g.,technical or organisational measures to ensure security and confidentiality) to be
adopted by the data exporter and/or data importer to address the situation. The data
exporter shall suspend the data transfer if it considers that no appropriate safeguards
for such transfer can be ensured, or if instructed by the competent supervisory
authority to do so. In this case, the data exporter shall be entitled to terminate thecontract, insofar as it concerns the processing of personal data under these Clauses. If
the contract involves more than two Parties, the data exporter may exercise this rightto termination only with respect to the relevant Party, unless the Parties have agreed
otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and(e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities

Page 43
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

15.1. Notification(a) The data importer agrees to notify the data exporter and, where possible, the data
subject promptly (if necessary with the help of the data exporter) if it:i)receives a legally binding request from a public authority, including judicial
authorities, under the laws of the country of destination for the disclosure of
personal data transferred pursuant to these Clauses; such notification shall
include information about the personal data requested, the requesting authority,
the legal basis for the request and the response provided; orii)becomes aware of any direct access by public authorities to personal datatransferred pursuant to these Clauses in accordance with the laws of the countryof destination; such notification shall include all information available to theimporter.

(b) If the data importer is prohibited from notifying the data exporter and/or the data
subject under the laws of the country of destination, the data importer agrees to use
its best efforts to obtain a waiver of the prohibition, with a view to communicating as
much information as possible, as soon as possible. The data importer agrees todocument its best efforts in order to be able to demonstrate them on request of thedata exporter.
(c) Where permissible under the laws of the country of destination, the data importer
agrees to provide the data exporter, at regular intervals for the duration of thecontract, with as much relevant information as possible on the requests received (inparticular, number of requests, type of data requested, requesting authority/ies,
whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c)for the duration of the contract and make it available to the competent supervisory
authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer
pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it
is unable to comply with these Clauses.
15.2. Review of legality and data minimisation(a) The data importer agrees to review the legality of the request for disclosure, inparticular whether it remains within the powers granted to the requesting publicauthority, and to challenge the request if, after careful assessment, it concludes that
there are reasonable grounds to consider that the request is unlawful under the lawsof the country of destination, applicable obligations under international law andprinciples of international comity. The data importer shall, under the same conditions,pursue possibilities of appeal. When challenging a request, the data importer shallseek interim measures with a view to suspending the effects of the request until thecompetent judicial authority has decided on its merits. It shall not disclose thepersonal data requested until required to do so under the applicable procedural rules.

Page 44
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

These requirements are without prejudice to the obligations of the data importer
under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to therequest for disclosure and, to the extent permissible under the laws of the country ofdestination, make the documentation available to the data exporter. It shall also makeit available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information
permissible when responding to a request for disclosure, based on a reasonableinterpretation of the request.
Clause 16
Non-compliance with the Clauses and termination(a) The data importer shall promptly inform the data exporter if it is unable to comply
with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply
with these Clauses, the data exporter shall suspend the transfer of personal data to
the data importer until compliance is again ensured or the contract is terminated.
This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns theprocessing of personal data under these Clauses, where:i) the data exporter has suspended the transfer of personal data to the data importer
pursuant to paragraph (b) and compliance with these Clauses is not restored
within a reasonable time and in any event within one month of suspension;ii) the data importer is in substantial or persistent breach of these Clauses; oriii) the data importer fails to comply with a binding decision of a competent court orsupervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such noncompliance. Where the contract involves more than two Parties, the data
exporter may exercise this right to termination only with respect to the relevant
Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract
pursuant to paragraph (c) shall at the choice of the data exporter immediately be
returned to the data exporter or deleted in its entirety. The same shall apply to any
copies of the data. The data importer shall certify the deletion of the data to the data
exporter. Until the data is deleted or returned, the data importer shall continue toensure compliance with these Clauses. In case of local laws applicable to the data
importer that prohibit the return or deletion of the transferred personal data, the data
importer warrants that it will continue to ensure compliance with these Clauses andwill only process the data to the extent and for as long as required under that local
law.

Page 45
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) theEuropean Commission adopts a decision pursuant to Article 45(3) of Regulation (EU)2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii)
Regulation (EU) 2016/679 becomes part of the legal framework of the country towhich the personal data is transferred. This is without prejudice to other obligations
applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of the EU Member State in which the data
exporter is established. Where such law does not allow for third-party beneficiaryrights, they shall be governed by the law of another EU Member State that does allow
for third-party beneficiary rights. The Parties agree that this shall be the law ofGermany.

Clause 18
Choice of forum and jurisdiction(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU
Member State.
(b) The Parties agree that those shall be the courts of Germany.
(c) A data subject may also bring legal proceedings against the data exporter and/or data
importer before the courts of the Member State in which he/she has his/her habitualresidence.
(d)

The Parties agree to submit themselves to the jurisdiction of such courts.

Page 46

Powered by LegalTech from Willing & Able and the Germany Certification Body.

Version: 1.07
Classification: PublicDocument Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20ΑΝΝΕΧ I
A. LIST OF PARTIESSEE APPENDIX 7

Page 47
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

B. DESCRIPTION OF TRANSFERSEE APPENDIX 8

Page 48
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

C. COMPETENT SUPERVISORY AUTHORITY
SEE APPENDIX 10

Page 49
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX IITECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data
importer(s) (including any relevant certifications) to ensure an appropriate level of security,
taking into account the nature, scope, context and purpose of the processing, and therisks for the rights and freedoms of natural persons.
SEE APPENDIX 9Page 50
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX III
LIST OF SUB-PROCESSORS
The controller has authorised the use of the following sub-processors:
SEE APPENDIX 6

Page 51
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 4 – SCCs 2021/914 MODULE THREE: Transfer Processor toProcessor

STANDARD CONTRACTUAL CLAUSES 2021/914
MODULE THREE: Transfer Processor to Processor
Clause 1
Purpose and scope(a) The purpose of these contractual clauses is to ensure compliance with therequirements of Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons with regard to theprocessing of personal data and on the free movement of such data (General Data
Protection Regulation) for the transfer of personal data to a third country.
(b) The Parties:i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies(hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A(hereinafter each “data exporter”), andii) the entity/ies in a third country receiving the personal data from the data exporter,
directly or indirectly via another entity also Party to these Clauses, as listed in Annex
I.A (hereinafter each “data importer”)
have agreed to these standard contractual clauses (hereinafter: “Clauses”).
(c) These Clauses apply with respect to the transfer of personal data between the Parties
as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an
integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses(a) These Clauses set out appropriate safeguards, including enforceable data subject
rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) ofRegulation (EU) 2016/679 and, with respect to data transfers from controllers toprocessors and/or processors to processors, standard contractual clauses pursuant to
Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except toselect the appropriate Module(s) or to add or update information in the Appendix.
This does not prevent the Parties from including the standard contractual clauses laid
down in these Clauses in a wider contract and/or to add other clauses or additionalsafeguards, provided that they do not contradict, directly or indirectly, these Clauses
or prejudice the fundamental rights or freedoms of data subjects.
Page 52
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) These Clauses are without prejudice to obligations to which the data exporter issubject by virtue of Regulation (EU) 2016/679.

Clause 3
Third-party beneficiaries(a) The data subjects can enforce against the data exporter and/or data importer these
Clauses, with the following exceptions:i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;ii)

Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);iii)

Clause 9(a), (c), (d) and (e);iv)

Clause 12(a), (d) and (f);v)

Clause 13;vi)

Clause 15.1 (c), (d) and (e);vii) Clause 16 (e);viii) Clause 18 (a) and (b);(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU)2016/679.
Clause 4
Interpretation(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, thoseterms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation(EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights andobligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy

In the event of a contradiction between these Clauses and the provisions of other relatedagreements between the Parties, existing at the time these Clauses are agreed or enteredinto thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)The details of the transfer(s), and in particular the categories of personal data that aretransferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Page 53
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 7
Docking clause(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties,
accede to these Clauses at any time, either as a data exporter or as a data importer, bycompleting the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shallbecome a Party to these Clauses and have the rights and obligations of a data
exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses
from the period prior to becoming a Party.
Clause 8
Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data
importer is able, through the implementation of appropriate technical and organisational
measures, to satisfy its obligations under these Clauses.

8.1. Instructions(a) The data exporter has informed the data importer that it acts as processor under the
instructions of its controller(s), which the data exporter shall make available to thedata importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions
from the controller, as communicated to the data importer by the data exporter, andany additional documented instructions from the data exporter. Such additional
instructions shall not conflict with the instructions from the controller. The controller
or data exporter may give further documented instructions regarding the dataprocessing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow
those instructions. Where the data importer is unable to follow the instructions fromthe controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations
on the data importer as set out in the contract or other legal act under Union orMember State law between the controller and the data exporter.
8.2. Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of thetransfer, as set out in Annex I.B., unless on further instructions from the controller, as
communicated to the data importer by the data exporter, or from the data exporter.

Page 54
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

8.3. Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix
as completed by the Parties, available to the data subject free of charge. To the extent
necessary to protect business secrets or other confidential information, including personaldata, the data exporter may redact part of the text of the Appendix prior to sharing a copy,
but shall provide a meaningful summary where the data subject would otherwise not beable to understand its content or exercise his/her rights. On request, the Parties shallprovide the data subject with the reasons for the redactions, to the extent possible
without revealing the redacted information.
8.4. Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or
has become outdated, it shall inform the data exporter without undue delay. In this case,the data importer shall cooperate with the data exporter to rectify or erase the data.
8.5. Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex
I.B. After the end of the provision of the processing services, the data importer shall, at the
choice of the data exporter, delete all personal data processed on behalf of the controller
and certify to the data exporter that it has done so, or return to the data exporter all
personal data processed on its behalf and delete existing copies. Until the data is deleted
or returned, the data importer shall continue to ensure compliance with these Clauses. In
case of local laws applicable to the data importer that prohibit return or deletion of thepersonal data, the data importer warrants that it will continue to ensure compliance withthese Clauses and will only process it to the extent and for as long as required under that
local law. This is without prejudice to Clause 14, in particular the requirement for the data
importer under Clause 14(e) to notify the data exporter throughout the duration of thecontract if it has reason to believe that it is or has become subject to laws or practices notin line with the requirements under Clause 14(a).
8.6. Security of processing(a) The data importer and, during transmission, also the data exporter shall implement
appropriate technical and organisational measures to ensure the security of the data,
including protection against a breach of security leading to accidental or unlawfuldestruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter‘personal data breach’). In assessing the appropriate level of security, they shall takedue account of the state of the art, the costs of implementation, the nature, scope,
context and purpose(s) of processing and the risks involved in the processing for thedata subject. The Parties shall in particular consider having recourse to encryption or
pseudonymisation, including during transmission, where the purpose of processing
can be fulfilled in that manner. In case of pseudonymisation, the additional
information for attributing the personal data to a specific data subject shall, where
Page 55
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

possible, remain under the exclusive control of the data exporter or the controller. In
complying with its obligations under this paragraph, the data importer shall at least
implement the technical and organisational measures specified in Annex II. The data
importer shall carry out regular checks to ensure that these measures continue toprovide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only tothe extent strictly necessary for the implementation, management and monitoring of
the contract. It shall ensure that persons authorised to process the personal data havecommitted themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by thedata importer under these Clauses, the data importer shall take appropriate
measures to address the breach, including measures to mitigate its adverse effects.
The data importer shall also notify, without undue delay, the data exporter and, whereappropriate and feasible, the controller after having become aware of the breach.
Such notification shall contain the details of a contact point where more information
can be obtained, a description of the nature of the breach (including, where possible,
categories and approximate number of data subjects and personal data records
concerned), its likely consequences and the measures taken or proposed to address
the data breach, including measures to mitigate its possible adverse effects. Where,
and in so far as, it is not possible to provide all information at the same time, the initial
notification shall contain the information then available and further information shall,as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data
exporter to comply with its obligations under Regulation (EU) 2016/679, in particular
to notify its controller so that the latter may in turn notify the competent supervisory
authority and the affected data subjects, taking into account the nature of processing
and the information available to the data importer.
8.7. Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, politicalopinions, religious or philosophical beliefs, or trade union membership, genetic data, or
biometric data for the purpose of uniquely identifying a natural person, data concerning
health or a person’s sex life or sexual orientation, or data relating to criminal convictions
and offences (hereinafter ‘sensitive data’), the data importer shall apply the specificrestrictions and/or additional safeguards set out in Annex I.B.
8.8. Onward transfers
The data importer shall only disclose the personal data to a third party on documented
instructions from the controller, as communicated to the data importer by the data
exporter. In addition, the data may only be disclosed to a third party located outside theEuropean Union (in the same country as the data importer or in another third country,
Page 56
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses,
under the appropriate Module, or if:i)the onward transfer is to a country benefitting from an adequacy decision pursuant to
Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;ii)

the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47
Regulation of (EU) 2016/679;

iii) the onward transfer is necessary for the establishment, exercise or defense of legal
claims in the context of specific administrative, regulatory or judicial proceedings; oriv) the onward transfer is necessary in order to protect the vital interests of the data
subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the othersafeguards under these Clauses, in particular purpose limitation.
8.9. Documentation and compliance(a) The data importer shall promptly and adequately deal with enquiries from the data
exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular,
the data importer shall keep appropriate documentation on the processing activities
carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliancewith the obligations set out in these Clauses available to the data exporter, whichshall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of theprocessing activities covered by these Clauses, at reasonable intervals or if there areindications of non-compliance. The same shall apply where the data exporter
requests an audit on instructions of the controller. In deciding on an audit, the data
exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter
shall make the results available to the controller.
(f)

The data exporter may choose to conduct the audit by itself or mandate an
independent auditor. Audits may include inspections at the premises or physicalfacilities of the data importer and shall, where appropriate, be carried out withreasonable notice.

(g) The Parties shall make the information referred to in paragraphs (b) and (c), including
the results of any audits, available to the competent supervisory authority on request.

Clause 9
Use of sub-processors(a) GENERAL WRITTEN AUTHORISATION: The data importer has the controller’s generalauthorisation for the engagement of sub-processor(s) from an agreed list. The data
Page 57
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

importer shall specifically inform the controller in writing of any intended changes tothat list through the addition or replacement of sub-processors at least 30 days inadvance, thereby giving the controller sufficient time to be able to object to suchchanges prior to the engagement of the sub-processor(s). The data importer shallprovide the controller with the information necessary to enable the controller toexercise its right to object. The data importer shall inform the data exporter of theengagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing
activities (on behalf of the controller), it shall do so by way of a written contract thatprovides for, in substance, the same data protection obligations as those binding thedata importer under these Clauses, including in terms of third-party beneficiary rights
for data subjects. The Parties agree that, by complying with this Clause, the data
importer fulfils its obligations under Clause 8.8. The data importer shall ensure thatthe sub-processor complies with the obligations to which the data importer is subject
pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy ofsuch a sub-processor agreement and any subsequent amendments. To the extent
necessary to protect business secrets or other confidential information, including
personal data, the data importer may redact the text of the agreement prior tosharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the
performance of the sub-processor’s obligations under its contract with the data
importer. The data importer shall notify the data exporter of any failure by the
sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor
whereby – in the event the data importer has factually disappeared, ceased to exist inlaw or has become insolvent – the data exporter shall have the right to terminate thesub-processor contract and to instruct the sub-processor to erase or return the
personal data.
Clause 10
Data subject rights(a) The data importer shall promptly notify the data exporter and, where appropriate, thecontroller of any request it has received from a data subject, without responding tothat request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data
exporter, the controller in fulfilling its obligations to respond to data subjects’ requests
for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU)2018/1725, as applicable. In this regard, the Parties shall set out in Annex II theappropriate technical and organisational measures, taking into account the nature of
the processing, by which the assistance shall be provided, as well as the scope andthe extent of the assistance required.
Page 58
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shallcomply with the instructions from the controller, as communicated by the data
exporter.

Clause 11
Redress(a) The data importer shall inform data subjects in a transparent and easily accessible
format, through individual notice or on its website, of a contact point authorised tohandle complaints. It shall deal promptly with any complaints it receives from a data
subject.
(b) In case of a dispute between a data subject and one of the Parties as regards
compliance with these Clauses, that Party shall use its best efforts to resolve the issue
amicably in a timely fashion. The Parties shall keep each other informed about suchdisputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3,
the data importer shall accept the decision of the data subject to:i)lodge a complaint with the supervisory authority in the Member State of his/her
habitual residence or place of work, or the competent supervisory authority
pursuant to Clause 13;ii)

refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body,organisation or association under the conditions set out in Article 80(1) of Regulation(EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or
Member State law.
(f)

The data importer agrees that the choice made by the data subject will not prejudice
his/her substantive and procedural rights to seek remedies in accordance withapplicable laws.
Clause 12
Liability(a) Each Party shall be liable to the other Party/ies for any damages it causes the otherParty/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall beentitled to receive compensation, for any material or non-material damages the data
importer or its sub-processor causes the data subject by breaching the third-party
beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject,
and the data subject shall be entitled to receive compensation, for any material or
non-material damages the data exporter or the data importer (or its sub- processor)
Page 59
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

causes the data subject by breaching the third-party beneficiary rights under these
Clauses. This is without prejudice to the liability of the data exporter and, where thedata exporter is a processor acting on behalf of a controller, to the liability of thecontroller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) fordamages caused by the data importer (or its sub-processor), it shall be entitled toclaim back from the data importer that part of the compensation corresponding to
the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject
as a result of a breach of these Clauses, all responsible Parties shall be jointly andseverally liable and the data subject is entitled to bring an action in court against anyof these Parties.
(f)

The Parties agree that if one Party is held liable under paragraph (e), it shall beentitled to claim back from the other Party/ies that part of the compensation
corresponding to its/their responsibility for the damage.

(g) The data importer may not invoke the conduct of a sub-processor to avoid its own
liability.

Clause 13
Supervision(a) [Where the data exporter is established in an EU Member State:] The supervisory
authority with responsibility for ensuring compliance by the data exporter with
Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shallact as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with its
Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation(EU) 2016/679:] The supervisory authority of the Member State in which therepresentative within the meaning of Article 27(1) of Regulation (EU) 2016/679 isestablished, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with its
Article 3(2) without however having to appoint a representative pursuant to Article27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member
States in which the data subjects whose personal data is transferred under these
Clauses in relation to the offering of goods or services to them, or whose behaviour ismonitored, are located, as indicated in Annex I.C, shall act as competent supervisory
authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with thecompetent supervisory authority in any procedures aimed at ensuring compliancewith these Clauses. In particular, the data importer agrees to respond to enquiries,
Page 60
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

submit to audits and comply with the measures adopted by the supervisory authority,
including remedial and compensatory measures. It shall provide the supervisory
authority with written confirmation that the necessary actions have been taken.
Clause 14
Local laws and practices affecting compliance with the Clauses(a) The Parties warrant that they have no reason to believe that the laws and practices inthe third country of destination applicable to the processing of the personal data by
the data importer, including any requirements to disclose personal data or measuresauthorising access by public authorities, prevent the data importer from fulfilling its
obligations under these Clauses. This is based on the understanding that laws andpractices that respect the essence of the fundamental rights and freedoms and do
not exceed what is necessary and proportionate in a democratic society to safeguard
one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not incontradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken
due account in particular of the following elements:i)the specific circumstances of the transfer, including the length of the processing
chain, the number of actors involved and the transmission channels used;
intended onward transfers; the type of recipient; the purpose of processing; thecategories and format of the transferred personal data; the economic sector inwhich the transfer occurs; the storage location of the data transferred;ii)

the laws and practices of the third country of destination– including thoserequiring the disclosure of data to public authorities or authorising access bysuch authorities – relevant in light of the specific circumstances of the transfer,and the applicable limitations and safeguards;iii)

any relevant contractual, technical or organisational safeguards put in place tosupplement the safeguards under these Clauses, including measures applied
during transmission and to the processing of the personal data in the country ofdestination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b),it has made its best efforts to provide the data exporter with relevant information andagrees that it will continue to cooperate with the data exporter in ensuring
compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make itavailable to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed
to these Clauses and for the duration of the contract, it has reason to believe that it isor has become subject to laws or practices not in line with the requirements underparagraph (a), including following a change in the laws of the third country or ameasure (such as a disclosure request) indicating an application of such laws inPage 61
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

practice that is not in line with the requirements in paragraph (a). The data exporter
shall forward the notification to the controller.
(f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise
has reason to believe that the data importer can no longer fulfill its obligations underthese Clauses, the data exporter shall promptly identify appropriate measures (e.g.
technical or organisational measures to ensure security and confidentiality) to be
adopted by the data exporter and/or data importer to address the situation, if
appropriate in consultation with the controller. The data exporter shall suspend thedata transfer if it considers that no appropriate safeguards for such transfer can beensured, or if instructed by the controller or the competent supervisory authority to
do so. In this case, the data exporter shall be entitled to terminate the contract, insofar
as it concerns the processing of personal data under these Clauses. If the contract
involves more than two Parties, the data exporter may exercise this right totermination only with respect to the relevant Party, unless the Parties have agreed
otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and(e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1. Notification(a) The data importer agrees to notify the data exporter and, where possible, the data
subject promptly (if necessary with the help of the data exporter) if it:i)receives a legally binding request from a public authority, including judicial
authorities, under the laws of the country of destination for the disclosure of
personal data transferred pursuant to these Clauses; such notification shall
include information about the personal data requested, the requesting authority,
the legal basis for the request and the response provided; orii)becomes aware of any direct access by public authorities to personal datatransferred pursuant to these Clauses in accordance with the laws of the countryof destination; such notification shall include all information available to theimporter.
The data exporter shall forward the notification to the controller.

(b) If the data importer is prohibited from notifying the data exporter and/or the data
subject under the laws of the country of destination, the data importer agrees to use
its best efforts to obtain a waiver of the prohibition, with a view to communicating as
much information as possible, as soon as possible. The data importer agrees todocument its best efforts in order to be able to demonstrate them on request of thedata exporter.
(c) Where permissible under the laws of the country of destination, the data importer
agrees to provide the data exporter, at regular intervals for the duration of thecontract, with as much relevant information as possible on the requests received (inPage 62
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

particular, number of requests, type of data requested, requesting authority/ies,
whether requests have been challenged and the outcome of such challenges, etc.).
The data exporter shall forward the information to the controller.
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c)for the duration of the contract and make it available to the competent supervisory
authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer
pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it
is unable to comply with these Clauses.
15.2. Review of legality and data minimisation(a) The data importer agrees to review the legality of the request for disclosure, inparticular whether it remains within the powers granted to the requesting publicauthority, and to challenge the request if, after careful assessment, it concludes that
there are reasonable grounds to consider that the request is unlawful under the lawsof the country of destination, applicable obligations under international law andprinciples of international comity. The data importer shall, under the same conditions,pursue possibilities of appeal. When challenging a request, the data importer shallseek interim measures with a view to suspending the effects of the request until thecompetent judicial authority has decided on its merits. It shall not disclose thepersonal data requested until required to do so under the applicable procedural rules.
These requirements are without prejudice to the obligations of the data importer
under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to therequest for disclosure and, to the extent permissible under the laws of the country ofdestination, make the documentation available to the data exporter. It shall also makeit available to the competent supervisory authority on request. The data exporter shallmake the assessment available to the controller.
(c) The data importer agrees to provide the minimum amount of information
permissible when responding to a request for disclosure, based on a reasonableinterpretation of the request.
Clause 16
Non-compliance with the Clauses and termination(a) The data importer shall promptly inform the data exporter if it is unable to comply
with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply
with these Clauses, the data exporter shall suspend the transfer of personal data to
the data importer until compliance is again ensured or the contract is terminated.
This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns theprocessing of personal data under these Clauses, where:
Page 63
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

i)

the data exporter has suspended the transfer of personal data to the data
importer pursuant to paragraph (b) and compliance with these Clauses is notrestored within a reasonable time and in any event within one month ofsuspension;ii)

the data importer is in substantial or persistent breach of these Clauses; oriii)

the data importer fails to comply with a binding decision of a competent court orsupervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority and the controllerof such non- compliance. Where the contract involves more than two Parties, the data
exporter may exercise this right to termination only with respect to the relevant Party,
unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract
pursuant to paragraph (c) shall at the choice of the data exporter immediately be
returned to the data exporter or deleted in its entirety. The same shall apply to any
copies of the data. The data importer shall certify the deletion of the data to the data
exporter. Until the data is deleted or returned, the data importer shall continue toensure compliance with these Clauses. In case of local laws applicable to the data
importer that prohibit the return or deletion of the transferred personal data, the data
importer warrants that it will continue to ensure compliance with these Clauses andwill only process the data to the extent and for as long as required under that local
law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) theEuropean Commission adopts a decision pursuant to Article 45(3) of Regulation (EU)2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii)
Regulation (EU) 2016/679 becomes part of the legal framework of the country towhich the personal data is transferred. This is without prejudice to other obligations
applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of the EU Member State in which the data
exporter is established. Where such law does not allow for third-party beneficiary rights,
they shall be governed by the law of another EU Member State that does allow for
third-party beneficiary rights. The Parties agree that this shall be the law of Germany.
Clause 18
Choice of forum and jurisdiction(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU
Member State.
(b) The Parties agree that those shall be the courts of Germany.

Page 64
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(c) A data subject may also bring legal proceedings against the data exporter and/or data
importer before the courts of the Member State in which he/she has his/her habitualresidence.
(d)

The Parties agree to submit themselves to the jurisdiction of such courts.

Page 65

Powered by LegalTech from Willing & Able and the Germany Certification Body.

Version: 1.07
Classification: PublicDocument Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20ΑΝΝΕΧ I
A. LIST OF PARTIESSEE APPENDIX 7

Page 66
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

B. DESCRIPTION OF TRANSFERSEE APPENDIX 8

Page 67
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

C. COMPETENT SUPERVISORY AUTHORITY
SEE APPENDIX 10

Page 68
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX IITECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data
importer(s) (including any relevant certifications) to ensure an appropriate level of security,
taking into account the nature, scope, context and purpose of the processing, and therisks for the rights and freedoms of natural persons.
SEE APPENDIX 9Page 69
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ANNEX III
LIST OF SUB-PROCESSORS
The controller has authorised the use of the following sub-processors:

SEE APPENDIX 6

Page 70
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 5 – SCCs 2021/914 MODULE FOUR: Transfer Processor toController

STANDARD CONTRACTUAL CLAUSES 2021/914
MODULE FOUR: Transfer Processor to Controller
Clause 1
Purpose and scope(a) The purpose of these contractual clauses is to ensure compliance with therequirements of Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons with regard to theprocessing of personal data and on the free movement of such data (General Data
Protection Regulation) for the transfer of personal data to a third country.
(b) The Parties:i)the natural or legal person(s), public authority/ies, agency/ies or other body/ies(hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A(hereinafter each “data exporter”), andii)

the entity/ies in a third country receiving the personal data from the data
exporter, directly or indirectly via another entity also Party to these Clauses, as
listed in Annex I.A (hereinafter each “data importer”)

have agreed to these standard contractual clauses (hereinafter: “Clauses”).
(c) These Clauses apply with respect to the transfer of personal data between the Parties
as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an
integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses(a) These Clauses set out appropriate safeguards, including enforceable data subject
rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) ofRegulation (EU) 2016/679 and, with respect to data transfers from controllers toprocessors and/or processors to processors, standard contractual clauses pursuant to
Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except toselect the appropriate Module(s) or to add or update information in the Appendix.
This does not prevent the Parties from including the standard contractual clauses laid
down in these Clauses in a wider contract and/or to add other clauses or additionalsafeguards, provided that they do not contradict, directly or indirectly, these Clauses
or prejudice the fundamental rights or freedoms of data subjects.
Page 71
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(b) These Clauses are without prejudice to obligations to which the data exporter issubject by virtue of Regulation (EU) 2016/679.

Clause 3
Third-party beneficiaries(a) The data subjects can enforce against the data exporter and/or data importer these
Clauses, with the following exceptions:i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;ii)

Clause 8.1 (b) and Clause 8.3(b);[iii) and iv) not applicable]v)

Clause 13;vi)

Clause 15.1 (c), (d) and (e);vii) Clause 16 (e);viii) Clause 18;(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU)2016/679.
Clause 4
Interpretation(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, thoseterms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation(EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights andobligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy

In the event of a contradiction between these Clauses and the provisions of other relatedagreements between the Parties, existing at the time these Clauses are agreed or enteredinto thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)The details of the transfer(s), and in particular the categories of personal data that aretransferred and the purpose(s) for which they are transferred, are specified in Annex I.B
hereunder.

Page 72
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 7
Docking clause(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties,
accede to these Clauses at any time, either as a data exporter or as a data importer, bycompleting the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shallbecome a Party to these Clauses and have the rights and obligations of a data
exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses
from the period prior to becoming a Party.

Clause 8
Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data
importer is able, through the implementation of appropriate technical and organisational
measures, to satisfy its obligations under these Clauses.
8.1. Instructions(a) The data exporter shall process the personal data only on documented instructions
from the data importer acting as its controller.
(b) The data exporter shall immediately inform the data importer if it is unable to follow
those instructions, including if such instructions infringe Regulation (EU) 2016/679 orother Union or Member State data protection law.
(c) The data importer shall refrain from any action that would prevent the data exporterfrom fulfilling its obligations under Regulation (EU) 2016/679, including in the context
of sub-processing or as regards cooperation with competent supervisory authorities.
(d) After the end of the provision of the processing services, the data exporter shall, at the
choice of the data importer, delete all personal data processed on behalf of the data
importer and certify to the data importer that it has done so, or return to the data
importer all personal data processed on its behalf and delete existing copies.
8.2. Security of processing(a) The Parties shall implement appropriate technical and organisational measures toensure the security of the data, including during transmission, and protection against
a breach of security leading to accidental or unlawful destruction, loss, alteration,
unauthorised disclosure or access (hereinafter ‘personal data breach’). In assessing
the appropriate level of security, they shall take due account of the state of the art, thecosts of implementation, the nature of the personal data, the nature, scope, context
and purpose(s) of processing and the risks involved in the processing for the data
subjects, and in particular consider having recourse to encryption orPage 73
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

pseudonymisation, including during transmission, where the purpose of processing
can be fulfilled in that manner.
(b) The data exporter shall assist the data importer in ensuring appropriate security of thedata in accordance with paragraph (a). In case of a personal data breach concerning
the personal data processed by the data exporter under these Clauses, the data
exporter shall notify the data importer without undue delay after becoming aware ofit and assist the data importer in addressing the breach.
(c) The data exporter shall ensure that persons authorised to process the personal data
have committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality.
8.3. Documentation and compliance(a) The Parties shall be able to demonstrate compliance with these Clauses.
(b) The data exporter shall make available to the data importer all information necessary
to demonstrate compliance with its obligations under these Clauses and allow for andcontribute to audits.

[Clause 9 not applicable]

Clause 10
Data subject rights
The Parties shall assist each other in responding to enquiries and requests made by data
subjects under the local law applicable to the data importer or, for data processing by thedata exporter in the EU, under Regulation (EU) 2016/679.
Clause 11
Redress
The data importer shall inform data subjects in a transparent and easily accessible format,
through individual notice or on its website, of a contact point authorised to handle
complaints. It shall deal promptly with any complaints it receives from a data subject.
Clause 12
Liability(a) Each Party shall be liable to the other Party/ies for any damages it causes the otherParty/ies by any breach of these Clauses.
(b) Each Party shall be liable to the data subject, and the data subject shall be entitled toreceive compensation, for any material or non-material damages that the Party
causes the data subject by breaching the third-party beneficiary rights under these

Page 74
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clauses. This is without prejudice to the liability of the data exporter under Regulation(EU) 2016/679.
(c) Where more than one Party is responsible for any damage caused to the data subject
as a result of a breach of these Clauses, all responsible Parties shall be jointly andseverally liable and the data subject is entitled to bring an action in court against anyof these Parties.
(d) The Parties agree that if one Party is held liable under paragraph (c), it shall beentitled to claim back from the other Party/ies that part of the compensation
corresponding to its/their responsibility for the damage.
(e) The data importer may not invoke the conduct of a processor or sub-processor to
avoid its own liability.
[Clause 13 not applicable]
Clause 14
Local laws and practices affecting compliance with the Clauses
Where the EU processor combines the personal data received from the third
country-controller with personal data collected by the processor in the EU):(a) The Parties warrant that they have no reason to believe that the laws and practices inthe third country of destination applicable to the processing of the personal data by
the data importer, including any requirements to disclose personal data or measuresauthorising access by public authorities, prevent the data importer from fulfilling its
obligations under these Clauses. This is based on the understanding that laws andpractices that respect the essence of the fundamental rights and freedoms and do
not exceed what is necessary and proportionate in a democratic society to safeguard
one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not incontradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken
due account in particular of the following elements:i)the specific circumstances of the transfer, including the length of the processing
chain, the number of actors involved and the transmission channels used;
intended onward transfers; the type of recipient; the purpose of processing; thecategories and format of the transferred personal data; the economic sector inwhich the transfer occurs; the storage location of the data transferred;ii)

the laws and practices of the third country of destination– including thoserequiring the disclosure of data to public authorities or authorising access bysuch authorities – relevant in light of the specific circumstances of the transfer,and the applicable limitations and safeguards;iii)

any relevant contractual, technical or organisational safeguards put in place tosupplement the safeguards under these Clauses, including measures applied

Page 75
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

during transmission and to the processing of the personal data in the country ofdestination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b),it has made its best efforts to provide the data exporter with relevant information andagrees that it will continue to cooperate with the data exporter in ensuring
compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make itavailable to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed
to these Clauses and for the duration of the contract, it has reason to believe that it isor has become subject to laws or practices not in line with the requirements underparagraph (a), including following a change in the laws of the third country or ameasure (such as a disclosure request) indicating an application of such laws inpractice that is not in line with the requirements in paragraph (a).
(f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise
has reason to believe that the data importer can no longer fulfill its obligations underthese Clauses, the data exporter shall promptly identify appropriate measures (e.g.
technical or organisational measures to ensure security and confidentiality) to be
adopted by the data exporter and/or data importer to address the situation. The data
exporter shall suspend the data transfer if it considers that no appropriate safeguards
for such transfer can be ensured, or if instructed by the competent supervisory
authority to do so. In this case, the data exporter shall be entitled to terminate thecontract, insofar as it concerns the processing of personal data under these Clauses. If
the contract involves more than two Parties, the data exporter may exercise this rightto termination only with respect to the relevant Party, unless the Parties have agreed
otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and(e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities

Where the EU processor combines the personal data received from the third
country-controller with personal data collected by the processor in the EU:
15.1. Notification(a) The data importer agrees to notify the data exporter and, where possible, the data
subject promptly (if necessary with the help of the data exporter) if it:i)receives a legally binding request from a public authority, including judicial
authorities, under the laws of the country of destination for the disclosure of
personal data transferred pursuant to these Clauses; such notification shall
include information about the personal data requested, the requesting authority,
the legal basis for the request and the response provided; orPage 76
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

ii)

becomes aware of any direct access by public authorities to personal datatransferred pursuant to these Clauses in accordance with the laws of the countryof destination; such notification shall include all information available to theimporter.

