The Small Print That Sponsors Love
1. Definitions
In this Schedule, the following words shall have the following meanings:
- “Act” means the Data Protection Act 2018.
- “Associate” means any corporate or other form of organisation or any individual person with whom the Organiser and the Sponsor has an association which does, or could, entail the transfer of personal data for processing.
- “ICO” means the Information Commissioner’s Office.
- “Data Protection Legislation” means all or any of: (a) the GDPR, (b) the applied GDPR, (c) the Act, (d) regulations made under the Act (e) regulations made under section 2(2) of the European Communities Act 1972 which relate to the GDPR or the Law Enforcement Directive.
- “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
- “the applied GDPR” means the GDPR as applied by Chapter 3 of Part 2 of the Act.
- “Law Enforcement Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.
- “data controller”, “data processor”, “sub-processor”, “data subjects”, “personal data”, “process”, “processed” and “processing” shall have the meanings respectively, as defined in the Act. In this agreement, “personal data”, is limited to data which comes into the control of each party in some way connected to this agreement.
2. Data Protection
2.1. The obligations described in this Schedule are in addition to the parties’ obligations under the Data Protection Legislation.
2.2. The Organiser and the Sponsor agrees that personal data may move between the Organiser and the Sponsor and vice versa in such a way that either of the Organiser and the Sponsor may be controller of some personal data and processor of others.
2.3. Details of the anticipated processing activities are set out at Appendix 1 to this Schedule.
3. How the Organiser and the Sponsor shall process data
Each of the Organiser and the Sponsor agrees that it shall at all times comply with the provisions and obligations imposed by the Data Protection Legislation and, in particular, shall:
3.1. process personal data only to the extent necessary to provide their respective obligations under this agreement and only in accordance with prior written instructions of the other (if required);
3.2. immediately inform the other party if its instruction infringes the Data Protection Legislation;
3.3. ensure that every person processing personal data under this agreement does so strictly on a need-to-know basis, has received training on their obligations relating to handling of personal data and is bound by confidentiality obligations no less stringent than our confidentiality obligations under this agreement;
3.4. in order to use commonly accepted international communications and money transfer protocols, it will be necessary to use sub-contractors for certain service provision. The parties shall not necessarily be aware of the identity of every organisation involved in the train of communications. When that happens, each of the Organiser and the Sponsor accepts full responsibility for compliance with the Data Protection Legislation.
3.5. subject to the exceptions mentioned in the last previous sub-paragraph, the Sponsor will not use sub-processors for personal data processing under this agreement without prior written consent of the Organiser.
3.6. wherever possible, enter into a written contract with each such sub-processor, which includes the same obligations on the sub-processor as those imposed on each of the Organiser and the Sponsor under this agreement.
3.7. subject to the other provisions of this Schedule, not process personal data or permit any third party to process personal data outside of the European Economic Area (EEA) unless:
3.7.1 EU standard contractual clauses approved by the European Commission or the ICO are entered into between the Organiser and the Sponsor or relevant Associate as data exporter, and the relevant recipient of the personal data as data importer; or
3.7.2 the recipient of the personal data has entered into a data processing agreement with the data exporter; or
3.7.3 the recipient of the personal data is regulated within the United States of America solely by the U.S. Department of Commerce, is certified under the EU/US Privacy Shield framework, and continues to be certified for the period within which it processes the personal data; or
3.7.4 the recipient of the personal data has entered into binding corporate rules, which are valid in respect of the processing of personal data under this agreement and have been approved by the European Commission or the ICO; or
3.7.5 the transfer is to a recipient located within a jurisdiction whose law relating to the processing of personal data has been approved by the European Commission or the ICO (subject to any applicable restrictions).
