1.2. The terms “personal data”, “data subject”, “processor”, “controller”, “processing”, “personal data breach”, “pseudonymisation” and “supervisory authority” will have the meanings given them by Data Protection Law.  The term “special category data” shall mean the personal data referred to in paragraph 1 of Article 9.

1.3. Unless the context otherwise requires references to persons shall include natural persons, bodies corporate, unincorporated associations, governments, states, trusts and partnerships, in each case whether or not having a separate legal personality.  References to the word “include” or “including” are to be construed without limitation.

1.4. References to Schedules and Clauses are to the schedules and clauses of this Agreement unless otherwise specified.

1.5. References in this Agreement to any statute, statutory provision or EC Directive (“legislation”) include a reference to that legislation as amended, extended, consolidated or replaced from time to time and include any former legislation which it re-enacts, consolidates or replaces and any order, regulation, instrument or other subordinate legislation made under the relevant legislation. 

1.6. Any reference to “writing” or “written” includes faxes but does not include e-mail or any other electronic format.

2. GENERAL

2.1. Schedule 1 (Data Sharing Details) describes the subject matter, duration, nature and purpose of processing and the personal data categories and data subject types in respect of which inploi may process to fulfil its obligations under the Services Contract.

2.2 Whenever inploi processes personal data on the Controller’s behalf:

2.2.1 the Controller shall be the controller and inploi shall be the processor in respect of such personal data; and 

2.2.2 inploi shall only process such personal data on the Controller’s documented instructions except insofar as required to do otherwise by Data Protection Law.

2.3. inploi shall inform the Controller on becoming aware of:

2.3.1. any requirement of Applicable Law which requires inploi to process personal data otherwise than on the Controller’s documented instructions, unless the Applicable Law prohibits such information on important grounds of public interest; or 

2.3.2. any instruction from the Controller in relation to the processing of personal data which, in inploi’s reasonable opinion, infringes Data Protection Law.

2.4. The Controller will ensure that it has all necessary appropriate consents and notices in place to enable the lawful collection of personal data by inploi on behalf of the Controller for the duration and purposes of and in accordance with the Services Contract.

3. DATA PROCESSOR OBLIGATIONS

3.3.1. to process, use or disclose the Personal Data: 

3.3.1.1. only to the extent and in such manner as is necessary to for the purpose(s) specified in the Schedule to this Agreement, or

3.3.1.2. where required by Domestic Law to otherwise process that Personal Data. Where inploi is relying on Domestic Law as the basis for processing Personal Data, inploi shall notify the Controller as soon as reasonably practicable of this before performing the processing required by Domestic Law, unless the Domestic Law prohibits inploi from so notifying the Controller.  

3.3.2. to ensure that it has in place appropriate technical and organisational measures, to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected;

3.3.3. to ensure that all Personal Data is kept confidential and that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential;

3.3.4. to reasonably assist the Controller in performing impact assessments and consultations with supervising authorities and regulators;

3.3.5. to maintain complete and accurate records and information to demonstrate its compliance with this Agreement and allow for audits by the Controller or the Controller’s designated auditor;

3.3.6. to notify the Controller of the name and contact details of its data protection officer if it has appointed one in accordance with Data Protection Law; and

3.3.7. to promptly provide the Controller with notice and full details of any compensation claim that it receives from any person relating to processing of Personal Data, and to not make any admission of liability and not agree any settlement or compromise of the relevant claim without the Controller’s prior written consent (the Controller acting reasonably and timeously in considering and where appropriate providing that consent), and to consult fully with the Controller prior to taking any action.

4. SECURITY

4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk to the rights and freedoms of natural persons, Inploi shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk including (as appropriate):

4.1.1. the pseudonymisation and encryption of personal data;

4.1.2. inploi’s ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; 

4.1.3. inploi’s ability to restore the availability and accessibility of personal data in a timely manner in the event of a physical or technical incident; 

4.1.4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing; and

4.1.5. providing any assistance that the Controller reasonably requires in order for it to implement appropriate technical and organisational measures to protect its personal data.

4.2. In assessing the appropriate level of security measures to be taken under Clause 4.1 (Security) above, inploi shall take account of the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

4.3. inploi shall ensure that its employees, and any other persons with access to personal data inploi processes on the Controller’s behalf are made aware of their data protection and security obligations and are subject to binding obligations of confidentiality and have undertaken the necessary training in relation to handling personal data. 

