Snapshot 138331
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Considering a private cloud connectivity service? Here's why Gartner® believes SDCIs are the way to go.
Access the report
Data Processing Addendum
for Resale of PCCW Global and Console Connect Services
This Data Processing Addendum for Resale of PCCW Global Services (“Addendum”) sets out the terms on which a Party (“Data Processor”) and/or its sub-processors processes Personal Data on behalf of the other Party (“Data Controller”) in connection with the performance of the Data Processor’s obligations under the Specific Terms for Resale of PCCW Global Services (“Specific Terms”) and related Master Services Agreement (collectively, the “Principal Agreements”).
This Addendum is incorporated into and made a part of the Specific Terms for Resale of PCCW Global Services (the “Specific Terms”). Capitalised terms used herein and not otherwise defined shall have the meanings set forth in the Specific Terms or the EU GDPR, as applicable.
1. Interpretation
1.1 The following terms have the meanings set out below:
“Applicable Law”
means any and all:
(i) legislation (including statutes, statutory instruments, treaties, regulations, orders, directives, by-laws, and decrees) and common law; and
(ii) judgments, resolutions, decisions, orders, notices or demands of a competent court, tribunal, regulatory body or governmental authority in each case having the force of binding law or by which either party is bound;
in each case in any jurisdiction relevant to the parties in the context of this Addendum;
“Data Breach”
means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
“Data Controller”
shall have the meaning given in the DP Law;
“Data Controller’s Group”
means the Data Controller, its subsidiaries and subsidiary undertakings from time to time, any holding company of the Data Controller and all other subsidiaries and subsidiary undertakings of any such holding company;
“Data Processor”
shall be used in accordance with the DP Law;
“Data Processor’s Group”
means the Data Processor, its subsidiaries and subsidiary undertakings from time to time, any holding company of the Data Processor and all other subsidiaries and subsidiary undertakings of any such holding company;
“data subject”
shall have the meaning given in the General Data Protection Regulation (EU) 2016/679, as the same may be amended or updated from time to time (“EU GDPR”);
“DP Law”
means all Applicable Law from time to time relating to the processing of personal data and privacy including (where applicable) the General Data Protection Regulation (EU) 2016/679 as the same may be amended or updated from time to time;
“National Privacy Law”
means the DP Law of a jurisdiction outside of the EEA or UK applicable to the non-EEA/UK jurisdiction in which a Party is established;
“Personal Data”
means all personal data (which has the meaning given to that term in DP Law) processed under this Addendum
“processing”
has the meaning given to that term in DP Law, and “process” and “processed” shall have a corresponding meaning;
“Regulator”
means the UK Information Commissioner, a supervisory authority (as defined in the General Data Protection Regulation (EU) 2016/679) or any other person having regulatory or supervisory authority over processing of Personal Data by the parties; and
“Restricted Transfer”
means: (a) a transfer of Personal Data from Data Controller to Data Processor; or (b) an onward transfer of Personal Data from Data Processor to another Sub-Processor, in each case, where such transfer would be prohibited by the DP Law in the absence of any data transfer safeguard;
“Sub-Processor”
has the meaning given to that term in sub-clause [2.4(C)].
1.2 In this Addendum, unless otherwise specified:
(A) references to clauses are to clauses of this Addendum;
(B) use of any gender includes the other genders;
(C) references to a “company” shall be construed so as to include any corporation or other body corporate, wherever and however incorporated or established;
(D) references to a “person” shall be construed so as to include any individual, firm, company, corporation, body corporate, government, state or agency of a state, local or municipal authority or government body or any joint venture, association or partnership (whether or not having separate legal personality);
(E) a reference to any statute or statutory provision shall be construed as a reference to the same as it may have been, or may from time to time be, amended, modified or re-enacted and shall include any subordinate legislation made from time to time under that statute or statutory provision;
(F) a reference to any other document referred to in this Addendum is a reference to that other document as amended, varied or supplemented at any time;
(G)
(i) the rule known as the ejusdem generis rule shall not apply and accordingly general words introduced by the word “other” shall not be given a restrictive meaning by reason of the fact that they are preceded by words indicating a particular class of acts, matters or things; and
(ii) general words shall not be given a restrictive meaning by reason of the fact that they are followed by particular examples intended to be embraced by the general words and any words following the terms “including”, “include”, “in particular” or any other similar expression shall be construed as illustrative only; and
(H) the expressions “holding company”, “subsidiary” and “subsidiary undertaking” shall have the meaning given in the Companies Act 2006.
1.3 In this Addendum, unless otherwise specified all headings and titles are inserted for convenience only and are to be ignored in the interpretation of this Addendum.
2. Data Protection
2.1 Where this Addendum or the Principal Agreements require the Data Processor to process Personal Data on behalf of the Data Controller, this Clause 2 shall apply.
2.2 The Data Processor shall comply with its obligations under DP Law.
2.3 The description of the nature and purpose of the processing carried out by the Data Processor under this Addendum, and the type of Personal Data and categories of data subjects contained in the Personal Data is set out in the Schedule to this Addendum.
