APPENDIX 3

GDPR ADDENDUM

1. In this section, “controller”, “processor”, “data subject”, “personal data” and “processing” have the same meanings as set out in applicable data protection and privacy laws and regulations (“Data Protection Laws”).

2. This Appendix applies to any personal data “Data”) in respect of which the Supplier acts as “processor” in connection with this contract. The processor processes such data during the contract to enable it to provide its services to the Client.

3. The processor shall:

3.1 process the Data in accordance with Data Protection Laws (and nothing in this agreement relieves the obligations of the processor of its own direct responsibilities and liabilities under Data Protection Laws);

3.2 process the Data only so far as is necessary for the purpose of performing its obligations under this agreement;

3.3 process the Data only on written instructions from the controller as set out in this agreement unless the law requires otherwise in which case the processor shall inform the controller before processing;

3.4 not transfer Data outside the UK without the controller’s prior written consent unless there is a legal basis to make the transfer including use of appropriate standard clauses in contracts with subcontractors located outside the UK/EEA ;

3.5 not disclose Data to anyone other than its employees or agents and shall ensure that those persons are subject to an obligation of confidentiality in relation to the Data;

3.6 take and regularly review technical and organisational security measures (including where applicable in relation to encryption, pseudonymisation, resilience of processing systems, backing up personal data in order to be able to reinstate the system and testing) sufficient to comply with the obligations imposed on the controller under Data Protection Laws – for more information please see our Security Policy which is available on request by emailing [email protected];

3.7 not subcontract any processing of Data without the controller’s prior written consent except that the controller shall be deemed to consent to use of any person on the controller’s list of translation or other service subcontractors from time to time;

3.8 in respect of any sub-processors:
3.8.1 impose on the sub-processor the same obligations in relation to Data that are imposed on the processor under this agreement; and
3.8.2 the processor remains fully liable to the controller for the performance of the sub-processor’s obligations;

3.9 take reasonable steps to assist the controller in complying with the controller’s own obligations under Data Protection Laws including:
● responding to subject access requests;
● keeping Data secure;
● notifying data subjects about personal data breaches;
● carrying out any data protection impact assessment (”DPIA”); and
● consulting with the relevant supervisory authority where applicable following a DPIA;

3.10 on termination of this agreement, at the controller’s option either delete or return all Data to the controller, unless the processor is legally required to retain the Data (and the processor assumes that the controller opts for deletion of Data unless it requests return of the Data within 14 days of termination);

3.11 make available to the controller all information necessary:
3.11.1 to demonstrate compliance with its obligations relating to Data both in this agreement and under Data Protection Laws; and
3.11.2 to submit and contribute to audits carried out by the controller or an auditor appointed by the controller; and

3.12 immediately inform the controller if in its opinion a controller instruction does not comply with Data Protection Laws.

Sign Language Direct is a trading name for Absolute Translations Ltd