(b) If the data importer is prohibited from notifying the data exporter and/or the data
subject under the laws of the country of destination, the data importer agrees to use
its best efforts to obtain a waiver of the prohibition, with a view to communicating as
much information as possible, as soon as possible. The data importer agrees todocument its best efforts in order to be able to demonstrate them on request of thedata exporter.
(c) Where permissible under the laws of the country of destination, the data importer
agrees to provide the data exporter, at regular intervals for the duration of thecontract, with as much relevant information as possible on the requests received (inparticular, number of requests, type of data requested, requesting authority/ies,
whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c)for the duration of the contract and make it available to the competent supervisory
authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer
pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it
is unable to comply with these Clauses.
15.2. Review of legality and data minimisation(a) The data importer agrees to review the legality of the request for disclosure, inparticular whether it remains within the powers granted to the requesting publicauthority, and to challenge the request if, after careful assessment, it concludes that
there are reasonable grounds to consider that the request is unlawful under the lawsof the country of destination, applicable obligations under international law andprinciples of international comity. The data importer shall, under the same conditions,pursue possibilities of appeal. When challenging a request, the data importer shallseek interim measures with a view to suspending the effects of the request until thecompetent judicial authority has decided on its merits. It shall not disclose thepersonal data requested until required to do so under the applicable procedural rules.
These requirements are without prejudice to the obligations of the data importer
under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to therequest for disclosure and, to the extent permissible under the laws of the country ofdestination, make the documentation available to the data exporter. It shall also makeit available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information
permissible when responding to a request for disclosure, based on a reasonableinterpretation of the request.
Page 77
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Clause 16
Non-compliance with the Clauses and termination(a) The data importer shall promptly inform the data exporter if it is unable to comply
with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply
with these Clauses, the data exporter shall suspend the transfer of personal data to
the data importer until compliance is again ensured or the contract is terminated.
This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns theprocessing of personal data under these Clauses, where:i)the data exporter has suspended the transfer of personal data to thedata importer pursuant to paragraph (b) and compliance with these Clauses is
not restored within a reasonable time and in any event within one month ofsuspension;ii)

the data importer is in substantial or persistent breach of these Clauses; oriii)

the data importer fails to comply with a binding decision of a competent court orsupervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such noncompliance. Where the contract involves more than two Parties, the data exporter
may exercise this right to termination only with respect to the relevant Party, unlessthe Parties have agreed otherwise.
(d) Personal data collected by the data exporter in the EU that has been transferred prior
to the termination of the contract pursuant to paragraph (c) shall immediately bedeleted in its entirety, including any copy thereof. The data importer shall certify thedeletion of the data to the data exporter. Until the data is deleted or returned, thedata importer shall continue to ensure compliance with these Clauses. In case of local
laws applicable to the data importer that prohibit the return or deletion of thetransferred personal data, the data importer warrants that it will continue to ensurecompliance with these Clauses and will only process the data to the extent and for as
long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) theEuropean Commission adopts a decision pursuant to Article 45(3) of Regulation (EU)2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii)
Regulation (EU) 2016/679 becomes part of the legal framework of the country towhich the personal data is transferred. This is without prejudice to other obligations
applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law

Page 78
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

These Clauses shall be governed by the law of a country allowing for third-party
beneficiary rights. The Parties agree that this shall be the law of Germany.
Clause 18
Choice of forum and jurisdiction

Any dispute arising from these Clauses shall be resolved by the courts of Germany.

Page 79
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20ΑΝΝΕΧ I
A. LIST OF PARTIESSEE APPENDIX 7

Page 80
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

B. DESCRIPTION OF TRANSFERSEE APPENDIX 8

Page 81
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 6 – SUB-PROCESSORSA CURRENT LIST OF OUR PROCESSORS CAN BE FOUND ON OUR WEBSITE OR CAN BE
REQUESTED SEPARATELY.

Our list contains the following information on all processors:

Company name, Link to website, Service or transmission details, Country of processing, Subject
matter of (sub-) processing, Nature of (sub-) processing, Duration of (sub-) processing,Concluded contract or appropriate safeguards according to Art. 44ff GDPR.

IF YOU USE OTHER PROCESSORS NOT MENTIONED IN OUR LIST AND / OR APPROVED BY US,
PLEASE SEND US A LIST OF THEIR PROCESSORS FOR VERIFICATION AND / OR APPROVAL.

Page 82
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 7 – LIST OF PARTIES
Party Number 1:
Name: Provider name, see Main-Agreement
Address: Provider address, see Main-Agreement
Contact person’s name, position and contact details: Provider contact person, see
Main-Agreement
Activities relevant to the data transferred under these Clauses: All activities in which
personal data are processed or transmitted
If applicable, the controller’s data protection officer: If applicable, see website of Provider
If applicable, the representative in the European Union: If applicable, see website ofProviderAccession date/date: See date of Main-Agreement
Role: Controller and/or Processor, based on the applicable SCCs or other contract, orOverseas Recipient
Party Number 2:
Name: Business Partner name, see Main-Agreement
Address: Business Partner address, see Main-Agreement
Contact person’s name, position and contact details: Business Partner contact person, see
Main-Agreement
Activities relevant to the data transferred under these Clauses: All activities in which
personal data are processed or transmitted
If applicable, the controller’s data protection officer: If applicable, see website of Business
Partner
If applicable, the representative in the European Union: If applicable, see website ofBusiness Partner
Accession date/date: See date of Main-Agreement
Role: Controller and/or Processor, based on the applicable SCCs or other contract, orOverseas Recipient

Page 83
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 8 – DESCRIPTION OF THE PROCESSING OR THE TRANSFER
Categories of data subjects / personal information subjects whose personal data isprocessed or transferred:
Customers, potential customers, employees, business partners, suppliers.
Categories of personal data / personal information processed or transferred:
Customer data, data of potential customers, employee data, data of business partners,
supplier data.
Sensitive data processed or transferred (if applicable) and applied restrictions or
safeguards that fully take into consideration the nature of the data and the risks
involved, such as for instance strict purpose limitation, access restrictions (including
access only for staff having followed specialised training), keeping a record of accessto the data, restrictions for onward transfers or additional security measures.
Sensitive data / sensitive personal information processed or transferred:
None.
Applied restrictions or safeguards:
None, because no sensitive data is processed or transferred.
Frequency of transfer:
The data is transferred on a continuous basis as long as the Main-Agreement is in force.
Nature of the processing:See Main-Agreement, the following processing could occur: collection, recording,organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use,
disclosure by transmission, dissemination, otherwise making available, alignment,
combination, restriction, erasure, destruction.
Purpose(s) for which the personal data / personal information is processed on behalfof the controller or Purpose(s) of the data transfer and further processing:Page 84
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

See Main-Agreement.
Duration of the processing:
Duration of the Main-Agreement.

The period for which the personal data will be retained, or, if that is not possible, thecriteria used to determine that period
The criteria for determining the retention period is resulting from the main contract andstatutory retention periods.
For processing by or transfer to (sub-) processors, also specify subject matter, natureand duration of the processing
Subject matter of (sub-) processing: SEE APPENDIX 6
Nature of (sub-) processing: SEE APPENDIX 6
Duration of (sub-) processing: SEE APPENDIX 6

Page 85
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURESThe technical and organizational security measures mentioned as follows are theminimum required from you, and are also fulfilled by us. If you have not implemented
these technical and organizational security measures, please inform us immediately.
Furthermore, you shall send us a list of all additional technical and organizational
security measures taken by you, if any.
1.

Measures of pseudonymization and encryption of personal data

Pseudonymisation of personal data that are no longer needed in plain text
Encryption of websites (SSL)
Encryption of e-mail (TLS 1.2 or 1.3)
2. Measures for ensuring ongoing confidentiality, integrity, availability andresilience of processing systems and services
Confidentiality agreements with employees
NDAs with third parties
Data Protection agreements with employees
FirewallAnti-Virus
Regular backups
3.

Measures for ensuring the ability to restore the availability and access topersonal data in a timely manner in the event of a physical or technicalincident

Regular backups of the whole system
Regular test of backup and recovery
Regular training of IT staff
4. Processes for regularly testing, assessing and evaluating the effectiveness oftechnical and organisational measures in order to ensure the security of theprocessing
In-house checks
Page 86
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Regular review of processes by IT
Regular audits (e.g. by the DPO)

5. Measures for user identification and authorisation
Authentication with username / password
Regular checks of authorisations
Password guideline
Limitation of the number of administrators
Management of rights by system administrator
6. Measures for the protection of data during transmission
Use of encryption technologies
Logging of activities and events
Encryption of email (TlS 1.2 or 1.3)
Use of company internal / restricted drives
7. Measures for the protection of data during storage
Logging of actions and events
Limitation of the number of administrator’s
Firewall
8. Measures for ensuring physical security of locations at which personal data areprocessed
Manual locking system
Security locks
Key control

9. Measures for ensuring events logging
Logging activated on application level

Page 87
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Regular manual checks of logs
10. Measures for ensuring system configuration, including default configuration
Configuration change control process
Data protection by default is observed
Configuration only by system administrator
Regular training of IT staff
11. Measures for internal IT and IT security governance and management
IT security policy
Training of employees on data security
IT team with clear roles and responsibilities
12. Measures for certification/assurance of processes and products
Clear overview of the provisions applicable to the provided products/services/processes
Regular internal and/or external audits
Assignment of audit responsibilities to certified experts
13. Measures for ensuring data minimization
Identification of the purpose of processing
Assessment of a link between processing and purpose
Identification of the applicable retention periods for each data category
Secure erasure of the data after expiration of the retention period
14. Measures for ensuring data quality
Logging of entry and modification of data
Assignment of rights for data entry
Traceability of entry, modification of data by individual user names (not user groups)
15. Measures for ensuring limited data retention
Page 88
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Regular training on retention periods
Regular audit and assessment of retained data
16. Measures for ensuring accountability
Provision of training / awareness rising
Regular controls and checks
Appropriate policies on data protection
Conclusion of SCCs
17. Measures for allowing data portability and ensuring erasure
Personal data is stored in a structured format
Monitoring of legal deadline ensured
Observation of retention periods
Establishment of data portability process
Proper handling of data subject requests
Secure data erasure and data carrier destruction ensured by contracting with Notebook12
GmbH & Co. KG, Fraunhoferring 3, 85238 Petershausen, Germany, email:info@notebook12.com
18. For transfers to (sub-) processors, also describe the specific technical andorganisational measures to be taken by the (sub-) processor to be able toprovide assistance to the controller and, for transfers from a processor to a
sub-processor, to the data exporter
Standard Contractual Clauses (SCCs) are signed or agreed on
Contractually agreed on effective control rights
Contractually agreed on provision of assistance to the controller

Page 89
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 10 – COMPETENT SUPERVISORY AUTHORITY
The supervisory authority responsible for the first controller is responsible. If the firstcontroller is located outside the European Union or the EEA, the parties hereby irrevocably
declare the competence of the following supervisory authority:

BayLDA - Das Bayerische Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Deutschland

Page 90
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 11 – Confidentiality and Data Protection Agreement for
Vendors

Confidentiality andData Protection Agreement for Vendors
Between our company- Principal -and your company- Contractor the following is agreed on:
1.

The Contractor is obliged to keep business and trade secrets as well as
operational matters of a confidential nature, which are designated as suchby the Principal in written or oral form, or are obviously to be recognized assuch information, confidential and not make them available to any third
party without explicit approval of Principal. The obligation to maintainsecrecy shall also apply to employees of Client and Contractor, third parties
and other contractual partners of Client and Contractor and theiremployees, provided that they are not directly involved in the matter inquestion.
Business and trade secret is any information thata)neither in general nor in their precise arrangement or composition is
generally known or otherwise available to the persons in circles, who usuallyhandle such type of information and is therefore of economic value andb)subject in appropriate circumstances to reasonable confidentiality
measures by its lawful owner andc)where there is a legitimate interest in secrecy.

Trade secret, according to global Trade Secrets Acts and thereby
confidential, is particularly information related to prices, target figures,
turnover / profit / income figures, economical figures, current and planned
projects, technological and conceptual structures, analytical work, softwarearchitectures and interfaces, datasets and their usage, passwords,
authorities, duties, suppliers and customers data, data of relevant business
partners as well as particularly all confidential information related tocustomers and suppliers of Principal, to which the Contractor got access
Page 91
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

when preparing or executing an order or regarding to customers andsuppliers of Principal, as for example information on relevant customers or
suppliers of Principal, business processes, infrastructure, business plans andproducts, software, programming or any information, that Contractor
processed during usage of confidential information. The information is not
subject of the nondisclosure obligation, if it is to everyone accessible or isgenerally known. In case of doubts Contractor shall obtain an instruction
from Principal regarding confidentiality of certain facts.
2.

The Contractor is obliged to keep bank secrecy, secrecy oftelecommunications, communication confidentiality, postal secrecy, secrecyof social data, and privacy of correspondence and abide all other secrecy
regulations and laws.

3.

Nondisclosure obligation is not applicable to third parties, insofar as there isa lawful disclosure obligation. It is also not applicable to persons who areprofessionally obliged to secrecy, insofar as disclosure of facts to be kept insecret is necessary to ensure legitimate interest of Contractor.

4.

The nondisclosure obligation also extends to matters of other companies,
with which the Principal is economically or organizationally associated.

5.

The nondisclosure obligation will continue to exist also after the terminationof the contractual relationship. If any post contractual nondisclosure
obligations of Contractor put an obstacles to its professional development, it
has the right to be exempted from these obligations by Principal.

6.

Contractor is notified, that disclosure of secrets may be punishable inaccordance with applicable Trade Secret Acts.

7.

The Contractor is obliged to keep personal data, to which it gets access to or
becomes aware of within a framework of its activities, confidential. The
Contractor is prohibited from unauthorized accessing or processing, inparticular to collect, record, organize, structure, store, adapt or alter, retrieve,
consult, use, disclose by transmission, dissemination or otherwise makeavailable, align or combine, restrict, erase or destruct personal data, whichmeans all information related to identified or identifiable natural persons; anidentifiable natural person is one who can be identified, directly or indirectly,
in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specificto the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person.
Personal data can only be processed, when consent or another legal basis
permits processing of such data.

Page 92
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Personal data shall be at all timesa) processed lawfully and in a comprehensive manner for the data subject;b) collected with the defined, explicit and legitimate purpose and shall not
be processed in other way, that is not associated with those purposes;c) adequate, relevant and limited to what is necessary in relation to the
purposes for which they are processed (‘data minimization’);d) accurate and, where necessary, kept up to date; every reasonable step
must be taken to ensure that personal data that are inaccurate, having
regard to the purposes for which they are processed, are erased or
rectified without delay;e) kept in a form which permits identification of data subjects for no longer
than is necessary for the purposes for which the personal data areprocessed;f) processed in a manner that ensures appropriate security of the personaldata, including protection against unauthorized or unlawful processing
and against accidental loss, destruction or damage, using appropriatetechnical or organizational measures (‘integrity and confidentiality’).
8.

The obligation to maintain data secrecy continues to exist after terminationof the contractual relationship.

9.

Contractor has been informed that the violation of the protection of
personal data may be punishable according to applicable data protection
laws.

10.

The Contractor will consider requirements of Principal’s customers on how
to deal with confidential matters and personal data and their protection.

11.

Defects in data protection or data protection system shall be unrequested
and immediately reported to the top management or Data Protection
Officer of the Principal.

12.

Special nondisclosure agreements or requirements (for example, project or
customer-oriented agreements) remain unaffected and are applicablebesides the obligations of this nondisclosure agreement.

13.

The Contractor recognizes that the Principal is obliged to thecomprehensive secrecy in relationship with its customers and is threatenedwith severe sanctions (loss of contract, penalty payments, compensationetc.), if these obligations will be infringed by Principal or Contractor.

14.

Infringement of abovementioned obligations can entitle the Principal to theextraordinary and when appropriate without previous notice termination ofcontractual relationship and cause Contractor’s obligation to compensation.

Page 93
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

This document contains general terms and conditions. They become effective by
publication and after written inclusion in the main contract (e.g., inclusion bysending a link via e-mail).

Page 94
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 12 – Confidentiality and Data Protection Agreement for
Customers

Confidentiality andData Protection Agreement for Customers
Between our company- Provider -and your company- Client jointly, the - Parties the following is agreed on:
1.

The Parties are obliged to keep business and trade secrets as well as
operational matters of a confidential nature, which are designated as suchby the other party in written or oral form, or are obviously to be recognizedas such information, confidential and not make them available to any third
party without explicit approval of the other party. The obligation to maintainsecrecy shall also apply to employees of the parties, third parties and othercontractual partners of the parties and their employees, provided that they
are not directly involved in the matter in question.
Business and trade secret is any information thatd)neither in general nor in their precise arrangement or composition is
generally known or otherwise available to the persons in circles, who usuallyhandle such type of information and is therefore of economic value ande)subject in appropriate circumstances to reasonable confidentiality
measures by its lawful owner andf)where there is a legitimate interest in secrecy.

Trade secret, according to global Trade Secrets Acts and thereby
confidential, is particularly information related to prices, target figures,
turnover / profit / income figures, economical figures, current and planned
projects, technological and conceptual structures, analytical work, softwarearchitectures and interfaces, datasets and their usage, passwords,
authorities, duties, suppliers and customers data, data of relevant business
partners as well as particularly all confidential information related tocustomers and suppliers of one party, to which the other party got access
Page 95
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

when preparing or executing an order or regarding to customers andsuppliers of the other party, as for example information on relevant
customers or suppliers of one party, business processes, infrastructure,business plans and products, software, programming or any information,that the other party processed during usage of confidential information. The
information is not subject of the nondisclosure obligation, if it is to everyone
accessible or is generally known. In case of doubts one party shall obtain an
instruction from the other party regarding confidentiality of certain facts.
2.

Both parties are obliged to keep bank secrecy, secrecy oftelecommunications, communication confidentiality, postal secrecy, secrecyof social data, and privacy of correspondence and to abide all other secrecy
regulations and laws.

3.

Nondisclosure obligation is not applicable to third parties, insofar as there isa lawful disclosure obligation. It is also not applicable to persons who areprofessionally obliged to secrecy, insofar as disclosure of facts to be kept insecret is necessary to ensure legitimate interest of the party.

4.

The nondisclosure obligation also extends to matters of other companies,
with which the other party is economically or organizationally associated.

5.

The nondisclosure obligation will continue to exist also after the terminationof the contractual relationship. If any post contractual nondisclosure
obligations of one party put an obstacles to the professional development of
the other party, the second party has the right to be exempted from theseobligations by the first party.

6.

Both parties understand that disclosure of secrets may be punishable inaccordance with applicable Trade Secret Acts.

7.

Both parties are obliged to keep personal data, to which they get access toor become aware of within the framework of their activities, confidential.
Both parties are prohibited from unauthorized accessing or processing, inparticular to collect, record, organize, structure, store, adapt or alter, retrieve,
consult, use, disclose by transmission, disseminate or otherwise makeavailable, align or combine, restrict, erase or destruct personal data, whichmeans all information related to identified or identifiable natural persons; anidentifiable natural person is one who can be identified, directly or indirectly,
in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specificto the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person.
Personal data can only be processed, when consent or another legal basis
permits processing of such data.

Page 96
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Personal data shall be at all timesg) processed lawfully and in a comprehensive manner for the data subject;h) collected with the defined, explicit and legitimate purpose and shall not
be processed in other way, that is not associated with those purposes;i) adequate, relevant and limited to what is necessary in relation to the
purposes for which they are processed (‘data minimization’);j) accurate and, where necessary, kept up to date; every reasonable step
must be taken to ensure that personal data that are inaccurate, having
regard to the purposes for which they are processed, are erased or
rectified without delay;k) kept in a form which permits identification of data subjects for no longer
than is necessary for the purposes for which the personal data areprocessed;l) processed in a manner that ensures appropriate security of the personaldata, including protection against unauthorized or unlawful processing
and against accidental loss, destruction or damage, using appropriatetechnical or organizational measures (‘integrity and confidentiality’).
8.

The obligation to maintain data secrecy continues to exist after terminationof the contractual relationship.

9.

Both parties are informed that the violation of the protection of personal
data may be punishable according to applicable data protection laws.

10.

Both parties will consider requirements of the other parties’ customers on
how to deal with confidential matters and personal data and theirprotection.

11.

Defects in data protection or data protection system shall be unrequested
and immediately reported to the top management or Data Protection
Officer of the other party.

12.

Special nondisclosure agreements or requirements (for example, project or
customer-oriented agreements) remain unaffected and are applicablebesides the obligations of this nondisclosure agreement.

13.

The parties recognize that the other party may be obliged to comprehensive
secrecy in relationship with its customers and is threatened with severe
sanctions (loss of contract, penalty payments, compensation etc.), if theseobligations will be infringed by one of the parties.

14.

Infringement of abovementioned obligations can entitle the other party to
the extraordinary and when appropriate without previous notice

Page 97
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

termination of contractual relationship and cause an obligation tocompensation.
This document contains general terms and conditions. They become effective by
publication and after written inclusion in the main contract (e.g. inclusion bysending a link via e-mail).

Page 98
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 13 – Standard Data Protection Clauses to be issued by theCommissioner under S119A(1) Data Protection Act 2018

Standard Data Protection Clauses to be issued by theCommissioner under S119A(1) Data Protection Act 2018
International Data Transfer Agreement
VERSION A1.0, in force 21 March 2022

This IDTA has been issued by the Information Commissioner for Parties making
Restricted Transfers. The Information Commissioner considers that it provides
Appropriate Safeguards for Restricted Transfers when it is entered into as a legallybinding contract.

Part 1: Tables
Table 1: Parties and signatures
Start datesee Main-Agreement

The Parties

Exporter (who sends the
Restricted Transfer)

Importer (who receives the
Restricted Transfer)

Parties’ details

Full legal name:

Full legal name:see Main-Agreement

see Main-Agreement

Trading name (if different): if
applicable, see
Main-Agreement

Trading name (if different): if
applicable, see
Main-Agreement

Main address (if a company
registered address):

Main address (if a company
registered address):see Main-Agreement

see Main-Agreement

Page 99
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Key Contact

Official registration number(if any) (company number orsimilar identifier):

Official registration number(if any) (company number orsimilar identifier):

if applicable, see
Main-Agreement

if applicable, see
Main-Agreement

Full Name (optional):

Full Name (optional):

if applicable, see
Main-Agreement

if applicable, see
Main-Agreement

Job Title:

Job Title:

if applicable, see
Main-Agreement

if applicable, see
Main-Agreement

Contact details including
email:

Contact details including
email:

if applicable, see
Main-Agreement

if applicable, see
Main-Agreement

Importer Data
Subject Contact

Job Title: see
Main-Agreement
Contact details including
email: see Main-Agreement

Signaturesconfirming
each Party
agrees to bebound by this
IDTA

Page 100
Version: 1.07
Classification: Public

Signed for and on behalf ofthe Exporter set out above

Signed for and on behalf of
the Importer set out above

Signed:Signed:see Main-Agreement

see Main-Agreement

Date of signature:

Date of signature:see Main-Agreement

see Main-Agreement

Full name:

Full name:see Main-Agreement

see Main-Agreement

Job title:

Job title:

see Main-Agreement

see Main-Agreement

Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Table 2: Transfer Details
UK country’s
law thatgoverns the
IDTA:

England and Wales, Northern Ireland, or Scotland

Primary place
for legal claims
to be made by
the Parties

England and Wales, Northern Ireland, or Scotland

The status of
the ExporterIn relation to the Processing of the Transferred Data:

The status of
the ImporterIn relation to the Processing of the Transferred Data:

Whether UK
GDPR applies tothe Importer

UK GDPR applies to the Importer’s Processing of theTransferred Data

LinkedAgreement

If the Importer is the Exporter’s Processor or
Sub-Processor – the agreement(s) between the Parties
which sets out the Processor’s or Sub-Processor’s
instructions for Processing the Transferred Data:

see Main-Agreement, or alternatively, place on the mainestablishment of the Exporter, or alternatively, based on theplace of residence of the majority of data subjects

see Main-Agreement, or alternatively, place on the mainestablishment of the Exporter, or alternatively, based on theplace of residence of the majority of data subjects

Exporter is a Controller / or / Exporter is a Processor or
Sub-Processor – based on the nature of theMain-Agreement, and the Agreement with another
Controller

Importer is a Controller / or / Importer is the Exporter’s
Processor or Sub-Processor / or / Importer is not the
Exporter’s Processor or Sub-Processor (and the Importer has
been instructed by a Third Party Controller) - based on thenature of the Main-Agreement, and the Agreement withanother Controller or Third Party

Name of agreement: if any, see Main-Agreement
Page 101
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Date of agreement: if any, see Main-Agreement
Parties to the agreement: if any, see Main-Agreement
Reference (if any): if any, see Main-Agreement
Other agreements – any agreement(s) between the Parties
which set out additional obligations in relation to theTransferred Data, such as a data sharing agreement orservice agreement:
Name of agreement: if any, see Main-Agreement
Date of agreement: if any, see Main-Agreement
Parties to the agreement: if any, see Main-Agreement
Reference (if any): if any, see Main-Agreement
If the Exporter is a Processor or Sub-Processor – theagreement(s) between the Exporter and the Party(s) whichsets out the Exporter’s instructions for Processing theTransferred Data:
Name of agreement: if any, see Main-Agreement
Date of agreement: if any, see Main-Agreement
Parties to the agreement: if any, see Main-Agreement
Reference (if any): if any, see Main-Agreement
Term

The Importer may Process the Transferred Data for thefollowing time period:
the period for which the Linked Agreement is in force

Ending the
IDTA before theend of the Term

The Parties cannot end the IDTA before the end of the Term
unless there is a breach of the IDTA or the Parties agree in
writing.

Ending the
IDTA when the

Which Parties may end the IDTA as set out in Section ‎29.2:

Page 102
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Approved IDTA
changesneither Party

Can theImporter makefurthertransfers of theTransferred
Data?

The Importer MAY transfer on the Transferred Data to
another organisation or person (who is a different legal
entity) in accordance with Section 16.1 (Transferring on theTransferred Data).

Specific
restrictions
when theImporter may
transfer on theTransferred
Data

The Importer MAY ONLY forward the Transferred Data inaccordance with Section 16.1:

Review Dates

Each time there is a change to the Transferred Data,
Purposes, Importer Information, TRA or risk assessment.

there are no specific restrictions.

Table 3: Transferred Data
Transferred
Data

The personal data to be sent to the Importer under this IDTA
consists of:
The categories of Transferred Data will update automaticallyif the information is updated in the Linked Agreement
referred to.

SpecialCategories of
Personal Dataand criminal
convictions andoffences
Page 103
Version: 1.07
Classification: Public

The Transferred Data includes data relating to:nonePowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Relevant Data
Subjects

The Data Subjects of the Transferred Data are:PurposeThe Importer may Process the Transferred Data for thefollowing purposes: To fulfil the Main-Agreement.

The categories of Data Subjects will update automatically if
the information is updated in the Linked Agreement
referred to.

Table 4: Security Requirements
Security ofTransmission
Security of
Storage
Security ofProcessing
Organisational
security
measures
Technical
security
minimum
requirements
Updates to the
Security
Requirements

Page 104
Version: 1.07
Classification: Public

See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURES
See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURES
See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURES
See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURES

See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURESThe Security Requirements will update automatically if theinformation is updated in the Linked Agreement referred to.

Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Part 2: Extra Protection Clauses
Extra Protection
Clauses:None(i) Extra
technical
security
protections

See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURES(ii) Extra
organisational
protectionsNone(iii) Extra
contractual
protections

None

Part 3: Commercial Clauses
Commercial
Clausessee Main-Agreement

Part 4: Mandatory Clauses
Information that helps you to understand this IDTA
1.

This IDTA and Linked Agreements

1.1

Each Party agrees to be bound by the terms and conditions set out in the
IDTA, in exchange for the other Party also agreeing to be bound by the
IDTA.

1.2

This IDTA is made up of:
1.2.1

Part one: Tables;

1.2.2

Part two: Extra Protection Clauses;

1.2.3

Part three: Commercial Clauses; and1.2.4

Part four: Mandatory Clauses.

Page 105
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

1.3

The IDTA starts on the Start Date and ends as set out in Sections 29 or 30.

1.4

If the Importer is a Processor or Sub-Processor instructed by the Exporter:
the Exporter must ensure that, on or before the Start Date and during theTerm, there is a Linked Agreement which is enforceable between theParties and which complies with Article 28 UK GDPR (and which they will
ensure continues to comply with Article 28 UK GDPR).

1.5

References to the Linked Agreement or to the Commercial Clauses are tothat Linked Agreement or to those Commercial Clauses only in so far as
they are consistent with the Mandatory Clauses.

2.

Legal Meaning of Words

2.1

If a word starts with a capital letter it has the specific meaning set out inthe Legal Glossary in Section 36.

2.2

To make it easier to read and understand, this IDTA contains headings andguidance notes. Those are not part of the binding contract which forms
the IDTA.

3.

You have provided all the information required

3.1

The Parties must ensure that the information contained in Part one:
Tables is correct and complete at the Start Date and during the Term.

3.2

In Table 2: Transfer Details, if the selection that the Parties are Controllers,
Processors or Sub-Processors is wrong (either as a matter of fact or as aresult of applying the UK Data Protection Laws) then:
3.2.1

the terms and conditions of the Approved IDTA which apply tothe correct option which was not selected will apply; and3.2.2

the Parties and any Relevant Data Subjects are entitled to
enforce the terms and conditions of the Approved IDTA which
apply to that correct option.

3.3

In Table 2: Transfer Details, if the selection that the UK GDPR applies iswrong (either as a matter of fact or as a result of applying the UK Data
Protection Laws), then the terms and conditions of the IDTA will still apply
to the greatest extent possible.

4.

How to sign the IDTA

4.1

The Parties may choose to each sign (or execute):

Page 106
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

4.1.1the same copy of this IDTA;

4.1.2

two copies of the IDTA. In that case, each identical copy is still an
original of this IDTA, and together all those copies form one
agreement;

4.1.3

a separate, identical copy of the IDTA. In that case, each identical
copy is still an original of this IDTA, and together all those copies
form one agreement,

unless signing (or executing) in this way would mean that the IDTA would not bebinding on the Parties under Local Laws.
5.

Changing this IDTA

5.1

Each Party must not change the Mandatory Clauses as set out in the
Approved IDTA, except only:
5.1.1

to ensure correct cross-referencing: cross-references to Part one:
Tables (or any Table), Part two: Extra Protections, and/or Part
three: Commercial Clauses can be changed where the Parties
have set out the information in a different format, so that thecross-reference is to the correct location of the same information,or where clauses have been removed as they do not apply, as set
out below;

5.1.2

to remove those Sections which are expressly stated not to apply
to the selections made by the Parties in Table 2: Transfer Details,
that the Parties are Controllers, Processors or Sub-Processors
and/or that the Importer is subject to, or not subject to, the UK
GDPR. The Exporter and Importer understand and acknowledge
that any removed Sections may still apply and form a part of this
IDTA if they have been removed incorrectly, including because
the wrong selection is made in Table 2: Transfer Details;

5.1.3

so the IDTA operates as a multi-party agreement if there are
more than two Parties to the IDTA. This may include nominatinga lead Party or lead Parties which can make decisions on behalfof some or all of the other Parties which relate to this IDTA
(including reviewing Table 4: Security Requirements and Part
two: Extra Protection Clauses, and making updates to Part one:
Tables (or any Table), Part two: Extra Protection Clauses, and/orPart three: Commercial Clauses); and/or

Page 107
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

5.1.4

to update the IDTA to set out in writing any changes made to theApproved IDTA under Section 5.4, if the Parties want to. Thechanges will apply automatically without updating them as
described in Section 5.4;

provided that the changes do not reduce the Appropriate Safeguards.
5.2

If the Parties wish to change the format of the information included inPart one: Tables, Part two: Extra Protection Clauses or Part three:
Commercial Clauses of the Approved IDTA, they may do so by agreeing to
the change in writing, provided that the change does not reduce theAppropriate Safeguards.

5.3

If the Parties wish to change the information included in Part one: Tables,
Part two: Extra Protection Clauses or Part three: Commercial Clauses ofthis IDTA (or the equivalent information), they may do so by agreeing to
the change in writing, provided that the change does not reduce theAppropriate Safeguards.

5.4

From time to time, the ICO may publish a revised Approved IDTA which:
5.4.1

makes reasonable and proportionate changes to the Approved
IDTA, including correcting errors in the Approved IDTA; and/or

5.4.2

reflects changes to UK Data Protection Laws.

The revised Approved IDTA will specify the start date from which the changes to
the Approved IDTA are effective and whether an additional Review Date isrequired as a result of the changes. This IDTA is automatically amended as
set out in the revised Approved IDTA from the start date specified.
6.

Understanding this IDTA

6.1

This IDTA must always be interpreted in a manner that is consistent with
UK Data Protection Laws and so that it fulfils the Parties’ obligation toprovide the Appropriate Safeguards.

6.2

If there is any inconsistency or conflict between UK Data Protection Laws
and this IDTA, the UK Data Protection Laws apply.

6.3

If the meaning of the IDTA is unclear or there is more than one meaning,the meaning which most closely aligns with the UK Data Protection Laws
applies.

Page 108
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

6.4

Nothing in the IDTA (including the Commercial Clauses or the Linked
Agreement) limits or excludes either Party’s liability to Relevant Data
Subjects or to the ICO under this IDTA or under UK Data Protection Laws.

6.5

If any wording in Parts one, two or three contradicts the Mandatory
Clauses, and/or seeks to limit or exclude any liability to Relevant Data
Subjects or to the ICO, then that wording will not apply.

6.6

The Parties may include provisions in the Linked Agreement which
provide the Parties with enhanced rights otherwise covered by this IDTA.
These enhanced rights may be subject to commercial terms, including
payment, under the Linked Agreement, but this will not affect the rights
granted under this IDTA.

6.7

If there is any inconsistency or conflict between this IDTA and a Linked
Agreement or any other agreement, this IDTA overrides that Linked
Agreement or any other agreements, even if those agreements have been
negotiated by the Parties. The exceptions to this are where (and in so far
as):
6.7.1

the inconsistent or conflicting terms of the Linked Agreement orother agreement provide greater protection for the Relevant
Data Subject’s rights, in which case those terms will override the
IDTA; and

6.7.2

a Party acts as Processor and the inconsistent or conflicting
terms of the Linked Agreement are obligations on that Party
expressly required by Article 28 UK GDPR, in which case thoseterms will override the inconsistent or conflicting terms of the
IDTA in relation to Processing by that Party as Processor.

6.8

The words “include”, “includes”, “including”, “in particular” are used to set
out examples and not to set out a finite list.