2.4 The Data Processor shall:
process the Personal Data only on documented instructions from the Data Controller including with regard to transfers of Personal Data to a third country or an international organisation, unless the Data Processor is legally required to process the Personal Data for another purpose by European or Member State law to which the Data Processor is subject and provided it informs the Data Controller of that legal requirement and the proposed processing before such processing takes place (unless that law prohibits such information on important grounds of public interest);
(A) ensure that persons authorised to process the Personal Data are contractually bound to, or under an appropriate statutory obligation of, confidentiality;
(B) take all measures required by DP Law, including implementing appropriate technical and organisational measures, to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks for the rights and freedoms of natural persons and the risks presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed. Such measures shall include (as appropriate):
(i) pseudonymising and encrypting Personal Data;
(ii) ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
(iii) having the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and
(iv) having a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
(C) have general authorisation to engage another processor to process the Personal Data (a “Sub-Processor”) provided that it enters into a contract with such Sub‑Processor in accordance with sub-clause 2.4(D);
(D) if a Sub-Processor is engaged, the Data Processor shall ensure that such Sub-Processor is bound by the terms of a contract which imposes on such Sub‑Processor the same data protection obligations as are set out in this Addendum and in particular the Data Processor shall obtain sufficient guarantees from the Sub-Processor that it shall implement appropriate technical and organisational measures in such a manner that the processing shall meet the requirements of DP Law. Where the Sub-Processor fails to fulfil its data protection obligations, the Data Processor shall remain fully liable to the Data Controller for the performance of the Sub-Processor’s obligations;
(E) taking into account the nature of the processing, assist the Data Controller by appropriate technical and organisational measures (as far as this is possible) for the fulfilment of the Data Controller’s obligation to respond to requests for exercising the data subject's rights under DP Law;
(F) taking into account the nature of the processing and the information available to the Data Processor, provide to the Data Controller such assistance as the Data Controller may from time to time reasonably require to enable it to comply with its security, breach notification, breach communication, impact assessment and prior consultation responsibilities under DP Law, including:
(i) otifying the Data Controller without undue delay after becoming aware of a Data Breach; and
(ii) assisting the Data Controller with making any mandatory notifications to Regulators and/or affected data subjects in the event of a Data Breach;
(G) following the termination or expiry of this Addendum, (at the Data Controller’s choice) delete, or return to the Data Controller, all Personal Data and delete existing copies of the Personal Data unless such Personal Data is required to be retained by the Data Processor under DP Law;
(H) make available to the Data Controller all information reasonably required to demonstrate compliance with this clause 2 and allow for and contribute to audits, including inspections, conducted by or on behalf of the Data Controller (any such audit or inspection shall be carried out no more than once each calendar year of the term of this Addendum as described in the Schedule hereto and only on providing not less than four (4) weeks’ prior written notice to the Data Processor);
(I) with regards to sub-clause 2.4(H), immediately inform the Data Controller if, in its opinion, an instruction from the Data Controller infringes DP Law.
3. Cross-border Data Transfers
3.1 For Data Controller based in the European Economia Area (“EEA”)(“EEA Data Controller”) or Data Controller based in the United Kingdom (“UK”)(“UK Data Controller”), any transfer of Personal Data to an jurisdiction outside the EEA or UK (as the case maybe) shall be subject to the Standard Contractual Clauses based on the Commission Implementing Decision (EU) 2021/914 of 4th June 2021 (as amended and updated from time to time) (the “Standard Contractual Clauses”) and as supplemented by the International Data Transfer Addendum to the Standard Contractual Clauses which applies to UK Personal Data only. Other than the EU and the UK, there is also cross-border data transfer restriction under the National Privacy Law of certain jurisdictions (including without limitation Singapore).
3.2 Data Controller, as data exporter, and the Data Processor on behalf of itself and each Sub-Processor that it engages as data importer shall enter into the Standard Contractual Clauses, the UK Addendum or the relevant clauses under National Privacy Law, in respect of any Restricted Transfer, which terms shall take precedence over any in this Addendum. Therefore, the Parties shall, in addition to this Addendum, enter into a separate data transfer agreement ("Data Transfer Agreement") before carrying out any Restricted Transfer (whichever is earlier) so that:
(a) the EEA Data Controller exporter enters into the relevant Standard Contractual Clauses Data Transfer Agreement with the Non-EEA importing Data Processor;
(b) the UK Data Controller exporter enters into the UK Addendum and relevant Data Transfer Agreement with the Non-UK importing Data Processor; and
(c) the Non-EEA and Non-UK Data Controller exporters that are located in jurisdiction with cross-border data transfer restrictions under National Privacy Law (including without limitation Singapore) shall enter into the relevant data transfer contractual clauses with the importing Data Processor not located in the Data Controller exporter's jurisdiction.
4. Choice of Governing Law and Dispute Resolution
This Addendum is to be governed by and construed in accordance with the laws of the jurisdiction where the PCCW Global entity named in the Order Form is incorporated (“Governing Jurisdiction”). Any matter, claim or dispute arising out of or in connection with this Addendum , whether contractual or non-contractual, is to be governed by and determined in accordance with the laws of the Governing Jurisdiction and each party irrevocably agrees that the courts of the Governing Jurisdiction shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Addendum or its subject matter or formation (including non-contractual disputes or claims).