3.8. have in place at all times appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by processing the personal data, to prevent accidental, unauthorised or unlawful destruction, loss, alteration, or access to personal data, including as a minimum whatever security measures the Organiser and the Sponsor requires of each other and notify to that other. Examples of such measures are:
3.8.1 the pseudonymisation and encryption of personal data;
3.8.2 the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; and
3.8.3 a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;
3.9. maintain a written record of all categories of processing activities carried out on behalf of the other party and when that other party asks, copy the record to him. The record shall contain:
3.9.1 name and contact details and (where applicable) those of our approved sub-processors and details of their respective data protection officers;
3.9.2 the categories of personal data, data subjects and processing activities carried out on behalf of the Organiser and the Sponsor or Associates;
3.9.3 where applicable, transfers of personal data to a third country (i.e. non-EU Member State) or an international organisation, including identification of that third country and documentation evidencing implementation of suitable safeguards; and
3.9.4 a general description of the technical and organisational security measures we have installed as referred to in Article 32(1) of the GDPR;
3.10. when the Organiser asks, give to the Organiser or to the ICO, access to the Sponsor’s employees, data processing facilities, procedures, and records to inspect and audit compliance with the Data Protection Legislation and the terms of this agreement. The Organiser and the Sponsor agree that each of the Organiser and the Sponsor shall (and shall ensure any sub-processor shall) give all reasonable cooperation and assistance.
3.11. immediately tell the other party (and in any event within 24 hours) after becoming aware of any actual or suspected unlawful destruction, loss, alteration, disclosure of, or access to, personal data transmitted, stored or otherwise processed by us or any sub-processor under this agreement;
3.12. provide reasonable assistance to each other in:
3.12.1 responding to data subject’s requests to exercise their rights under the Act;
3.12.2 responding to communications received from the ICO relating to the processing of personal data under this agreement, including notifying the other immediately of any such communication;
3.12.3 taking measures to address data security incidents, including, where appropriate, measures to mitigate their possible adverse effects;
3.12.4 promptly upon request, transfer personal data to a third party in compliance with a request from a data subject to exercise their right to data portability;
3.12.5 make available to other on request all information necessary to demonstrate compliance with the obligations set out in this Schedule; and
3.13. at the Organiser’s request (no more than once in every calendar year) the Sponsor shall complete and return without delay information security and data protection questionnaires.
4. Post termination
4.1. Upon termination the Organiser and the Sponsor and any sub processor shall:
4.1.1 physically destroy all copies of media upon which any personal data was supplied and any further copies;
4.1.2 return all personal data stored in hard copy to other party;
4.1.3 delete all personal data stored in soft copy, by some method which prevents future re-activation of that data;
4.1.4 certify within 14 days of such request that the requirements of this paragraph have been complied with.
4.2. Where either the Organiser and the Sponsor or his processor, sub-processor is required to retain personal data in order to comply with applicable law, that party will tell the other party and will retain such personal data only in the capacity as set out in this Schedule and shall comply with the obligations as far as applicable law permits.
5. Warranty and acceptance of liability
5.1. Each party represents and warrant that the information provided in any response to any request by other shall be complete, true and accurate, and will not misrepresent his business or practices in respect of his ability to comply with the Data Protection Legislation and his obligations under this agreement.
5.2. If any act or omission of a party or his processors, sub-processors results in data transmitted or processed under this agreement being lost or degraded so as to be unusable, then that party shall be liable to the other for the cost of reconstituting the data and/or his and his Associate’s costs in recreating such data.
Data Processing Activities
Appendix 1 to Schedule
What either party may process in each category
1. The Organiser and the Sponsor shall process this basic personal data
1.1. Name
1.2. Address
1.3. Email address
1.4. Telephone number
1.5. Product, service, technology or other business-associated information together with information relating to electronic communication, which may be personal information only when associated with the name or identity of the data subject.
1.6. Technical information relating to electronic communication, which is personal information only when associated with the name or identity of the data subject
2. Processing the data of these data subjects
The Customers or prospective customers of the parties who do now or might in the future use the products together with any other people whose data is acquired in the course of business between the parties.
3. This is why and how the Organiser and the Sponsor shall process personal data
3.1. Personal data will be processed in order to satisfy the respective obligations of the Organiser and the Sponsor under this contract.
3.2. Personal data will be processed in ways that are usual and reasonable in conducting the businesses of sponsorship.
4. Retention period
4.1. Each of the Organiser and the Sponsor may retain personal data, along with much other data, for six years, for these reasons:
4.1.1. for accounting and taxation purposes;
4.1.2. to provide evidence if required in connection with a legal claim;
4.1.3. for any other reason where the law provides a six years limitation period;
4.2. If any event occurs which requires the Organiser or the Sponsor lawfully to continue to retain data beyond that period, then it may do so.
