Data Processing Agreement

Data Processing Agreement

Updated: 7th August 2020

This Data Processing Agreement applies to: (i) KLDiscovery Ontrack Limited (company number 02669766) having its registered office address at Ontrack, Nexus, 25 Farringdon Street, London, EC4A 4AB (“Ontrack”); and (ii) the applicable Customer placing an order for Ontrack’s services pursuant to the applicable service terms of business (“Terms”).

The Parties have agreed that the terms of this Data Processing Agreement shall apply to the Processing of Personal Data (as defined below) that is required to enable Ontrack to provide the services to the applicable Customer.

Definitions

In this Data Processing Agreement:

Data Processing provisions

1. Data Processor and Data Controller
   1. The Parties agree that, in respect of Protected Data, the Customer shall be the Data Controller and Ontrack shall be the Data Processor. It is acknowledged that the Customer shall have sole responsibility for the accuracy, quality, integrity and reliability of any Protected Data and of the means by which it acquired such Protected Data.
   2. The Customer warrants, represents and undertakes, that: (i) all Protected Data used in connection with the services pursuant to the Terms shall comply in all respects with Data Protection Laws; (ii) all instructions given by it to Ontrack in respect of Protected Data shall at all times be in accordance with Data Protection Laws; (iii) it has obtained all necessary consents from any Data Subject whose Personal Data is included within the Protected Data or otherwise has the appropriate legal permission to provide the Protected Data to Ontrack; and (iv) it will comply with the terms of this Data Processing Agreement.
   3. Ontrack warrants, represents and undertakes, that it shall: (i) process the Protected Data only to the extent necessary in connection with the Terms; and (ii) process the Protected Data in accordance with the Customer’s documented instructions and the requirements of Data Protection Laws; (iii) promptly inform the Customer if Ontrack considers that the Customer’s instructions infringe Data Protection Laws, or if Ontrack becomes unable to comply with Customer's instructions regarding the Processing of Protected Data (whether as a result of a change in applicable law, or a change in Customer’s instructions); and (iv) comply with the terms of this Data Processing Agreement.
2. Instructions and details of Processing
   1. The Processing of Protected Data to be carried out by Ontrack under this Data Processing Agreement shall comprise the Processing as required for Ontrack to provide the services.
3. Technical and organisational measures
   1. Ontrack shall implement and maintain, at its cost and expense, appropriate technical and organisational measures in relation to the Processing and security of Protected Data in accordance with Data Protection Laws and in accordance with Articles 32-34 of the GDPR in particular.  Ontrack shall ensure that such technical and organisational measures are appropriate to the particular risks that are presented by its Processing activities, in particular to protect Protected Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access.
4. Using Personnel and Sub-Processors
   1. Save as set out in clause 4.2, Ontrack shall not engage any sub-processor for carrying out any processing activities in respect of the Client Data without the Client’s prior written authorisation. In the event that authorisation is provided, prior to making any disclosure to any approved sub-processor, Ontrack shall put in place written terms with the sub-processor which are equivalent to those set out in this Data Processing Agreement. It is acknowledged and accepted that, notwithstanding anything to the contrary in this Agreement, Ontrack shall remain fully liable to the Client for the performance of each sub-processor’s obligations. Ontrack shall inform the Client of any intended changes concerning the addition or replacement of such sub-processors and allow Client a reasonable opportunity to object, on reasonable grounds, to any such changes or replacements.
   2. Approved sub-processors at the date of this Data Processing Agreement are set out at Annex 1.
   3. Ontrack shall ensure the reliability of its Personnel who have access to Protected Data and ensure that they process it only where strictly necessary for the services, ensure that they are fully aware of the measures to be put in place and the steps to be taken when Processing the Protected Data having regard to Data Protection Laws, and ensure that they have committed themselves to protect the confidentiality of the Protected Data including by way of an appropriate obligation of confidentiality (whether by written contract or otherwise) in respect of the Protected Data.
