ESTUARY HOUSING ASSOCIATION
This Agreement is made on the: 4 May 2018
(1) Estuary Housing Association ("Estuary") whose registered office is 8th & 9th floors, Maitland House, Warrior Square, Southend on Sea, SS1 2JY
(2) Cast Media Group Ltd
Hill House, Whitehall Road, Leeds, West Yorkshire, LS12 64Y- ("the Third-Party Organisation").
(A) Estuary has agreed that Cast Media Group Ltd will perform the Service(s) defined below.
(B) Estuary as the Controller is required by the General Data Protection Regulation ('GDPR') to put in place an agreement with any organisation which processes personal data on its behalf to govern the processing of that data.
(C) The Parties now wish to enter into this Agreement to regulate the processing of personal data by Cast Media Group Ltd to ensure that adequate safeguards are in place with respect to the protection of Personal Data in accordance with the GDPR.
(D) In so far as this Agreement is entered into before the GDPR and the Data Protection Act 2018 come into force, this Agreement adopts the provisions of both the GDPR and the Act as though they were already in force at the date of this Agreement and the Parties agree to interpret and enforce the terms of this Agreement accordingly.
1. DEFINITIONS AND INTERPRETATION
1.1 The following words and phrases used in this Agreement and the Schedules shall have the following meanings except where the context otherwise requires:
"the GDPR" means the General Data Protection Regulation 2016 as varied by the Data Protection Act 2018 ('the Act') or other such statutory provisions which modify consolidate, re-enact or supersede the GDPR;
"this Agreement" this Agreement (including any Schedule or Annex to it and any document in agreed form);
"Data Subject" means any living individual whose personal data is the subject of this agreement;
"Personal Data" means any information relating to an identified or identifiable living person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. Identification may arise from other information which is already in the possession of, or is likely to come into the possession of Estuary or Cast Media Group Ltd;
"Data Processing", "Process",
"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
"Services" means the Services to be carried out by Cast Media Group Ltd
"Transfer" means the disclosure, communication, copying or movement of data from one party to another regardless of the media type, including but not limited to movement across a network, physical transfers, and transfers from one media or device to another, or by remote access to the data.
"Information Commissioner" means the Information Commissioner appointed by the Government to fulfil the duties of commissioner under the GDPR and his/her appointed officers.
'Nominated Officer' means in the case of Estuary [Jane Hill] and in the case of [Cast Media Group] [Craig Knowles] or such other persons as either party shall notify to the other during the term of this agreement.
1.2 The Personal Data to be processed under this agreement consists of:
· Name, Email Address, Home Address, Telephone Number
1.3 Data will be shared from: 01/05/2018 to 31/12/2018
1.4 Estuary will store the information shared by Cast Media Group Limited until the completion of the sale of the final property at St Johns Road, Romford. This agreement will be reviewed on 1st January 2019 if any properties remain unsold at the St Johns Road, Romford.
2. OBLIGATIONS OF ESTUARY
2.1 Estuary agrees that it shall comply with all provisions under the GDPR.
2.2 Estuary agrees that it shall give full and proper instructions to Cast Media Group Ltd as necessary to enable Cast Media Group Ltd to comply with its obligations set out in Clause 3 below.
2.3 Estuary has satisfied itself that Cast Media Group Ltd will provide sufficient guarantees in respect of the data protection principles under the GDPR, and that it has assessed Cast Media Group Ltd's technical and organisational security measures and considers them:
(a) to be appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing; and
(b) to offer a level of security appropriate to the risks presented by the Processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation; and
(c) to meet the requirements of the GDPR and ensure the protection of the rights and freedoms of the Data Subjects.
3. OBLIGATIONS OF Cast Media Group Ltd
3.1. Cast Media Group Ltd will collect and process the Personal Data in compliance with the GDPR.
3.2. Cast Media Group Ltd will only process the Personal Data in accordance with Estuary's instructions for the following purpose(s) only:
· Personal data entered on Carnarvon website to be shared solely with Estuary.
3.3. Cast Media Group Ltd will treat the Personal Data, and any other information provided by Estuary as confidential, and will ensure that access to the Personal Data is limited to only those employees who need to access it for the purpose of complying with this agreement. Further that Storm Creative Media Limited ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.4. Cast Media Group Ltd will not disclose the Personal Data to a third party in any circumstances without the permission of Estuary, unless the disclosure is required by law.
3.5. Cast Media Group Ltd will not knowingly or wilfully do or omit to do anything that would cause Estuary to be in breach of the GDPR.
3.6. Cast Media Group Ltd will notify Estuary of any security breach that may impact the processing of the Personal Data covered by this agreement, within twenty-four hours of discovering, or becoming aware of any such breach. Cast Media Group Ltd will cooperate with Estuary's investigation of the incident and implementation of any required corrective action agreed between the parties.
3.7. Cast Media Group Ltd will not sub-contract any of the processing without the explicit written consent of Estuary and where such written consent is provided, Cast Media Group Ltd will ensure that any sub-contractor it uses to process the Personal Data will comply with the terms of this Agreement and the provisions of the Act.
3.8. Cast Media Group Ltd will employ appropriate operational and technological processes and procedures to keep the Personal Data safe from unauthorised use or access, loss, destruction, theft or disclosure. When a data subject access request or other request exercising the Data Subject's rights under the GDPR (right to erasure, rectification, restriction or objection) is received for Personal Data processed under the terms of this Agreement or where Estuary is required to respond to any investigation conducted by the Information Commissioner as a result, then Cast Media Group Ltd will co-operate with Estuary to enable compliance with any obligations which may arise from such investigation or request.
3.9. Cast Media Group Ltd will not transfer the Personal Data outside of the European Economic Area without the explicit written permission of Estuary. If Estuary grants such written consent, Cast Media Group Ltd shall
a) provide evidence of the adequate level of protection of the personal data that is to be transferred outside the European Economic Area on request and
b) comply with any reasonable instructions notified to it by Estuary; and
c) comply with all the provisions of Chapter V of the GDPR.
4.1 This Agreement will terminate automatically on the end date given in clause 1.3 above.
4.2 In the event of a breach of any term of this Agreement by either party, the other party shall be entitled to terminate the agreement on 24 hours written notice (which may be given by hard copy letter or by email to the other party's Nominated Officer).
4.3 On satisfactory completion of the Services or on termination of this Agreement Cast Media Group Ltd shall:
(a) either forthwith return to Estuary all copies of the Personal Data which it is processing or has processed on behalf of Estuary, or securely destroy/ dispose of and/or securely delete (where in electronic form) the same within 7 days of being requested to do so and shall confirm compliance in writing; and
(b) shall cease processing any Personal Data on behalf of Estuary.
Each party shall indemnify the other against all costs, expense, including legal expenses, damages, loss, including loss of business or loss of profits, liabilities, demands, claims, actions or proceedings which the other party may incur arising out of any breach of this Agreement.
6. GOVERNING LAW
This Agreement shall be governed by and construed in accordance with English law and each party hereby submits to the non-exclusive jurisdiction of the English courts.
By Jane Hill, Central Services Manager
For and on behalf of
Estuary Housing Association
By [insert name, job title]
For and on behalf of
Cast Media Group Ltd