6.9

References to:
6.9.1

singular or plural words or people, also includes the plural or
singular of those words or people;

6.9.2

legislation (or specific provisions of legislation) means thatlegislation (or specific provision) as it may change over time. This
includes where that legislation (or specific provision) has been

Page 109
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

consolidated, re-enacted and/or replaced after this IDTA has
been signed; and6.9.3

any obligation not to do something, includes an obligation not toallow or cause that thing to be done by anyone else.

7.

Which laws apply to this IDTA

7.1

This IDTA is governed by the laws of the UK country set out in Table 2:
Transfer Details. If no selection has been made, it is the laws of Englandand Wales. This does not apply to Section 35 which is always governed by
the laws of England and Wales.

How this IDTA provides Appropriate Safeguards
8.

The Appropriate Safeguards

8.1

The purpose of this IDTA is to ensure that the Transferred Data has
Appropriate Safeguards when Processed by the Importer during theTerm. This standard is met when and for so long as:

8.2

8.3

8.1.1

both Parties comply with the IDTA, including the Security
Requirements and any Extra Protection Clauses; and8.1.2

the Security Requirements and any Extra Protection Clauses
provide a level of security which is appropriate to the risk of a
Personal Data Breach occurring and the impact on Relevant
Data Subjects of such a Personal Data Breach, including
considering any Special Category Data within the Transferred
Data.

The Exporter must:
8.2.1

ensure and demonstrate that this IDTA (including any Security
Requirements and Extra Protection Clauses) provides
Appropriate Safeguards; and8.2.2(if the Importer reasonably requests) provide it with a copy of any
TRA.

The Importer must:
8.3.1

Page 110
Version: 1.07
Classification: Public

before receiving any Transferred Data, provide the Exporter withall relevant information regarding Local Laws and practices andthe protections and risks which apply to the Transferred Data
Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

when it is Processed by the Importer, including any information
which may reasonably be required for the Exporter to carry out
any TRA (the “Importer Information”);

8.4

8.3.2

co-operate with the Exporter to ensure compliance with the
Exporter’s obligations under the UK Data Protection Laws;

8.3.3

review whether any Importer Information has changed, andwhether any Local Laws contradict its obligations in this IDTA
and take reasonable steps to verify this, on a regular basis. These
reviews must be at least as frequent as the Review Dates; and8.3.4

inform the Exporter as soon as it becomes aware of any Importer
Information changing, and/or any Local Laws which may preventor limit the Importer complying with its obligations in this IDTA.
This information then forms part of the Importer Information.

The Importer must ensure that at the Start Date and during the Term:
8.4.1

the Importer Information is accurate;

8.4.2

it has taken reasonable steps to verify whether there are any
Local Laws which contradict its obligations in this IDTA or any
additional information regarding Local Laws which may be
relevant to this IDTA.

8.5

Each Party must ensure that the Security Requirements and Extra
Protection Clauses provide a level of security which is appropriate to therisk of a Personal Data Breach occurring and the impact on Relevant Data
Subjects of such a Personal Data Breach.

9.

Reviews to ensure the Appropriate Safeguards continue

9.1

Each Party must:
9.1.1

Page 111
Version: 1.07
Classification: Public

review this IDTA (including the Security Requirements and Extra
Protection Clauses and the Importer Information) at regularintervals, to ensure that the IDTA remains accurate and up todate and continues to provide the Appropriate Safeguards. Each
Party will carry out these reviews as frequently as the relevant
Review Dates or sooner; andPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

9.1.2

9.2

inform the other party in writing as soon as it becomes aware if
any information contained in either this IDTA, any TRA or
Importer Information is no longer accurate and up to date.

If, at any time, the IDTA no longer provides Appropriate Safeguards theParties must Without Undue Delay:
9.2.1

pause transfers and Processing of Transferred Data whilst achange to the Tables is agreed. The Importer may retain a copyof the Transferred Data during this pause, in which case theImporter must carry out any Processing required to maintain, so
far as possible, the measures it was taking to achieve theAppropriate Safeguards prior to the time the IDTA no longer
provided Appropriate Safeguards, but no other Processing;

9.2.2

agree a change to Part one: Tables or Part two: Extra Protection
Clauses which will maintain the Appropriate Safeguards (inaccordance with Section 5); and9.2.3

where a change to Part one: Tables or Part two: Extra Protection
Clauses which maintains the Appropriate Safeguards cannot be
agreed, the Exporter must end this IDTA by written notice on the
Importer.

10.

The ICO

10.1

Each Party agrees to comply with any reasonable requests made by the
ICO in relation to this IDTA or its Processing of the Transferred Data.

10.2

The Exporter will provide a copy of any TRA, the Importer Information andthis IDTA to the ICO, if the ICO requests.

10.3

The Importer will provide a copy of any Importer Information and this
IDTA to the ICO, if the ICO requests.

The Exporter
11.

Exporter’s obligations

11.1

The Exporter agrees that UK Data Protection Laws apply to its Processingof the Transferred Data, including transferring it to the Importer.

11.2

The Exporter must:

Page 112
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

11.2.1

comply with the UK Data Protection Laws in transferring theTransferred Data to the Importer;

11.2.2comply with the Linked Agreement as it relates to its transferring
the Transferred Data to the Importer; and11.2.3carry out reasonable checks on the Importer’s ability to comply
with this IDTA, and take appropriate action including under
Section 9.2, Section 29 or Section 30, if at any time it no longer
considers that the Importer is able to comply with this IDTA or toprovide Appropriate Safeguards.

11.3

The Exporter must comply with all its obligations in the IDTA, including
any in the Security Requirements, and any Extra Protection Clauses andany Commercial Clauses.

11.4

The Exporter must co-operate with reasonable requests of the Importer topass on notices or other information to and from Relevant Data Subjects
or any Third Party Controller where it is not reasonably practical for the
Importer to do so. The Exporter may pass these on via a third party if it isreasonable to do so.

11.5

The Exporter must co-operate with and provide reasonable assistance tothe Importer, so that the Importer is able to comply with its obligations to
the Relevant Data Subjects under Local Law and this IDTA.

The Importer
12.

General Importer obligations

12.1

The Importer must:
12.1.1

only Process the Transferred Data for the Purpose;

12.1.2comply with all its obligations in the IDTA, including in the
Security Requirements, any Extra Protection Clauses and any
Commercial Clauses;

12.1.3comply with all its obligations in the Linked Agreement which
relate to its Processing of the Transferred Data;

12.1.4keep a written record of its Processing of the Transferred Data,
which demonstrate its compliance with this IDTA, and provide
this written record if asked to do so by the Exporter;

Page 113
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

12.1.5

if the Linked Agreement includes rights for the Exporter toobtain information or carry out an audit, provide the Exporter
with the same rights in relation to this IDTA; and12.1.6if the ICO requests, provide the ICO with the information it would
be required on request to provide to the Exporter under thisSection 12.1 (including the written record of its Processing, andthe results of audits and inspections).

12.2

The Importer must co-operate with and provide reasonable assistance tothe Exporter and any Third Party Controller, so that the Exporter and any
Third Party Controller are able to comply with their obligations under UK
Data Protection Laws and this IDTA.

13.

Importer’s obligations if it is subject to the UK Data Protection Laws

13.1

If the Importer’s Processing of the Transferred Data is subject to UK Data
Protection Laws, it agrees that:

13.2

13.1.1

UK Data Protection Laws apply to its Processing of theTransferred Data, and the ICO has jurisdiction over it in that
respect; and13.1.2it has and will comply with the UK Data Protection Laws in
relation to the Processing of the Transferred Data.

If Section 13.1 applies and the Importer complies with Section 13.1, it does
not need to comply with:●

Section 14 (Importer’s obligations to comply with key data protection
principles);●Section 15 (What happens if there is an Importer Personal Data Breach);●Section 15 (How Relevant Data Subjects can exercise their data subject
rights); and●Section 21 (How Relevant Data Subjects can exercise their data subject
rights – if the Importer is the Exporter’s Processor or Sub-Processor).

14.

Importer’s obligations to comply with key data protection principles

14.1

The Importer does not need to comply with this Section 14 if it is the
Exporter’s Processor or Sub-Processor.

Page 114

Powered by LegalTech from Willing & Able and the Germany Certification Body.

Version: 1.07
Classification: PublicDocument Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

14.2

The Importer must:
14.2.1ensure that the Transferred Data it Processes is adequate,
relevant and limited to what is necessary for the Purpose;

14.2.2ensure that the Transferred Data it Processes is accurate and(where necessary) kept up to date, and (where appropriate
considering the Purposes) correct or delete any inaccurate
Transferred Data it becomes aware of Without Undue Delay; and14.2.3ensure that it Processes the Transferred Data for no longer thanis reasonably necessary for the Purpose.

15.

What happens if there is an Importer Personal Data Breach

15.1

If there is an Importer Personal Data Breach, the Importer must:

15.2

15.1.1

take reasonable steps to fix it, including to minimise the harmful
effects on Relevant Data Subjects, stop it from continuing, andprevent it happening again. If the Importer is the Exporter’s
Processor or Sub-Processor: these steps must comply with the
Exporter’s instructions and the Linked Agreement and be in
co-operation with the Exporter and any Third Party Controller;and15.1.2ensure that the Security Requirements continue to provide (orare changed in accordance with this IDTA so they do provide) alevel of security which is appropriate to the risk of a Personal
Data Breach occurring and the impact on Relevant Data
Subjects of such a Personal Data Breach.

If the Importer is a Processor or Sub-Processor: if there is an Importer
Personal Data Breach, the Importer must:
15.2.1Page 115
Version: 1.07
Classification: Public

notify the Exporter Without Undue Delay after becoming awareof the breach, providing the following information:
15.2.1.1

a description of the nature of the Importer Personal
Data Breach;

15.2.1.2(if and when possible) the categories andapproximate number of Data Subjects andTransferred Data records concerned;

Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

15.3

15.2.1.3

likely consequences of the Importer Personal Data
Breach;15.2.1.4

steps taken (or proposed to be taken) to fix theImporter Personal Data Breach (including tominimise the harmful effects on Relevant Data
Subjects, stop it from continuing, and prevent it
happening again) and to ensure that Appropriate
Safeguards are in place;

15.2.1.5

contact point for more information; and15.2.1.6

any other information reasonably requested by the
Exporter,

15.2.2

if it is not possible for the Importer to provide all the above
information at the same time, it may do so in phases, Without
Undue Delay; and15.2.3

assist the Exporter (and any Third Party Controller) so the
Exporter (or any Third Party Controller) can inform Relevant Data
Subjects or the ICO or any other relevant regulator or authority
about the Importer Personal Data Breach Without Undue Delay.

If the Importer is a Controller: if the Importer Personal Data Breach is likely
to result in a risk to the rights or freedoms of any Relevant Data Subject
the Importer must notify the Exporter Without Undue Delay after
becoming aware of the breach, providing the following information:
15.3.1a description of the nature of the Importer Personal Data Breach;

15.3.2(if and when possible) the categories and approximate number
of Data Subjects and Transferred Data records concerned;

15.3.3likely consequences of the Importer Personal Data Breach;

15.3.4steps taken (or proposed to be taken) to fix the Importer
Personal Data Breach (including to minimise the harmful effects
on Relevant Data Subjects, stop it from continuing, and prevent
it happening again) and to ensure that Appropriate Safeguards
are in place;

15.3.5contact point for more information; and15.3.6any other information reasonably requested by the Exporter.

Page 116
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

If it is not possible for the Importer to provide all the above information at thesame time, it may do so in phases, Without Undue Delay.
15.4

If the Importer is a Controller: if the Importer Personal Data Breach is likely
to result in a high risk to the rights or freedoms of any Relevant Data
Subject, the Importer must inform those Relevant Data Subjects Without
Undue Delay, except in so far as it requires disproportionate effort, andprovided the Importer ensures that there is a public communication orsimilar measures whereby Relevant Data Subjects are informed in an
equally effective manner.

15.5

The Importer must keep a written record of all relevant facts relating to
the Importer Personal Data Breach, which it will provide to the Exporterand the ICO on request.

This record must include the steps it takes to fix the Importer Personal Data
Breach (including to minimise the harmful effects on Relevant Data
Subjects, stop it from continuing, and prevent it happening again) and toensure that Security Requirements continue to provide a level of security
which is appropriate to the risk of a Personal Data Breach occurring and theimpact on Relevant Data Subjects of such a Personal Data Breach.
16.
16.1

Transferring on the Transferred Data
The Importer may only transfer on the Transferred Data to a third party if it
is permitted to do so in Table 2: Transfer Details Table, the transfer is for
the Purpose, the transfer does not breach the Linked Agreement, and one
or more of the following apply:
16.1.1the third party has entered into a written contract with theImporter containing the same level of protection for Data
Subjects as contained in this IDTA (based on the role of therecipient as controller or processor), and the Importer has
conducted a risk assessment to ensure that the Appropriate
Safeguards will be protected by that contract; or

16.1.2the third party has been added to this IDTA as a Party; or

16.1.3

if the Importer was in the UK, transferring on the Transferred
Data would comply with Article 46 UK GDPR; orPage 117
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

16.1.4

if the Importer was in the UK transferring on the Transferred Data
would comply with one of the exceptions in Article 49 UK GDPR;
or

16.1.5the transfer is to the UK or an Adequate Country.

16.2

The Importer does not need to comply with Section 16.1 if it is transferringon Transferred Data and/or allowing access to the Transferred Data inaccordance with Section 23 (Access Requests and Direct Access).

17.

Importer’s responsibility if it authorises others to perform its
obligations

17.1

The Importer may sub-contract its obligations in this IDTA to a Processor
or Sub-Processor (provided it complies with Section 16).

17.2

If the Importer is the Exporter’s Processor or Sub-Processor: it must also
comply with the Linked Agreement or be with the written consent of theExporter.

17.3

The Importer must ensure that any person or third party acting under its
authority, including a Processor or Sub-Processor, must only Process theTransferred Data on its instructions.

17.4

The Importer remains fully liable to the Exporter, the ICO and Relevant
Data Subjects for its obligations under this IDTA where it has
sub-contracted any obligations to its Processors and Sub-Processors, orauthorised an employee or other person to perform them (and references
to the Importer in this context will include references to its Processors,
Sub-Processors or authorised persons).

What rights do individuals have?
18.

The right to a copy of the IDTA

18.1

If a Party receives a request from a Relevant Data Subject for a copy of thisIDTA:
18.1.1

it will provide the IDTA to the Relevant Data Subject and informthe other Party, as soon as reasonably possible;

18.1.2it does not need to provide copies of the Linked Agreement, but
it must provide all the information from those Linked
Agreements referenced in the Tables;

Page 118
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

18.1.3

it may redact information in the Tables or the information
provided from the Linked Agreement if it is reasonably necessary
to protect business secrets or confidential information, so long as
it provides the Relevant Data Subject with a summary of thoseredactions so that the Relevant Data Subject can understand thecontent of the Tables or the information provided from theLinked Agreement.

19.

The right to Information about the Importer and its Processing

19.1

The Importer does not need to comply with this Section 19 if it is the
Exporter’s Processor or Sub-Processor.

19.2

The Importer must ensure that each Relevant Data Subject is provided
with details of:●

the Importer (including contact details and the Importer Data Subject
Contact);●

the Purposes; and●any recipients (or categories of recipients) of the Transferred Data;

The Importer can demonstrate it has complied with this Section 19.2 if theinformation is given (or has already been given) to the Relevant Data
Subjects by the Exporter or another party.
The Importer does not need to comply with this Section 19.2 in so far as to do sowould be impossible or involve a disproportionate effort, in which case, theImporter must make the information publicly available.
19.3

The Importer must keep the details of the Importer Data Subject Contact
up to date and publicly available. This includes notifying the Exporter inwriting of any such changes.

19.4

The Importer must make sure those contact details are always easy toaccess for all Relevant Data Subjects and be able to easily communicate
with Data Subjects in the English language Without Undue Delay.

20.

How Relevant Data Subjects can exercise their data subject rights

20.1

The Importer does not need to comply with this Section 20 if it is the
Exporter’s Processor or Sub-Processor.

Page 119
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

20.2

If an individual requests, the Importer must confirm whether it isProcessing their Personal Data as part of the Transferred Data.

20.3

The following Sections of this Section 20, relate to a Relevant Data
Subject’s Personal Data which forms part of the Transferred Data theImporter is Processing.

20.4

If the Relevant Data Subject requests, the Importer must provide themwith a copy of their Transferred Data:
20.4.1

Without Undue Delay (and in any event within one month);

20.4.2at no greater cost to the Relevant Data Subject than it would be
able to charge if it were subject to the UK Data Protection Laws;

20.4.3in clear and plain English that is easy to understand; and20.4.4in an easily accessible form

together with

20.5

20.6

20.4.5(if needed) a clear and plain English explanation of theTransferred Data so that it is understandable to the Relevant
Data Subject; and20.4.6

information that the Relevant Data Subject has the right to bringa claim for compensation under this IDTA.

If a Relevant Data Subject requests, the Importer must:
20.5.1

rectify inaccurate or incomplete Transferred Data;

20.5.2

erase Transferred Data if it is being Processed in breach of thisIDTA;

20.5.3cease using it for direct marketing purposes; and20.5.4comply with any other reasonable request of the Relevant Data
Subject, which the Importer would be required to comply with if
it were subject to the UK Data Protection Laws.

The Importer must not use the Transferred Data to make decisions about
the Relevant Data Subject based solely on automated processing,including profiling (the “Decision-Making”), which produce legal effects
concerning the Relevant Data Subject or similarly significantly affects
them, except if it is permitted by Local Law and:

Page 120
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

20.6.1

the Relevant Data Subject has given their explicit consent tosuch Decision-Making; or

20.6.2

Local Law has safeguards which provide sufficiently similarprotection for the Relevant Data Subjects in relation to such
Decision-Making, as to the relevant protection the Relevant Data
Subject would have if such Decision-Making was in the UK; or

20.6.3the Extra Protection Clauses provide safeguards for theDecision-Making which provide sufficiently similar protection for
the Relevant Data Subjects in relation to such Decision-Making,as to the relevant protection the Relevant Data Subject would
have if such Decision-Making was in the UK.

21.

How Relevant Data Subjects can exercise their data subject rights– if
the Importer is the Exporter’s Processor or Sub-Processor

21.1

Where the Importer is the Exporter’s Processor or Sub-Processor: If theImporter receives a request directly from an individual which relates to
the Transferred Data it must pass that request on to the Exporter Without
Undue Delay. The Importer must only respond to that individual as
authorised by the Exporter or any Third Party Controller.

22.

Rights of Relevant Data Subjects are subject to the exemptions in the UK
Data Protection Laws

22.1

The Importer is not required to respond to requests or provide
information or notifications under Sections 18, 19, 20, 21 and 23 if:
22.1.1

it is unable to reasonably verify the identity of an individual
making the request; or

22.1.2the requests are manifestly unfounded or excessive, including
where requests are repetitive. In that case the Importer may
refuse the request or may charge the Relevant Data Subject areasonable fee; or

22.1.3a relevant exemption would be available under UK Data
Protection Laws, were the Importer subject to the UK Data
Protection Laws.

If the Importer refuses an individual’s request or charges a fee under Section 22.1.2
it will set out in writing the reasons for its refusal or charge, and inform thePage 121
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Relevant Data Subject that they are entitled to bring a claim forcompensation under this IDTA in the case of any breach of this IDTA.

How to give third parties access to Transferred Data under Local Laws
23.

Access requests and direct access

23.1

In this Section ‎23 an “Access Request” is a legally binding request (except
for requests only binding by contract law) to access any Transferred Dataand “Direct Access” means direct access to any Transferred Data by publicauthorities of which the Importer is aware.

23.2

The Importer may disclose any requested Transferred Data in so far as it
receives an Access Request, unless in the circumstances it is reasonable
for it to challenge that Access Request on the basis there are significant
grounds to believe that it is unlawful.

23.3

In so far as Local Laws allow and it is reasonable to do so, the Importer will
Without Undue Delay provide the following with relevant information
about any Access Request or Direct Access: the Exporter; any Third Party
Controller; and where the Importer is a Controller, any Relevant Data
Subjects.

23.4

In so far as Local Laws allow, the Importer must:
23.4.1

make and keep a written record of Access Requests and Direct
Access, including (if known): the dates, the identity of therequestor/accessor, the purpose of the Access Request or Direct
Access, the type of data requested or accessed, whether it waschallenged or appealed, and the outcome; and the Transferred
Data which was provided or accessed; and23.4.2

provide a copy of this written record to the Exporter on each
Review Date and any time the Exporter or the ICO reasonably
requests.

24.

Giving notice24.1

If a Party is required to notify any other Party in this IDTA it will be marked
for the attention of the relevant Key Contact and sent by e-mail to thee-mail address given for the Key Contact.

24.2

If the notice is sent in accordance with Section 24.1, it will be deemed tohave been delivered at the time the e-mail was sent, or if that time isoutside of the receiving Party’s normal business hours, the receiving

Page 122
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Party’s next normal business day, and provided no notice of non-delivery
or bounceback is received.
24.3

The Parties agree that any Party can update their Key Contact details bygiving 14 days’ (or more) notice in writing to the other Party.

25.

General clauses

25.1

In relation to the transfer of the Transferred Data to the Importer and theImporter’s Processing of the Transferred Data, this IDTA and any Linked
Agreement:
25.1.1

contain all the terms and conditions agreed by the Parties; and25.1.2override all previous contacts and arrangements, whether oral orin writing.

25.2

If one Party made any oral or written statements to the other before
entering into this IDTA (which are not written in this IDTA) the other Party
confirms that it has not relied on those statements and that it will nothave a legal remedy if those statements are untrue or incorrect, unlessthe statement was made fraudulently.

25.3

Neither Party may novate, assign or obtain a legal charge over this IDTA
(in whole or in part) without the written consent of the other Party, which
may be set out in the Linked Agreement.

25.4

Except as set out in Section 17.1, neither Party may sub contract its
obligations under this IDTA without the written consent of the other Party,
which may be set out in the Linked Agreement.

25.5

This IDTA does not make the Parties a partnership, nor appoint one Party
to act as the agent of the other Party.

25.6

If any Section (or part of a Section) of this IDTA is or becomes illegal,
invalid or unenforceable, that will not affect the legality, validity andenforceability of any other Section (or the rest of that Section) of this IDTA.

25.7

If a Party does not enforce, or delays enforcing, its rights or remedies
under or in relation to this IDTA, this will not be a waiver of those rights orremedies. In addition, it will not restrict that Party’s ability to enforce thoseor any other right or remedy in future.

Page 123
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

25.8

If a Party chooses to waive enforcing a right or remedy under or in relation
to this IDTA, then this waiver will only be effective if it is made in writing.
Where a Party provides such a written waiver:25.8.1

it only applies in so far as it explicitly waives specific rights orremedies;

25.8.2it shall not prevent that Party from exercising those rights orremedies in the future (unless it has explicitly waived its ability to
do so); and25.8.3it will not prevent that Party from enforcing any other right orremedy in future.

What happens if there is a breach of this IDTA?
26.

Breaches of this IDTA

26.1

Each Party must notify the other Party in writing (and with all relevant
details) if it:
26.1.1has breached this IDTA; or

26.1.2it should reasonably anticipate that it may breach this IDTA, andprovide any information about this which the other Party
reasonably requests.

26.2

In this IDTA “Significant Harmful Impact” means that there is more than aminimal risk of a breach of the IDTA causing (directly or indirectly)
significant damage to any Relevant Data Subject or the other Party.

27.

Breaches of this IDTA by the Importer

27.1

If the Importer has breached this IDTA, and this has a Significant Harmful
Impact, the Importer must take steps Without Undue Delay to end the
Significant Harmful Impact, and if that is not possible to reduce the
Significant Harmful Impact as much as possible.

27.2

Until there is no ongoing Significant Harmful Impact on Relevant Data
Subjects:
27.2.1the Exporter must suspend sending Transferred Data to the
Importer;

27.2.2

If the Importer is the Exporter’s Processor or Sub-Processor: if theExporter requests, the importer must securely delete all

Page 124
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Transferred Data or securely return it to the Exporter (or a third
party named by the Exporter); and27.2.3

if the Importer has transferred on the Transferred Data to a third
party receiver under Section 16, and the breach has a Significant
Harmful Impact on Relevant Data Subject when it is Processedby or on behalf of that third party receiver, the Importer must:
27.2.3.1

notify the third party receiver of the breach andsuspend sending it Transferred Data; and27.2.3.2

if the third party receiver is the Importer’s Processor
or Sub-Processor: make the third party receiversecurely delete all Transferred Data being Processedby it or on its behalf, or securely return it to the
Importer (or a third party named by the Importer).

27.3

If the breach cannot be corrected Without Undue Delay, so there is no
ongoing Significant Harmful Impact on Relevant Data Subjects, theExporter must end this IDTA under Section 30.1.

28.

Breaches of this IDTA by the Exporter

28.1

If the Exporter has breached this IDTA, and this has a Significant Harmful
Impact, the Exporter must take steps Without Undue Delay to end the
Significant Harmful Impact and if that is not possible to reduce the
Significant Harmful Impact as much as possible.

28.2

Until there is no ongoing risk of a Significant Harmful Impact on Relevant
Data Subjects, the Exporter must suspend sending Transferred Data to
the Importer.

28.3

If the breach cannot be corrected Without Undue Delay, so there is no
ongoing Significant Harmful Impact on Relevant Data Subjects, theImporter must end this IDTA under Section 30.1.

Ending the IDTA
29.
29.1

How to end this IDTA without there being a breach
The IDTA will end:
29.1.1Page 125
Version: 1.07
Classification: Public

at the end of the Term stated in Table 2: Transfer Details; orPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

29.2

29.1.2

if in Table 2: Transfer Details, the Parties can end this IDTA byproviding written notice to the other: at the end of the notice
period stated;

29.1.3at any time that the Parties agree in writing that it will end; or

29.1.4at the time set out in Section ‎29.2.

If the ICO issues a revised Approved IDTA under Section ‎5.4, if any Party
selected in Table 2 “Ending the IDTA when the Approved IDTA changes”,
will as a direct result of the changes in the Approved IDTA have asubstantial, disproportionate and demonstrable increase in:
29.2.1

its direct costs of performing its obligations under the IDTA;
and/or

29.2.2

its risk under the IDTA,

and in either case it has first taken reasonable steps to reduce that cost or risk sothat it is not substantial and disproportionate, that Party may end the IDTA
at the end of a reasonable notice period, by providing written notice for that
period to the other Party before the start date of the revised Approved IDTA.
30.

How to end this IDTA if there is a breach

30.1

A Party may end this IDTA immediately by giving the other Party written
notice if:
30.1.130.1.2

Page 126
Version: 1.07
Classification: Public

the other Party has breached this IDTA and this has a Significant
Harmful Impact. This includes repeated minor breaches whichtaken together have a Significant Harmful Impact, and30.1.1.1

the breach can be corrected so there is no Significant
Harmful Impact, and the other Party has failed to do
so Without Undue Delay (which cannot be more than
14 days of being required to do so in writing); or

30.1.1.2

the breach and its Significant Harmful Impact cannot
be corrected;

the Importer can no longer comply with Section 8.3, as there are
Local Laws which mean it cannot comply with this IDTA and thishas a Significant Harmful Impact.

Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

31.

What must the Parties do when the IDTA ends?

31.1

If the parties wish to bring this IDTA to an end or this IDTA ends inaccordance with any provision in this IDTA, but the Importer must comply
with a Local Law which requires it to continue to keep any Transferred
Data then this IDTA will remain in force in respect of any retained
Transferred Data for as long as the retained Transferred Data is retained,
and the Importer must:

31.2

31.1.1

notify the Exporter Without Undue Delay, including details of therelevant Local Law and the required retention period;

31.1.2

retain only the minimum amount of Transferred Data it needs tocomply with that Local Law, and the Parties must ensure they
maintain the Appropriate Safeguards, and change the Tables
and Extra Protection Clauses, together with any TRA to reflect
this; and31.1.3stop Processing the Transferred Data as soon as permitted bythat Local Law and the IDTA will then end and the rest of thisSection 29 will apply.

When this IDTA ends (no matter what the reason is):31.2.1the Exporter must stop sending Transferred Data to the
Importer; and31.2.2

if the Importer is the Exporter’s Processor or Sub-Processor: theImporter must delete all Transferred Data or securely return it to
the Exporter (or a third party named by the Exporter), as
instructed by the Exporter;

31.2.3

if the Importer is a Controller and/or not the Exporter’s Processor
or Sub-Processor: the Importer must securely delete all
Transferred Data.

31.2.4the following provisions will continue in force after this IDTA ends
(no matter what the reason is):Page 127
Version: 1.07
Classification: Public●

Section 1 (This IDTA and Linked Agreements);●

Section 2 (Legal Meaning of Words);●

Section 6 (Understanding this IDTA);
Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

●Section 7 (Which laws apply to this IDTA);●

Section 10 (The ICO);●

Sections 11.1 and 11.4 (Exporter’s obligations);●

Sections 12.1.2, 12.1.3, 12.1.4, 12.1.5 and 12.1.6 (General Importer
obligations);●

Section 13.1 (Importer’s obligations if it is subject to UK Data
Protection Laws);●

Section 17 (Importer’s responsibility if it authorised others to
perform its obligations);●

Section 24 (Giving notice);●

Section 25 (General clauses);●

Section 31 (What must the Parties do when the IDTA ends);●

Section 32 (Your liability);●

Section 33 (How Relevant Data Subjects and the ICO may bringlegal claims);●

Section 34 (Courts legal claims can be brought in);●

Section 35 (Arbitration); and●Section 36 (Legal Glossary).

How to bring a legal claim under this IDTA
32.

Your liability

32.1

The Parties remain fully liable to Relevant Data Subjects for fulfilling their
obligations under this IDTA and (if they apply) under UK Data Protection
Laws.

32.2

Each Party (in this Section, “Party One”) agrees to be fully liable to
Relevant Data Subjects for the entire damage suffered by the Relevant
Data Subject, caused directly or indirectly by:
32.2.1Page 128
Version: 1.07
Classification: Public

Party One’s breach of this IDTA; and/orPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

32.2.2

where Party One is a Processor, Party One’s breach of any
provisions regarding its Processing of the Transferred Data in the
Linked Agreement;

32.2.3where Party One is a Controller, a breach of this IDTA by theother Party if it involves Party One’s Processing of the Transferred
Data (no matter how minimal)in each case unless Party One can prove it is not in any way responsible for the
event giving rise to the damage.
32.3

If one Party has paid compensation to a Relevant Data Subject under
Section 32.2, it is entitled to claim back from the other Party that part ofthe compensation corresponding to the other Party’s responsibility for thedamage, so that the compensation is fairly divided between the Parties.

32.4

The Parties do not exclude or restrict their liability under this IDTA or UK
Data Protection Laws, on the basis that they have authorised anyone who
is not a Party (including a Processor) to perform any of their obligations,and they will remain responsible for performing those obligations.

33.

How Relevant Data Subjects and the ICO may bring legal claims

33.1

The Relevant Data Subjects are entitled to bring claims against the
Exporter and/or Importer for breach of the following (including where
their Processing of the Transferred Data is involved in a breach of thefollowing by either Party):●

Section 1 (This IDTA and Linked Agreements);●

Section 3 (You have provided all the information required by Part one:
Tables and Part two: Extra Protection Clauses);●

Section 8 (The Appropriate Safeguards);●

Section 9 (Reviews to ensure the Appropriate Safeguards continue);●

Section 11 (Exporter’s obligations);●

Section 12 (General Importer Obligations);●

Section 13 (Importer’s obligations if it is subject to UK Data ProtectionLaws);

Page 129
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

●Section 14 (Importer’s obligations to comply with key data protectionlaws);●

Section 15 (What happens if there is an Importer Personal Data Breach);●Section 16 (Transferring on the Transferred Data);●

Section 17 (Importer’s responsibility if it authorises others to perform its
obligations);●

Section 18 (The right to a copy of the IDTA);●

Section 19 (The Importer’s contact details for the Relevant Data
Subjects);●

Section 20 (How Relevant Data Subjects can exercise their data subject
rights);●Section 21 (How Relevant Data Subjects can exercise their data subject
rights– if the Importer is the Exporter’s Processor or Sub-Processor);●

Section 23 (Access Requests and Direct Access);●

Section 26 (Breaches of this IDTA);●

Section 27 (Breaches of this IDTA by the Importer);●

Section 28 (Breaches of this IDTA by the Exporter);●

Section 30 (How to end this IDTA if there is a breach);●Section 31 (What must the Parties do when the IDTA ends); and●any other provision of the IDTA which expressly or by implication
benefits the Relevant Data Subjects.

33.2

The ICO is entitled to bring claims against the Exporter and/or Importerfor breach of the following Sections: Section 10 (The ICO), Sections 11.1 and11.2 (Exporter’s obligations), Section 12.1.6 (General Importer obligations)and Section 13 (Importer’s obligations if it is subject to UK Data ProtectionLaws).

33.3

No one else (who is not a Party) can enforce any part of this IDTA
(including under the Contracts (Rights of Third Parties) Act 1999).

Page 130
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

33.4

The Parties do not need the consent of any Relevant Data Subject or the
ICO to make changes to this IDTA, but any changes must be made inaccordance with its terms.

33.5

In bringing a claim under this IDTA, a Relevant Data Subject may be
represented by a not-for-profit body, organisation or association under thesame conditions set out in Article 80(1) UK GDPR and sections 187 to 190
of the Data Protection Act 2018.

34.

Courts legal claims can be brought in

34.1

The courts of the UK country set out in Table 2: Transfer Details have
non-exclusive jurisdiction over any claim in connection with this IDTA
(including non-contractual claims).

34.2

The Exporter may bring a claim against the Importer in connection withthis IDTA (including non-contractual claims) in any court in any country
with jurisdiction to hear the claim.

34.3

The Importer may only bring a claim against the Exporter in connection
with this IDTA (including non-contractual claims) in the courts of the UK
country set out in the Table 2: Transfer Details

34.4

Relevant Data Subjects and the ICO may bring a claim against the
Exporter and/or the Importer in connection with this IDTA (including
non-contractual claims) in any court in any country with jurisdiction tohear the claim.

34.5

Each Party agrees to provide to the other Party reasonable updates about
any claims or complaints brought against it by a Relevant Data Subject or
the ICO in connection with the Transferred Data (including claims inarbitration).

35.

Arbitration

35.1

Instead of bringing a claim in a court under Section 34, any Party, or a
Relevant Data Subject may elect to refer any dispute arising out of or inconnection with this IDTA (including non-contractual claims) to final
resolution by arbitration under the Rules of the London Court ofInternational Arbitration, and those Rules are deemed to be incorporated
by reference into this Section ‎35.

35.2

The Parties agree to submit to any arbitration started by another Party or
by a Relevant Data Subject in accordance with this Section ‎35.

Page 131
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

35.3

There must be only one arbitrator. The arbitrator (1) must be a lawyer
qualified to practice law in one or more of England and Wales, or Scotland,or Northern Ireland and (2) must have experience of acting or advising on
disputes relating to UK Data Protection Laws.