5. Assistance with the Customer’s compliance and Data Subject rights
   1. Ontrack shall promptly refer all Data Subject Requests it receives to the Customer. Ontrack shall provide such reasonable assistance as the Customer reasonably requires (taking into account the nature of Processing and the information available to Ontrack) to the Customer in ensuring compliance with the Customer’s obligations under Data Protection Laws with respect to: (i) the security of Processing; (ii) data protection impact assessments (as such term is defined in Data Protection Laws); (iii) prior consultation with a Supervisory Authority regarding high risk Processing; and (iv) notifications to the Supervisory Authority and/or communications to Data Subjects by the Customer in response to any Personal Data Breach, provided that, in the event that such assistance is disproportionate in time and resources to Ontrack, Customer shall pay Ontrack’s fees for providing such assistance.
6. International data transfers
   1. Personal Data is hosted and processed by Ontrack within the European Economic Area (“EEA”) and Ontrack shall not transfer any Personal Data outside the EEA without the Customer’s prior written approval.  
7. Records, information and audit
   1. Ontrack shall: (i) create; (ii) keep up-to-date; and (ii) maintain, full and accurate records relating to all Processing of Protected Data.
   2. Ontrack shall grant to Customer the right of audit, no more than once per calendar year and on a minimum of 30 (thirty) days written notice, during normal business hours and subject to reasonable confidentiality undertakings being given, to access and take copies of such records relating to Processing of Protected Data and shall provide all reasonable assistance to Customer in exercising its audit rights.  This audit right shall not extend to any third party data centre or other third party facility housing any server equipment where only visual and accompanied inspection is permitted.
   3. Ontrack shall at Customer’s request and expense promptly provide Customer with all information necessary to enable Customer to demonstrate compliance with its obligations under the GDPR, to the extent that Ontrack is able to provide such information.
8. Breach notification
   1. In respect of any Personal Data Breach involving Protected Data , Ontrack shall, without undue delay: (i) notify the Customer of the Personal Data Breach; and (ii) provide the Customer with details of the Personal Data Breach.
9. Deletion or return of Personal Data and copies
   1. Ontrack shall, at the Customer’s written request, either delete or return all the Protected Data  to the Customer in such form as the Customer reasonably requests within a reasonable time after the earlier of: (i) the end of the provision of the relevant data recovery services pursuant to the Terms related to Processing; or (ii) once Processing by Ontrack of any Protected Data  is no longer required for the purpose of Ontrack’s performance of its relevant obligations under this Data Processing Agreement, and delete existing copies (unless storage of any Protected Data  is required by applicable law and, if so, Ontrack shall inform the Customer of any such requirement).  Ontrack shall procure that its Sub-Processors shall undertake the same actions with regard to Protected Data.
   2. In the event that Protected Data remains within Ontrack’s possession or control for any period longer than 12 (twelve) months without any active instructions from the Customer, Ontrack shall delete such Protected Data.
10. Indemnity
    1. Each Party (the “Indemnifying Party”) shall indemnify and keep indemnified the other Party (the “Indemnified Party”) in respect of all claims, demands, actions, settlements, interest, charges, procedures, expenses, losses and damages suffered or incurred by, awarded against or agreed to be paid by, the Indemnified Party arising from or in connection with the Indemnifying Party’s non-compliance with this Data Processing Agreement and/or breach of Data Protection Laws.
11. Liability
    1. The total liabilities of either Party under this Data Processing Agreement shall in no event exceed the contractual limits set out and agreed in the Terms.
12. Term and Termination
    1. Unless terminated by agreement of the Parties, this Data Processing Agreement shall commence on the date an order is placed for services pursuant to the Terms and continue in force for so long as Ontrack continues to process Protected Data.
13. Choice of Law
    1. This Data Processing Agreement shall be subject to the terms of the choice of law provision set out in the Terms.

Date: 7th August 2020

Annex 1 – Sub-Processors and Transfers