The Parties have agreed on the following contractual clauses (the “Agreement”) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. This Agreement is comprised of the following parts:
These Clauses which are comprised of certain universal clauses to which the DecentLawGroup agree to be bound in the interpretation of the rights and obligations of each DecentLawGroup under this Agreement.
For the purposes of this Agreement, the following terms shall have the following meanings and cognate terms shall be construed accordingly:
"DecentLawAffiliate" means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with DecentLaw, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;
"DecentLawGroup" means the group of companies comprising DecentLaw and DecentLawAffiliates, an indicative but not inclusive list of which entities is set out in Schedule A as amended from time to time;
"Data Controller" means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, or the person meeting any similar concept under National Privacy Law as the context requires;
"Data Subject" means an identified or identifiable natural person and, only in those countries whose other legal persons receive the same or similar protection pursuant to National Privacy Laws as natural persons, also includes such other legal persons. For these purposes, an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
"EU Data Protection Law" means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time including by the GDPR and laws implementing or supplementing the GDPR;
"European Economic Area" (also "EEA") means those countries which are part of the European Economic Area, (which currently comprises the 28 EU Member States together with Norway, Iceland and Lichtenstein) from time to time;
in the case of a Member State of the European Union, EU Data Protection Laws as applicable in such Member State; or
in the case of a jurisdiction which is not a Member State of the European Union, the national legislation governing the collection, use, disclosure and protection of Personal Data and other data protection or privacy legislation in that jurisdiction, in force from time to time, together with EU Data Protection Law to the extent that such EU Data Protection Law is applicable;
"Participation Agreement" means a deed substantially in the form set out in Schedule B which has been executed and delivered by both the Lead Entity and such member of DecentLawGroup as wishes to join this Agreement to confirm its adoption of the terms of this Agreement, such terms to be modified where necessary to comply with any legal or operational considerations in relation to the relevant DecentLawAffiliate;
"Personal Data" means any information relating to a Data Subject and/or any such information as may be defined as constituting personal data, or any equivalent thereof, in any applicable National Privacy Law;
of Personal Data which is subject to any National Privacy Law of a relevant jurisdiction in respect of that Personal Data in circumstances which do not offer an adequate level of protection for the rights and freedoms of data subjects in relation to the Processing of Personal Data as required by the relevant National Privacy Law of a relevant jurisdiction; and
which is not subject to any of the permitted derogations or conditions contained in the relevant National Privacy Law (including without limitation a legally valid consent of the Data Subject) such that in the absence of the obligations created by this Agreement the export of the Personal Data would be in breach of the relevant National Privacy Law;
>
"Special Term" has the meaning given to it in clause 7.1;
Where the Data Exporter is not subject to EU Data Protection Law, then the definitions set out above shall be interpreted, to the extent that such definitions are inconsistent with the relevant National Privacy Law applicable in that country and to the extent that is necessary, in accordance with the relevant National Privacy Law in that jurisdiction.
Where responses to enquiries from Data Subjects, Data Importers, Data Exporters or the relevant authority(ies) are to be made within a "reasonable time", if any provision of applicable National Privacy Law prescribes a specified timeframe by which a response must be provided, the response must be provided within that prescribed timeframe.
>
Data description The details of the Personal Data, as required by article 28(3) of the GDPR (and equivalent requirements of other Data Protection Laws), including the categories of Personal Data and the purposes for which they are transferred, are set out in Schedules C, D, E and G each of which form an integral part of this Agreement. Some or all of the Parties may execute additional Schedules to cover additional transfers between such Parties, which will be submitted to the relevant Supervisory Authority where required.
Clause I(d) - the data importer (as defined therein) will be responsible in the first instance for responding to enquiries from data subjects and the authority concerning its Processing of the personal data transferred pursuant to this Agreement; and
National Privacy Laws in certain jurisdictions may require the obligations in Schedule C, D and E to be supplemented by additional or alternative provisions to ensure an adequate level of protection in respect of Relevant Transfers originating from those jurisdictions ("Special Terms"). The provisions in Schedule C, D and E shall be interpreted in accordance with any Special Terms identified in Schedule G, as applicable to Relevant Transfers originating from a jurisdiction specified in that schedule.
The Parties undertake not to vary or modify the provisions set out in Schedule C, D or E where applicable, of this Agreement. This restriction does not preclude the Parties from amending other parts of this Agreement or adding provisions on business related issues where required as long as they do not contradict the provisions in Schedule C, D or E ("Permitted Variation").
A person who is not a Party to this Agreement has no right under the Contracts (Rights of Third Parties) Act 1999 (or such other equivalent national legislation that may be applicable in a relevant jurisdiction) to enforce any term of this Agreement except to the extent set out in Clause 8.1.
Subject to Clause 11.4 this Agreement may be terminated and any term may be amended or waived without the consent of any Data Subject.
Except as set forth in Clause 8.1 and Schedule C, D and E and to the fullest extent permissible under applicable law, nothing contained in this Agreement will entitle any Third Party, including, without limitation, Data Subjects to any claim, cause of action, remedy or right of any kind whatsoever.
>
Power of Attorney
In respect of any Relevant Transfer or Onward Transfer to another Party where the Data Importer acts as a Processor, the Data Exporter hereby grants, to the extent permissible by law by virtue of this clause, a power of attorney to such Data Importer to execute, in the name and on behalf of the Data Exporter, any Subprocessor agreement contemplated under or made pursuant to clause 11 of Schedule D or clause 3.6.2 of Schedule E.