35.4

London shall be the seat or legal place of arbitration. It does not matter if
the Parties selected a different UK country as the ‘primary place for legal
claims to be made’ in Table 2: Transfer Details.

35.5

The English language must be used in the arbitral proceedings.

35.6

English law governs this Section ‎35. This applies regardless of whether or
not the parties selected a different UK country’s law as the ‘UK country’s
law that governs the IDTA’ in Table 2: Transfer Details.

36.

Legal Glossary

Word or Phrase

Legal definition(this is how this word or phrase must be interpreted in
the IDTA)

Access Request

As defined in Section 23, as a legally binding request (except
for requests only binding by contract law) to access any
Transferred Data.

Adequate
Country

A third country, or:●●●a territory;
one or more sectors or organisations within a third
country;
an international organisation;

which the Secretary of State has specified by regulations
provides an adequate level of protection of Personal Data inaccordance with Section 17A of the Data Protection Act 2018.
Appropriate
Safeguards

Page 132
Version: 1.07
Classification: Public

The standard of protection over the Transferred Data and of
the Relevant Data Subject’s rights, which is required by UK
Data Protection Laws when you are making a RestrictedPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Word or Phrase

Legal definition(this is how this word or phrase must be interpreted in
the IDTA)
Transfer relying on standard data protection clauses under
Article 46(2)(d) UK GDPR.

Approved IDTA

The template IDTA A1.0 issued by the ICO and laid before
Parliament in accordance with s119A of the Data Protection
Act 2018 on 2 February 2022, as it is revised under Section
5.4.

Commercial
Clauses

The commercial clauses set out in Part three.

Controller

As defined in the UK GDPR.

DamageAll material and non-material loss and damage.

Data Subject

As defined in the UK GDPR.

Decision-Making

As defined in Section 20.6, as decisions about the Relevant
Data Subjects based solely on automated processing,including profiling, using the Transferred Data.

Direct AccessAs defined in Section 23 as direct access to any Transferred
Data by public authorities of which the Importer is aware.

Exporter

The exporter identified in Table 1: Parties & Signature.

Extra Protection
Clauses

The clauses set out in Part two: Extra Protection Clauses.

ICO

The Information Commissioner.

Page 133
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Word or Phrase

Legal definition(this is how this word or phrase must be interpreted in
the IDTA)

Importer

The importer identified in Table 1: Parties & Signature.

Importer Data
Subject Contact

The Importer Data Subject Contact identified in Table 1:
Parties & Signature, which may be updated in accordancewith Section 19.

Importer
Information

As defined in Section 8.3.1, as all relevant information
regarding Local Laws and practices and the protections andrisks which apply to the Transferred Data when it isProcessed by the Importer, including for the Exporter tocarry out any TRA.

Importer
Personal Data
BreachA ‘personal data breach’ as defined in UK GDPR, in relation
to the Transferred Data when Processed by the Importer.

LinkedAgreement

The linked agreements set out in Table 2: Transfer Details (ifany).

Local Laws

Laws which are not the laws of the UK and which bind theImporter.

Mandatory
Clauses

Part four: Mandatory Clauses of this IDTA.

Notice Period

As set out in Table 2: Transfer Details.

Party/Parties

The parties to this IDTA as set out in Table 1: Parties &Signature.

Page 134
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Word or Phrase

Legal definition(this is how this word or phrase must be interpreted in
the IDTA)

Personal Data

As defined in the UK GDPR.

Personal Data
BreachAs defined in the UK GDPR.

Processing

As defined in the UK GDPR.
When the IDTA refers to Processing by the Importer, thisincludes where a third party Sub-Processor of the Importer
is Processing on the Importer’s behalf.

Processor

As defined in the UK GDPR.

PurposeThe ‘Purpose’ set out in Table 2: Transfer Details, including
any purposes which are not incompatible with the purposes
stated or referred to.

Relevant Data
Subject

A Data Subject of the Transferred Data.

RestrictedTransfer

A transfer which is covered by Chapter V of the UK GDPR

Review Dates

The review dates or period for the Security Requirements set
out in Table 2: Transfer Details, and any review dates set out
in any revised Approved IDTA.

Significant
Harmful Impact

As defined in Section 26.2 as where there is more than aminimal risk of the breach causing (directly or indirectly)
significant harm to any Relevant Data Subject or the otherParty.

Page 135
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Word or Phrase

Legal definition(this is how this word or phrase must be interpreted in
the IDTA)Special Category
Data

As described in the UK GDPR, together with criminal
conviction or criminal offence data.

Start Date

As set out in Table 1: Parties and signature.

Sub-Processor

A Processor appointed by another Processor to Process
Personal Data on its behalf.
This includes Sub-Processors of any level, for example a
Sub-Sub-Processor.

TablesThe Tables set out in Part one of this IDTA.

Term

As set out in Table 2: Transfer Details.

Third Party
Controller

The Controller of the Transferred Data where the Exporter is
a Processor or Sub-Processor
If there is not a Third Party Controller this can bedisregarded.

Transfer Risk
Assessment or
TRA

A risk assessment in so far as it is required by UK Data
Protection Laws to demonstrate that the IDTA provides theAppropriate Safeguards

Transferred Data

Any Personal Data which the Parties transfer, or intend totransfer under this IDTA, as described in Table 2: Transfer
Details

UK Data
Protection Laws

All laws relating to data protection, the processing of
personal data, privacy and/or electronic communications inPage 136
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Word or Phrase

Legal definition(this is how this word or phrase must be interpreted in
the IDTA)
force from time to time in the UK, including the UK GDPR
and the Data Protection Act 2018.

UK GDPRAs defined in Section 3 of the Data Protection Act 2018.

Without Undue
Delay

Without undue delay, as that phase is interpreted in the UK
GDPR.

Page 137
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 14 – International Data Transfer Addendum to the EU
Commission Standard Contractual ClausesStandard Data Protection Clauses to be issued by theCommissioner under S119A(1) Data Protection Act 2018
International Data Transfer Addendum to the EU Commission
Standard Contractual Clauses
VERSION B1.0, in force 21 March 2022

This Addendum has been issued by the Information Commissioner for Parties
making Restricted Transfers. The Information Commissioner considers that itprovides Appropriate Safeguards for Restricted Transfers when it is entered into asa legally binding contract.

Part 1: Tables
Table 1: Parties​Start date​see Main-Agreement​The Parties​ xporter (who sends theE
Restricted Transfer)I​ mporter (who receives the
Restricted Transfer)​Parties’ details​Full legal name:​Full legal name:​see Main-Agreement​see Main-Agreement​Trading name (if different):​Trading name (if different):i​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreement

Page 138
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

​Key Contact​Signature (ifrequired for the
purposes ofSection ‎2)​ ain address (if a company
M
registered address):​ ain address (if a company
M
registered address):​see Main-Agreement​see Main-Agreement​​​ fficial registration numberO(if any) (company number orsimilar identifier):​ fficial registration numberO(if any) (company number orsimilar identifier):i​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreement​Full Name (optional):​Full Name (optional):i​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreement​Job Title:​Job Title:i​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreement​ ontact details includingC
email:​ ontact details includingC
email:

i​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreementi​f applicable, see
Main-Agreement

Table 2: Selected SCCs, Modules and Selected Clauses​ ddendum EUASCCsThe version of the Approved EU SCCs which this Addendum
is appended to, detailed below, including the Appendix
Information:​ ate: see above, Additional conditions for compliance withD
the General Data Protection Regulation (GDPR), UK-GDPR
and Confidentiality of Trade Secrets

Page 139
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

​Reference (if any): if applicable, see Main-Agreement​Other identifier (if any): if applicable, see Main-Agreement

Table 3: Appendix Information“Appendix Information” means the information which must be provided for theselected modules as set out in the Appendix of the Approved EU SCCs (other than
the Parties), and which for this Addendum is set out in:​Annex 1A: List of Parties: see APPENDIX 7 – LIST OF PARTIES​ nnex 1B: Description of Transfer: see APPENDIX 8 – DESCRIPTION OF THE
A
PROCESSING OR THE TRANSFER​ nnex II: Technical and organisational measures including technical andAorganisational measures to ensure the security of the data: APPENDIX 9 –TECHNICAL AND ORGANISATIONAL MEASURES​ nnex III: List of Sub processors (Modules 2 and 3 only): if applicable, separate
Alist of our sub-processors must be requested separately

Table 4: Ending this Addendum when the Approved Addendum Changes​Ending thisAddendum
when theApproved
Addendumchanges​Which Parties may end this Addendum as set out in Section ‎19:
​neither Party

Part 2: Mandatory Clauses
Entering into this Addendum
1.

Each Party agrees to be bound by the terms and conditions set out in thisAddendum, in exchange for the other Party also agreeing to be bound by thisAddendum.

2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by
the Parties, for the purpose of making Restricted Transfers, the Parties may
enter into this Addendum in any way that makes them legally binding on theParties and allows data subjects to enforce their rights as set out in thisPage 140
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Addendum. Entering into this Addendum will have the same effect as signing
the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum
3. Where this Addendum uses terms that are defined in the Approved EU SCCs
those terms shall have the same meaning as in the Approved EU SCCs. In
addition, the following terms have the following meanings:​Addendum​ his International Data Transfer Addendum which isTmade up of this Addendum incorporating the
Addendum EU SCCs.

​Addendum EU SCCs

​ he version(s) of the Approved EU SCCs which thisT
Addendum is appended to, as set out in Table 2,
including the Appendix Information.

​ ppendix
A
Information​As set out in Table ‎3.

​ ppropriate
A
Safeguards​ he standard of protection over the personal data and ofTdata subjects’ rights, which is required by UK Data
Protection Laws when you are making a RestrictedTransfer relying on standard data protection clauses
under Article 46(2)(d) UK GDPR.

​ pprovedA
Addendum​ he template Addendum issued by the ICO and laidT
before Parliament in accordance with s119A of the Data
Protection Act 2018 on 2 February 2022, as it is revised
under Section ‎18.

​Approved EU SCCs

​ he Standard Contractual Clauses set out in the Annex
Tof Commission Implementing Decision (EU) 2021/914 of
4 June 2021.

​ICO​The Information Commissioner.

Page 141
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

​Restricted Transfer​ transfer which is covered by Chapter V of the UK
A
GDPR.

​UK

​ he United Kingdom of Great Britain and NorthernT
Ireland.

​ K Data Protection
U
Laws​ ll laws relating to data protection, the processing ofA
personal data, privacy and/or electronic
communications in force from time to time in the UK,
including the UK GDPR and the Data Protection Act
2018.

​UK GDPR​As defined in section 3 of the Data Protection Act 2018.

4. This Addendum must always be interpreted in a manner that is consistent
with UK Data Protection Laws and so that it fulfils the Parties’ obligation toprovide the Appropriate Safeguards.
5. If the provisions included in the Addendum EU SCCs amend the Approved
SCCs in any way which is not permitted under the Approved EU SCCs or the
Approved Addendum, such amendment(s) will not be incorporated in thisAddendum and the equivalent provision of the Approved EU SCCs will taketheir place.
6. If there is any inconsistency or conflict between UK Data Protection Laws andthis Addendum, UK Data Protection Laws applies.
7. If the meaning of this Addendum is unclear or there is more than one
meaning, the meaning which most closely aligns with UK Data Protection
Laws applies.
8. Any references to legislation (or specific provisions of legislation) means thatlegislation (or specific provision) as it may change over time. This includes
where that legislation (or specific provision) has been consolidated, re-enacted
and/or replaced after this Addendum has been entered into.

Page 142
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Hierarchy
9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU
SCCs prevail over all related agreements between the parties, the parties agree
that, for Restricted Transfers, the hierarchy in Section ‎10 will prevail.
10. Where there is any inconsistency or conflict between the Approved
Addendum and the Addendum EU SCCs (as applicable), the Approved
Addendum overrides the Addendum EU SCCs, except where (and in so far as)
the inconsistent or conflicting terms of the Addendum EU SCCs provides
greater protection for data subjects, in which case those terms will override
the Approved Addendum.
11. Where this Addendum incorporates Addendum EU SCCs which have beenentered into to protect transfers subject to the General Data Protection
Regulation (EU) 2016/679 then the Parties acknowledge that nothing in thisAddendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs
12. This Addendum incorporates the Addendum EU SCCs which are amended tothe extent necessary so that:a. together they operate for data transfers made by the data exporter tothe data importer, to the extent that UK Data Protection Laws apply tothe data exporter’s processing when making that data transfer, andthey provide Appropriate Safeguards for those data transfers;
b. Sections ‎9 to ‎11 override Clause 5 (Hierarchy) of the Addendum EU SCCs;
andc. this Addendum (including the Addendum EU SCCs incorporated into it)is (1) governed by the laws of England and Wales and (2) any disputearising from it is resolved by the courts of England and Wales, in eachcase unless the laws and/or courts of Scotland or Northern Ireland havebeen expressly selected by the Parties.
13.Unless the Parties have agreed alternative amendments which meet therequirements of Section ‎12, the provisions of Section ‎15 will apply.
14.No amendments to the Approved EU SCCs other than to meet therequirements of Section ‎12 may be made.
15.The following amendments to the Addendum EU SCCs (for the purpose of
Section ‎12) are made:Page 143
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

a. References to the “Clauses” means this Addendum, incorporating the
Addendum EU SCCs;
b. In Clause 2, delete the words:“and, with respect to data transfers from controllers to processors
and/or processors to processors, standard contractual clauses
pursuant to Article 28(7) of Regulation (EU) 2016/679”;
c. Clause 6 (Description of the transfer(s)) is replaced with:“The details of the transfers(s) and in particular the categories of
personal data that are transferred and the purpose(s) for which they
are transferred) are those specified in Annex I.B where UK Data
Protection Laws apply to the data exporter’s processing when
making that transfer.”;d. Clause 8.7(i) of Module 1 is replaced with:“it is to a country benefitting from adequacy regulations pursuant to
Section 17A of the UK GDPR that covers the onward transfer”;
e. Clause 8.8(i) of Modules 2 and 3 is replaced with:“the onward transfer is to a country benefitting from adequacy
regulations pursuant to Section 17A of the UK GDPR that covers the
onward transfer;”f.

References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of 27 April 2016 on the protectionof natural persons with regard to the processing of personal data and on
the free movement of such data (General Data Protection Regulation)”and “that Regulation” are all replaced by “UK Data Protection Laws”.
References to specific Article(s) of “Regulation (EU) 2016/679” are replacedwith the equivalent Article or Section of UK Data Protection Laws;

g. References to Regulation (EU) 2018/1725 are removed;h. References to the “European Union”, “Union”, “EU”, “EU Member State”,“Member State” and “EU or Member State” are all replaced with the “UK”;i.

The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, isreplaced with “Clause 11(c)(i)”;j.

Clause 13(a) and Part C of Annex I are not used;

Page 144
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

k. The “competent supervisory authority” and “supervisory authority” areboth replaced with the “Information Commissioner”;l.

In Clause 16(e), subsection (i) is replaced with:“the Secretary of State makes regulations pursuant to Section 17A of
the Data Protection Act 2018 that cover the transfer of personal data
to which these clauses apply;”;m. Clause 17 is replaced with:“These Clauses are governed by the laws of England and Wales.”;n. Clause 18 is replaced with:“Any dispute arising from these Clauses shall be resolved by the
courts of England and Wales. A data subject may also bring legal
proceedings against the data exporter and/or data importer before
the courts of any country in the UK. The Parties agree to submit
themselves to the jurisdiction of such courts.”; ando. The footnotes to the Approved EU SCCs do not form part of the
Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum
16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU
SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
17. If the Parties wish to change the format of the information included in Part 1:
Tables of the Approved Addendum, they may do so by agreeing to the change
in writing, provided that the change does not reduce the Appropriate
Safeguards.
18. From time to time, the ICO may issue a revised Approved Addendum which:a. makes reasonable and proportionate changes to the Approved
Addendum, including correcting errors in the Approved Addendum;
and/orb. reflects changes to UK Data Protection Laws;
The revised Approved Addendum will specify the start date from which thechanges to the Approved Addendum are effective and whether the Parties
need to review this Addendum including the Appendix Information. This

Page 145
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Addendum is automatically amended as set out in the revised Approved
Addendum from the start date specified.
19.If the ICO issues a revised Approved Addendum under Section ‎18, if any Party
selected in Table 4 “Ending the Addendum when the Approved Addendum
changes”, will as a direct result of the changes in the Approved Addendum
have a substantial, disproportionate and demonstrable increase in:aits direct costs of performing its obligations under the Addendum;
and/orb

its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce those costs or risks
so that it is not substantial and disproportionate, then that Party may end thisAddendum at the end of a reasonable notice period, by providing written
notice for that period to the other Party before the start date of the revised
Approved Addendum.
20. The Parties do not need the consent of any third party to make changes to thisAddendum, but any changes must be made in accordance with its terms.

Page 146
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 15 – Data Processing Agreement for the United Kingdom

Data Processing Agreement for the United Kingdom
This Data Processing Agreement is concluded on the same date as the Services
Agreement (as defined below) and is concluded by and between(1)
the Controller, named with its Company details as a Party in the Services
Agreement; and(2)
the Processor, named with its Company details as a Party in the Services
Agreement.

(each a Party and together the Parties)

1.

Preamble

The Processor is a provider of professional services (Services). The Parties entered into an
Agreement which describes the Services provided by the Processor to or on behalf of theController in more detail (Services Agreement).
The Parties have agreed to enter into this Agreement in relation to the Processing of
Personal Data by the Processor in the course of providing the Services. The terms of thisAgreement are intended to apply in addition to and not in substitution of the terms of theServices Agreement.
2.

Definitions and interpretation

2.1.

In this Agreement the terms Controller, Processor, Personal Data, Special
Categories Of Personal Data, Processing, Pseudonymisation, Encryption,
Personal Data Breach, Supervisory Authority, Categories of Data Subject, Typesof Personal Data, Scope, and Purpose shall have the meanings given to them by
Data Protection Legislation (as defined below).

2.2.

In addition to those terms, the following definitions shall apply:Affiliates means in relation to the Controller, each and any business entity or
undertaking under the Controller’s direction and in relation to either Party, any
entity that directly or indirectly controls, is controlled by or is under common
control with that Party (where control is defined as the direct or indirect ownership

Page 147
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

or control of more than 50% of the shares or other equity securities, of an entity orof the power to direct or significantly influence the direction of the management,
policies and voting interests of an entity whether by contract or otherwise).
Authorised Person means the Person(s) be nominated by the Controller from time
to time in writing.
Business Day means a day other than a Saturday, Sunday or public holiday inEngland when banks in the City of London are generally open for business.
Data Protection Legislation means the UK-GDPR and any national laws,
regulations and secondary legislation in the UK; all applicable laws and regulations
relating to the Processing of Personal Data and privacy; and where applicable, theguidance and codes of practice issued by the UK Information Commissioner’s
Office (ICO) or any other Supervisory Authority (and the equivalent of any of theforegoing in any relevant jurisdiction).

EEA means the European Economic Area including, for the Purposes of thisAgreement, the UK.
Personnel means in relation to a Party, those of its employees, workers, agents,
consultants, contractors, sub-contractors, representatives or other Persons
employed or engaged by that Party on whatever terms.
Sub-Processor means any entity (whether or not an Affiliate of the Processor, but
excluding the Processor’s Personnel) appointed by or on behalf of the Processor toprocess Personal Data on behalf of the Controller under this Agreement.
2.3.

Clause, schedule and paragraph headings shall not affect the interpretation of thisAgreement.

2.4.

A Person includes a natural Person, corporate or unincorporated body (whether or
not having separate legal personality). A reference to a Company shall include any
Company, corporation or other body corporate, wherever and however
incorporated or established.

2.5.

Unless the context otherwise requires, any reference to a Party shall be deemed toinclude that Party’s Affiliates and where an obligation is imposed on a Party under
this Agreement, it will be required to procure compliance with such obligation bythat Party’s Affiliates where appropriate.

2.6.

Unless the context otherwise requires, words in the singular shall include the pluraland in the plural shall include the singular and a reference to one gender shall
include a reference to the other genders.

Page 148
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

2.7.

A reference to a statute or statutory provision is a reference to it as amended,
extended or re-enacted from time to time and shall include all subordinate
legislation made from time to time under that statute or statutory provision.

2.8.

Unless the context otherwise requires, a reference to writing or written includes
email but not fax.

2.9.

Any words following the terms including, include, in particular or for example or
any similar phrase shall be construed as illustrative and shall not limit thegenerality of the related general words.

2.10.

In the event of any ambiguity or inconsistency between the terms of thisAgreement (including its Schedules) and the terms of the Services Agreement, theterms of this Agreement shall take precedence.

3.

Roles and responsibilities
Schedule 1 sets out the Scope and Purpose of the Processing of Personal Data by
the Processor, the duration of the Processing and the Types of Personal Data andCategories of Data Subject concerned.

4.

Compliance with Data Protection Legislation

4.1.

Each Party shall comply with all applicable requirements of the Data Protection
Legislation. This clause is in addition to, and does not relieve any Party fromcomplying with, a Party’s obligations under the Data Protection Legislation.

4.2.

Without prejudice to the generality of this clause, the Controller will ensure that it
has all necessary appropriate consents and notices in place to enable the lawfultransfer to and Processing of the Personal Data by the Processor in connection
with the performance by the Processor of its obligations under the Services
Agreement and this Agreement.

4.3.

To the extent within the Controller’s control having regard to the Processor’s
obligations under the Services Agreement and this Agreement, the Controller shallbe responsible for the accuracy and quality of the Personal Data processed by theProcessor under this Agreement.

4.4.

The Processor shall have an ongoing obligation throughout the duration of theServices Agreement to identify and report to the Controller:
4.4.1.

Page 149
Version: 1.07
Classification: Public

best practice techniques relating to the Processing of Personal Data under
this Agreement; andPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

4.4.2.

the emergence of new and evolving technologies which could improve
the availability, confidentiality and/or integrity of the Processing of
Personal Data under this Agreement.

5.

Processing of Personal Data by the Processor

5.1.

The Processor shall only process Personal Data:
5.1.1.
5.1.2.

for the Purposes expressly specified in the Services Agreement;
otherwise in accordance with the Controller’s documented instructions asgiven by an Authorised Person,

unless the Processor is required by any applicable law to which the Processor issubject, to process Personal Data for any other Purposes (in which case theProcessor shall, to the extent permitted by such applicable law, inform theController of such legal requirement before undertaking such Processing).
5.2.

The Controller shall ensure that any Authorised Person is fully aware of the terms of
the Services Agreement and this Agreement such that the Processor shall beentitled to assume that any instruction given by any Authorised Person to theProcessor shall be given with the Controller’s full authority. The Controller further
acknowledges and agrees that the Processor shall not be under any duty toinvestigate the completeness, accuracy or sufficiency of any instructions given to it
by any Authorised Person.

6.

Processor’s Personnel

6.1.

The Processor shall take reasonable steps to ensure the reliability of those of its
Personnel who may have access to any Personal Data.

6.2.

The Processor shall ensure that those of its Personnel authorised to process
Personal Data under this Agreement:
6.2.1.
6.2.2.
6.2.3.

6.3.

are aware of the confidential nature of the Personal Data;
are bound by obligations of confidentiality by virtue of a written
Agreement between the Processor and such Persons; andhave received appropriate training on the handling of Personal Data andon their responsibilities in relation to the Processing of Personal Data.

The Processor shall implement appropriate technical and organisational measures
to ensure that those of its Personnel only have access to such part or parts of the
Personal Data as is strictly necessary for the performance of their duties andobligations.

Page 150
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

7.

Security of the Processing

7.1.

Taking into account the state of the art, the costs of implementation and thenature, Scope, context and Purposes of the Processing as well as the risk of varying
likelihood and severity for the rights and freedoms of the data subjects theProcessor shall, in relation to the Processing of Personal Data under thisAgreement, implement appropriate technical and organisational measures toensure a level of security appropriate to that risk, including, as appropriate:7.1.1.
7.1.2.
7.1.3.
7.1.4.

the Pseudonymisation and Encryption of Personal Data;
the ability to ensure the ongoing confidentiality, integrity, availability andresilience of Processing systems and services;
the ability to restore the availability and access to Personal Data in a timely
manner in the event of a physical or technical incident;
a process for regularly testing, assessing and evaluating the effectivenessof technical and organisational measures for ensuring the security of theProcessing.

7.2.

In assessing the appropriate level of security, the Processor shall take into accountany risks that are presented by the Processing, in particular, from a Personal Data
Breach.

7.3.

The Processor shall implement the specific security measures set out in Schedule
2. The Processor may add to, amend, or replace the specific security measures forsecurity reasons and shall notify the Controller in writing where it has done so.

8.

Sub-Processors

8.1.

The Controller hereby authorises the Processor to appoint Sub-Processors (General
Written Authorisation). The Processor shall name all its Sub-Processors to theController prior to initiation of Processing.

8.2.

With respect to each Sub-Processor appointed by the Processor under General
Written Authorisation, the Processor shall:
8.2.1.

8.2.2.

Page 151
Version: 1.07
Classification: Public

undertake appropriate due diligence prior to the Processing of Personal
Data by such Sub-Processor to ensure that it is capable of providing thelevel of protection for Personal Data required by the terms of the Services
Agreement and this Agreement;
enter into a written Agreement with the Sub-Processor incorporating
terms which are substantially similar (and no less onerous) than those set
out in this Agreement and which meets the requirements stipulated inarticle 28(3) of the UK-GDPR; andPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

8.2.3.

as between the Controller and the Processor, remain fully liable to theController for all acts or omissions of such Sub-Processor as though they
were its own.

8.3.

To the extent that the Processor has already appointed any Sub-Processors prior to
the Processing of any Personal Data under this Agreement, the Processor shallensure that its obligations under clause 8.2 are met as soon as practicable.

8.4.

Where the Processor proposes any changes concerning the addition or
replacement of any Sub-Processor, it shall notify the Controller in writing as soon asreasonably practicable prior to implementing such change specifying:
8.4.1.
8.4.2.
8.4.3.
8.4.4.

the name of any Sub-Processor which it proposes to add or replace;the Processing activity or activities affected by the proposed change;
the reasons for the proposed change; andthe proposed date for implementation of the change.

8.5.

If within thirty (30) days of receipt of a notice under clause 8.4 the Controller(acting reasonably and in good faith) notifies the Processor in writing of any
objections to the proposed change, the Parties shall use their respective
reasonable endeavours to resolve the Controller’s objections. Where such
resolution cannot be agreed within thirty (30) days of the Processor’s receipt of theController’s objections (or such longer period as the Parties may agree in writing)
the Controller may, notwithstanding the terms of the Services Agreement, serve
written notice on the Processor to terminate the Services Agreement (to the extent
that the provision of the Services is or would be affected by the proposed change).

8.6.

The Processor shall, upon the Controller’s request, provide the Controller withcopies of any Agreements between the Processor and its Sub-Processors (which
may be redacted to remove information which is confidential to the Processor
and/or its Sub-Processors and which is not relevant to the terms of thisAgreement).

9.

Rights of data subjects

9.1.

Taking into account the nature of the Processing, the Processor shall assist theController by implementing appropriate technical and organisational measures,
insofar as this is possible, for the fulfilment of the Controller’s obligation to respondto requests for exercising the data subject’s rights under the Data Protection
Legislation.

9.2.

Without prejudice to the generality of clause 9.1, the Processor shall implement
measures intended to uphold the rights of data subjects.

Page 152
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

9.3.

The Processor shall:
9.3.1.

9.3.2.

promptly and in any case within one (1) Business Day] notify the Controller
if it (or any of its Sub-Processors) receives a request from a data subject
under the Data Protection Legislation in respect of any Personal Data
processed by the Processor under the terms of the Services Agreement or
this Agreement; andgive to the Controller its full co-operation and assistance in relation to any
request made by a data subject to have access to their Personal Data.

10.

Notification of Personal Data Breaches

10.1.

The Processor shall notify the Controller without undue delay after becoming
aware of any Personal Data Breach affecting the Personal Data processed by theProcessor under this Agreement, providing sufficient information to enable theController to evaluate the impact of such Personal Data Breach and to meet any
obligations on the Controller to report the Personal Data Breach to a Supervisory
Authority and/or notify the affected data subjects in accordance with the Data
Protection Legislation.

10.2.

The Processor shall provide the Controller with such assistance as the Controller
may reasonably request and take such reasonable commercial steps as theController may request in order to evaluate, investigate, mitigate and remediate
any Personal Data Breach (including, where applicable, communicating any
Personal Data Breach to affected data subjects).

11.

Data Protection Impact Assessments and Prior Consultation
The Processor shall provide the Controller with such assistance as the Controller
may reasonably request with any data protection (or privacy) impact assessments
and prior consultation with any Supervisory Authority or other competentauthorities which the Controller considers necessary pursuant to Articles 35 and 36
of the UK-GDPR respectively. The Processor’s assistance shall, in each case, belimited to the Processing of Personal Data under this Agreement.

12.

Obligations upon expiry or termination of the Services Agreement

12.1.

Notwithstanding the Processor’s obligations under the Services Agreement
following its expiry or termination, the Processor shall promptly and in any event
within thirty (30) days of the expiry or termination of the Services Agreement, at
the Controller’s option (given by any Authorised Person) either delete or return (insuch format and on such media or by such means as the Parties shall agree in
writing) all copies of the Personal Data processed by the Processor and/or its
Sub-Processors on behalf of the Controller under this Agreement.

Page 153
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

12.2.

Where the Controller has instructed the Processor to delete the Personal Data
under clause 12.1, the Processor shall do so in accordance with best industry
practice for the reliable and secure deletion of data for the secure destruction ofconfidential material.

12.3.

The Processor (and those of its Sub-Processors, as appropriate) may retain a copy of
the Personal Data processed by it under this Agreement to the extent required byany applicable law to which the Processor (or any Sub-Processor) is subject andonly for such period as shall be required by such applicable law. Where applicable,
the Processor shall notify the Controller of such requirement and shall ensure thatsuch Personal Data are kept confidential and not processed for any other Purpose.

12.4.

The Controller may require the Processor to provide a written certificate confirmingthat it has complied with its obligations under this clause 12.

13.

Record-keeping requirements and audit rights

13.1.

The Processor shall maintain a record of all categories of processing activities
carried out by it on behalf of the Controller under this Agreement in accordancewith Data Protection Legislation (Processing Records).

13.2.

The Processor shall permit the Controller, any Authorised Person or any otherauditor mandated by the Controller, on reasonable notice and during theProcessor’s normal business hours (but without notice, in the case of any
reasonably suspected breach of this clause 13) to:
13.2.1.
13.2.2.

gain access to, and take copies of, the Processing Records and any otherinformation held at the Processor's premises; andinspect all Processing Records, documents and electronic data and theProcessor’s systems, facilities and equipment,

for the Purpose of auditing and certifying the Processor's compliance with its
obligations under this Agreement. Such audit rights may be exercised only once inany calendar year during the term of the Services Agreement and for a period of
three years following the expiry or termination of the Services Agreement.
13.3.

The Processor shall give all necessary assistance to the conduct of any audits underclause 13.2.

13.4.

The Processor further agrees that it shall provide the Controller with suchassistance as it may reasonably request in connection with any compulsory or
voluntary audit or inspection by a Supervisory Authority or other competentauthority.

Page 154
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

13.5.

The Processor shall immediately inform the Controller if, in its opinion, any
instruction infringes the Data Protection Legislation.

14.

Transfers of Personal Data outside of the EEA

14.1.

For the Purposes of this clause 14, the Transfer of any Personal Data shall include:
14.1.1.
14.1.2.
14.1.3.

14.2.

storing Personal Data on servers located or co-located outside the EEA;
appointing any Sub-Processor which is located outside the EEA (inaccordance with clause 8; orgranting access rights to any of the Processor’s Personnel who are locatedoutside the EEA.

The Processor shall not transfer any Personal Data processed under thisAgreement outside of the EEA except with the Controller’s prior written consent
and provided that the Controller is satisfied that the following conditions havebeen met:
14.2.1.

14.2.2.
14.2.3.

the Controller, the Processor and/or any Sub-Processor (as appropriate)
have (1) the International Data Transfer Agreement (published by the ICO)or (2) the International Data Transfer Addendum to the European
Commission’s Standard Contractual Clauses for International Data
Transfers (published by the ICO) and the Standard Contractual Clauses(Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on
standard contractual clauses for the transfer of personal data to third
countries pursuant to Regulation (EU) 2016/679 of the European
Parliament and of the Council or Commission Implementing Decision (EU)2021/915 of 4 June 2021 on standard contractual clauses between
controllers and processors under Article 28(7) of Regulation (EU) 2016/679
of the European Parliament and of the Council and Article 29(7) ofRegulation (EU) 2018/1725 of the European Parliament and of the Council)
in place;the data subject has enforceable rights and effective legal remedies inrelation to the Processing of Personal Data relating to them; andthe Processor and/or Sub-Processor (as appropriate) complies with its
obligations under the Data Protection Legislation by providing anadequate level of protection for any Personal Data that are transferred.

15.

General provisions

15.1.

Term and termination: Except in respect of any provision of this Agreement that
expressly or by implication is intended come into or continue in force on or after

Page 155
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

the expiry or termination of the Services Agreement, this Agreement shall becoterminous with the Services Agreement.
15.2.

Third Party rights: A Person who is not a Party to this Agreement shall not have any
rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any terms ofthis Agreement.

15.3.

Severance
15.3.1.

If any provision or part-provision of this Agreement is or becomes invalid,illegal or unenforceable, it shall be deemed modified to the minimum
extent necessary to make it valid, legal and enforceable. If suchmodification is not possible, the relevant provision or part-provision shallbe deemed deleted. Any modification to or deletion of a provision or
part-provision under this clause shall not affect the validity andenforceability of the rest of this Agreement.

15.3.2.

If any provision or part-provision of this Agreement is invalid, illegal or
unenforceable, the Parties shall negotiate in good faith to amend suchprovision so that, as amended, it is legal, valid and enforceable, and, to thegreatest extent possible, achieves the intended commercial result of theoriginal provision.

15.4.

Variation: Except as expressly provided in this Agreement, no variation of thisAgreement shall be effective unless it is in writing and signed by the Parties (ortheir authorised representatives).

15.5.

Governing law: This Agreement and any dispute or claim arising out of or inconnection with it or its subject matter or formation (including non-contractual
disputes or claims) shall be governed by and construed in accordance with English
law.

15.6.

Jurisdiction: Each Party irrevocably agrees that the English courts shall haveexclusive jurisdiction to settle any dispute or claim arising out of or in connection
with this Agreement or its subject matter or formation (including non-contractual
disputes or claims).

Page 156
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Schedule 1
1.

– Summary of the Processing activities

Processing by the Processora.

Scope of the Processing
See Services Agreementb.

Purpose of the Processing
See Services Agreementc.

Duration of the Processing
Duration of Services Agreement

2.

Types of Personal Data
Customer data, data of potential customers, employee data, data of business
partners, supplier data.

3.

