AGREED TERMS

1. Definitions and Interpretation

1.1 The following definitions and rules of interpretation apply in this Agreement.

1.2 Definitions:

1.3 This Agreement is subject to the terms of the Master Agreement and is incorporated into the Master Agreement.

1.4 Interpretations and defined terms set forth in the Master Agreement apply to the interpretation of this Agreement.

1.5 The categories of data subjects, types of personal data, nature, subject matter and duration of processing are as set out in the Master Agreement and/or as necessary for the performance of the Master Agreement.

1.6 In the case of conflict or ambiguity between:

1. any provision contained in the body of this Agreement and any provision contained in the Annexes, the provision in the body of this Agreement will prevail;
2. the terms of any accompanying invoice or other documents annexed to this Agreement and any provision contained in the Annexes, the provision contained in the Annexes will prevail; and
3. any of the provisions of this Agreement and the provisions of the Master Agreement, the provisions of this Agreement will prevail.

2. Personal data types and processing purposes

2.1 The parties agree and acknowledge that for the purpose of the Data Protection Legislation:

1. the Licensee identified in the Master Agreement is the Controller and BLUEVANGAS is the Processor of all Content Data processed for the purpose of the Master Agreement.
2. the Controller retains control of the Content Data and remains responsible for its compliance obligations under the Data Protection Legislation, including but not limited to, providing any required notices and obtaining any required consents, and for the written processing instructions it gives to the Processor.

3. Processor's obligations

3.1 The Processor will only process the Personal Data to the extent, and in such a manner, as is necessary for Master Agreement in accordance with the Controller's written instructions.

3.2 The Processor will not process the Personal Data for any other purpose or in a way that does not comply with this Agreement or the Data Protection Legislation.

3.3 The Processor must promptly notify the Controller if, in its opinion, the Controller's instructions do not comply with the Data Protection Legislation.

3.4 The Processor must comply promptly with any Owner written instructions requiring the Processor to amend, transfer, delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised processing.

3.5 The Processor will maintain the confidentiality of the Personal Data and will not disclose the Personal Data to third-parties unless the Controller or this Agreement specifically authorises the disclosure, or as required by domestic law, court or regulator (including the Commissioner).

3.6 If a domestic law, court or regulator (including the Commissioner) requires the Processor to process or disclose the Personal Data to a third-party, the Processor must first inform the Controller of such legal or regulatory requirement and give the Controller an opportunity to object or challenge the requirement, unless the domestic law prohibits the giving of such notice.

3.7 The Processor will reasonably assist the Controller, at Controller’s cost, with meeting the Controller's compliance obligations under the Data Protection Legislation, taking into account the nature of the Processor's processing and the information available to the Processor, including in relation to Data Subject rights, data protection impact assessments and reporting to and consulting with the Commissioner under the Data Protection Legislation.

3.8 The Processor must notify the Controller promptly of any changes to the Data Protection Legislation that may reasonably be interpreted as adversely affecting the Processor's performance of the Master Agreement or this Agreement.

4. Processor's employees

4.1 The Processor will ensure that all of its employees:

1. are informed of the confidential nature of the Personal Data and are bound by written confidentiality obligations and use restrictions in respect of the Personal Data;
2. have undertaken training on the Data Protection Legislation and how it relates to their handling of the Personal Data and how it applies to their particular duties; and
3. are aware both of the Processor's duties and their personal duties and obligations under the Data Protection Legislation and this Agreement.

5. Security

5.1 The Processor must at all times implement appropriate technical and organisational measures against accidental, unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data.

5.2 The Processor must implement such measures to ensure a level of security appropriate to the risk involved, including as appropriate:

1. the pseudonymisation and encryption of personal data;
2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
4. a process for regularly testing, assessing and evaluating the effectiveness of the security measures.

6. Personal data breach

6.1 The Processor will as soon as possible and without undue delay notify the Controller in writing if it becomes aware of:

1. the loss, unintended destruction or damage, corruption, or unusability of part or all of the Personal Data.
2. any accidental, unauthorised or unlawful processing of the Personal Data; or
3. any Personal Data Breach.

6.2 Where the Processor becomes aware of (a), (b) and/or (c) above, it will, without undue delay, also provide the Controller with the following written information:

1. description of the nature of (a), (b) and/or (c), including the categories of in-scope Personal Data and approximate number of both Data Subjects and the Personal Data records concerned;
2. the likely consequences; and
3. a description of the measures taken or proposed to be taken to address (a), (b) and/or (c), including measures to mitigate its possible adverse effects.