5. SUB-PROCESSING

inploi shall be entitled to engage another person to process any of the Controller’s personal data (each a “sub-processor”). Where inploi engages a sub-processor, inploi shall: 

5.1. inform the Controller of any intended changes concerning the addition or replacement of any sub-processor (and allow the Controller reasonable opportunity to object to such change); 

5.2. ensure that its sub-processor(s) are engaged on terms equivalent to those to which inploi is itself subject under this Agreement (and any other confidentiality or similar obligations or agreements between inploi and the Controller); 

5.3. ensure that any sub-processor provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of Data Protection Law (including the requirements relating to security, integrity and confidentiality); and

5.4. where a sub-processor fails to fulfil its data protection or confidentiality obligations, remain fully liable to the Controller for the performance of (or failure to perform) those obligations.

6. REQUESTS FROM DATA SUBJECTS AND SUPERVISORY AUTHORITIES

If a data subject makes a request relating to the exercise of his or her legal rights in relation to personal data, inploi shall, at the Controller’s cost, provide the Controller with any information and assistance reasonably required by the Controller in order to respond to requests for exercising the data subject’s rights laid down in Chapter III.

7. PERSONAL DATA BREACHES AND NOTIFICATION

If inploi becomes aware of a personal data breach relating to any personal data processed on the Controller’s behalf, inploi shall notify the Controller within 48 hours of becoming aware of the breach and thereafter provide details of the nature of the personal data breach and shall provide the Controller with such information and assistance as it requires in relation to the personal data breach at the Controller’s cost.

8. PRIVACY IMPACT ASSESSMENTS

Taking into account the nature of the processing and the information available to inploi, inploi shall, at the Controller’s cost, provide the Controller with such information and assistance as the Controller reasonably requires in order to: 

8.1. carry out any privacy impact assessments (under Article 35);

8.2. consult with a supervisory authority prior to processing (under Article 36); and/or

8.3. meet any obligations under Data Protection Law which derive from the activities described in Clauses 8.1 and 8.2 (Privacy Impact Assessments) above.

9. DELETION AND RETURN OF DATA

After completing any processing of personal data on the Controller’s behalf, inploi shall (at the Controller’s option) delete or return all such personal data (and any copies of the same), unless inploi is required to store such copies to comply with a requirement imposed by Applicable Law (in which case inploi may store such copies to the extent necessary to meet that requirement).  Where inploi is required to delete personal data, to the extent that it is not practical for inploi to do so immediately, inploi shall do so as soon as possible, and in the meantime shall ensure appropriate safeguards are put in place and the data is not retained for a longer period than is appropriate and in any event not longer than the duration of the Services Contract.

10. CROSS-BORDER TRANSFERS OF PERSONAL DATA

10.1. inploi shall not transfer any of the Controller’s personal data outside of the UK or the EEA without having the Controller’s prior written consent to that transfer and either:

10.1.1. the UK government having decided that country, territory or organisation ensures adequate protection under Article 45; or

10.1.2. having other appropriate safeguards in place (as set out in Article 46); or

10.1.3. one or more of the derogations in Article 49 applies.

10.2. For the avoidance of doubt, nothing in this Agreement shall permit the transfer of personal data to any sub-processors located outside the UK or the EEA, unless expressly agreed in writing by the Parties.

11. AUDITS

12. TERM AND TERMINATION

12.1. This Agreement will remain in full force and effect so long as:

12.1.1. the Services Contract remains in effect; or

12.1.2. inploi retains any of the personal data related to the Services Contract in its possession (“Term”).

12.2. Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the Services Contract in order to protect the personal data will remain in full force and effect.

12.3. If a change in any Data Protection Law prevents either party from fulfilling all or part of its Services Contract obligations, the parties may agree to suspend the processing of the personal data until that processing complies with the new requirements. If the parties are unable to bring the personal data processing into compliance with the Data Protection Law within thirty (30) days, either party may terminate the Services Contract with immediate effect on written notice to the other party.

13. INDEMNIFICATION AND LIABILITY

13.1. inploi agrees to indemnify, keep indemnified and defend at its own expense the Controller against all costs, claims, damages or expenses incurred by the Controller or for which the Controller may become liable due to any failure by inploi or its employees, subcontractors or agents to comply with any of its obligations under this Agreement and/or the Data Protection Law.

13.2. Any limitation of liability set forth in the Services Contract will not apply to this Agreement’s indemnity or reimbursement obligations.

13.3. Subject to clause 13.4 (Liabilities that cannot be limited) the indemnity by inploi under clause 13.1 (Indemnification and Liability) shall be limited to the total amount paid or payable under the Service Contract in respect of any single occurrence of a breach that may arise and to which the indemnity applies.

13.4. Nothing in this Agreement limits any liability which cannot legally be limited, including but not limited to liability for:

13.4.1. death or personal injury caused by negligence;

13.4.2. fraud or fraudulent misrepresentation; and

13.4.3. breach of the terms implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982 (title and quiet possession).