Categories of Data Subject
Customers, potential customers, employees, business partners, suppliers.

Page 157
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Schedule 2– Specific security measures

See APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES

Page 158
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 16 – CCPA-CPRA CONTRACTOR AGREEMENT

CCPA-CPRA CONTRACTOR AGREEMENT
This CCPA-CPRA Contractor Agreement is concluded on the same date as the Services
Agreement (as defined below) and is concluded by and between(1)

the Business, named with its contact details as a Party in the Services Agreement;
and

(2)

the Contractor, named with its contact details as a Party in the Services
Agreement.

For the purpose of this Agreement the term Contractor shall include an Independent
Contractor and/or a Service Provider and/or a Third Party as defined by CCPA whererequired to include such parties and/or to allow the conclusion of this Agreement withthem as contractual partners.

(each a Party and together the Parties)

1.

Preamble

1.1.

The Contractor is a provider of professional Services (Services). The Parties enteredinto an Agreement which describes the Services provided by the Contractor to or
on behalf of the Business in more detail (Services Agreement).

1.2.

The Parties have agreed to enter into this Agreement in relation to the Processingof Personal Information by the Contractor in the course of providing the Services.
The terms of this Agreement are intended to apply in addition to and not in
substitution of the terms of the Services Agreement.

2.

Definitions and interpretation

2.1.

In this Agreement, in CCPA related written or verbal communication, in theServices Agreement and in any of its amendments the terms Advertising andMarketing, Aggregate Consumer Information, Biometric Information, Business,
Business Associate, Business Controller Information, Business Purpose,
Collected, Collection, Collects, Commercial Credit Reporting Agency,
Commercial Purposes, Common Branding, Consent, Consumer, Consumer
Privacy Fund, Contractor, Control, Controlled, Covered Person, Cross-Context

Page 159
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Behavioral Advertising, Dark Pattern, Deidentified, Designated Methods For
Submitting Requests, Device, Director, Family, Fraudulent Concealment,
Health Care Operations, Homepage, Household, Identifiable Private
Information, Independent Contractor, Individually Identifiable Health
Information, Infer, Inference, Intentionally Interacts, Management Employee,
Medical Information, Nonpersonalized Advertising, Officer, Owner, Ownership
Information, Patient Information, Payment, Person, Personal Information,
Precise Geolocation, Processing, Profiling, Protected Health Information,
Provider Of Health Care, Pseudonymization, Pseudonymize, Publicly Available,
Reidentify, Research, Right To Opt-Out, Sale, Security and Integrity, Sell,
Selling, Sensitive Personal Information, Service, Services, Share, Shared,
Sharing, Sold, Specific Pieces Of Information, Specific Pieces Of Information
Obtained From The Consumer, Third Party, Treatment, Unique Identifier,Unique Personal Identifier, Vehicle Information, Verifiable Consumer Request,
Vessel Dealer, Vessel Information and all other terms defined by or under Data
Protection Legislation shall have the meanings given to them by Data Protection
Legislation.
2.2.

In addition to those terms, the following definitions shall apply:Affiliate or Affiliates means each and any Person or undertaking under the Parties
direction and in relation to either Party, any Person that directly or indirectly
controls, is controlled by or is under common control with that Party (wherecontrol is defined as the direct or indirect ownership or control of at least 50% of
the shares (including joint-ventures and partners in which a business has at least a
40% interest) or other equity securities, of a Person or of the power to direct orsignificantly influence the direction of the management, policies and votinginterests of a Person whether by contract or otherwise).
Authorized Person means the Person(s) be nominated by the Business from time
to time in writing.
California Consumer Privacy Act or CCPA means Title 1.81.5 California Consumer
Privacy Act of 2018 (California Civil Code §§ 1798.100–1798.199), as amended orsuperseded from time to time.
California Privacy Rights Act or CPRA means the California Privacy Rights Act of
2020, (2020 Cal. Legis. Serv. Proposition 24, codified at Cal. Civ. Code §§ 1798.100 etseq.), and its implementing regulations, as amended or superseded from time totime.
Data Protection Legislation means CCPA and CPRA as well as any regulation
adopted, published, administered, implemented, or enforced by the California
Privacy Protection Agency or by the Attorney General to further the purposes of
CCPA and/or CPRA, and any related case-law.

Page 160
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Natural Person means any living individual that is a subject to the Data Protection
Legislation.
Personnel means in relation to a Party an employee of, a Management Employee
of, Owner of, Director of, Officer of, Medical Staff Member of, or other Natural
Person of that Party on whatever terms employed or engaged.
Sub-Contractor means any other Person (whether or not an Affiliate of theContractor, but excluding the Contractor’s Personnel) appointed by or on behalf of
the Contractor or its Sub-Contractors to Process Personal Information for a
Business Purpose on behalf of the Business under this Agreement or the Services
Agreement, and any other Person engaged to assist the Contractor in Processing
Personal Information for a Business Purpose on behalf of the Business, and anyother Person engaged by the Contractor engages another Person to assist in
Processing Personal Information for a Business Purpose.
2.3.

For the purpose of this Agreement the term CCPA shall include CPRA.

2.4.

Clause, schedule and paragraph headings shall not affect the interpretation of thisAgreement.

2.5.

A Person shall include a Natural Person, corporate or unincorporated body(whether or not having separate legal personality).

2.6.

A reference to a Company shall include any Company, corporation or other body
corporate, partnership, sole proprietorship, nonprofit, or government agency
wherever and however incorporated or established.

2.7.

Unless the context otherwise requires, any reference to a Party shall be deemed toinclude that Party’s Affiliates and where an obligation is imposed on a Party under
this Agreement, it will be required to procure compliance with such obligation bythat Party’s Affiliate where appropriate. For the avoidance of doubt, complianceshall be ensured by the Party that is affiliated with an Affiliate.

2.8.

Unless the context otherwise requires, words in the singular shall include the pluraland, in the plural, shall include the singular and a reference to one gender shall
include a reference to the other genders.

2.9.

A reference to a statute or statutory provision is a reference to it as amended,superseded, extended or re-enacted from time to time and shall include all
subordinate legislation made from time to time under that statute or statutory
provision, and the related case-law.

2.10.

Unless the context otherwise requires, a reference to writing or written includes
email but not fax.

Page 161
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

2.11.

Any words following the terms including, include, in particular or for example or
any similar phrase shall be construed as illustrative and shall not limit thegenerality of the related general words.

3.

Scope of this Agreement
This Agreement shall apply only where, and to the extent that, the Contractor
Processes Personal Information that is subject to Data Protection Legislation on
behalf of the Business as a Contractor in course of providing Services pursuant to
the Services Agreement.

4.

Compliance with Data Protection Legislation

4.1.

Each Party shall comply with all applicable requirements of Data Protection
Legislation.

4.2.

Without prejudice to the generality of this clause, the Business will ensure that it
has all necessary appropriate Consents and notices in place to enable the lawfultransfer to and Processing of the Personal Information by the Contractor inconnection with the performance of the Contractor’s obligations under theServices Agreement and this Agreement.

4.3.

To the extent within the Business’s Control having regard to the Contractor’s
obligations under the Services Agreement and this Agreement, the Business shallbe responsible for the accuracy and quality of the Personal Information Processedby the Contractor under the Services Agreement and this Agreement.

5.

Specification of the Personal Information which is disclosed to and/or
Processed by the Contractor (1798.100 (d) (1) CCPA)

5.1.

The Personal Information which is disclosed by the Business for limited andspecified purposes are:
Types of Personal Information: Customer data, data of potential customers,
employee data, data of business partners, supplier data, consumer data.
Categories of Data Subjects: Customers, potential customers, employees, business
partners, suppliers, consumers.
Limited and specified purposes: To fulfill the contractual obligations described in
the Services Agreement.

Page 162
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

6.

General obligations of the Contractor (1798.140 ( j) (1) and (ag) (1) CCPA)

6.1.

The Contractor shall not Sell or Share Personal Information.

6.2.

The Contractor shall not retain, use, or disclose the Personal Information for any
purpose other than for the Business Purposes specified in the Services Agreement
or in this Agreement, including retaining, using, or disclosing the Personal
Information for a Commercial Purpose other than the Business Purposes specified
in the Services Agreement or in this Agreement, or as otherwise permitted by Data
Protection Legislation.

6.3.

The Contractor shall not retain, use, or disclose the information outside of thedirect Business relationship between the Contractor and the Business.

6.4.

The Contractor shall not combine the Personal Information that the Contractor
receives pursuant to the Services Agreement with the Business with Personal
Information that it receives from or on behalf of another Person or Persons, orCollects from its own interaction with the Consumer, provided that the Contractor
may combine Personal Information to perform any Business Purpose as defined inregulations adopted pursuant to paragraph (10) of subdivision (a) of Section
1798.185 CCPA, except as provided for in paragraph (6) of subdivision (e) of Section
1798.140 CCPA and in regulations adopted by the California Privacy Protection
Agency.

6.5.

The Contractor certifies that it understands the restrictions above and that theContractor will comply with them.

6.6.

The Contractor permits the Business to monitor the Contractor’s compliance with
the Services Agreement and this Agreement through measures, including, but notlimited to, ongoing manual reviews and automated scans and regularassessments, audits, or other technical and operational testing at least once every
12 months.

6.7.

The Contractor shall only Process Personal Information for the purposes expressly
specified in the Services Agreement or this Agreement or otherwise in accordancewith the Business’s documented instructions as given by an Authorized Person,
unless the Contractor is required by any applicable law to which the Contractor issubject, to Process Personal Information for any other purposes, in which case theContractor shall, to the extent permitted by such applicable law, inform theBusiness of such legal requirement before undertaking such Processing.

7.

Sub-Contractor (1798.140 ( j) (2) and (ag) (2) CCPA)

Page 163
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

7.1.

If the Contractor engages any other Person to assist it in Processing Personal
Information for a Business Purpose on behalf of the Business, or if any other Person
engaged by the Contractor engages another Person to assist in Processing
Personal Information for that Business Purpose, it shall notify the Business of thatengagement, and the engagement shall be pursuant to the Services Agreementbinding the other Person to observe all the requirements set forth in paragraph (1)of subdivision (j) of Section 1798.140 CCPA and/or paragraph (1) of subdivision (ag)of Section 1798.140 CCPA.

7.2.

The Contractor has the Business’s general authorization for the engagement of
Sub-Contractor’s from an agreed list that is subject to notification, and from time
to time, after changes have been occurred, to re-notification. The Contractor shallspecifically inform in writing the Business of any intended changes of that list
through the addition or replacement of Sub-Contractor’s at least thirty (30) days inadvance, thereby giving the Business sufficient time to be able to object to suchchanges prior to the engagement of the concerned Sub-Contractor(s). The
Contractor shall provide the Business with the information necessary to enable theBusiness to exercise the right to object.

7.3.

Where the Contractor engages a Sub-Contractor for carrying out specificprocessing activities for a Business Purpose on behalf of the Business, it shall do so
by way of a contract which imposes on the Sub-Contractor, in substance, the same
privacy obligations as the ones imposed on the Contractor in accordance with theServices Agreement and this Agreement and Data Protection Legislation. The
Contractor shall ensure that the Sub-Contractor complies with the obligations towhich the Contractor is subject pursuant to the Services Agreement and thisAgreement and to Data Protection Legislation.

7.4.

At the Business’s request, the Contractor shall provide a copy of such a
Sub-Contractor agreement and any subsequent amendments to the Business. To
the extent necessary to protect business secrets or other confidential information,
including Personal Information, the Contractor may redact the text of theagreement prior to sharing the copy.

7.5.

The Contractor shall remain fully responsible to the Business for the performanceof the Sub-Contractor’s obligations in accordance with its contract with theContractor. The Contractor shall notify the Business of any failure by the
Sub-Contractor to fulfill its contractual obligations.

7.6.

The Contractor shall with regards to any Sub-Contractor undertake appropriate
due diligence prior to Processing of Personal Information that is Processed for a
Business Purpose on behalf of the Business by the Sub-Contractor to ensure that
the Sub-Contractor is capable of providing the level of protection for Personal

Page 164
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Information as it is required by the Services Agreement, this Agreement and Data
Protection Legislation.
7.7.

The Contractor shall ensure that the Personnel of all its Sub-Contractors and theirother Sub-Contractors and all individuals responsible for handling Consumer
inquiries about the Business’ privacy practices or the Business’ compliance with
Data Protection Legislation are informed of all requirements in Sections 1798.100,
1798.105, 1798.106, 1798.110, 1798.115, 1798.125, and 1798.130 CCPA, and how to direct
Consumers to exercise their rights under those sections (see paragraph (6) of
subdivision (a) of Section 1798.130).

8.

Obligation of Contractor to comply with applicable obligations (1798.100 (d) (2)
CCPA)

8.1.

The Contractor is obliged to comply with all applicable obligations of, and toprovide the same level of privacy protection as required by Data Protection
Legislation.

8.2.

The Contractor certifies to be, and to take from time to time all steps to stay at all
times, in full compliance with Data Protection Legislation whenever acting as aContractor on behalf of the Business as well as when acting as a Business in themeaning given in subdivision (d) of Cal. Civ. Code 1798.140 for its own Commercial
Purposes and/or Business Purposes whenever the Contractor is Processing
Personal Information of Personnel of the Business.

9.

Right to help ensure compliance with Business’ obligations (1798.100 (d) (3)
CCPA)

9.1.

The Contractor grants the Business the right to take reasonable and appropriate
steps to help ensure that the Contractor uses the Personal Information transferredin a manner consistent with the Business’ obligations under Data Protection
Legislation.

10.

Right to audit (1798.140 ( j) (1) (C) CCPA)

10.1.

The Contractor permits the Business, any Authorized Person or any other auditor
mandated by the Business, on reasonable notice and during the Contractor’s
normal Business hours (but without notice, in the case of any reasonably
suspected breach of this Agreement) to (a) gain access to, and take copies of, theprocessing records and any other information held at the Contractor's premises;and (b) inspect documents and electronic data and the Contractor’s systems,
facilities and equipment, for the purpose of auditing and certifying the Contractor's

Page 165
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

compliance with its obligations under the Services Agreement and thisAgreement.
10.2.

Such audit rights may be exercised only once in any calendar year during the termof the Services Agreement and for a period of three years following the expiry or
termination of the Services Agreement. The Contractor shall give all necessary
assistance to the conduct of any audits.

10.3.

The Contractor further agrees that it shall provide the Business with suchassistance as it may reasonably request in connection with any compulsory or
voluntary audit or inspection by the California Privacy Protection Agency or by the
Attorney General.

11.

Notification of failure to comply with Data Protection Legislation (1798.100 (d)(4) CCPA)

11.1.

The Contractor shall notify the Business if it makes the determination that it can nolonger meet its obligations under Data Protection Legislation.

12.

Stop and remediate unauthorized use of Personal Information (1798.100 (d) (5)
CCPA)

12.1.

The Contractor grants the Business the right, upon notice, including under Section
1798.100 (d) (4) CCPA, to take reasonable and appropriate steps to stop andremediate unauthorized use of Personal Information.

13.

Deletion of Consumer’s Personal Information (1798.105 (c) (3) and (d) CCPA)

13.1.

The Contractor shall cooperate with the Business in responding to a Verifiable
Consumer Request, and at the direction of the Business, shall delete, or enable theBusiness to delete and shall notify any of its own Service Providers or Contractors todelete Personal Information about the Consumer Collected, Used, Processed, orRetained by the Contractor.

13.2.

The Contractor shall notify any Service Providers, Contractors, or Third Parties who
may have accessed Personal Information from or through the Contractor, unlessthe information was accessed at the direction of the Business, to delete theConsumer’s Personal Information unless this proves impossible or involves
disproportionate effort.

13.3.

The Contractor shall not be required to comply with a deletion request submitted
by the Consumer directly to the Contractor to the extent that the Contractor has
Collected, Used, Processed, or Retained the Consumer’s Personal Information in its
role as a Contractor to the Business.

Page 166
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

13.4.

The Contractor acting pursuant to its Services Agreement with the Business,
another Service Provider, or another Contractor, is not required to comply with a
Consumer’s request to delete the Consumer’s Personal Information if it isreasonably necessary for the Business or Contractor to maintain the Consumer’s
Personal Information in order to (1) complete the transaction for which the
Personal Information was Collected, fulfill the terms of a written warranty or
product recall conducted in accordance with federal law, provide a good or service
requested by the Consumer, or reasonably anticipated by the Consumer within thecontext of a Business’ ongoing Business relationship with the Consumer, orotherwise perform a contract between the Business and the Consumer, or (2) help
to ensure security and integrity to the extent the use of the Consumer’s Personal
Information is reasonably necessary and proportionate for those purposes, or (3)debug to identify and repair errors that impair existing intended functionality, or(4) exercise free speech, ensure the right of another Consumer to exercise that
Consumer’s right of free speech, or exercise another right provided for by law, or (5)comply with the California Electronic Communications Privacy Act pursuant toChapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code,or (6) engage in public or peer-reviewed scientific, historical, or statistical researchthat conforms or adheres to all other applicable ethics and privacy laws, when theBusiness’ deletion of the information is likely to render impossible or seriously
impair the ability to complete such research, if the Consumer has provided
informed Consent, or (7) enable solely internal uses that are reasonably alignedwith the expectations of the Consumer based on the Consumer’s relationship with
the Business and compatible with the context in which the Consumer provided
the information, or (8) comply with a legal obligation.

14.

Sell or Share of Personal Information by another Service Provider, another
Contractor or Third Party (1798.115 (d) CCPA)

14.1.

The Contractor shall contractually prevent any other Service Provider, or other
Contractor or Third Party from Selling or Sharing Personal Information about aConsumer that has been Sold to, or Shared with, the other Service Provider, orother Contractor or the Third Party by the Contractor unless the Consumer hasreceived explicit notice and is provided an opportunity to exercise the right to
opt-out pursuant to Section 1798.120 CCPA.

14.2.

Where the Contractor acts, based on the relationship between the Business to aclient of the Business (for the avoidance of doubt, where the Business is a
Contractor for another Business) as another Service Provider, or other Contractor or
Third Party, the Contractor shall not Sell or Share Personal Information about aConsumer that has been Sold to, or Shared with, the Contractor by the Business,
unless the Consumer has received explicit notice and is provided an opportunity to
exercise the right to opt-out pursuant to Section 1798.120 CCPA.

Page 167
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

15.

Consumers’ Right to Limit Use and Disclosure of Sensitive Personal
Information (1798.121 (a) and (c) CCPA)

15.1.

In case the Contractor assists the Business in performing the purposes authorized
by subdivision (a) of Section 1798.121 CCPA, the Contractor shall not use theSensitive Personal Information after it has received instructions from the Businessand to the extent it has actual knowledge that the Personal Information is
Sensitive Personal Information for any other purpose.

15.2.

The Contractor shall limit its use of the Consumer’s Sensitive Personal Informationthat are Processed on behalf of the Business under this Agreement to that use
which is necessary to perform the Services or provide the goods, and shall Process
only in accordance with documented instructions given by the Business. The
Contractor shall not disclose the Consumer’s sensitive Personal Information to any
Third Party.

16.

Disclosure, Correction, and Deletion requirements (1798.130 CCPA)

16.1.

In case the Business receives a Verifiable Consumer Request pursuant to Section
1798.110 CCPA or 1798.115 CCPA the Contractor shall assist the Business inanswering such request.

16.2.

The Contractor shall not comply with a Verifiable Consumer Request received
directly from a Consumer or a Consumer’s Authorized Agent, pursuant to Section
1798.110 CCPA or 1798.115 CCPA, to the extent that the Contractor has Collected
Personal Information about the Consumer in its role as a Contractor. In such case
the Contractor shall inform the Business without undue delay about receiving the
Verifiable Consumer Request.

16.3.

The Contractor shall provide assistance to the Business with respect to theBusiness’ response to a Verifiable Consumer Request, including, but not limited to,by providing to the Business the Consumer’s Personal Information in theContractor’s possession, which the Contractor obtained as a result of providing
Services to the Business, and by correcting inaccurate information or by enabling
the Business to do the same.

16.4.

The Contractor shall disclose and deliver the required information to the Businessfree of charge, correct inaccurate Personal Information, or delete a Consumer’s
Personal Information, based on the Consumer’s request, within fifteen (15) days ofreceiving a Request from the Business.

Page 168
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

16.5.

The Contractor shall assist the Business through appropriate technical andorganizational measures in complying with the requirements of subdivisions (d) to(f), inclusive, of Section 1798.100 CCPA, taking into account the nature of theProcessing.

17.

General Assistance by the Contractor, Assistance with Consumer Rights
Whenever required, the Contractor shall assist the Business to comply with Data
Protection Legislation, including, but not limited to, assisting to comply with the
obligations imposed on Businesses by Sections 1798.100, 1798.105, 1798.106, 1798.110,
1798.115, 1798.121, 1798.125, 1798.130, and 1798.135 CCPA.

18.

Opt-Out and Advertising and Marketing (1798.140 (e) (6) CCPA)

18.1.

The Contractor shall not combine the Personal Information of opted-out
Consumers that the Contractor receives from, or on behalf of, the Business with
Personal Information that the Contractor receives from, or on behalf of, another
Person or Persons or Collects from its own interaction with the Consumer for the
purpose of providing advertising and marketing to the Consumer.

19.

Processing of other Personal Information by the Business and the Contractor
for their own Business Purposes (1798.145 (m) (1) and (n) (1) CCPA)

19.1.

The Business is collecting and Processing Personal Information about Natural
Persons in the course of these Natural Persons acting as a job applicant to,employee of, Owner of, Director of, Officer of, Medical Staff Member of,
Independent Contractor of, another Service Provider of, another Contractor of, or
Third Party of the Contractor or its Sub-Contractors to the extent that the Natural
Person’s Personal Information is Collected and used by the Business solely within
the context of the Natural Person’s role or former role as a job applicant to,employee of, Owner of, Director of, Officer of, Medical Staff Member of, an
Independent Contractor of, another Service Provider of, another Contractor of, or
Third Party of the Contractor and/or its Sub-Contractors. The Personal Information
may include, but is not limited to, emergency contact information and informationthat is necessary for the Business to retain to administer benefits for another
Natural Person.

19.2.

The Business is collecting and Processing Personal Information reflecting written
or verbal communications or transactions between the Business and theConsumer, where the Consumer is a Natural Person who acted or is acting as a job
applicant to, an employee, Owner, Director, Officer, or Independent Contractor,
another Service Provider of, another Contractor of, or Third Party of a Company,
partnership, sole proprietorship, nonprofit, or government agency and whose
communications or transactions with the Business occur solely within the context

Page 169
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

of the Business conducting due diligence regarding, or providing or receiving a
product or service to or from such Company, partnership, sole proprietorship,
nonprofit, or government agency.
19.3.

The Contractor shall inform any job applicant to, employee of, Owner of, Director of,
Officer of, Medical Staff Member of, Independent Contractor of, another Service
Provider of, another Contractor of, or Third Party of such Company, partnership,
sole proprietorship, nonprofit, or government agency that is engaged with theContractor for a Business Purpose on behalf of the Business, the Contractor and/or
its Sub-Contractors about the transparency document published by the Businesson its Homepage that contains information in regards to obligations imposed on
Businesses by Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.121,
1798.125, 1798.130, and 1798.135 CCPA for these groups of Natural Persons.

19.4.

The Contractor shall publish a document on its Homepage that contains
information in regards to the obligations imposed on Businesses by Sections
1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.121, 1798.125, 1798.130, and 1798.135
CCPA and inform any job applicant to, employee of, Owner of, Director of, Officer of,Medical Staff Member of, Independent Contractor of, another Service Provider of,another Contractor of, or Third Party of the Business of whose Personal Informationis Collected or Processed by the Contractor for its own Business Purposes about its
own publication.

20.

Reliability of and contract with the Contractor’s Personnel, access limitation,
training, and information requirements

20.1.

The Contractor shall take reasonable steps to ensure reliability of those of its
Personnel who may have access to any Personal Information that is Processed for a
Business Purpose on behalf of the Business.

20.2.

The Contractor shall ensure that those of its Personnel authorized to Process
Personal Information under the Service Agreement or this Agreement (a) areaware of the confidential nature of the Personal Information, and (b) are bound by
obligations of confidentiality by virtue of a written contract between the Contractor
and such Persons; and (c) have received appropriate training on the handling of
Personal Information and on their responsibilities in relation to the Processing of
Personal Information.

20.3.

The Contractor shall implement reasonable security procedures and practices aswell as technical and organizational measures to ensure that those of its Personnel
only have access to such part or parts of the Personal Information that is Processed
for a Business Purpose on behalf of the Business as is strictly necessary for the
performance of their duties and obligations.

Page 170
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

20.4.

The Contractor shall ensure that its Personnel and all individuals responsible forhandling Consumer inquiries about the Business’ privacy practices or the Business’
compliance with Data Protection Legislation are informed of all requirements in
Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.125, and 1798.130 CCPA,
and how to direct Consumers to exercise their rights under those sections (seeparagraph (6) of subdivision (a) of Section 1798.130).

21.

Reasonable security procedures and practices (1798.150 (a) (1) CCPA)

21.1.

Where appropriate and/or required to protect the rights and freedoms of Natural
Persons, the Contractor shall encrypt and/or redact Personal Information that is
Processed for a Business Purpose on behalf of the Business, as defined insubparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5 CCPA.

21.2.

To the extend such Personal Information is Processed for a Business Purpose on
behalf of the Business, the Contractor shall encrypt email addresses, passwords,
security questions and security answers that would permit access to an account.

21.3.

The Contractor shall implement and maintain at all times reasonable security
procedures and practices appropriate to the nature of the information to protect all
Personal Information that is Processed for a Business Purpose on behalf of theBusiness, pursuant to Section 1798.81.5 CCPA.

21.4.

The Contractor has implemented reasonable security procedures and practices
and published them on its Homepage and/or communicated them to theBusiness. The Contractor may add to, amend, or replace the reasonable security
procedures and practices for security reasons and shall notify the Business inwriting where it has done so at least ten (10) days before such changes are in effect,
thereby giving the Business sufficient time to be able to object to such changes
prior to them becoming effective. The Contractor shall provide the Business with
the information necessary to enable the Business to exercise the right to object.

21.5.

The Contractor shall, in relation to the Personal Information that is Processed for a
Business Purpose on behalf of the Business, ensure ongoing confidentiality,
integrity, availability and resilience of processing systems and Services, and theability to restore the availability and access to Personal Information in a timely
manner in the event of a physical or technical incident.

22.

Liability and indemnification (1798.145. (i) (1) and (2) CCPA)

22.1.

The Business shall not be liable under CCPA if the Contractor receiving Personal
Information from the Business uses it in violation of the restrictions set forth in
CCPA. At the time of disclosing the Personal Information, the Business does not

Page 171
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

have actual knowledge, or reason to believe, that the Service Provider or Contractor
intends to commit such a violation.
22.2.

The Contractor agrees to indemnify, defend, and hold harmless the Business fromand against any loss, cost, or damage of any kind (including reasonable outside
attorneys' fees) to the extent arising out of any breach of Data Protection
Legislation by the Contractor, and/or its negligence or willful misconduct.

23.

Obligations upon expiry or termination of the Services Agreement

23.1.

Notwithstanding the Contractor’s obligations under the Services Agreement
following its expiry or termination, the Contractor shall promptly and in any event
within thirty (30) days of the expiry or termination of the Services Agreement, at
the Business’s option (given by any Authorized Person) either delete or return (insuch format and on such media or by such means as the Parties shall agree in
writing) all copies of the Personal Information Processed by the Contractor and/or
its Sub-Contractors for a Business Purpose on behalf of the Business under thisAgreement or the Services Agreement.

23.2.

Where the Business has instructed the Contractor to delete the Personal
Information, the Contractor shall do so in accordance with best industry practices
for the reliable and secure deletion of data or for the secure destruction ofconfidential material.

23.3.

The Contractor (and those of its Sub-Contractors, as appropriate) may retain a copyof the Personal Information Processed for a Business Purpose on behalf of theBusiness under this Agreement or the Services Agreement to the extent requiredby any applicable law to which the Contractor (or any Sub-Contractor) is subject
and only for such period as shall be required by such applicable law. Where
applicable, the Contractor shall notify the Business of such requirement and shallensure that such Personal Information are kept confidential and not Processed forany other purpose.

23.4.

The Business may require the Contractor to provide a written certificate confirmingthat it has complied with its obligations under this paragraph.

24.

Notification of Personal Information Security Breaches

24.1.

The Contractor shall notify the Business without undue delay after becoming
aware of a Personal Information Security Breach affecting the Personal Information
Processed for a Business Purpose on behalf of the Business under this Agreement
or the Services Agreement, providing sufficient information to enable the Businessto evaluate the impact of such Personal Information Security Breach and to meet
any obligations of the Business in accordance with Data Protection Legislation.

Page 172
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

24.2.

The Contractor shall provide the Business with such assistance as the Businessmay reasonably request and take such reasonable commercial steps as theBusiness may request in order to evaluate, investigate, mitigate and remediate any
Personal
Information
Security
Breach(including,whereapplicable,communicating any Personal Information Security Breach to affected Consumers).

25.

General provisions

25.1.

Term and termination: Except in respect of any provision of this Agreement that
expressly or by implication is intended come into or continue in force on or after
the expiry or termination of the Services Agreement, this Agreement shall becoterminous with the Services Agreement.

25.2.

Third Party rights: A Person who is not a Party to this Agreement shall not have any
rights to enforce any terms of this Agreement.

25.3.

Severance: If any provision or part-provision of this Agreement is or becomes
invalid, illegal or unenforceable, it shall be deemed modified to the minimum
extent necessary to make it valid, legal and enforceable. If such modification is notpossible, the relevant provision or part-provision shall be deemed deleted. Any
modification to or deletion of a provision or part-provision under this clause shallnot affect the validity and enforceability of the rest of this Agreement. If any
provision or part-provision of this Agreement is invalid, illegal or unenforceable, theParties shall negotiate in good faith to amend such provision so that, as amended,
it is legal, valid and enforceable, and, to the greatest extent possible, achieves theintended commercial result of the original provision.

25.4.

Variation: Except as expressly provided in this Agreement, no variation of thisAgreement shall be effective unless it is in writing and signed by the Parties (ortheir authorized representatives) or otherwise accepted by the Parties.

25.5.

This Agreement supersedes any conflicting or inconsistent provisions in theServices Agreement or any other contract between the Parties related to theProcessing of Personal Information subject to the Data Protection Legislation and,in the event of ambiguity, this Agreement will prevail. The Services Agreement or
any other contract between the Parties, as amended and modified by thisAgreement, otherwise remain in full force and effect.

Page 173
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 17 – Data Processing Agreement, Joint Controllership
Agreement and Cross-Border Personal Data Transfer and Sharing
Agreement for the United Arab Emirates

Data Processing Agreement, Joint Controllership Agreement
and Cross-Border Personal Data Transfer and Sharing
Agreement for the United Arab Emirates
This Data Processing Agreement, Joint Controllership Agreement and Cross-Border
Personal Data Transfer and Sharing Agreement for the United Arab Emirates (Agreement)
is concluded on the same date as the Services Agreement (as defined below) and isconcluded by and between(1)
the Controller, named with its Company details as a Party in the Services
Agreement; and(2)
the Other Party, named with its Company details as a Party in the Services
Agreement.

(together the Parties)

1.

Preamble

1.1

The Other Party is a provider of professional services (Services) and/or provides its
Services as a Joint-Controller. The Parties entered into an agreement which
describes the Services provided by the Other Party acting on behalf of theController or as an Other Controller, or acting jointly with the Controller, in detail(Services Agreement).

1.2

The Parties have agreed to enter into this Agreement in relation to the Processingof Personal Data by the Other Party, or jointly by the Other Party and theController, in the course of providing the Services. The terms of this Agreement are
intended to apply in addition to and not in substitution of the terms of the Services
Agreement.

2.

Definitions and interpretation

2.1

PDPL means the Decree Law No. 45 of 2021 as issued at the Presidential Palace in
Abu Dhabi and published in the Official Gazette which is in force since 2nd ofPage 174
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

January 2022, as amended or superseded from time to time. The legal definitions
from Art. 1 PDPL apply and shall have the meanings given to them by Data
Protection Legislation.
2.2

Other Controller means an establishment or natural person acting as a Controller,
who has Personal Data and who, given the nature of his/her activity, specifies themethod, criteria and purpose of Processing such Personal Data, whether
individually or jointly with other persons or establishments, that is Processing
Personal Data that originated from the Controller, whether the data is transferredin a Cross-Border Personal Data Transfer, Shared, or Processed within the United
Arab Emirates.

2.3

Joint-Controller means an establishment or natural person who Processes
Personal Data jointly with the Controller.

2.4

Data Protection Legislation means the Decree Law No. 45 of 2021 as well as any
regulation adopted, published, administered, implemented, or enforced by theGovernment of the United Arab Emirates or by one of the seven emirates, as
amended or superseded from time to time, all related Executive Regulations
regarding or concretizing the PDPL, and any related case-law.

3.

Applicability of the Agreement
This Agreement shall apply to the Processing of Personal Data, whether totally or
partially, through automatically operated electronic systems or other means, by (1)any Other Controller, Joint-Controller or Processor located in the United ArabEmirates who carries out the activities of Processing Personal Data of Data
Subjects inside or outside the United Arab Emirates, and (2) any Other Controller,
Joint-Controller or Processor located outside the United Arab Emirates who carries
out the activities of Processing Personal Data of Data Subjects inside the United
Arab Emirates, as long as (3) such Personal Data is or will be Processed on behalf of
the Controller, or in Joint-Controllership with the Controller, or is or will be Subject
to a Cross-Border Personal Data Transfer and/or Sharing for Processing Purposes
executed or initiated by or jointly with the Controller.

4.

Compliance with Data Protection Legislation

4.1

Each Party shall comply with all applicable requirements of Data Protection
Legislation. This Clause is in addition to, and does not relieve any Party fromcomplying with, a Party’s obligations under Data Protection Legislation.

4.2

If the Other Party is a Processor, without prejudice to the generality of this Clause,
the Controller will ensure that it has all necessary Consents and notices in place toenable the lawful transfer to and Processing of the Personal Data by the Processor

Page 175
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

in connection with the performance of its obligations under the Services
Agreement.
4.3

If the Other Party is a Processor, to the extent within the Controller’s control having
regard to the Processor’s obligations under the Services Agreement, the Controller
shall be responsible for the accuracy and quality of the Personal Data Processed by
the Processor.

4.4

If the Other Party is a Processor, the Processor shall have an ongoing obligation
throughout the duration of the Services Agreement to identify and report to theController best practice techniques relating to the Processing of Personal Data andthe emergence of new and evolving technologies which could improve theavailability, confidentiality and/or integrity of the Processing of Personal Data.

5.

Sub-Processors

5.1

If the Processing involves more than one Processor (Sub-Processor), theProcessing must be made in accordance with a contract or written agreement
whereby their obligations, responsibilities and roles related to the Processing areclearly defined.