All Parties other than the Lead Entity hereby grant, to the extent permissible by law by virtue of this clause, a power of attorney to the Lead Entity to act as their attorney for the purposes of executing:
Where due to local formalities it is not permissible by law solely by virtue of clauses 9.2 or 9.2 for the relevant Party to grant a power of attorney as required by clauses 9.1 or 9.2 as applicable, each other Party shall at the request of the relevant Party execute or otherwise enter into all such deeds, documents, assurances, acts and things (which may include an agency Agreement) as any Party may reasonably require to achieve the purpose envisaged by clauses 9.1 and 9.2.
Limitation of liability >
Subject to Clause 8, the Parties shall be liable for all direct loss and damages, but to the extent permissible by law not any indirect or consequential losses arising out of, or in connection with, all breaches by them of this Agreement.
The Parties agree that if one Party is held liable under Clause 8 for a violation which was a result of the other Party’s breach of Clause 7.2 or of the obligations in Schedule C, D or E the Party in breach will, to the extent to which it is liable, indemnify the other Party for any cost, charge, damages, expenses or loss it has incurred.
the Data Importer or Data Processor is in material breach of any of its obligations under this Agreement which is incapable of being remedied or has not been remedied within a reasonable period on receipt of notice from any Party to this Agreement; or
Notwithstanding anything else in this clause 11, the Parties agree that the termination of the Agreement at any time, in any circumstances and for whatever reason does not exempt them from the obligations and/or conditions under the Agreement as regards the Processing of the transferred Exported Personal Data.
In the event of termination of this Agreement, with the relevant provision of Schedule D and Schedule E as applicable shall apply in respect of the deletion or return of the Exported Personal Data.
The Parties, in their capacity as Data Exporter, hereby appoint Lead Entity to act as their agent for the receipt of any notices from the Data Importer under this Agreement (including any separate data transfer agreements between the Parties created under or as a result of this Agreement) or the provision of any consent required to be provided to the Data Importer under this Agreement (including any separate data transfer agreements between the Parties created under or as a result of this Agreement). In such circumstances, the Lead Entity shall act at all times in the best interests of the relevant Data Exporter and shall co ordinate and manage relevant notices and consents on behalf of that Data Exporter, mindful of the Data Exporter's obligations under this Agreement (including any separate data transfer agreements between the Parties created under or as a result of this Agreement) and responsibility to comply with the National Privacy Laws.
>
Miscellaneous
No IP Rights The Parties acknowledge that nothing in this Agreement constitutes a transfer or assignment of any ownership rights (including any intellectual property rights) in respect of the Exported Personal Data or Personal Data.
Further Efforts The Parties will use their best endeavours to procure that any Third Party executes and performs all such further deeds, documents, assurances, acts and things as any of the Parties to this Agreement may reasonably require by notice in writing to any other Party to carry the provisions of this Agreement into full force and effect.
Entire Agreement This Agreement represents the entire understanding between the Parties in relation to its subject matter and supersedes all agreements and representations made by the Parties, whether oral or written in relation to its subject matter.
No Waiver Failure by any Party to enforce its rights under this Agreement shall not be taken as or deemed to be a waiver of such right.
Severance If any part, term or provision under this Agreement is held to be illegal or unenforceable the validity or enforceability of the remainder of this Agreement will not be affected.
No Assignment None of the Parties may assign or transfer any of the rights or obligations under this Agreement without the prior written consent of the Lead Entity.
Counterpart This Agreement may be executed in any number of counterparts each of which, when executed and delivered, shall be an original but all the counterparts together shall constitute one and the same document.
Registration The Parties agree to deposit a copy of this Agreement with the relevant Authorities if they so request or if such deposit is required under the applicable National Privacy Law.
Governing law This Agreement shall be interpreted according to and governed by the laws of England and Wales, except for those provisions or clauses which dictate the application of another law.
Signature In witness whereof this document has been entered into on the date stated at the beginning.
This Deed is made on {Sign.YMD} between: Center for Decentralized Law, a Swiss non-existent foundation whose business address is 0001 route de la Fantasie, Calgary , CH-9999 and {P2.US.N,E,A}.
Whereas: >
By a DecentLaw Community Data Transfer Agreement dated {Sign.YMD} ("Intra-Group Agreement"), members of DecentLawGroup have agreed to ensure the adequate protection of any Personal Data which is transferred between themselves.
Defined terms used in this Deed shall have the meanings given to them in the Intra-Group Agreement;
{_P2} covenants for itself to observe and perform and be bound by all the terms and conditions of the Intra-Group Agreement to the intent and effect that it shall from the date of this Deed be a Party to the Intra-Group Agreement with the benefit of, but subject to, all its terms and conditions;
Controller - Controller Agreement Commission Decision C(2004)5721 SET II Standard contractual clauses for the transfer of personal data from the Community to third countries (controller to controller transfers)
ANNEX A
Data processing principles
ANNEX B
Description of the Transfer
Schedule D
Controller-Processor Agreement Commission Decision C(2010)593 Standard Contractual Clauses (processors)
APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES
APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES
Schedule E
Basic Controller-Processor Agreement
Schedule F
Technical and Organisational Security Measures
Schedule G
Country Specific Amendments to Schedule C, D and E