Schedule
Nature and Purpose of Processing:
To enable the Data Processor to perform its duties and obligations set out in this Addendum and the Principal Agreements.
Term of this Addendum/Duration of Processing:
From the commencement of the Principal Agreements until the discharge of all the duties and obligations on the part of the Data Processor pursuant to the Principal Agreements and/or for compliance with applicable legal, tax or accounting requirements.
Types of Personal Data which may be processed:
Business contact details of the other party and its business customers, limited to name, office phone number, mobile number, email address, fax number and business address.
Categories of Data Subject:
Employees, workers and contractors of the other party and/or the other party’s business customers.
Need help?
We’d love to assist! If you’re unsure which service is right for you, or just want to explore your options, feel free to get in touch.
Get in touch
Services
Access Ports
Connect to clouds
Layer 2 (point-to-point)
Layer 3 (CloudRouter®)
Internet On-Demand
Marketplace
Managed network services
Quick links
Help centre
Data centre locations
About us
Latest news
Contact us
Cookies
Legal
©2026 PCCW Global. All Rights Reserved.
Privacy statement Terms of use Cookie policy
Log in
Sign up
Connect to
Connect
Where would you like to connect?
Looking for pricing?
Create an account on Console Connect and get access to our pricing calculator.
Sign up
Ecosystem
Google Cloud
AWS
Microsoft Azure
IBM Cloud
Oracle Cloud
Huawei Cloud
Alibaba Cloud
Tencent Cloud
Vultr Cloud
OVHcloud
F5
ServiceFabricTM (Digital Realty)
Clouds
Direct cloud connectivity that is fast, secure and scalable.
Learn more
Data Centres
Interconnect on-demand between data locations worldwide.
Learn more
Internet Exchanges
Peer with the world’s leading Internet Exchanges.
Learn more
Business partners
Discover, click and connect to business partners.
Learn more
Data centres
Internet Exchanges
Clouds
Services
On-demand services
Where would you like to connect?
Looking for pricing?
Create an account on Console Connect and get access to our pricing calculator.
Sign up
Access Ports
Your journey begins with an Access Port.
Learn more
Layer 2 (point-to-point)
Fast, private and on-demand Layer 2 network connections.
Learn more
Layer 3 (CloudRouter®)
Seamless and secure multi-cloud networking.
Learn more
Edge SIM
Securely connect any edge device to anywhere.
Learn more
Internet On-Demand
Premium internet access whenever you need it
Learn more
Marketplace
Browse, buy and bundle complementary solutions
Learn more
API
Get started with your API integration.
Learn more
API Adaptor
Managed network services
PCCW Global also offers complementary managed connectivity solutions.
Learn more
Managed connectivity
Mobility
Security
Media
Satellite
Voice
Internet On-Demand
Access Ports
Layer 2 (Point-to-Point)
Layer 3 (CloudRouter®)
Edge Sim
Marketplace
Partners
Resources
Resources
Where would you like to connect?
Blog
Insights and trends for connecting networks and clouds.
Learn more
Content hub
Develop your networking expertise and industry insight.
Learn more
Case studies
Learn how our solutions are helping customers.
Learn more
Looking Glass
Insights into network performance and connectivity.
Learn more
API doc
How to use our proprietary and standard-based network APIs.
Learn more
Blog
Content hub
API doc
Case studies
Looking Glass
Company
About Console Connect and PCCW Global
About us
Uniquely combining software fabric and global network infrastructure to deliver world-class services.
Learn more
News
The latest news and insights about PCCW Global and Console Connect.
Learn more
Careers
Join a global network of thinkers, builders and changemakers.
Learn more
Leadership
Discover more about our leadership team who are driving innovation and delivering operational excellence.
Learn more
Awards
Our network and on-demand platform services are gaining recognition worldwide.
Learn more
CSR
Building a better-connected, more sustainable world.
Learn more
Our network
Our high-performance global network connects you securely across the globe.
Learn more
Events
Meet and connect with us at industry events and conferences worldwide.
Learn more
About us
Network
News
Events
Awards
Leadership
Careers
CSR
Connect to
Ecosystem
Google Cloud
AWS
Microsoft Azure
IBM Cloud
Oracle Cloud
Huawei Cloud
Alibaba Cloud
Tencent Cloud
Vultr Cloud
OVHcloud
F5
ServiceFabricTM (Digital Realty)
Clouds
Data centres
Internet Exchanges
Business Partners
Services
Access Ports
Layer 2 (Point-to-Point)
Layer 3 (CloudRouter®)
Edge Sim
Internet On-Demand
Marketplace
API
API Adaptor
Managed network services
Managed connectivity
Mobility
Security
Media
Satellite
Voice
Partners
Resources
Blog
Content hub
Case studies
API doc
Looking Glass
Company
About us
Leadership
Network
News
Events
Awards
Careers
CSR
Locations
Contact us
Help centre
Go to pccwglobal.com
Considering a private cloud connectivity service? Here's why Gartner® believes SDCIs are the way to go.
Access the report
×