5.2

The Controller hereby authorizes the Other Party to appoint Sub-Processors(General Written Authorization). The Other Party shall name all its Sub-Processors
to the Controller prior to initiation of Processing.

5.3

With respect to each Sub-Processor appointed by the Other Party under General
Written Authorization, the Other Party shall (a) undertake appropriate due
diligence prior to the Processing of Personal Data by such Sub-Processor to ensurethat it is capable of providing the level of protection for Personal Data required by
the terms of the Services Agreement and this Agreement, and (b) enter into a
written Agreement with the Sub-Processor incorporating terms which aresubstantially similar (and no less onerous) than those set out in this Agreement
and which meet the requirements stipulated by PDPL.

5.4

In regard to the Agreement between the Controller and the Other Party, the Other
Party remain fully liable to the Controller for all acts or omissions of its
Sub-Processor as though they were its own.

5.5

To the extent that the Other Party has already appointed any Sub-Processors prior
to the Processing of any Personal Data under this Agreement, the Other Party shallensure that its obligations under this Section are met.

Page 176
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

5.6

Where the Other Party proposes any changes concerning the addition or
replacement of any Sub-Processor, it shall notify the Controller in writing as soon asreasonably practicable prior to implementing such change specifying (a) the nameof any Sub-Processor which it proposes to add or replace, and (b) the Processing
activity or activities affected by the proposed change, and (c) the reasons for the
proposed change; and (d) the proposed date for implementation of the change.

5.7

If within thirty (30) days of receipt of a notice the Controller (acting reasonably andin good faith) notifies the Other Party in writing of any objections to the proposedchange, the Parties shall use their respective reasonable endeavors to resolve theController’s objections. Where such resolution cannot be agreed within thirty (30)days of the Other Party’s receipt of the Controller’s objections (or such longer
period as the Parties may agree in writing) the Controller may, notwithstanding
the terms of the Services Agreement, serve written notice on the Other Party toterminate the Services Agreement (to the extent that the provision of the Services
are or would be affected by the proposed change).

5.8

The Other Party shall, upon the Controller’s request, provide the Controller withcopies of any Agreements between the Other Party and its Sub-Processors (which
may be redacted to remove information which is confidential to the Other Party
and/or its Sub-Processors and which is not relevant to the terms of thisAgreement).

6.

Data Subject's Consent and Exceptions

6.1

The Other Party shall Process Personal Data only with the Data Subject's Consent.

6.2

If the Other Party is a Processor, the Data Subject's Consent shall be obtained by
the Controller. The Processor shall obtain proof of the Data Subject's Consent fromthe Controller before starting the Processing of Personal Data of Data Subject's.

6.3

If the Other Party and the Controller act as Joint-Controllers, the Data Subject's
Consent may be obtained by either party. If the Data Subject's Consent was
obtained by one of the Joint-Controllers, that Joint-Controller shall, before startingor initiating the Processing of Personal Data of Data Subject's, inform the second
Joint-Controller about obtaining the required Consent.

6.4

If the Other Party is an Other Controller and/or in any case of a Cross-Border
Personal Data Transfer and/or Sharing for Processing Purposes the Other Party
shall obtain the Data Subject's Consent before starting the Processing of Personal
Data of Data Subject's.

6.5

In the following cases, in which Processing is considered lawful, the Other Party
may Process without the Data Subject's Consent, namely (1) if the Processing isPage 177
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

necessary to protect the public interest, or (2) if the Processing is for Personal Data
that has become available and known to the public by an act of the Data Subject,or (3) if the Processing is necessary to initiate or defend against any actions toclaim rights or legal proceedings, or related to judicial or security procedures, or (4)if the Processing is necessary for the purposes of occupational or preventive
medicine, for assessment of the working capacity of an employee, medical
diagnosis, provision of health or social care, treatment or health insurance services,or management of health or social care systems and services, in accordance withthe legislation in force in the United Arab Emirates, or (5) if the Processing isnecessary to protect public health, including the protection from communicablediseases and epidemics, or for the purposes of ensuring the safety and quality ofhealth care, medicines, drugs and medical devices, in accordance with thelegislation in force in the United Arab Emirates, or (6) if the Processing is necessary
for archival purposes or for scientific, historical and statistical studies, in accordancewith the legislation in force in the United Arab Emirates, or (7) if the Processing isnecessary to protect the interests of the Data Subject, or (8) if the Processing isnecessary for the Controller or Data Subject to fulfill his/her obligations andexercise his/her legally established rights in the field of employment, social security
or laws on social protection, to the extent permitted by those laws, or (9) if theProcessing is necessary to perform a contract to which the Data Subject is a party
or to take, at the request of the Data Subject, procedures for concluding, amendingor terminating a contract, or (10) if the Processing is necessary to fulfill obligations
imposed by other laws of the United Arab Emirates on Controllers, or (11) any othercases set by the Executive Regulations of PDPL.
7.

Personal Data Processing Controls
The Other Party shall Process Personal Data only according to the following
controls, namely (1) Processing must be made in a fair, transparent and lawfulmanner, and (2) Personal Data must be collected for a specific and clear purpose,and may not be Processed at any subsequent time in a manner incompatible withthat purpose. However, Personal Data may be Processed if the purpose ofProcessing is similar or close to the purpose for which such data is collected, and(3) Personal Data must be sufficient for and limited to the purpose for which theProcessing is made, and (4) Personal Data must be accurate and correct and must
be updated whenever necessary, and (5) Appropriate measures and proceduresmust be in place to ensure erasure or correction of incorrect Personal Data, and (6)Personal Data must be kept securely and protected from any breach, infringement,
or illegal or unauthorized Processing by establishing and applying appropriatetechnical and organizational measures and procedures in accordance with thelaws and legislation in force in this regard, and (7) Personal Data may not be kept
after fulfilling the purpose of Processing. It may only be kept in the event that theidentity of the Data Subject is anonymized using the “Anonymization” feature, and(8) any other controls set by the Executive Regulations of PDPL.

Page 178
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

8.

Conditions for Consent to Data Processing

8.1

If the Other Party is an Other Controller or acts jointly as a Joint-Controller with theController, the Other Party shall be able to prove the Consent of the Data Subject
to Process his/her Personal Data in the event that the Processing is based on such
Consent.

8.2

If the Other Party is an Other Controller, or acts jointly as a Joint-Controller with theController, the Other Party shall be able to prove that Consent was given in a clear,simple, unambiguous and easily accessible manner, whether in writing orelectronic form and that the Consent language indicated the right of the Data
Subject to withdraw, at any time, its Consent and that such withdrawal could be
easily made, and that such withdrawal shall not affect the legality and lawfulness of
the Processing made based on the Consent given prior to the withdrawal.

9.

General Obligations of the Other Party

9.1

The Other Party shall take appropriate technical and organizational measures andprocedures to apply the necessary standards to protect and secure Personal Data,in order to maintain its confidentiality and privacy and to ensure that it is not
infringed, damaged, altered or tampered with, taking into account the nature,
scope and purposes of Processing and the potential risks to the confidentiality andprivacy of the Personal Data of the Data Subject. The Parties agreed on therequired technical and organizational measures and procedures in APPENDIX 9 –TECHNICAL AND ORGANISATIONAL MEASURES.

9.2

The Other Party shall apply the appropriate measures, both when defining themeans of Processing or during the Processing itself, in order to comply with theprovisions of PDPL, including the controls stipulated in Article 5 PDPL. Suchmeasures may include Pseudonymization.

9.3

The Other Party shall apply the appropriate technical and organizational measureswith respect to default settings to ensure that the Processing of Personal Data islimited to its intended purpose. This obligation applies to the amount and type of
Personal Data collected, the type of Processing to be made thereon, and the periodof storage and accessibility of such data.

9.4

The Other Party shall maintain a special record of Personal Data which must
include the data of the Controller and Data Protection Officer, as well as a
description of the categories of Personal Data held thereby, data of the persons
authorized to access such Personal Data, the Processing durations, restrictions andscope, the mechanism of erasure, modification or Processing of Personal Data, thepurpose of Processing and any data related to the movement and Cross-Border

Page 179
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Processing of such data, while indicating the technical and organizational
procedures related to information security and Processing operations, provided
that the Controller provides this record to the UAE Data Office whenever requested
to do so.
9.5

The Other Party shall appoint only Processors who provide sufficient guarantees toapply technical and organizational measures in a manner that ensures that theProcessing meets the Processing requirements, rules and controls stipulated by
PDPL, the Executive Regulations of PDPL and decisions issued in implementationof PDPL.

9.6

The Other Party shall provide the UAE Data Office, based on a decision from thecompetent judicial authority, with any information requested thereby in exercise of
its competencies stipulated by PDPL and the Executive Regulations of PDPL.

9.7

The Other Party shall fulfill any other obligations set by the Executive Regulationsof PDPL. The Other Party shall monitor and abide the Executive Regulations of
PDPL.

10.

General Obligations of the Other Party if that Party acts as a Processor

10.1

This Section 10 applies only if the Other Party acts as a Processor and Processes
Personal Data on behalf of the Controller. The Clauses of Section 10 of thisAgreement shall supersede any conflicting Clauses in other Sections of thisAgreement regarding to the Processor.

10.2

The Processor shall make and carry out the Processing in accordance with the
instructions of the Controller and the contracts and agreements concluded
between them that specify in particular the scope, subject, purpose and nature of
the Processing, the type of Personal Data and categories of Data Subjects. The
Parties determined the scope, subject, purpose and nature of the Processing, thetype of Personal Data and categories of Data Subjects in the Services Agreement
and/or in APPENDIX 8 – DESCRIPTION OF THE PROCESSING OR THE TRANSFER.

10.3

The Processor shall apply the appropriate technical and organizational measuresand procedures to protect Personal Data at the design stage, both when defining
the means of Processing or during the Processing itself, taking into consideration
the cost of applying such measures and procedures and the nature, scope andpurposes of the Processing. The Parties agreed on the technical and organizational
measures and procedures in APPENDIX 9 – TECHNICAL AND ORGANISATIONAL
MEASURES.

10.4

The Processor shall make the Processing according to the purpose and period set
therefor and notify the Controller if the Processing exceeds the set period, in order

Page 180
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

to extend such period or issue the appropriate directions. Whenever required, thenotifications shall be made within two working days after such event occurred or isdetermined.
10.5

The Processor shall not take any action that would disclose the Personal Data or
the results of Processing, except in cases permitted by law.

10.6

The Processor shall protect and secure the Processing operation and secure themedia and electronic devices used in the Processing and the Personal Data stored
therein.

10.7

The Processor shall maintain a special record of Personal Data Processed on behalfof the Controller, which must include the data of the Controller, Processor andData Protection Officer, as well as a description of the categories of Personal Data
held thereby, data of the persons authorized to access such Personal Data, theProcessing durations, restrictions and scope, the mechanism of erasure,modification or Processing of Personal Data, the purpose of Processing and any
data related to the movement and Cross-Border Processing of such data, while
indicating the technical and organizational procedures related to information
security and Processing operations, provided that the Processor provides thisrecord to the UAE Data Office whenever requested to do so.

10.8

The Processor shall provide all means to prove abidance thereby to the provisionsof PDPL, at the request of the Controller or UAE Data Office.

10.9

The Processor shall make and carry out the Processing in accordance with therules, requirements and controls set by PDPL and the Executive Regulations of
PDPL, or as instructed by the UAE Data Office.

10.10

The Executive Regulations of PDPL shall set the procedures, controls, conditions,and technical and standard criteria related to the Processors obligations. The
Processor shall monitor and abide the Executive Regulations of PDPL.

11.

General Obligations if the Parties act as Joint-Controllers

11.1This Section 11 shall apply only if the Controller and the Other Party act jointly as
Joint-Controllers. The Clauses of Section 11 of this Agreement shall supersede any
conflicting Clauses in other Sections of this Agreement regarding to the
Joint-Controllers.

11.2

The Joint-Controllers determined the scope, subject, purpose and nature of theProcessing, the type of Personal Data and categories of Data Subjects in theServices Agreement and/or in APPENDIX 8 – DESCRIPTION OF THE PROCESSING
OR THE TRANSFER.

Page 181
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

11.3

The Joint-Controllers shall jointly ensure compliance with Data Protection
Legislation when Processing Personal Data. Both controllers are equally
responsible for the legality and lawfulness of joint Processing.

11.4

Regardless of the place of Business of each Joint-Controller, both Joint-Controllers
agree that the UAE Data Office is the competent supervisory authority.

11.5

The Controller undertakes to provide the Data Subject's with all information
regarding the Data Subject's Rights under PDPL. The Controller acts as the contact
point for Data Subjects.

11.6

The Joint-Controllers shall jointly take the appropriate technical and organizational
measures and procedures to apply the necessary standards to protect and secure
Personal Data, in order to maintain its confidentiality and privacy and to ensurethat it is not infringed, damaged, altered or tampered with, taking into account thenature, scope and purposes of Processing and the potential risks to theconfidentiality and privacy of the Personal Data of the Data Subject. The Parties
agreed on the technical and organizational measures and procedures in
APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES.

11.7

The Joint-Controllers shall jointly apply the appropriate measures, both whendefining the means of Processing or during the Processing itself, in order tocomply with the provisions of PDPL, including the controls stipulated in Article 5
PDPL. Such measures may include Pseudonymization.

11.8

The Joint-Controllers shall jointly apply the appropriate technical andorganizational measures with respect to default settings to ensure that theProcessing of Personal Data is limited to its intended purpose. This obligation
applies to the amount and type of Personal Data collected, the type of Processing
to be made thereon, and the period of storage and accessibility of such data. The
Parties agreed on the technical and organizational measures and procedures in
APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES.

11.9

The Joint-Controllers shall jointly maintain a special record of Personal Data whichmust include the data of the Controller and Data Protection Officer, as well as a
description of the categories of Personal Data held thereby, data of the persons
authorized to access such Personal Data, the Processing durations, restrictions andscope, the mechanism of erasure, modification or Processing of Personal Data, thepurpose of Processing and any data related to the movement and Cross-Border
Processing of such data, while indicating the technical and organizational
procedures related to information security and Processing operations, provided
that the Controller provides this record to the UAE Data Office whenever requested
to do so.

Page 182
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

11.10

The Joint-Controllers shall jointly appoint only Processors who provide sufficientguarantees to apply technical and organizational measures in a manner that
ensures that the Processing meets the Processing requirements, rules and controls
stipulated by PDPL, the Executive Regulations of PDPL and decisions issued in
implementation of PDPL.

11.11

The Joint-Controllers shall jointly provide the UAE Data Office, based on a decisionfrom the competent judicial authority, with any information requested thereby inexercise of its competencies stipulated by PDPL and the Executive Regulations of
PDPL.

11.12

The Joint-Controllers shall jointly appoint a Data Protection Officer in accordancewith Section 13 of this Agreement.

12.

Reporting a Personal Data Breach

12.1

The Other Party shall, immediately upon becoming aware of any infringement or
breach of the Personal Data of the Data Subject that would prejudice the privacy,
confidentiality and security of such data, report such infringement or breach andthe results of the investigation to the Controller.

12.2

Such reporting shall be accompanied by the following data and documents,
namely (a) the nature, form, causes, approximate number and records of theinfringement or breach, and (b) the data of the Data Protection Officer appointed
by the Other Party, and (c) the potential and expected effects of the infringement
or breach, and (d) the procedures and measures taken thereby and proposed to be
applied to address this infringement or breach and reduce its negative effects, and(e) documentation of the infringement or breach and the corrective actions takenby the Other Party, and (f) any other requirements that the UAE Data Officedemands from the Controller.

12.3

The Other Party will assist the Controller by all means to allow the Controller tonotify the Data Subject in the event that the infringement or breach would
prejudice the privacy, confidentiality and security of his/her Personal Data andadvise him/her of the procedures taken thereby, within such period and inaccordance with such procedures and conditions as set by the Executive
Regulations of PDPL.

13.

Appointment of Data Protection Officer

13.1

The Other Party shall appoint a Data Protection Officer who has sufficient skills andknowledge of Personal Data Protection, in any of the following cases, namely (a) if
the Processing would cause a high-level risk to the confidentiality and privacy ofPage 183
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

the Personal Data of the Data Subject as a result of adopting technologies that are
new or associated with the amount of data, or (b) if the Processing will involve asystematic and comprehensive assessment of Sensitive Personal Data, including
Profiling and Automated Processing, or (c) if the Processing will be made on a large
amount of Sensitive Personal Data.
13.2

The Data Protection Officer may be employed or authorized by the Other Party,
whether inside or outside the United Arab Emirates.

13.3

The Other Party shall specify the contact address of the Data Protection Officer
and notify the UAE Data Office.

14.

Responsibilities of the Data Protection Officer of the Other Party

14.1

The Data Protection Officer of the Other Party shall be responsible for ascertaining
compliance by the Other Party with the provisions of PDPL, the Executive
Regulations of PDPL, and the instructions issued by the UAE Data Office.

14.2

The Data Protection Officer of the Other Party shall, in particular, undertake thefollowing duties and powers, namely (a) verifying the quality and validity of theprocedures adopted by both the Controller and Processor, and (b) receiving
requests and complaints related to Personal Data in accordance with theprovisions of PDPL and the Executive Regulations of PDPL, and (c) providing
technical advice related to the procedures of periodic evaluation and examinationof Personal Data Protection systems and intrusion prevention systems of theController and Processor, documenting the results of such evaluation, andproviding appropriate recommendations in this regard, including risk assessment
procedures, and (d) acting as a liaison between the Controller or Processor, as thecase may be, and the UAE Data Office regarding their implementation of theprovisions of Personal Data Processing stipulated by PDPL, and (e) any other duties
or powers specified under the Executive Regulations of PDPL.

14.3

The Data Protection Officer of the Other Party shall maintain the confidentiality of
the information and data received thereby in implementation of the duties andpowers given thereto pursuant to the provisions of PDPL and the Executive
Regulations of PDPL and in accordance with the legislation in force in the United
Arab Emirates.

15.

Obligations of the Other Party towards the Data Protection Officer

15.1

The Other Party shall provide all means to ensure that the Data Protection Officer
performs the responsibilities and duties assigned thereto, as stipulated in Article 11
PDPL, in a proper manner, including, in particular, the following, namely (a)ensuring that he/she is appropriately and timely engaged in all matters relating toPage 184
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Personal Data Protection, and (b) ensuring that he/she is provided with all thenecessary resources and support to perform the duties assigned by PDPL, and (c)not to terminate his/her service or impose any disciplinary penalty for a reason
related to the performance of his/her duties in accordance with the provisions of
PDPL, and (d) ensuring that he/she is not assigned to duties that lead to a conflictof interest with the duties assigned under PDPL.
15.2

Data Subject's shall communicate directly with the Data Protection Officer of theController for any matters related to his/her Personal Data and the Processing
under PDPL in order to exercise his/her rights in accordance with the provisions of
PDPL. The Data Protection Officer of the Other Party shall refer Data Subject's to
the Data Protection Officer of the Controller. Only where the Other Party acts as
the Controller, the Data Protection Officer of the Other Party shall communicate
directly with Data Subject's. If the Other Party and the Controller act as
Joint-Controllers, the Data Protection Officers of both parties coordinate how to
and who responds to Data Subject's.

16.

Right to Obtain Information, Right to Request Personal Data Transfer, Right toCorrection or Erasure of Personal Data, Right to Restrict Processing, Right toStop Processing, Right to Processing and Automated Processing

16.1

The Other Party shall take all appropriate technical and organizational measuresand procedures to ensure the Data Subject's Rights, and to allow the Controller tocomply with any request made by any Data Subject regarding the Right to Obtain
Information, Right to Request Personal Data Transfer, Right to Correction or
Erasure of Personal Data, Right to Restrict Processing, Right to Stop Processing,Right to Processing and Automated Processing and any other Right granted by
Data Protection Legislation.

16.2

The Other Party shall provide appropriate and clear ways and mechanisms toenable the Data Subject to communicate with the Other Party and place requests
regarding the Data Subject's Rights stipulated by PDPL. The Other Party shallinform the Controller about any request of a Data Subject regarding any Data
Subject Right without undue delay.

17.

Personal Data Security

17.1

The Other Party shall establish and take appropriate technical and organizational
measures and procedures to ensure achievement of the information security levelthat is commensurate with the risks associated with Processing, in accordancewith the best international standards and practices, which may include (a)encryption of Personal Data and application of Pseudonymization, and (b)application of procedures and measures that ensure the confidentiality, safety,
validity and flexibility of Processing systems and services, and (c) application ofPage 185
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

procedures and measures that ensure the timely retrieval and access of Personal
Data in the event of any physical or technical failure, and (d) application ofprocedures that ensure a smooth testing, evaluation and assessment of theeffectiveness of technical and organizational measures so as to ensure the securityof Processing. The Parties agreed on the technical and organizational measuresand procedures in APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES.
17.2

When evaluating the level of information security, the Other Party shall be taken
into account (a) risks associated with Processing, including Personal Data damage,loss, accidental or illegal modification, disclosure or unauthorized access, whether
transmitted, stored or Processed, and (b) the costs, nature, scope and purposes ofProcessing, as well as the different potential risks to the privacy and confidentialityof the Personal Data of the Data Subject.

18.

Assessment of Personal Data Protection Impact

18.1

Subject to the nature, scope and purposes of Processing, the Other Party shall,
before starting the Processing, assess the impact of the proposed Processing on
Personal Data Protection, when using any of the modern technologies that would
pose a high risk to the privacy and confidentiality of the Personal Data of the Data
Subject (Impact Assessment).

18.2

The Impact Assessment shall be required (a) if the Processing involves a systematicand comprehensive assessment of the personal aspects of the Data Subject basedon Automated Processing, including Profiling, which would have legal
consequences or would seriously affect the Data Subject, and (b) if the Processing
will be made on a large amount of Sensitive Personal Data.

18.3

The Impact Assessment must include, at a minimum (a) a clear and systematic
explanation of the impact of the proposed Processing on Personal Data Protection
and the purpose of such Processing, and (b) an assessment of the necessity andsuitability of Processing for the purpose of PDPL, and (c) an assessment of thepotential risks to the privacy and confidentiality of the Personal Data of the Data
Subject, and (d) the proposed procedures and measures to minimize the potential
risks to Personal Data Protection.

18.4

The Other Party may make a single assessment for a set of Processing operationsof similar natures and risks.

18.5

The Other Party shall coordinate with the Data Protection Officer when assessing
the impact of Personal Data Protection.

Page 186
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

18.6

The Other Party shall review the assessment outcomes periodically to ensure that
the Processing is carried out in accordance with the assessment, in case the levelsof risks associated with the Processing operations are different.

19.

Cross-Border Personal Data Transfer and Sharing for Processing Purposes if
there is an Adequate Level of Protection
The Other Party may transfer Personal Data outside the United Arab Emirates in
the following cases approved by the Office, namely (1) if the country or territory towhich the Personal Data is to be transferred has special legislation on Personal
Data Protection therein, including the most important provisions, measures,controls, requirements and rules for protecting the privacy and confidentiality of
the Personal Data of the Data Subject and his/her ability to exercise his/her rights,
and provisions related to imposing appropriate measures on the Controller orProcessor through a supervisory or judicial authority, and (2) if the United ArabEmirates accedes to bilateral or multilateral agreements related to Personal Data
Protection with the countries to which the Personal Data is to be transferred.

20.

Cross-Border Personal Data Transfer and Sharing for Processing Purposes if
there is not an Adequate Level of Protection

20.1

With the exception of what is stated in Article 22 PDPL, the Other Party may
transfer Personal Data outside the United Arab Emirates in the following cases: (a)In countries where there is no data protection law, Establishments operating in the
United Arab Emirates and in those countries may transfer data under a contract oragreement that obliges the Establishment in those countries to implement theprovisions, measures, controls and requirements set out by PDPL, including
provisions related to imposing appropriate measures on the Controller or Processor
through a competent supervisory or judicial authority in that country, which shallbe specified in the contract, or (b) the express Consent of the Data Subject totransfer his/her Personal Data outside the United Arab Emirates in a manner that
does not conflict with the security and public interest of the United Arab Emirates,or (c) if the transfer is necessary to fulfill obligations and establish, exercise or
defend rights before judicial authorities, or (d) if the transfer is necessary to enter
into or execute a contract between the Controller and Data Subject, or between
the Controller and a other Party to achieve the Data Subject's interest, or (e) if thetransfer is necessary to perform a procedure relating to international judicial
cooperation, or (f) if the transfer is necessary to protect the public interest.

20.2

The Other Party shall observe and comply with the Executive Regulations of PDPL
that set the controls and requirements for the cases referred above, which must be
met for transferring Personal Data outside the United Arab Emirates.

Page 187
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

20.3

Whereas the Other Party is an Establishment in a country where there is no dataprotection law, and receives Personal Data in a Cross-Border Personal Data
Transfer from the Controller and/or receives Personal Data that is Shared forProcessing Purposes by the Controller, the Other Party agrees to implement theprovisions, measures, controls and requirements set out by PDPL, including
provisions related to imposing appropriate measures on the Other Party through acompetent supervisory or judicial authority. The competent judicial authority is thearbitral tribunal referred to in Section 23 of this Agreement. The parties agree that
the UAE Data Office is the competent supervisory authority.

21.

Obligations upon expiry or termination of the Services Agreement

21.1

Notwithstanding the Other Party’s obligations under the Services Agreement
following its expiry or termination, the Other Party shall promptly and in any event
within thirty (30) days of the expiry or termination of the Services Agreement, at
the Controller’s option either delete or return (in such format and on such media orby such means as the Parties shall agree in writing) all copies of the Personal Data
Processed by the Other Party and/or its Sub-Processors on behalf of the Controller
or originating from the Controller.

21.2

Where the Controller has instructed the Other Party to delete the Personal Data,
the Other Party shall do so in accordance with best industry practice for the
reliable and secure deletion of data and for the secure destruction of confidential
material.

21.3

The Other Party (and those of its Sub-Processors, as appropriate) may retain a copyof the Personal Data Processed by and under this Agreement to the extent
required by any applicable law to which the Other Party (or any Sub-Processor) is
subject and only for such period as shall be required by such applicable law. Where
applicable, the Other Party shall notify the Controller of such requirement and shallensure that such Personal Data are kept confidential and not Processed for any
other Purpose.

21.4

The Controller may require the Other Party to provide a written certificate
confirming that it has complied with its obligations under this Section.

22.

Liability and indemnification

22.1

The Other Party shall be liable for any violation of Data Protection Legislation or
this Agreement by the Other Party or its Sub-Processors.

22.2

The Other Party agrees to indemnify, defend, and hold harmless the Controller
from and against any loss, cost, or damage of any kind (including reasonable
outside attorneys' fees) to the extent arising out of any breach of Data Protection

Page 188
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Legislation by the Other Party, and/or its negligence or willful misconduct, or its
Sub-Processors.
23.

Arbitration Clause

23.1

All disputes arising out of or in connection with this contract or its validity shall befinally settled under the rules of arbitration of the German Institution for Arbitratione. V. (DIS), excluding ordinary legal action.

23.2

The arbitral tribunal consists of a single arbitrator. The parties hereby irrevocably
agree that the sole arbitrator may be appointed by attorney-at-law Mr. Ulrich
Baumann and / or Prof. Dr. h.c. Heiko Jonny Maniero, whereby theabove-mentioned persons can appoint themselves also to the arbitrator in therespective arbitration procedure, as far as the own designation no conflicts ofinterests stand against. The seat of the arbitral tribunal is Abu Dhabi.

23.3

The language of the proceedings is German.

23.4

The law applicable in the case is the Law of the United Arab Emirates.

24.

General provisions

24.1

Except in respect of any provision of this Agreement that expressly or by
implication is intended come into or continue in force on or after the expiry or
termination of the Services Agreement, this Agreement shall be coterminous with
the Services Agreement.

24.2

A Person who is not a Party to this Agreement shall not have any rights to enforce
any terms of this Agreement.

24.3

If any provision or part-provision of this Agreement is or becomes invalid, illegal or
unenforceable, it shall be deemed modified to the minimum extent necessary to
make it valid, legal and enforceable. If such modification is not possible, therelevant provision or part-provision shall be deemed deleted. Any modification toor deletion of a provision or part-provision under this Clause shall not affect thevalidity and enforceability of the rest of this Agreement.

24.4

Except as expressly provided in this Agreement, no variation of this Agreement
shall be effective unless it is in writing and signed by the Parties (or theirauthorized representatives).

Page 189
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 18 – Standard Contract for Outbound Cross-border Transfer
of Personal Information (People’s Republic of China)

Standard Contract for Outbound Cross-border Transfer of
Personal Information (People’s Republic of China)
The Personal Information Handler and the Overseas Recipient will carry out theactivities concerning the outbound cross-border transfer of Personal Informationin accordance with this Contract. The Parties have entered into or agreed to enter
into a commercial contract to further the commercial acts related to suchactivities, namely the Main-Agreement on the date of conclusion of theMain-Agreement.
The major body of this Contract is drafted in accordance with the requirements of
the Measures for the Standard Contract for Outbound Cross-border Transfer of
Personal Information. Other agreements between the Parties, if any, may be
specified in Appendix II. The Appendix forms an integrated part of this Contract.
Article 1 Definitions
In this Contract, unless the context otherwise requires:
1.

"Personal Information Handler" refers to any organization or individual thatindependently decides the purpose and method of the Personal
Information handling activities and transfers Personal Information outside
the territory of the People's Republic of China.

2.

"Overseas Recipient" refers to an organization or individual outside theterritory of the People's Republic of China that receives Personal
Information from the Personal Information Handler.

3.

Personal Information Handler or Overseas Recipient are referred toindividually as a "Party", and collectively as the "Parties".

4.

"Personal Information Subject" refers to a natural person identified by or
associated with the Personal Information.

5.

"Personal Information" refers to all kinds of information related to identified
or identifiable natural persons that are electronically or otherwise recorded,
excluding information that has been anonymized.

6.

"Sensitive Personal Information" refers to the Personal Information that,once leaked or illegally used, is likely to result in damage to the personal

Page 190
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

dignity of any natural person or damage to his or her personal or property
safety, including biometric recognition, religious belief, specific identity,
medical health, financial account, personal whereabouts, and the Personal
Information of minors under the age of 14.
7.

"Regulatory Authority" refers to the Cyberspace Administration of thePeople's Republic of China at the provincial level or above.

8.

"Relevant Laws and Regulations" refer to the laws and regulations of thePeople's Republic of China, such as the Cybersecurity Law of the People's
Republic of China, the Data Security Law of the People's Republic of China,
the Personal Information Protection Law of the People’s Republic of China,
the Civil Code of the People's Republic of China, Civil Procedure Law of thePeople's Republic of China, and Measures for the Standard Contract for
Outbound Cross-border Transfer of Personal Information.

9.

The meanings of other terms not defined in the Contract are in line withthose stipulated in the Relevant Laws and Regulations.
Article 2 Obligations of the Personal Information Handler

The Personal Information Handler shall perform the following obligations:1.

Handle Personal Information in accordance with the Relevant Laws andRegulations. The Personal Information to be transferred overseas shall belimited to the minimum scope required for the purpose of handling.

2.

Inform the Personal Information Subject of matters such as the name andcontact information of the Overseas Recipient, the purpose of handling,method of handling, type of Personal Information, retention periods, andthe methods and procedures for the Personal Information Subject toexercise his/her rights specified in Appendix I “Description of the OutboundCross-border Transfer of Personal Information”. Where Sensitive Personal
Information is transferred overseas, the Personal Information Subject shallbe informed of the necessity of the outbound cross-border transfer of
Sensitive Personal Information and the impact on the rights and interestsof the Personal Information Subject, unless otherwise provided in the laws
and administrative regulations that such notification is not required.

3.

If Personal Information is transferred overseas based on the consent of theindividual, the separate consent of the Personal Information Subject shallbe obtained. Where the Personal Information involves that of a minor
under the age of 14, the separate consent of the minor's parent or any otherguardian, shall be obtained. Where written consent is required by laws andadministrative regulations, the written consent shall be obtained.

Page 191
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

4.

Inform the Personal Information Subject that the Personal Information
Handler and the Overseas Recipient have agreed that the Personal
Information Subject is a third-party beneficiary under this Contract, and if
the Personal Information Subject fails to raise an express rejection within
thirty days, the Personal Information Subject shall be entitled to act as athird-party beneficiary in accordance with the Contract.

5.

Make reasonable efforts to ensure that the Overseas Recipient has taken
the following technical and organizational measures to perform its
obligations under this Contract (taking into account potential Personal
Information security risks that may be caused by the purpose of Personal
Information handling, the type, scale, scope and sensitivity of the Personal
Information, the scale and frequency of the transfer, the period of theoutbound cross-border transfer of Personal Information, the period ofretention by the Overseas Recipient, and other matters that may lead to a
Personal Information security risk): APPENDIX 9 – TECHNICAL AND
ORGANISATIONAL MEASURES.

6.

Provide copies of Relevant Laws and Regulations and technical standards
to the Overseas Recipient upon request.

7.

Reply to inquiries from the Regulatory Authority about the Overseas
Recipient's handling activities.

8.

Carry out a Personal Information Protection Impact Assessment inaccordance with the Relevant Laws and Regulations regarding the
proposed transfer of Personal Information to the Overseas Recipient. The
assessment shall focus on the following matters:(1)

the legality, legitimacy and necessity of the purpose, scope andmethod of handling Personal Information by the Personal
Information Handler and Overseas Recipient;(2)

the scale, scope, type, and sensitivity of Personal Information to betransferred overseas, and the risks that the outbound cross-bordertransfer may pose to Personal Information rights and interests;(3)

the obligations that the Overseas Recipient undertakes to assume,
and whether the organizational and technical measures andcapabilities to perform such obligations are sufficient to ensure thesecurity of the Personal Information to be transferred overseas;(4)risk of Personal Information being tampered with, destroyed, leaked,
lost, illegally used, etc. after the outbound cross-border transfer, andwhether there are channels for individuals to smoothly exercise
Personal Information rights and interests etc.;

Page 192
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

(5)in accordance with Article 4 hereof, to evaluate whether the
performance of this Contract will be affected by the local policies andregulations with respect to protection of Personal Information; and(6)other matters that may affect the security of outbound cross-bordertransfer of Personal Information.

The Personal Information Protection Impact Assessment Report shall be
kept for at least three years.
9.

Provide a copy of this Contract to the Personal Information Subject upon
the Personal Information Subject 's request. If trade secrets or confidential
business information are involved, the relevant contents of the copy of thisContract may be appropriately redacted, provided that such redaction will
not affect the understanding of the Personal Information Subject.

10.

Assume a burden of proof for the performance of obligations under thisContract.

11.

In accordance with Relevant Laws and Regulations, provide the Regulatory
Authority with all information as described in Article 3.11, including allcompliance audit results.
Article 3 Obligations of the Overseas Recipient

The Overseas Recipient shall perform the following obligations:1.