6.3 Immediately following any accidental, unauthorised or unlawful Personal Data processing or Personal Data Breach, the parties will co-ordinate with each other to investigate the matter.

6.4 Further, the Processor will reasonably co-operate with the Controller (at the Controller’s cost) in the Controller's handling of the matter, including but not limited to:

1. assisting with any investigation;
2. providing the Controller with physical access to any facilities and operations affected;
3. facilitating interviews with the Processor's employees, former employees and others involved in the matter including, but not limited to, its officers and directors;
4. making available all relevant records, logs, files, data reporting and other materials required to comply with all Data Protection Legislation or as otherwise reasonably required by the Controller; and
5. taking reasonable and prompt steps to mitigate the effects and to minimise any damage resulting from the Personal Data Breach or accidental, unauthorised or unlawful Personal Data processing.

6.5 The Processor will not inform any third-party of any accidental, unauthorised or unlawful processing of all or part of the Personal Data and/or a Personal Data Breach without first obtaining the Controller's written consent, except when required to do so by Applicable Law.

6.6 The Processor agrees that the Controller has the sole right to determine:

1. whether to provide notice of the accidental, unauthorised or unlawful processing and/or the Personal Data Breach to any Data Subjects, the Commissioner, other in-scope regulators, law enforcement agencies or others, as required by law or regulation or in the Controller's discretion, including the contents and delivery method of the notice; and
2. whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

6.7 The Controller will cover all reasonable expenses associated with the performance of the obligations under clause 6.1 to clause 6.3.

7. Subcontractors

7.1 The Processor may authorise a third-party (subcontractor) to process the Personal Data where reasonably required for the performance of the Main Agreement provided that:

1. the Processor enters into a written contract with the subcontractor that contains terms substantially the same as those set out in this Agreement, in particular, in relation to requiring appropriate technical and organisational data security measures, and, upon the Controller's written request, provides the Controller with copies of the relevant excerpts from such contracts;
2. the Processor maintains control over all of the Personal Data it entrusts to the subcontractor; and
3. the subcontractor's contract terminates automatically on termination of this Agreement for any reason.

8. Complaints, data subject requests and third-party rights

8.1 The Processor shall take such technical and organisational measures as may be appropriate, and promptly provide such information to the Controller as the Controller may reasonably require (and at Controller’s cost), to assist the Controller to comply with:

1. the rights of Data Subjects under the Data Protection Legislation, including, but not limited to, subject access rights, the rights to rectify, port and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
2. information or assessment notices served on the Controller by the Commissioner under the Data Protection Legislation.

8.2 The Processor must notify the Controller immediately in writing if it receives:

1. any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party's compliance with the Data Protection Legislation;
2. a request from a Data Subject for access to their Personal Data or to exercise any of their other rights under the Data Protection Legislation.

8.3 The Processor must not disclose the Personal Data to any Data Subject or to a third-party other than in accordance with the Controller's written instructions, or as required by Applicable Law.

9. Term and termination

9.1 This Agreement will remain in full force and effect so long as:

1. the Master Agreement remains in effect; or
2. the Processor retains any of the Personal Data related to the Master Agreement in its possession or control (Term).

9.2 Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the Master Agreement in order to protect the Personal Data will remain in full force and effect.

9.3 If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its Master Agreement obligations, the parties may agree to suspend the processing of the Personal Data until that processing complies with the new requirements.

10. Data return and destruction

10.1 At the Controller's request (and cost), the Processor will give the Controller, or a third-party nominated in writing by the Controller, a copy of or access to all or part of the Personal Data in its possession or control in the format and on the media reasonably specified by the Controller.

10.2 On termination of the Master Agreement for any reason or expiry of its term, the Processor will securely delete or destroy or, if directed in writing by the Controller, return and not retain, all or any of the Personal Data related to this Agreement in its possession or control.

10.3 If any law, regulation, or government or regulatory body requires the Processor to retain any documents, materials or Personal Data that the Processor would otherwise be required to return or destroy, it will notify the Controller in writing of that retention requirement, giving details of the documents, materials or Personal Data that it must retain, the legal basis for such retention, and establishing a specific timeline for deletion or destruction once the retention requirement ends.