This Data Protection Policy and Addendum to Agreements forms main relationship between I.S.B.A. ("Supplier); and the costumer
(A) The parties have agreed that it may be necessary for Supplier to Process certain Personal Data on behalf of the costumer, which may act as a “controller” or a “processor” (as defined in Applicable Data Protection Laws) in respect of such Personal Data.

(B) In light of this Processing, the parties have agreed to enter into this DPA to address the compliance obligations imposed upon the costumer pursuant to Applicable Data Protection Laws including (where applicable) the GDPR and (where applicable) instructions from any relevant controller. Supplier is appointed by the costumer to Process such Personal Data on behalf of the costumer as is necessary in accordance with the terms of this

1.1  Where Applicable Data Protection Laws apply and ascribe a different meaning to a Defined Term, that different meaning will apply. Where the relevant Applicable Data Protection Laws do not contain the same Defined Term but contain a word or phrase with an equivalent or similar meaning then that word or phrase, and its definition, will be applied to the interpretation of this clause 1.


2. Data Protection
2.1  The costumer reserves the right to, and Supplier agrees the costumer has the right to, amend this DPA at any time during the term of the Agreement by written notice to Supplier if necessary to comply with any legal requirement or guidance from a Supervisory Authority, or if required to take account of any changes to the Processing of Personal Data.

2.2  The subject matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subject as required by the GDPR or equivalent provisions of any Applicable Data Protection Laws, relating to this Addendum, are as set out in a separate document if necessary. Supplier shall Process only the types of Personal Data, relating to the categories of Data Subjects, and in the manner required to deliver the Services in the manner agreed by the parties.

2.3  Where Personal Data is Processed by Supplier, its agents, Subprocessors or employees under or in connection with the Underlying Agreement, Supplier shall, and shall procure that its agents, Subprocessors and employees shall:
  2.3.1  only Process the Personal Data in accordance with documented instructions from the costumer (whether in the Agreement or otherwise) unless required by Applicable Data Protection Laws to which Supplier is subject, in which case Supplier shall to the extent permitted by Applicable Data Protection Laws inform the costumer of that legal requirement before the relevant Processing of that Personal Data;
  2.3.2  not Process, transfer, modify or alter Personal Data or disclose or permit the disclosure of the Personal Data to any third party (including any affiliate of Supplier) unless specifically directed to do so in writing by the costumer.
  2.3.3  implement all appropriate technical and organisational measures to ensure the security of the Personal Data, such measures being appropriate to the harm which might result from unauthorised or unlawful Processing or accidental loss, destruction or damage to Personal Data and to the nature of the Personal Data which is to be protected. These measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it;
  2.3.4  regularly (at least once per year) test key controls, systems and procedures, including those of its Subproccessors, and provide the result with the results of all such tests and any other audit, review or examination;
  2.3.5  keep all Personal Data and any analyses, profiles or documents derived therefrom separate from all other data and documentation of Supplier;
  2.3.6  Process Personal Data in accordance with Applicable Data Protection Laws (as applicable) and not do or permit anything to be done which might cause the costumer in any way to be in breach of any Applicable Data Protection Laws;
  2.3.7  promptly, and in any case within seven (7) working days of receipt, notify the costumer of any communication received from a Data Subject regarding the Processing of their Personal Data, or any other communication received (including from a Supervisory Authority) relating to either party's obligations under Applicable Data Protection Laws in respect of Personal Data and assist the costumer to respond to any such communication;
  2.3.8  take all steps to ensure the reliability of any employee who may have access to Personal Data, ensuring in each case that access is strictly limited to those individuals who require access to the relevant Personal Data as strictly necessary for Supplier to perform its obligations under the Agreement and an Addendum ,if any, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality;
  2.3.9  unless otherwise required by an Agreement, cease Processing Personal Data immediately upon the termination or expiry of the Agreement and as soon as possible thereafter, securely return or delete from its systems all Personal Data transferred to it under the Agreement and any copies of it or of the information it contains and Supplier shall confirm in writing.
  2.3.10  immediately upon becoming aware of or reasonably suspecting a Personal Data Breach, notify the costumer in writing of such Personal Data Breach, such notice to include all information reasonably required by the costumer to comply with its obligations under Applicable Data Protection Laws, and co-operate with the costumer and take such reasonable commercial steps as are directed by the costumer to assist in the investigation, mitigation and remediation of each Personal Data Breach; and
  2.3.11  make available to the costumer on request all information necessary to demonstrate compliance with the obligations laid down in this Addendum and allow for and contribute to audits, including allowing for inspections by the costumer of any premises and systems where the Processing of Personal Data takes place.

2.4  Notwithstanding any provision in the Agreement Supplier shall:
  2.4.1  indemnify, defend and hold harmless the costumer , its affiliates and their officers, directors, employees, agents and contractors from and against all losses, liabilities, claims, damages, costs and expenses (including reasonable legal costs and other professional adviser’s fees and costs, along with (to the extent permitted by law) costs of investigation, litigation, settlement, judgment, interest, penalties, fines and remedial actions) arising from, or in connection with, breach by Supplier (or any of its Subprocessors) of Applicable Data Protection Laws, including arising from third party claims;

2.5  Without prejudice to the foregoing or to any other rights or remedies of the costumer in the event of a breach referred to in clause 2.5, Supplier undertakes to promptly remedy the circumstances giving rise to such breach at its sole cost and expense. Save as otherwise, each party shall pay its own costs in connection with the negotiation, preparation, execution and performance of their obligations and all documents ancillary to it.