Handle the Personal Information in accordance with Appendix I“Description of the Outbound Cross-border Transfer of Personal
Information”. Where the Overseas Recipient handles the Personal
Information in a way beyond the purpose and method of the Personal
Information handling, and types of the Personal Information as agreed, it
shall obtain the separate consent of the Personal Information Subject inadvance if the handling of Personal Information is based on the consent of
the Personal Information Subject; where the Personal Information of aminor under the age of 14 is involved, the separate consent of the minor’s
parent, or any other guardian, shall be obtained.

2.

Where the Overseas Recipient is contracted by the Personal Information
Handler to handle Personal Information, the Overseas Recipient shallhandle the Personal Information in accordance with the agreement with
the Personal Information Handler and shall not handle the Personal
Information in a way beyond the purpose or method of the Personal
Information handling.

3.

Provide a copy of this Contract to the Personal Information Subject upon
the Personal Information Subject’s request. If trade secrets or other

Page 193
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

confidential business information are involved, relevant parts of thisContract may be appropriately redacted, provided that such redaction will
not affect the understanding of the Personal Information Subject.
4.

Handle the Personal Information in a manner that has the least impact on
the rights and interests of the Personal Information Subject.

5.

The retention period of Personal Information shall be the minimum period
necessary for achieving the purpose of handling. Upon expiry of theretention period, the Personal Information (including all back-up copies)
shall be deleted. Where the handling of Personal Information is contracted
by the Personal Information Handler, and the personal information
handling agreement fails to become effective, becomes null and void, or iscancelled or terminated, the Personal Information being handled shall be
returned to the Personal Information Handler or deleted, and a written
statement shall be provided to the Personal Information Handler. If it istechnically difficult to delete the Personal Information, the handling of the
Personal Information, other than the storage and any necessary measurestaken for security protection, shall be ceased.

6.

Ensure the security of Personal Information handling in the following ways:

7.

(1)

take technical and organizational measures including but not limited
to those listed in Article 2.5 of this Contract and carry out regularinspections to ensure the security of Personal Information; and(2)

ensure that the personnel authorized to handle Personal Information
perform their confidentiality obligations and establish access control
permissions of minimum authorization.

In the event that Personal information is or may be tampered with,destroyed, leaked, lost, illegally used, provided or accessed withoutauthorization, the Overseas Recipient shall:(1)

promptly take appropriate measures to mitigate the adverse impact
on the Personal Information Subject;(2)

immediately notify the Personal Information Handler and report to
the Regulatory Authority in accordance with the Relevant Laws andRegulations. The notice shall contain the following contents:

Page 194
Version: 1.07
Classification: Publici.

the type of Personal Information to which the tampering with,destruction, leakage, loss, illegal use, unauthorized provision oraccess occurs or may occur, the cause of such event or potential
event, and the potential harm;ii.

remedial measures that have been taken;
Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

8.

iii.

measures that can be taken by the Personal Information Subject
to mitigate harm; andiv.

contact information of the person, or team, in charge of handlingthe situation.

(3)

where the Relevant Laws and Regulations require the notification of
the Personal Information Subject, the content of the notice shall
include the foregoing contents in Article 3.7. (2) above; where thehandling of Personal Information is contracted by the Personal
Information Handler, the Personal Information Handler shall notify
the Personal Information Subject;(4)

record and retain all the situations thereof relating to the occurrenceor potential occurrence of tampering, destruction, leakage, loss,
illegal use, unauthorized provision or access, including all remedial
measures taken.

The Overseas Recipient may provide Personal Information to the third party
located outside the territory of the People’s Republic of China only, if all of
the following requirements are met:(1)

there is a necessity from the business perspective;(2)

the Personal Information Subject has been informed of such third
party’s name, contact information, the purpose of handling, methodof handling, type of Personal Information, retention periods, and themethods and procedures for the Personal Information Subject toexercise his/her rights. Where Sensitive Personal Information isprovided to such third party, the Personal Information Subject should
also be informed of the necessity of the outbound cross-bordertransfer of Sensitive Personal Information and the impact on therights and interests of the Personal Information Subject. However,unless otherwise provided by laws and administrative regulations
that such notification is not required;(3)

where the handling of Personal Information is based on the consent
of the Personal Information Subject, the separate consent of the
Personal Information Subject shall be obtained; where the Personal
Information of a minor under the age of 14 is involved, the separate
consent of the minor’s parent, or any other guardian, shall beobtained. Where written consent is required by laws andadministrative regulations, such written consent shall be obtained;(4)

enter into a written agreement with the third party to ensure that thehandling of Personal Information by the third party meets thestandards for protection of Personal Information required by the
Relevant Laws and Regulations of the People’s Republic of China, andPage 195
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

the Overseas Recipient will assume the liability for the infringementof Personal Information Subject’s rights due to the provision of
Personal Information to the third party located outside the territory of
the People’s Republic of China;(5)

provide a copy of the above agreement to the Personal Information
Subject upon the Personal Information Subject’s request. If trade
secrets or other confidential business information are involved,
relevant parts of the agreement may be appropriately redacted
provided that such redaction will not affect the understanding of the
Personal Information Subject.

9.

Where the Overseas Recipient is contracted by the Personal Information
Handler to handle Personal Information, and the Overseas Recipient
intends to sub-contract the handling to a third party, the Overseas
Recipient shall obtain the consent of the Personal Information Handler inadvance and shall ensure that the sub-contractor will not handle Personal
Information in a way beyond the purpose and method of the handling as
specified in Appendix I “Description of the Outbound Cross-border Transfer
of Personal Information”, and shall monitor the Personal Information
handling activities of the third party.

10.

When making use of Personal Information for automated decision-making,
the Overseas Recipient shall ensure the transparency of decision-making
and fair and impartial results, and shall not carry out unreasonable ordifferential treatment of the Personal Information Subject in terms oftransaction conditions, such as transaction price. Where automateddecision-making is used for pushing information and commercial
marketing to the Personal Information Subject, the Overseas Recipient
shall also provide the Personal Information Subject with options that are
not specific to the individuals’ characteristics, or a convenient way for the
Personal Information Subject to reject the automated decision-making.

11.

Undertake to provide the Personal Information Handler with all necessary
information required to comply with the obligations under this Contract,provide the Personal Information Handler access to review the necessary
data documents, and files, or conduct a compliance audit of the handling
activities under this Contract, and the Overseas Recipient shall facilitate thecompliance audit conducted by the Personal Information Handler.

12.

Maintain an accurate record of the Personal Information handling activities
carried out for at least 3 years and provide the relevant records anddocuments to the Regulatory Authority directly or through the Personal
Information Handler, as required by the Relevant Laws and Regulations.

13.

Agree to be subject to supervision by the Regulatory Authority during an
enforcement procedure related to supervising the implementation of thisPage 196
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Contract, including but not limited to responding to inquiries andinspections by the Regulatory Authority, following the actions taken or
decisions made by the Regulatory Authority, and providing written
confirmation that necessary measures have been taken etc.
Article 4 The Impact of Personal Information Protection Policies andRegulations in the Overseas Recipient’s Country or Region on the
Performance of this Contract
1.

The Parties warrant that they have exercised reasonable care whenentering into this Contract and are not aware of Personal Information
protection policies and regulations in the Overseas Recipient's country or
region (including any requirements on providing Personal Information or
authorizing public authorities to access Personal Information) that would
have an impact on the Overseas Recipient’s performance of its obligations
under this Contract.

2.

The Parties declare that, when making the warranties in Article 4.1, they
have conducted the assessment in conjunction with the following
circumstances:(1)

the specific circumstances of outbound cross-border transfer,including the purpose of handling the Personal Information, thetypes, scale, scope and sensitivity of the Personal Informationtransferred, the scale and frequency of transfer, the period of theoutbound cross-border transfer of Personal Information and theretention period of the Overseas Recipient, the previous experience of
the Overseas Recipient with respect to outbound cross-bordertransfer and handling of similar Personal Information, whether any
Personal Information security incident had occurred to the Overseas
Recipient and whether such incident was timely and effectively
handled, whether the Overseas Recipient has received any request to
provide Personal Information to the public authority of the country or
region where it is located and how the Overseas Recipient has
responded to such request;(2)

the Personal Information protection policies and regulations of thecountry or region where the Overseas Recipient is located, including
the following elements:

Page 197
Version: 1.07
Classification: Publici.

the existing Personal Information protection laws, regulations
and generally applicable standards of the country or region;ii.

the regional or global organizations of Personal Information
protection that the country or region accedes to, and binding
international commitments made by the country or region;andPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

iii.

(3)

the mechanisms for Personal Information protection
implemented in the country or region, such as whether there
are supervision and enforcement authorities and relevant
judicial authorities responsible for protecting Personal
Information.

the Overseas Recipient's security management system and technicalcapabilities.

3.

The Overseas Recipient warrants that it has used its best efforts to provide
the Personal Information Handler with the necessary relevant information
for the assessment under Article 4.2.

4.

The Parties shall keep a record of any such assessment carried out under
Article 4.2 as well as the assessment results.

5.

Where the Overseas Recipient is unable to perform this Contract due toany change in the policies and regulations on Personal Information
protection of the country or region where the Overseas Recipient is located(including any change of laws or mandatory measures in the country or
region where the Overseas Recipient is located), the Overseas Recipient
shall notify the Personal Information Handler immediately after being
aware of the aforesaid change.

6.

If the Overseas Recipient receives a request for provision of Personal
Information under this Contract from a governmental authority or judicial
authority in the country or region where the Overseas Recipient is located,
it shall promptly notify the Personal Information Handler.
Article 5 Rights of the Personal Information Subject

The Parties agree that the Personal Information Subject shall be entitled to thefollowing rights as a third-party beneficiary under this Contract.
1.

The Personal Information Subject, in accordance with Relevant Laws andRegulations, has the right to know and to make decisions on the handlingof the Personal Information, the right to restrict or refuse handling of the
Personal Information Subject’s Personal Information by others, the right torequest access to, copy, correct, supplement or delete the Personal
Information, and the right to request others to explain the rules for thehandling of the Personal Information Subject’s Personal Information.

2.

When the Personal Information Subject requests to exercise theabove-mentioned rights regarding their Personal Information that has
been transferred overseas, the Personal Information Subject may request
the Personal Information Handler to take appropriate measures for therealization of those rights, or directly make the request to the Overseas

Page 198
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Recipient. If the Personal Information Handler is unable to realize thoserights, it shall notify the Overseas Recipient and request the Overseas
Recipient to assist in the realization.
3.

4.

5.

The Overseas Recipient shall, as notified by the Personal Information
Handler or requested by the Personal Information Subject, realize therights that the Personal Information Subject is entitled to within areasonable period and in accordance with the Relevant Laws andRegulations.
The Overseas Recipient shall inform the Personal Information Subject
about the relevant information which shall be true, accurate and complete,in an obvious way and using clear and understandable language.
If the Overseas Recipient intends to refuse the request of the Personal
Information Subject, it shall inform the Personal Information Subject thereasons of the refusal, as well as the channels for the Personal Information
Subject to raise complaints with the relevant Regulatory Authority andseek judicial remedies.
The Personal Information Subject, as a third-party beneficiary to thisContract, has the right to claim against one or both, the Personal
Information Handler and the Overseas Recipient, in accordance with thisContract and require them to perform the following clauses under thisContract relating to the rights of the Personal Information Subject:(1)

Article 2, except for Articles 2.5, 2.6 and 2.7;

(2)Article 3, except for Articles 3.7(2) and 3.7(4), 3.9, 3.11, 3.12 and 3.13;(3)Article 4, except for Articles 4.5 and 4.6;

(4)

Article 5;(5)

Article 6;(6)

Article 8.2 and 8.3; and(7)

Article 9.5.

The above agreement shall not affect the rights and interests of the
Personal Information Subject in accordance with the Personal Information
Protection Law of the People’s Republic of China.
Article 6 Remedies
1.

The Overseas Recipient shall identify a contact person who is authorized torespond to enquiries or complaints concerning the handling of Personal
Information, and it shall promptly deal with any enquiries or complaints

Page 199
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

from the Personal Information Subject. The Overseas Recipient shall notify
the Personal Information Handler of the contact information and shallinform the Personal Information Subject of the contact information in amanner which is easy to understand, by separate notice or announcementon its website. To be specific: The contact person who is authorized torespond to enquiries or complaints concerning the handling of Personal
Information is the Data Protection Officer of the Overseas Recipient, thatcan be contacted over the phone number and email address published on
the website of the Overseas Recipient. For more details, see Appendix"CAC", that will be or is filed with the local CAC.
2.

If a dispute arises between either Party and the Personal Information
Subject with respect to the performance of this Contract, such Party shallnotify the other Party and the Parties shall cooperate to resolve the dispute.

3.

If the dispute cannot be resolved amicably and the Personal Information
Subject exercises the rights as a third-party beneficiary in accordance with
Article 5, the Overseas Recipient shall accept that the Personal Information
Subject may safeguard his/her rights through either of the followingmeans:(1)

lodging a complaint with the Regulatory Authority; and(2)bringing a lawsuit to the court specified in Article 6.5.

4.

The Parties agree that when the Personal Information Subject exercises therights as a third-party beneficiary with respect to a dispute under thisContract, if the Personal Information Subject chooses to apply the Relevant
Laws and Regulations of the People's Republic of China, such choice shallprevail.

5.

The parties agree that if the Personal Information Subject exercises therights as a third-party beneficiary with respect to a dispute under thisContract, the Personal Information Subject may file a lawsuit with acompetent court in accordance with the Civil Procedure Law of thePeople's Republic of China.

6.

The Parties agree that the choices made by the Personal Information
Subject to safeguard his/her rights will not impair the rights of the Personal
Information Subject to seek remedies in accordance with other laws andregulations.
Article 7 Termination of the Contract

1.

If the Overseas Recipient breaches the obligations specified in this Contract
or the Overseas Recipient is unable to perform this Contract due to achange in the policies and regulations on Personal Information protection

Page 200
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

in the Overseas Recipient's country or region (including amendment to thelaws or adoption of compulsory measures in the Overseas Recipient's
country or region), the Personal Information Handler may suspend theprovision of Personal Information to the Overseas Recipient until thebreach is corrected or the Contract is terminated.
2.

3.

4.

In case of any of the following circumstances, the Personal Information
Handler shall be entitled to terminate this Contract and notify theRegulatory Authority where necessary:(1)where the Personal Information Handler has suspended the provisionof Personal Information to the Overseas Recipient for more than one
month in accordance with Article 7.1;

(2)

the Overseas Recipient's compliance with this Contract will violate thelaws and regulations of its own country or region;(3)

the Overseas Recipient seriously or persistently breaches theobligations under this Contract;(4)

the Overseas Recipient or the Personal Information Handler havebreached this Contract pursuant to a final decision of a competentcourt or the regulatory body supervising the Overseas Recipient; andThe Overseas Recipient may also terminate this Contract in case of
sub-paragraph (1), (2) or (4) of above.
The Contract may be terminated upon mutual agreement by the Parties,
provided that such termination shall not exempt the Parties from theobligations of protecting Personal Information during the handling of the
Personal Information.
If the Contract is terminated, the Overseas Recipient shall promptly returnor delete the Personal Information (including all back-up copies) received
hereunder and provide the Personal Information Handler with a written
statement. If it is technically difficult to delete the Personal Information, any
handling of the Personal Information, other than the storage and taking
necessary security protection measures, shall be ceased.
Article 8 Liability for Breach of the Contract

1.

Each Party shall be liable to the other Party for any damage as a result of its
breach of this Contract.

2.

Each Party shall bear civil liabilities to the Personal Information Subject if its
breach of this Contract infringes the rights of the Personal Information
Subject, without prejudice to the administrative, criminal or other legal

Page 201
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

liabilities that shall be assumed by the Personal Information Handler under
the Relevant Laws and Regulations.
3.

The Parties shall assume joint and several liability in accordance with thelaw. The Personal Information Subject shall have the right to request eachParty or the Parties to assume liability. When the liability assumed by one
Party exceeds the liability such Party shall be assumed, it shall have theright to claim against the other Party accordingly.
Article 9 Miscellaneous1.

If this Contract conflicts with any other legal documents existing between
the Parties, the provisions of this Contract shall prevail.

2.

The formation, validity, performance and interpretation of this Contract andany dispute between the Parties arising from this Contract shall begoverned by the Relevant Laws and Regulations of the People's Republic ofChina.

3.

All notices shall be promptly transmitted or posted by electronic mail,cable, telex, facsimile (confirmation copy sent by airmail), or registeredairmail to (specified address in the Main Agreement or such other address
as may be substituted for such address by written notice). Receipt of any
notice under this Contract shall be deemed to have been received sevendays after its postmark-date in the case of registered airmail and threeworking days after dispatch in the case of e-mail, cable, telex or facsimiletransmission.

4.

Any dispute arising from this Contract between the Parties, the Personal
Information Handler and the Overseas Recipient, as well as a claim byeither Party against the other for recovery of compensation already paid to
the Personal Information Subject, shall be resolved by the Parties throughnegotiation; if such negotiation fails, either Party may adopt any of thefollowing methods to resolve the dispute (check the box for the chosen
arbitration institution, if arbitration is required):(1)

Arbitration. The dispute shall be submitted to:
China
International
Economicand Trade Arbitration
Commission◻ China Maritime Arbitration Commission◻ Beijing Arbitration Commission (Beijing International Arbitration
Center)◻ Shanghai International Arbitration Center
X
Other arbitration institutions that are members of theConvention on the
Recognition and Enforcement of Overseas
Arbitral Awards◻

Page 202
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

The arbitration shall be conducted in Munich, Germany (the place ofarbitration) in accordance with its arbitration rules then in force.
(2)

Litigation. Submit the dispute to a Chinese court with jurisdiction inaccordance with the applicable laws.

5.

This Contract shall be interpreted in accordance with Relevant Laws andRegulations and shall not be interpreted in a manner inconsistent with therights and obligations set forth in Relevant Laws and Regulations.

6.

This Contract shall be executed in two originals, and the Parties, thePersonal Information Handler and the Overseas Recipient, shall each holdone original(s), with equal legal effect.
This contract is signed or concluded online (implemented as terms andconditions and is and original and valid without signature).

Personal Information Handler: Authorized Person, that signed the Main
Agreement
Date: Date of Main Agreement

Overseas Recipient: Authorized Person, that signed the Main Agreement
Date: Date of Main Agreement

Appendix I
Description of the Outbound Cross-border Transfer of Personal Information
The details of the outbound cross-border transfer of Personal Information under
this Contract are as follows:
1.

Purpose of handling: see APPENDIXPROCESSING OR THE TRANSFER

2.

Method of handling: published as “Nature of (sub-) processing” in
APPENDIX 8 – DESCRIPTION OF THE PROCESSING OR THE TRANSFER

Page 203
Version: 1.07
Classification: Public

8–

DESCRIPTIONPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

OF THE© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

3.

The scale of Personal Information to be transferred overseas: Processing
and transfer on a small scale. For more details, see Appendix "CAC", that will
be or is filed with the local CAC.

4.

Type of Personal Information to be transferred overseas (please refer to the
Information Security Technologies - Personal Information Security
Specifications (GB/T 35273) and relevant standards):
Personal Information (3.1 in GB/T 35273-2020)
PI Subject (3.3 in GB/T 35273-2020)
PI Controller (3.4 in GB/T 35273-2020)
Explicit consent (3.6 in GB/T 35273-2020)
Consent (3.7 in GB/T 35273-2020)
Personalized display (3.16 in GB/T 35273-2020)
Business function (3.17 in GB/T 35273-2020)
For more details, see Appendix "CAC", that will be or is filed with the local

CAC.
5.

Type of Sensitive Personal Information to be transferred abroad (pleaserefer to the Information Security Technologies - Personal Information
Security Specifications (GB/T 35273) and relevant standards, if applicable):
None.

6.

The Overseas Recipient transfers Personal Information only to the following
third parties outside the People's Republic of China (if applicable): N/A.

7.

Method of transfer: Online Transfer.

8.

Retention period after the cross-border transfer:

9.

From date of Main Agreement to Date of Termination of Main Agreement(which cannot be determined yet).
Storage location after the outbound cross-border transfer: Office und legal
entity address of Overseas Recipient, or its sub-processors storage
locations.

10.

Other matters (to be filled in as appropriate): None.
Appendix II

Other Terms as Agreed by the Parties (If Necessary): None.

Page 204
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 19 – Standard Contract for Outbound Cross-border Transfer
of Personal Information (People’s Republic of China) (Contract
Language: Chinese)Standard Contract for Outbound Cross-border Transfer of
Personal Information (People’s Republic of China)

为了确保境外接收方处理个人信息的活动达到中华人民共和国相关法律法规规定的个人信息保
护标准，明确个人信息处理者和境外接收方个人信息保护的权利和义务，经双方协商一致，订立本合同。

双方确认并同意，本合同的中文版本为双方签订的正式版本。 非正式的英文翻译版本仅供无法阅读中文的人士理解参考。 如果双方同意签订本合同的英文版本，该等同意应被理解为双方已经签订了本合同的中文版本。

个人信息处理者： 见附件7-相关方名单地址： 见附件7-相关方名单联系方式： 见附件7-相关方名单联系人： 见附件7-相关方名单Page 205
Version: 1.07
Classification: Public

职务： 见附件7-相关方名单Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20境外接收方：见附件7-相关方名单地址： 见附件7-相关方名单联系方式： 见附件7-相关方名单联系人： 见附件7-相关方名单Page 206
Version: 1.07
Classification: Public

职务： 见附件7-相关方名单Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

个人信息处理者与境外接收方依据本合同约定开展个人信息出境活动，与此活动相关的商业行为，双方【已】/【约定】于【主协议签订日期】订立一份商业合同，即主协议。

本合同正文根据《个人信息出境标准合同办法》的要求拟定，在不与本合同正文内容相冲突的前
提下，双方如有其他约定可在附录二中详述，附录构成本合同的组成部分。

第一条 定义

在本合同中，除上下文另有规定外：（一）“个人信息处理者”是指在个人信息处理活动中自主决定处理目的、处理方式的，向中华人民
共和国境外提供个人信息的组织、个人。
（二）“境外接收方”是指在中华人民共和国境外自个人信息处理者处接收个人信息的组织、个
人。
（三）个人信息处理者或者境外接收方单称“一方”，合称“双方”。
（四）“个人信息主体”是指个人信息所识别或者关联的自然人。

（五）“个人信息”是指以电子或者其他方式记录的与已识别或者可识别的自然人有关的各种信息
，不包括匿名化处理后的信息。
（六）“敏感个人信息”是指一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等信息，以及不满十四周岁未成年人的个人信息。

Page 207
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（七）“监管机构”是指中华人民共和国省级以上网信部门。

（八）“相关法律法规”是指《中华人民共和国网络安全法》《中华人民共和国数据安全法》《中华人民共和国个人信息保护法》《中华人民共和国民法典》《中华人民共和国民事诉讼法》《个人信息出境标准合同办法》等中华人民共和国法律法规。
（九）本合同其他未定义术语的含义与相关法律法规规定的含义一致。

第二条 个人信息处理者的义务个人信息处理者应当履行下列义务：（一）按照相关法律法规规定处理个人信息，向境外提供的个人信息仅限于实现处理目的所需的最小范围。
（二）向个人信息主体告知境外接收方的名称或者姓名、联系方式、附录一“个人信息出境说明”中处理目的、处理方式、个人信息的种类、保存期限，以及行使个人信息主体权利的方式和程序等事项。
向境外提供敏感个人信息的，还应当向个人信息主体告知提供敏感个人信息的必要性以及对个人权益的影响。但是法律、行政法规规定不需要告知的除外。
（三）基于个人同意向境外提供个人信息的，应当取得个人信息主体的单独同意。涉及不满十四周岁未成年人个人信息的，应当取得未成年人的父母或者其他监护人的单独同意。法律、行政法规规定应
当取得书面同意的，应当取得书面同意。
（四）向个人信息主体告知其与境外接收方通过本合同约定个人信息主体为第三方受益人，如个
人信息主体未在 30 日内明确拒绝， 则可以依据本合同享有第三方受益人的权利。
（五）尽合理地努力确保境外接收方采取如下技术和管理措施

Page 208
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（综合考虑个人信息处理目的、个人信息的种类、规模、范围及敏感程度、传输的数量和频率、个人信息传输及境外接收方的保存期限等可能带来的个人信息安全风险），以履行本合同约定的义务：详见
附件9 – 技术和管理措施（六）根据境外接收方的要求向境外接收方提供相关法律规定和技术标准的副本。
（七）答复监管机构关于境外接收方的个人信息处理活动的询问。
（八）按照相关法律法规对拟向境外接收方提供个人信息的活动开展个人信息保护影响评估。重点评估以下内容：1.

个人信息处理者和境外接收方处理个人信息的目的、范围、

方式等的合法性、正当性、必要性。
2.

出境个人信息的规模、范围、种类、敏感程度，个人信息出境可能对个人信息权益带来的风险。
3.

境外接收方承诺承担的义务，以及履行义务的管理和技术措

施、能力等能否保障出境个人信息的安全。
4.

个人信息出境后遭到篡改、破坏、泄露、丢失、非法利用等的风险，个人信息权益维护的渠道是否通畅等。
5.

按照本合同第四条评估当地个人信息保护政策和法规对合

同履行的影响。
6.

其他可能影响个人信息出境安全的事

项。保存个人信息保护影响评估报告至少 3年。
（九）根据个人信息主体的要求向个人信息主体提供本合同的副本。如涉及商业秘密或者保密商
务信息，在不影响个人信息主体理解的前提下，可对本合同副本相关内容进行适当处理。
Page 209
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（十）对本合同义务的履行承担举证责任。

（十一）根据相关法律法规要求，向监管机构提供本合同第三条第十一项所述的信息，包括所有合规审计结果。

第三条 境外接收方的义务
境外接收方应当履行下列义务：（一）按照附录一“个人信息出境说明”所列约定处理个人信息。如超出约定的处理目的、处理方式
和处理的个人信息种类，基于个人同意处理个人信息的，应当事先取得个人信息主体的单独同意；涉及不满十四周岁未成年人个人信息的，应当取得未成年人的父母或者其他监护人的单独同意。
（二）受个人信息处理者委托处理个人信息的，应当按照与个人信息处理者的约定处理个人信息，
不得超出与个人信息处理者约定的处理目的、处理方式等处理个人信息。
（三）根据个人信息主体的要求向个人信息主体提供本合同的副本。如涉及商业秘密或者保密商
务信息，在不影响个人信息主体理解的前提下，可对本合同副本相关内容进行适当处理。
（四）采取对个人权益影响最小的方式处理个人信息。

（五）个人信息的保存期限为实现处理目的所必要的最短时间， 保存期限届满的，应当删除个人信息（包括所有备份）。受个人信息处理者委托处理个人信息，委托合同未生效、无效、被撤销或者终止的，应当将个人信息返还个人信息处理者或者予以删除，并向个人信息处理者提供书面说明。删除个人信息从技术上难以实现的，应当停止除存储和采取必要的安全保护措施之外的处理。
（六）按下列方式保障个人信息处理安全：

1.

Page 210
Version: 1.07
Classification: Public

采取包括但不限于本合同第二条第五项的技术和管理措施，

Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

并定期进行检查，确保个人信息安全。
2.

确保授权处理个人信息的人员履行保密义务，并建立最小授权的访问控制权限。
（七）如处理的个人信息发生或者可能发生篡改、破坏、泄露、丢失、非法利用、未经授权提供或者
访问，应当开展下列工作：1.

及时采取适当补救措施，减轻对个人信息主体造成的不利影

2.

立即通知个人信息处理者，并根据相关法律法规要求报告监响。

管机构。通知应当包含下列事项：（1）

发生或者可能发生篡改、破坏、泄露、丢失、非法利用、

未经授权提供或者访问的个人信息种类、原因和可能造成的危害。

（2） 已采取的补救措施。
（3） 个人信息主体可以采取的减轻危害的措施。
（4） 负责处理相关情况的负责人或者负责团队的联系方式。
3.

相关法律法规要求通知个人信息主体的，通知的内容包含本

项第 2 目的事项。受个人信息处理者委托处理个人信息的，由个人信
息处理者通知个人信息主体。
4.

记录并留存所有与发生或者可能发生篡改、破坏、泄露、丢

失、非法利用、未经授权提供或者访问有关的情况，包括采取的所有补
Page 211
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

救措施。
（八）同时符合下列条件的，方可向中华人民共和国境外的第三方提供个人信息：

1. 确有业务需要。
2.

已告知个人信息主体该第三方的名称或者姓名、联系方式、

处理目的、处理方式、个人信息种类、保存期限以及行使个人信息主体
权利的方式和程序等事项。向第三方提供敏感个人信息的，还应当向个人信息主体告知提供敏感个人信息的必要性以及对个人权益的影响。但是法律、行政法规规定不需要告知的除外。
3.

基于个人同意处理个人信息的，应当取得个人信息主体的单

独同意。涉及不满十四周岁未成年人个人信息的，应当取得未成年人的
父母或者其他监护人的单独同意。法律、行政法规规定应当取得书面同
意的，应当取得书面同意。
4.

与第三方达成书面协议，确保第三方的个人信息处理活动达

到中华人民共和国相关法律法规规定的个人信息保护标准，并承担因向中华人民共和国境外的第三方提供个人信息而侵害个人信息主体享有权利的法律责任。
5.

根据个人信息主体的要求向个人信息主体提供该书面协议的副本。如涉及商业秘密或者保密商务信息，在不影响个人信息主体理
解的前提下，可对该书面协议相关内容进行适当处理。

Page 212
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（九）受个人信息处理者委托处理个人信息，转委托第三方处理的，应当事先征得个人信息处理者
同意，要求该第三方不得超出本合同附录一“个人信息出境说明”中约定的处理目的、处理方式等处理个人信息，并对该第三方的个人信息处理活动进行监督。
（十）利用个人信息进行自动化决策的，应当保证决策的透明度和结果公平、公正，不得对个人信
息主体在交易价格等交易条件上实行不合理的差别待遇。通过自动化决策方式向个人信息主体进行信
息推送、商业营销的，应当同时提供不针对其个人特征的选项，或者向个人信息主体提供便捷的拒绝方
式。
（十一）承诺向个人信息处理者提供已遵守本合同义务所需的必要信息，允许个人信息处理者对
必要数据文件和文档进行查阅，或者对本合同涵盖的处理活动进行合规审计，并为个人信息处理者开
展合规审计提供便利。
（十二）对开展的个人信息处理活动进行客观记录，保存记录至少 3 年，并按照相关法律法规要
求直接或者通过个人信息处理者向监
管机构提供相关记录文件。

（十三）同意在监督本合同实施的相关程序中接受监管机构的监督管理，包括但不限于答复监管机构询问、配合监管机构检查、服从监管机构采取的措施或者作出的决定、提供已采取必要行动的书面证明等。

第四条 境外接收方所在国家或者地区个人信息保护政策和法规对合同履行的影响（一）双方应当保证在本合同订立时已尽到合理注意义务，未发现境外接收方所在国家或者地区
的个人信息保护政策和法规（包括任何提供个人信息的要求或者授权公共机关访问个人信息的规定）影响境外接收方履行本合同约定的义务。
（二）双方声明，在作出本条第一项的保证时，已经结合下列情形进行评估：1.

出境的具体情况，包括个人信息处理目的、传输个人信息的种类、规模、范围及敏感程度、传输的规模和频率、个人信息传输及境Page 213
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20外接收方的保存期限、境外接收方此前类似的个人信息跨境传输和处
理相关经验、境外接收方是否曾发生个人信息安全相关事件及是否进
行了及时有效地处置、境外接收方是否曾收到其所在国家或者地区公共机关要求其提供个人信息的请求及境外接收方应对的情况。
2.

境外接收方所在国家或者地区的个人信息保护政策和法规，

包括下列要素：（1）

该国家或者地区现行的个人信息保护法律法规及普遍适用

的标准。

（2） 该国家或者地区加入的区域性或者全球性的个人信息保护
方面的组织，以及所作出的具有约束力的国际承诺。
（3） 该国家或者地区落实个人信息保护的机制，如是否具备个人
信息保护的监督执法机构和相关司法机构等。
3.

境外接收方安全管理制度和技术手段保障能力。

（三）境外接收方保证，在根据本条第二项进行评估时，已尽最大努力为个人信息处理者提供了必要的相关信息。
（四）双方应当记录根据本条第二项进行评估的过程和结果。

（五）因境外接收方所在国家或者地区的个人信息保护政策和法规发生变化（包括境外接收方所
在国家或者地区更改法律，或者采取强制性措施）导致境外接收方无法履行本合同的，境外接收方应当在知道该变化后立即通知个人信息处理者。

Page 214
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（六）境外接收方接到所在国家或者地区的政府部门、司法机构关于提供本合同项下的个人信息要求的，应当立即通知个人信息处理者。

第五条 个人信息主体的权利
双方约定个人信息主体作为本合同第三方受益人享有以下权利：（一）个人信息主体依据相关法律法规，对其个人信息的处理享有知情权、决定权，有权限制或者
拒绝他人对其个人信息进行处理， 有权要求查阅、复制、更正、补充、删除其个人信息，有权要求对其个人信息处理规则进行解释说明。
（二）当个人信息主体要求对已经出境的个人信息行使上述权利时，个人信息主体可以请求个人
信息处理者采取适当措施实现，或者直接向境外接收方提出请求。个人信息处理者无法实现的，应当通知并要求境外接收方协助实现。
（三）境外接收方应当按照个人信息处理者的通知，或者根据个人信息主体的请求，在合理期限内
实现个人信息主体依照相关法律法规所享有的权利。
境外接收方应当以显著的方式、清晰易懂的语言真实、准确、完整地告知个人信息主体相关信
息。
（四）境外接收方拒绝个人信息主体的请求的，应当告知个人信息主体其拒绝的原因，以及个人信
息主体向相关监管机构提出投诉和寻求司法救济的途径。
（五）个人信息主体作为本合同第三方受益人有权根据本合同条款向个人信息处理者和境外接收
方的一方或者双方主张并要求履行本合同项下与个人信息主体权利相关的下列条款：

1. 第二条，但第二条第五项、第六项、第七项、第十一项除外。

2.

第三条，但第三条第七项第 2 目和第 4 目、第九项、第十一

项、第十二项、第十三项除外。
Page 215
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

3.

第四条，但第四条第五项、第六项除外。

4.

第五条。

5.

第六条。

6.

第八条第二项、第三项。

7.第九条第五项。
上述约定不影响个人信息主体依据《中华人民共和国个人信息保护法》享有的权益。

第六条 救济
（一）境外接收方应当确定一个联系人，授权其答复有关个人信息处理的询问或者投诉，并应当及时处理个人信息主体的询问或者投诉。境外接收方应当将联系人信息告知个人信息处理者，并以简
洁易懂的方式，通过单独通知或者在其网站公告，告知个人信息主体该联系人信息，具体为：境外接收方授权答复有关个人信息处理的询问或者投诉的联系人为境外接收方的数据保护人员。个人信息主体
可通过境外接收方网站公布的电话及电子邮件联系该等人员。更多详情，请参见附件“中国互联网信息办公室”，该文件将向或已向当地的中国互联网信息办公室备案。
（二）一方因履行本合同与个人信息主体发生争议的，应当通知另一方，双方应当合作解决争议。
（三）争议未能友好解决，个人信息主体根据第五条行使第三方受益人的权利的，境外接收方接受
个人信息主体通过下列形式维护权利：1. 向监管机构投诉。
2.