14. GENERAL

Conflict

14.1. If there is an inconsistency between any of the provisions of this Agreement and the provisions of:

14.1.1. the Services Contract; or 

14.1.2. any later agreement  (including an Order Form as defined in the Services Contract) entered into between the parties in relation to matters of data protection, the provisions of this Agreement shall remain in force and take priority. This Clause 14.1 (Conflict) shall apply unless any such later agreement is in writing and expressly and specifically: 

14.1.2.1. refers to this Agreement; and 

14.1.2.2. states how it is to be superseded, extinguished or varied. 

These requirements shall not be satisfied by such later agreements simply stating that they supersede or extinguish earlier agreements, statements or representations between the parties.

Notices

14.2. Any notice or other communication given to a party under or in connection with this Agreement must be in writing and delivered to:

• For the Controller: the Company Secretary

• For inploi: Daniella Willberg

14.3. Clause 14.2 (Notices) does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

Variation

14.4. No variation of this Agreement shall be of any effect unless it is agreed in writing and signed by or on behalf of each party.

Third Party Rights

14.5. No third party shall have the right to enforce any provision of this Agreement pursuant to the Contracts (Rights of Third Parties) Act 1999.

Waiver

14.6. No waiver of any right or remedy under this Agreement shall be deemed to be a waiver of any subsequent or other right or remedy and no failure to exercise or delay in exercising any right or remedy under this Agreement shall constitute a waiver of that right or remedy.  No single or partial exercise of any such right or remedy shall preclude or impair any other or further exercise of it or the exercise of any other right or remedy provided by law or under this Agreement.  

Invalidity

14.7. If any provision is or becomes illegal, invalid or unenforceable in any respect, the legality, validity or enforceability of the remaining provisions of this Agreement shall not in any way be affected or impaired by it and the provision shall apply with such deletions as are necessary to make it legal, valid and enforceable.  If any provision or part-provision is deemed deleted under this Clause, the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.

Entire Agreement

14.8. This Agreement constitutes the entire agreement between the parties relating to its subject matter and supersedes and extinguishes any drafts, agreements, undertakings, representations, warranties and arrangements of any nature whatsoever, whether or not in writing, between the parties in connection with the subject matter of this Agreement.  Each of the parties acknowledges and agrees that in entering into this Agreement it does not rely on, and shall have no remedy in respect of, any undertaking, promise, assurance, statement, representation (whether innocent or negligent), warranty or understanding (whether in writing or not) or any person (whether party to this Agreement or not) other than as expressly set out in this Agreement.  

Execution in Counterparts

14.9. This agreement may be executed in two counterparts, each of which shall constitute a duplicate original, but both counterparts shall together constitute the one agreement.

14.10. Transmission of the executed signature page of a counterpart of this agreement by email (in .PDF format) shall take effect as the transmission of an executed "wet-ink" counterpart of this agreement. If this method of transmission is adopted, without prejudice to the validity of the agreement thus made, each party shall on request promptly provide the other with the "wet ink" hard copy original of their counterpart.

14.11. No counterpart shall be effective until each party has provided to the other party at least one executed counterpart.

Governing Law and Jurisdiction

14.12. This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the laws of England. Each party irrevocably agrees that the courts of England shall have exclusive jurisdiction to settle any such dispute or claim.

SCHEDULE 1

Data Sharing Details

1. Agreed Purpose of the Processing, Subject Matter and Duration

1.1. Agreed Purpose:

1.1.1. The facilitation of the introduction of individuals expressing interest in work and career opportunities with the Controller for the duration of the Services Contract or up until the Controller hires the applicant (whichever is earlier). 

1.1.2. inploi shall process anonymised Personal Data on an aggregated basis to improve its services. 

1.2. Subject Matter:

1.2.1. The subject matter of the processing under this Agreement is the candidate’s Personal Data.

1.3. Durations:

1.3.1. The duration of the processing shall be for the term of the Services Contract.

2. Categories of Personal Data to be Processed

2.1. Personal Data includes the following categories of personal data:

2.1.1. Name (first and last)

2.1.2. Email address

2.1.3. Telephone number

2.1.4. Home address/location data including postcode

2.1.5. Job/Work preferences

2.1.6. Resume/CV files and/or data

2.1.7. User behaviour

2.1.8. Uploaded images and videos

2.1.9. Tracking information relating to the data subject's site visit

3. Categories of Data Subjects

3.1. Prospective candidates seeking work and career opportunities with the Company

4. Lawful Grounds for Processing

4.1. Legitimate interest.

5. Single Point of Contact

5.1. As defined in the Order form.