Page 216
Version: 1.07
Classification: Public

向本条第五项约定的法院提起诉讼。

Powered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（四）双方同意个人信息主体就本合同争议行使第三方受益人权利，个人信息主体选择适用中华
人民共和国相关法律法规的，从其选择。
（五）双方同意个人信息主体就本合同争议行使第三方受益人权利的，个人信息主体可以依据《中华人民共和国民事诉讼法》向有管辖权的人民法院提起诉讼。

（六）双方同意个人信息主体所作的维权选择不会减损个人信息主体根据其他法律法规寻求救济的权利。

第七条 合同解除（一）境外接收方违反本合同约定的义务，或者境外接收方所在国家或者地区的个人信息保护政
策和法规发生变化（包括境外接收方所在国家或者地区更改法律，或者采取强制性措施）导致境外接收方无法履行本合同的，个人信息处理者可以暂停向境外接收方提供个人信息，直到违约行为被改正或者合同被解除。
（二）有下列情形之一的，个人信息处理者有权解除本合同，并在必要时通知监管机构：1.

个人信息处理者根据本条第一项的规定暂停向境外接收方提供个人信息的时间超过 1 个月。
2.

境外接收方遵守本合同将违反其所在国家或者地区的法律规定。
3.

境外接收方严重或者持续违反本合同约定的义务。

4.

根据境外接收方的主管法院或者监管机构作出的终局决定，

境外接收方或者个人信息处理者违反了本合同约定的义务。
在本项第 1 目、第 2 目、第 4 目的情况下，境外接收方可以解除本合同。

Page 217
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（三）经双方同意解除本合同的，合同解除不免除其在个人信息处理过程中的个人信息保护义务。
（四）合同解除时，境外接收方应当及时返还或者删除其根据本合同所接收到的个人信息（包括所有备份），并向个人信息处理者提供书面说明。删除个人信息从技术上难以实现的，应当停止除存储和
采取必要的安全保护措施之外的处理。

第八条 违约责任
（一）双方应就其违反本合同而给对方造成的损失承担责任。

（二）任何一方因违反本合同而侵害个人信息主体享有的权利， 应当对个人信息主体承担民事法律
责任，且不影响相关法律法规规定个人信息处理者应当承担的行政、刑事等法律责任。
（三）双方依法承担连带责任的，个人信息主体有权请求任何一方或者双方承担责任。一方承担的责任超过其应当承担的责任份额时，有权向另一方追偿。

第九条 其他（一）如本合同与双方订立的任何其他法律文件发生冲突，本合同的条款优先适用。
（二）本合同的成立、效力、履行、解释、因本合同引起的双方间的任何争议，适用中华人民共和国相关法律法规。
（三）发出的通知应当以电子邮件、电报、电传、传真（以航空信件寄送确认副本）或者航空挂号信发往（具体地址以主协议中载明的地址为准）
或者书面通知取代该地址的其它地址。如以航空挂号信寄出本合同项下的通知，在邮戳日期后的7天应当视为收讫；如以电子邮件、电报、电传或者传真发出，在发出以后的3个工作日应当视为收讫。
（四）双方因本合同产生的争议以及任何一方因先行赔偿个人信息主体损害赔偿责任而向另一方的追偿，双方应当协商解决；协商解决不成的，任何一方可以采取下列第 种方式加以解决（如选择仲裁，请勾选仲裁机构）：Page 218
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

1. 仲裁。将该争议提交□中国国际经济贸易仲裁委员会

□中国海事仲裁委员会

□北京仲裁委员会（北京国际仲裁中心）□上海国际仲裁中心√其他《承认及执行外国仲裁裁决公约》成员的仲裁机构

按其届时有效的仲裁规则在 德国慕尼黑进行仲裁；诉讼。依法向中华人民共和国有管辖权的人民法院提起诉
2.
讼。
（五）本合同应当按照相关法律法规的规定进行解释，不得以与相关法律法规规定的权利、义务
相抵触的方式解释本合同。
（六）本合同正本一式贰份，双方各执 壹份，其法律效力相同。本合同于线上签订或签署（且可作为原始、有效的条款和条件执行，无需签名）

Page 219
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

个人信息处理者：[签署主协议的授权签字人]

年月日[主协议签署日期]

境外接收方： [签署主协议的授权签字人]

年月日[主协议签署日期]

附录一

个人信息出境说明
根据本合同向境外提供个人信息的详情约定如下：（一）处理目的：见附件8-处理或传输说明（二）处理方式：见附录8-处理或传输说明中的“（次级）处理性质”

Page 220
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（三）出境个人信息的规模：小规模处理及传输个人信息。更多详情，请参见附件“中国互联网信息办公室”，该文件将向或已向当地的中国互联网信息办公室备案。

（四）出境个人信息种类（参考GB/T 35273《信息安全技术 个人信息安全规范》和相关标准）：个人信息（参考GB/T 35273-2020第3.1条）
个人信息主体（参考GB/T 35273-2020第3.3条）
个人信息控制者（参考GB/T 35273-2020第3.4条）
明示同意（参考GB/T 35273-2020第3.6条）
授权同意（参考GB/T 35273-2020第3.7条）
个性化展示（参考GB/T 35273-2020第3.16条）
业务功能（参考GB/T 35273-2020第3.17条）

更多详情，请参见附件“中国互联网信息办公室”，该文件将向或已向当地的中国互联网信息办公室备案。

（五）出境敏感个人信息种类（如适用，参考 GB/T 35273《信息安全技术 个人信息安全规范》和相关标准）：无

（六）境外接收方只向以下中华人民共和国境外第三方提供个人信息（如适用）：不适用（七）传输方式：网络在线传输

Page 221
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

（八）出境后保存期限：
自主协议生效之日至主协议终止之日（待确定）（九）出境后保存地点：境外接收方的办公地址或注册地址，或其次级信息处理者的保存地点。

（十）其他事项（视情况填写）：无

附录二

双方约定的其他条款（如需要）无。

Page 222
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

APPENDIX 20 – Data Processing Agreement and National Joint
Controllership Agreement to comply with PIPL (People’s Republic ofChina) (Contract Language: Englisch)

Data Processing Agreement and National Joint
Controllership Agreement to comply with PIPL (People’s
Republic of China)
This Data Processing Agreement and National Joint Controllership Agreement to comply
with PIPL (People’s Republic of China) (Agreement) is concluded on the same date as theServices Agreement (as defined below) and is concluded by and between(1)

the Personal Information Handler, named with its Company details as a Party in
the Services Agreement (as defined below), and(2)

the Entrusted Person, named with its Company details as a Party in the Services
Agreement (as defined below).

(together the Parties)

1.

Preamble

1.1

The Entrusted Person is a provider of professional services (Services) and/or
provides its Services as a Joint-Controller and is based in the People’s Republic ofChina. The Personal Information Handler is also based in the People’s Republic ofChina. The Parties entered into an agreement which describes the Services
provided by the Entrusted Person acting on behalf of the Personal Information
Handler, or acting jointly with the Personal Information Handler, in more detail(Services Agreement).

1.2

The Parties have agreed to enter into this Agreement in relation to the Processingof Personal Information by the Entrusted Person, or jointly by the Entrusted Person
and the Personal Information Handler, in the course of providing the Services. The
terms of this Agreement are intended to apply in addition to and not in
substitution of the terms of the Services Agreement.

1.3This Agreement applies to all activities involving the Handling of Personal
Information of natural persons within the borders of the People’s Republic ofChina.

Page 223
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

2.

Definitions and interpretation

2.1

PIPL means the Personal Information Protection Law of the People’s Republic ofChina, passed at the 30th meeting of the Standing Committee of the 13th National
People's Congress on August 20, 2021, that entered into force on November 1, 2021,
as amended or superseded from time to time. The legal definitions from Article 73
PIPL shall apply.

2.2

Personal Information means all kinds of information, recorded by electronic orother means, related to identified or identifiable natural persons, not including
information after anonymization Handling.

2.3

Personal Information Handling includes Personal Information collection, storage,use, processing, transmission, provision, disclosure, deletion, etc.

2.4

Sensitive Personal Information means Personal Information that, once leaked orillegally used, may easily cause harm to the dignity of natural persons grave harmto personal or property security, including information on biometric characteristics,
religious beliefs, specially-designated status, medical health, financial accounts,
individual location tracking, etc., as well as the Personal Information of minors
under the age of 14.

2.5

Data Protection Officer means the Personal Information Protection Officer.

2.6

Joint-Controller means an Entrusted Person that qualifies as a Second PI Handlerthat jointly decides with the Personal Information Handler on the Personal
Information Handling purposes and Handling methods.

2.7

Data Protection Legislation means the Personal Information Protection Law of
the People’s Republic of China as well as any regulation adopted, published,administered, implemented, or enforced by the Government of the People’s
Republic of China, as amended or superseded from time to time, and any relatedcase-law.

3.

General Obligations

3.1

Each Party shall comply with all applicable requirements of Data Protection
Legislation. This Clause is in addition to, and does not relieve any Party fromcomplying with, a Party’s obligations under Data Protection Legislation.

3.2

If the Entrusted Person is Handling Personal Information on behalf of the Personal
Information Handler, without prejudice to the generality of this Clause, thePersonal Information Handler will ensure that it has all necessary Consents andPage 224
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

notices in place to enable the lawful transfer of the Personal Information to the
Entrusted Person in connection with the performance of its obligations under theServices Agreement.
3.3

If the Entrusted Person is Handling Personal Information on behalf of the Personal
Information Handler, to the extent within the Personal Information Handler’s
control having regard to the Entrusted Person’s obligations under the Services
Agreement, the Personal Information Handler shall be responsible for the accuracy
and quality of the Personal Information transferred to the Entrusted Person.

3.4

If the Entrusted Person is Handling Personal Information on behalf of the Personal
Information Handler, the Entrusted Person shall have an ongoing obligation
throughout the duration of the Services Agreement to identify and report to the
Personal Information Handler best practice techniques relating to the Handling of
Personal Information and the emergence of new and evolving technologies which
could improve the availability, confidentiality and/or integrity of the Handling of
Personal Information.

4.

Sub-Handlers

4.1

If the Handling involves more than one Entrusted Person (Sub-Handler), theHandling must be made in accordance with a contract or written agreement
whereby their obligations, responsibilities and roles related to the Handling areclearly defined.

4.2

The Personal Information Handler hereby authorizes the Entrusted Person toappoint Sub-Handlers (General Written Authorization). The Entrusted Person shallname all its Sub-Handlers to the Personal Information Handler prior to initiation ofHandling.

4.3

With respect to each Sub-Handler appointed by the Entrusted Person under
General Written Authorization, the Entrusted Person shall (a) undertake
appropriate due diligence prior to the Handling of Personal Information by such
Sub-Handler to ensure that it is capable of providing the level of protection for
Personal Information required by the terms of the Services Agreement and thisAgreement, and (b) enter into a written Agreement with the Sub-Handler
incorporating terms which are substantially similar (and no less onerous) thanthose set out in this Agreement and which meet the requirements stipulated by
PIPL.

4.4

In regard to the Agreement between the Personal Information Handler and the
Entrusted Person, the Entrusted Person remain fully liable to the Personal
Information Handler for all acts or omissions of its Sub-Handlers as though they
were its own.

Page 225
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

4.5

To the extent that the Entrusted Person has already appointed any Sub-Handlers
prior to the Handling of any Personal Information under this Agreement, theEntrusted Person shall ensure that its obligations under this Section are met.

4.6

Where the Entrusted Person proposes any changes concerning the addition or
replacement of any Sub-Handler, it shall notify the Personal Information Handler inwriting as soon as reasonably practicable prior to implementing such change
specifying (a) the name of any Sub-Handler which it proposes to add or replace,and (b) the Handling activity or activities affected by the proposed change, and (c)the reasons for the proposed change, and (d) the proposed date for
implementation of the change.

4.7

If within thirty (30) days of receipt of a notice the Personal Information Handler(acting reasonably and in good faith) notifies the Entrusted Person in writing of any
objections to the proposed change, the Parties shall use their respective
reasonable endeavors to resolve the Personal Information Handler’s objections.
Where such resolution cannot be agreed within thirty (30) days of the Entrusted
Person’s receipt of the Personal Information Handler’s objections (or such longer
period as the Parties may agree in writing) the Personal Information Handler may,notwithstanding the terms of the Services Agreement, serve written notice on the
Entrusted Person to terminate the Services Agreement (to the extent that theprovision of the Services are or would be affected by the proposed change).

4.8

The Entrusted Person shall, upon the Personal Information Handler’s request,
provide the Personal Information Handler with copies of any Agreements between
the Entrusted Person and its Sub-Handlers (which may be redacted to remove
information which is confidential to the Entrusted Person and/or its Sub-Handlers
and which is not relevant to the terms of this Agreement).

5.

Obligations of the Entrusted Person (Art. 5, 6, 7, 8, 9, and 10 PIPL)

5.1

The Entrusted Person shall observe the principles of legality, propriety, necessity,and sincerity for Personal Information Handling. The Entrusted Person shall not
Handle Personal Information in misleading, swindling, coercive, or other such ways.

5.2

The Entrusted Person shall Handle Personal Information only for clear andreasonablepurposes, that shall be directly related to the Handling purpose,using methods with the smallest influence on individual rights and interests.

5.3

The Entrusted Person shall limit the collection of Personal Information to thesmallest scope for realizing the Handling purpose, and not collect Personal
Information excessive.

Page 226
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

5.4

The Entrusted Person shall observe the principles of openness and transparency in
the Handling of Personal Information, disclose the rules for Handling Personal
Information and clearly indicate the purpose, method, and scope of Handling.

5.5

The Entrusted Person shall ensure the quality of Personal Information and avoid
adverse effects on individual rights and interests from inaccurate or incomplete
Personal Information.

5.6

The Entrusted Person shall bear full responsibility for its own Personal Information
Handling activities and adopt all necessary measures to safeguard the security of
the Personal Information it Handles. The Parties agreed on the required technicaland organizational measures and procedures in APPENDIX 9 – TECHNICAL AND
ORGANISATIONAL MEASURES.

5.7

The Entrusted Person shall not illegally collect, use, process, or transmit otherpersons' Personal Information, or illegally sell, buy, provide, or disclose otherpersons' Personal Information, or engage in Personal Information Handling
activities harming national security or the public interest.

6.

Consent and Legal Grounds (Art. 13, 14, 15, and 16 PIPL)

6.1

In principle, the Entrusted Person shall Handle Personal Information with theindividual’s consent.

6.2

However, the Entrusted Person may Handle Personal Information without theindividual’s consent in cases (1) where necessary to conclude or fulfill a contract inwhich the individual is an interested party, or where necessary to conduct humanresources management according to lawfully formulated labor rules andstructures and lawfully concluded collective contracts, or (2) where necessary to
fulfill statutory duties and responsibilities or statutory obligations, or (3) where
necessary to respond to sudden public health incidents or protect natural persons’
lives and health, or the security of their property, under emergency conditions, or(4) Handling Personal Information within a reasonable scope to implement news
reporting, public opinion supervision, and other such activities for the public
interest, or (5) when Handling Personal Information disclosed by persons
themselves or otherwise already lawfully disclosed, within a reasonable scope inaccordance with the provisions of PIPL, or (6) in other circumstances provided inlaws and administrative regulations.

6.3

Where Personal Information is Handled by the Entrusted Person based on theindividual’s consent, said consent shall be given by individuals under theprecondition of full knowledge, and in a voluntary and explicit statement. Where
laws or administrative regulations provide that separate consent or written consent

Page 227
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

shall be obtained to Handle Personal Information, those provisions are to befollowed by the Entrusted Person.
6.4

Where the Entrusted Person changes the purpose of Personal Information
Handling, the Handling method, or the categories of Handled Personal
Information, the Entrusted Person shall obtain the individual’s consent again.

6.5

Where Personal Information is Handled by the Entrusted Person based on theindividual’s consent, the Entrusted Person shall inform individuals about their rightto rescind their consent. The Entrusted Person shall provide a convenient way towithdraw consent.

6.6

The Entrusted Person shall not refuse to provide products or services on the basisthat an individual does not consent to the Handling of its Personal Information or
rescinds its consent, except where Handling Personal Information is necessary forthe provision of products or services.

7.

Transparency towards and Notifications of Individuals (Art. 17 and 18 PIPL)

7.1

The Entrusted Person shall, before Handling Personal Information, explicitly notify
individuals truthfully, accurately, and fully, using clear and easily understoodlanguage, namely about (1) the name or personal name and contact method of the
Entrusted Person, and (2) the purpose of Personal Information Handling and theHandling methods, the categories of Handled Personal Information, and theretention period, and (3) methods and procedures for individuals to exercise therights provided by PIPL, and (4) other items that laws or administrative regulations
provide shall be notified. Where the Entrusted Person Handles Personal
Information exclusively for the Personal Information Handler, the Entrusted Person
shall, before Handling Personal Information, explicitly notify and inform individuals
by means of the Transparency Document that was published on the website of the
Personal Information Handler.

7.2

Where a change occurs in the matters provided in the previous paragraph,individuals shall be notified by the Entrusted Person about the change.

7.3

Where the Entrusted Person notify the matters as provided under Section 7.1
through the method of formulating Personal Information Handling rules, theHandling rules shall be made public disclosed and convenient to read and store.

7.4

The Entrusted Person may not notify individuals about the items provided in
Section 7.1 under circumstances where laws or administrative regulations providethat confidentiality shall be preserved or notification is not necessary.

Page 228
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

7.5

Under emergency circumstances, where it is impossible to notify individuals in atimely manner in order to protect natural persons’ lives, health, and the security of
their property, the Entrusted Person shall notify them after the conclusion of theemergency circumstances.

8.

Retention (Art. 19 PIPL)

8.1

The Entrusted Person shall, except where laws or administrative regulations
provide otherwise, use the shortest period necessary to realize the purpose of the
Personal Information Handling as retention period.

9.

Rights and Obligations of each Party if the Parties act as Joint-Controllers (Art.
20 PIPL)

9.1

This Section 9 shall apply only if the Personal Information Handler and the
Entrusted Person act jointly as Joint-Controllers. The Clauses of Section 9 of thisAgreement shall supersede any conflicting Clauses in other Sections of thisAgreement regarding to both Joint-Controllers.

9.2

This Agreement does not influence an individual’s rights to demand any of the
Joint-Controllers to perform under PIPL provisions.

9.3

Where the Joint-Controllers harm Personal Information rights and interests,
resulting in damages, they bear joint liability according to the law.

9.4

The Joint-Controllers determined the scope, subject, purpose and nature of theHandling, the type of Personal Information and categories of individuals in theServices Agreement and/or in APPENDIX 8 – DESCRIPTION OF THE PROCESSING
OR THE TRANSFER.

9.5

The Joint-Controllers shall jointly ensure compliance with Data Protection
Legislation when Handling Personal Information. Both controllers are equally
responsible for the legality and lawfulness of joint Handling.

9.6

The Personal Information Handler undertakes to provide the individuals with all
information regarding their rights under PIPL. The Personal Information Handler
acts as the contact point for individuals.

9.7

The Joint-Controllers shall bear joint responsibility for Personal Information
Handling activities and adopt all necessary measures to safeguard the security of
the Personal Information they Handle jointly. The Parties agreed on the technicaland organizational measures and procedures in APPENDIX 9 – TECHNICAL AND
ORGANISATIONAL MEASURES.

Page 229
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

9.8

The Joint-Controllers shall jointly appoint only Sub-Handlers which adopted
necessary measures to safeguard the security of the Personal Information they
Handle and comply with PIPL.

9.9

Each Joint-Controller shall appoint a Data Protection Officer. Both Data Protection
Officers shall act jointly in good faith.

9.10

Where one of the Joint-Controllers provides a third party with Personal
Information, that Joint-Controller shall notify individuals about the name or
personal name of the recipient, their contact method, the Handling purpose,
Handling method, and Personal Information categories, and obtain separate
consent from the individuals.

9.11

Where one of the Joint-Controllers provides a third party with Personal
Information, that third party shall Handle Personal Information within the scope ofHandling purposes, Handling methods, Personal Information categories, etc. andwhen the third party is changing the original Handling purpose or Handling
methods, that third party shall inform and obtain the individual’s consent again.

10.

General Obligations of the Entrusted Person (Art. 21 PIPL)

10.1

Where the Personal Information Handler entrust the Handling of Personal
Information, it shall conclude an agreement with the Entrusted Person on the
purpose for entrusted Handling, the time limit, the Handling method, categories of
Personal Information, protection measures, as well as the rights and duties of bothsides, etc., and conduct supervision of the Personal Information Handling activitiesof the Entrusted Person.

10.2

The time limit of Handling of Personal Information by the Entrusted Person is theduration of the Services Agreement. The protection measures are agreed on with
APPENDIX 9 – TECHNICAL AND ORGANISATIONAL MEASURES.

10.3

The Personal Information Handler published a “List of (sub) processors, recipientsin third countries and international organizations” on its website. In this document,
the “Purpose for entrusted Handling” is published as “Subject matter of (sub-)processing”, the “Handling method” is published as “Nature of (sub-) processing”,
and the “Categories of Personal Information” are published as “Categories of
Personal Data”.

10.4

The Personal Information Handler is granted the right to conduct supervision of
the Personal Information Handling activities of the Entrusted Person.

Page 230
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

10.5

The Entrusted Person shall Handle Personal Information exclusively according tothis Agreement. The Entrusted Person shall not Handle Personal Information for
Handling purposes or in Handling methods, etc., in excess of this Agreement.

10.6

If this Agreement does not take effect, is void, has been cancelled, or has been
terminated, the Entrusted Person shall return the Personal Information to the
Personal Information Handler or delete it, and may not retain it.

11.

Mergers, separations, dissolution, declaration of bankruptcy, and other suchreasons (Art. 22 PIPL)

11.1

The Entrusted Person shall not transfer any Personal Information Handled onbehalf or for the Personal Information Handler due to mergers, separations,dissolution, declaration of bankruptcy, and other such reasons. Wherever suchreason may occur, the Personal Information Handler is to be informed and shalldecide on the transfer of Personal Information, the return of the Personal
Information to the Personal Information Handler or the deletion of the Personal
Information.

12.

Notifications where Personal Information Handlers provide other Personal
Information Handlers with the Personal Information they Handle (Art. 23 PIPL)

12.1

Where the Entrusted Person provide other Personal Information Handlers with the
Personal Information it Handles, the Entrusted person shall notify individuals about
the name or personal name of the recipient, their contact method, the Handling
purpose, Handling method, and Personal Information categories, and obtainseparate consent from the individual.

12.2

Where the Entrusted Person provide other Personal Information Handlers with the
Personal Information it Handles, the Entrusted person shall make sure by means ofa contract that all recipients that Handle Personal Information within theabove-mentioned scope of Handling purposes, Handling methods, Personal
Information categories, etc. and where recipients change the original Handling
purpose or Handling methods, the Entrusted Person shall make sure by means of acontract, that the recipients obtain the individual’s consent again.

13.

Automated Decision-Making (Art. 24 PIPL)

13.1

The Entrusted Person shall not use any methods for or engage with any
automated decision-making regarding the Personal Information that is Handled
for or on behalf of the Personal Information Handler.

14.

Non Disclosure of Personal Information (Art. 25 PIPL)

Page 231
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

14.1

The Entrusted Person shall not disclose any Personal Information Handled onbehalf of the Personal Information Handler to third parties. Sub-Handlers are notconsidered to be third parties.

15.

Major influence on individual rights and interests (Art. 27 PIPL)

15.1

Where the Entrusted Person Handles Personal Information that has been
disclosed by the persons themselves or was otherwise lawfully disclosed, except
where the person clearly refuses, and that may have a major influence on
individual rights and interests, the Entrusted Person shall obtain personal consent
in accordance with the provisions of PIPL.

16.

Sensitive Personal Information (Art. 28, 29, 30, 31, and 32 PIPL)

16.1

In general, the Entrusted Person shall not Handle Sensitive Personal Information
on behalf of the Personal Information Handler. However, if the Entrusted Person
would Handle Sensitive Personal Information in exceptional circumstances onbehalf of the Personal Information Handler, it may do so only where there is a
specific purpose and a need to fulfill, and under circumstances of strict protection
measures.

16.2

If the Entrusted Person would Handle Sensitive Personal Information in
exceptional circumstances on behalf of the Personal Information Handler, theEntrusted Person shall obtain the individual's separate consent. Where laws oradministrative regulations provide that written consent shall be obtained for
Handling Sensitive Personal Information, those provisions are to be followed by the
Entrusted Person.

16.3

If the Entrusted Person would Handle Sensitive Personal Information in
exceptional circumstances on behalf of the Personal Information Handler, theEntrusted Person shall, in addition to the items set out in Article 17, Paragraph 1, of
PIPL, also notify individuals of the necessity and influence on the individual's rights
and interests of Handling the Sensitive Personal Information, except where PIPL
provides that it is permitted not to notify the individuals.

16.4

In general, the Entrusted Person shall not Handle Personal Information of minors
under the age of 14 on behalf of the Personal Information Handler. However, if the
Entrusted Person would Handle Personal Information of minors under the age of
14 in exceptional circumstances on behalf of the Personal Information Handler, theEntrusted Person shall obtain the consent of the parent or other guardian of theminor. Where the Entrusted Person Handle the Personal Information of minors

Page 232
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

under the age of 14, the Entrusted Person shall formulate specialized Personal
Information Handling rules.
16.5

Where laws or administrative regulations provide that relevant administrative
licenses shall be obtained or other restrictions apply to the Handling of Sensitive
Personal Information, those provisions are to be followed by the Entrusted Person.

17.

Cross-Border Provision of Personal Information (Art. 38, 39, 40, 41, 42 and 43
PIPL)

17.1

Where the Entrusted Person, on behalf of the Personal Information Handler, truly
need to provide Personal Information outside the borders of the People’s Republicof China for business or other such requirements, the Entrusted Person shall meet
all requirements of PIPL.

17.2

In particular, in such case, the Entrusted Person shall meet one of the following
conditions: (1) passing a security assessment organized by the State cybersecurity
and informatization department according to Article 40 of PIPL, or (2) undergoing
Personal Information protection certification conducted by a specialized bodyaccording to provisions by the State cybersecurity and informatization department,or (3) concluding a contract with the foreign receiving side in accordance with astandard contract formulated by the State cyberspace and informatization
department, agreeing upon the rights and responsibilities of both sides, or (4)meet other conditions provided in laws or administrative regulations or by theState cybersecurity and informatization department.

17.3

Where treaties or international agreements that the People's Republic of China has
concluded or acceded to contain relevant provisions such as conditions onproviding personal data outside the borders of the People's Republic of China,
those provisions may be carried out by the Entrusted Person.

17.4

The Entrusted Person shall adopt necessary measures to ensure that foreign
receiving parties' Personal Information Handling activities reach the standard of
Personal Information protection provided in PIPL.

17.5

Where the Entrusted Person provide Personal Information outside of the bordersof the People’s Republic of China, the Entrusted Person shall notify the individual
about the foreign receiving side’s name or personal name, contact method,
Handling purpose, Handling methods, and Personal Information categories, as wellas ways or procedures for individuals to exercise the rights provided in PIPL withthe foreign receiving side, and other such matters, and obtain individuals’ separate
consent.

Page 233
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

17.6

If the Entrusted Person is a Critical information infrastructure operator that is
Handling Personal Information and reaches the quantities provided by the Statecybersecurity and informatization department the Entrusted Person shall store
Personal Information collected and produced within the borders of the People’s
Republic of China domestically. Where the Entrusted Person need to provide it
abroad, the Entrusted Person shall pass a security assessment organized by theState cybersecurity and informatization department; where laws or administrative
regulations and State cybersecurity and informatization department provisions
permit that security assessment not be conducted, those provisions are to befollowed by the Entrusted Person.

17.7

Competent authorities of the People's Republic of China, according to relevantlaws and treaties or international agreements that the People's Republic of China
has concluded or acceded to, or according to the principle of equality and mutual
benefit, are to Handle foreign judicial or law enforcement authorities' requests
regarding the provision of Personal Information stored domestically. Without theapproval of the competent authorities of the People's Republic of China, theEntrusted Person may not provide Personal Information stored within themainland territory of the People's Republic of China to foreign judicial or law
enforcement agencies.

17.8

The Entrusted Person shall observe the lists of the State cybersecurity andinformatization department that contain foreign organizations or individuals withlimitations or prohibitions regarding the provision of personal information to themand shall under no circumstances transfer or provide Personal Information to any
foreign organization or individual that is named or included on such lists.

17.9

Where the People’s Republic of China has adopted reciprocal measures against
any country or region on the basis of actual circumstances, based on Art. 43 PIPL,
the Entrusted Person shall comply with any such decision, and where required,without undue delay cease and desist any transfer to the respective country or
region.

18.

Individuals’ Rights in Personal Information Handling Activities (Art. 44, 45, 46,
47, 48, 49, and 50 PIPL)

18.1

The Entrusted Person shall comply with its own obligations under Art. 44, 45, 46,
47, 48, 49, and 50 PIPL and inform the Personal Information Handler, with undue
delay, fully about any individual that has contacted the Entrusted Person regarding
any Rights in Personal Information Handling Activities relating to any Personal
Information Handled on behalf of the Personal Information Handler.

18.2

Where the Entrusted Person Handles Personal Information on behalf of the
Personal Information Handler, the Entrusted Person shall, before Handling

Page 234
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

Personal Information, inform individuals about their Rights in Personal Information
Handling Activities regarding the Personal Information Handler by means of theTransparency Document published on the website of the Personal Information
Handler.
19.

Other Duties of the Entrusted Person (Art. 51, 52, 53, 54, 55, 56, 57, 58 and 59
PIPL)

19.1

The Entrusted Person shall, on the basis of the Personal Information Handling
purpose, Handling methods, Personal Information categories, as well as theinfluence on individuals' rights and interests, possibly existing security risks, etc.,
adopt at least the following measures to ensure Personal Information Handlingconforms to the provisions of laws and administrative regulations, and prevent
unauthorized access as well as Personal Information leaks, distortion, or loss: (1)formulate internal management structures and operating rules, and (2) implement
categorized management of Personal Information, and (3) adopt corresponding
technical security measures such as encryption, de-identification, etc., and (4)reasonably determine operational limits for Personal Information Handling, andregularly conducting security education and training for employees, and (5)formulate and organize the implementation of Personal Information security
incident response plans, and (6) take other measures provided in laws oradministrative regulations.

19.2

If the Entrusted Person has reached the quantities provided by the Statecybersecurity and informatization department, it shall appoint a Personal
Information Protection Officer, to be responsible for supervising Personal
Information Handling activities as well as adopted protection measures, etc., andshall disclose the methods of contacting the Personal Information Protection
Officer, and report the personal names of the Officer and contact methods to thedepartments fulfilling Personal Information protection duties and responsibilities.

19.3

If the Entrusted Person engages a Personal Information Handler outside theborders of the People’s Republic of China, the Entrusted Person shall make surethat the foreign Personal Information Handler has dedicated an entity or
appointed a representative within the borders of the People’s Republic of Chinathat is responsible for matters related to the Personal Information which it
Handles, and that the name of the relevant entity or the personal name of therepresentative and contact method, etc., was reported to the departments fulfillingpersonal information protection duties and responsibilities.

19.4

The Entrusted Person shall regularly engage in audits of their Personal Information
Handling and compliance with laws and administrative regulations.

Page 235
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

19.5

When one of the following circumstances is present, the Entrusted Person shallconduct a Personal Information Protection Impact Assessment in advance, andrecord the Handling situation: (1) Handling Sensitive Personal Information, or (2)Using Personal Information to conduct automated decision-making, or (3)Entrusting Personal Information Handling, providing Personal Information to other
Personal Information Handlers, or disclosing Personal Information, or (4) Providing
Personal Information abroad, or (5) other Personal Information Handling activities
with a major influence on individuals.

19.6

The Entrusted Person shall include the following content in the Personal
Information Protection Impact Assessment: (1) whether or not the Personal
Information Handling purpose, Handling method, etc., are lawful, legitimate, andnecessary, and (2) the influence on individuals' rights and interests, and the
security risks, and (3) whether protective measures undertaken are legal, effective,
and suitable to the degree of risk. The Entrusted Person shall preserve the Personal
Information Protection Impact Assessment Reports and Handling status records
for at least three years.

19.7

Where a Personal Information leak, distortion, or loss occurs or might haveoccurred, the Entrusted Person shall immediately adopt remedial measures, andnotify the Personal Information Handler to allow him to notify the departments
fulfilling Personal Information protection duties and responsibilities and theindividuals. The notification shall include the following items (1) the information
categories, causes, and possible harm caused by the leak, distortion, or loss that
occurred or might have occurred, and (2) the remedial measures taken by the
Personal Information Handler and measures individuals can adopt to mitigate
harm, and (3) the contact method of the Entrusted Person.

19.8

If the Entrusted Person is providing important Internet platform services, that havea large number of users, and its business models are complex, the Entrusted
Person shall fulfill the obligations in Art. 58 PIPL.

19.9

The Entrusted Persons shall, according to the provisions of PIPL and relevant laws
and administrative regulations, take necessary measures to safeguard the securityof the Personal Information it Handles, and assist the Personal Information Handler
in fulfilling its obligations provided in PIPL.

20.

Legal Liability (Art. 66 PIPL)

20.1

Where the Entrusted Person has Handled Personal Information in violation of PIPLor Personal Information is Handled by the Entrusted Person without fulfilling
Personal Information protection duties in accordance with the provisions of PIPL,
and the Entrusted Person acted on behalf of the Personal Information Handler, thePersonal Information Handler is entitled to order correction, and order the

Page 236
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20

provisional suspension or termination of service provision of the application
programs unlawfully Handling Personal Information.
21.

Compensation for infringements (Art. 69 PIPL)

21.1

Where the Entrusted Person Handled Personal Information, and such operation is
infringing Personal Information rights and interests and results in harm, and the
Entrusted Person cannot prove they are not at fault, the Entrusted Person shallbear compensation and take responsibility for the infringement. Responsibility tocompensate for infringement shall be determined according to the resulting loss
to the individual or the Personal Information Handler’s resulting benefits. Where
the loss to the individual and the Personal Information Handler’s benefits are
difficult to determine, a court may determine compensation according to practicalconditions.

Page 237
Version: 1.07
Classification: PublicPowered by LegalTech from Willing & Able and the Germany Certification Body.
Document Owner: Heiko Maniero.
Information Contained: Business Data

© All rights reserved by Heiko Maniero.
Approved by: Heiko Maniero, Ulrich Baumann.
Date: 2023-03-20