Snapshot 232229
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Protection and Information Security Addendum effective from 1 May 2. Controller to Controller
2026 (the “Addendum”). This Addendum is incorporated into the QA 2.1. The terms of this Condition 2 shall apply: (i) to the processing by either
General Terms of Sale available at https://www.qa.com/legal-privacy/ (the party of Business Contact Details disclosed by the other party in
“General Terms”). connection with the Contract; and (ii) to the extent that either party acts as
1. DEFINED TERMS a controller in relation to other personal data disclosed by the other party
1.1. For the purposes of this Addendum: in connection with the Contract (such personal data together with any
1.1.1. definitions in the General Terms shall apply; and Business Contact Details processed under the Contract being “Shared
1.1.2. the terms “controller”, “processor”, “data subject”, “personal data”, Personal Data”).
“processing” (and any derivatives thereof) and “appropriate technical 2.2. In relation to Shared Personal Data disclosed by the Data Discloser, the
and organisational measures” have the meanings given in Data Data Recipient shall comply with all the obligations imposed on a
Protection Legislation and the following terms shall have the following controller under the Data Protection Legislation, and any material breach
meanings: of the Data Protection Legislation by one party shall, if not remedied within
Agreed Purpose: means the provision or receipt (as applicable) of goods 30 days of written notice from the other party, give grounds to the other
and/or services under a Contract; party to terminate the Contract with immediate effect.
Business Contact Details: means personal data confined to the following 2.3. The Data Recipient shall process Business Contact Details disclosed by
categories of information relevant to the following categories of data subject: (a) the Data Discloser for the Agreed Purpose only.
business names; (b) basic personal details; and (c) contact details, in each case 2.4. Each party shall:
of the parties’ personnel used to administer the Contract; 2.4.1. ensure that it has satisfied a statutory ground under the Data Protection
Data Discloser: means either party when it discloses personal data to the other Legislation permitting it to transfer the Shared Personal Data to the Data
party in connection with the Contract; Recipient and the Permitted Recipients (in the case of Business Contact
Data Privacy Framework (‘DPF’): means the EU–U.S. Data Privacy Details, for the Agreed Purpose);
Framework, together with its UK Extension and the Swiss–U.S. Data Privacy 2.4.2. ensure that it has delivered to the data subjects such information as is
Framework, allowing personal data to be transferred to certified U.S. required by Data Protection Legislation including the fact that the Data
organisations in compliance with applicable Data Protection Legislation; Discloser is sharing Shared Personal Data with the Data Recipient (or a
DPF Principles: means the Data Privacy Principles issued by the U.S. category of recipients which includes the Data Recipient) and the
Department of Commerce; purposes of the data transfer;
Data Protection Legislation: means all applicable data protection, privacy and 2.4.3. ensure that all Permitted Recipients are subject to written contractual
electronic communications laws in the United Kingdom, the European Union obligations concerning the Shared Personal Data (including appropriate
and the United States, and any national implementing laws regulations and confidentiality and data security obligations); and
secondary legislation made under them each as amended or re-enacted and in 2.4.4. ensure that it has in place appropriate technical and organisational
force from time to time, including but not limited to: (i) the UK Data Protection measures to protect against unauthorised or unlawful processing of
Legislation; (ii) the General Data Protection Regulation ((EU) 2016/679) Shared Personal Data and against accidental loss or destruction of, or
(“GDPR”); (iii) the Directive on Privacy and Electronic Communications damage to, Shared Personal Data.
(Directive 2002/58/EC), and (iv) any relevant United States federal and state 2.5. Each party shall assist the other in complying with all applicable
data privacy laws, including the Electronic Communications Privacy Act, as requirements of the Data Protection Legislation relevant to Shared
amended (“ECPA”) and the California Consumer Privacy Act of 2018, as Personal Data processed in connection with the Contract. In particular,
amended (“CCPA”);. each party shall:
Data Recipient: means either party when it receives personal data from the 2.5.1. promptly inform the other party about the receipt of any data subject
other party in connection with the Contract; access request;
IC: means the UK Information Commission; 2.5.2. provide the other party with reasonable assistance, at the other party’s
EU Standard Contractual Clauses: means the contractual clauses annexed to cost, in complying with any data subject access request;
the EU Commission Decision 2021/914/EU or any successor clauses approved 2.5.3. not disclose or release any Shared Personal Data in response to a data
by the EU Commission; subject access request without first consulting the other party (to the
Permitted Jurisdiction: means a country or territory (a) in the case of any extent possible and legally permitted), provided that such consultation
transfer from the EEA or the UK (unless otherwise stated by the UK government shall not affect and be without prejudice to the party’s ability to respond
or the IC), in respect of which the European Commission has issued a finding of to the data subject access request within the time period required by
the adequacy of the protection of personal data; or (b) in the case of any Data Protection Legislation; and
transfer from the UK, which the UK Secretary of State has specified the 2.5.4. notify the other party without undue delay on becoming aware of any
standard of protection provided for data subjects with regard to the general breach of the Data Protection Legislation (providing such details as the
processing of personal data is not materially lower than the standard required other party may reasonably request).
under UK law; 2.6. The Data Discloser warrants that to the best of the Data Discloser’s
Permitted Recipients: means the parties to the Contract, the employees of knowledge, the Shared Personal Data it discloses to the Data Recipient is
each party and any third parties engaged to perform obligations in connection accurate and up to date.
with the Contract; 3. Controller to Processor
Restricted Transfer: (i) where the GDPR applies, a transfer of personal data 3.1. The terms of this Condition 3 shall apply to the extent that: (i) the
from the EEA either directly or via onward transfer, to any country or recipient Customer acts as a controller of personal data it discloses to the Supplier
outside of the EEA which is not a Permitted Jurisdiction; and (ii) where the UK in connection with the Contract and the Supplier acts as a processor in
GDPR applies, a transfer of personal data from the United Kingdom either relation to the personal data; or (ii) the Customer acts as a processor of
directly or via onward transfer, to any country or recipient outside of the UK personal data it discloses to the Supplier in connection with the Contract
which is not a Permitted Jurisdiction; and the Supplier acts as a Sub-processor of the Customer in relation to
Restricted Transfer Terms: means the EU Standard Contractual Clauses and the personal data.
the UK SCC Addendum; 3.2. Details of the: (i) subject-matter of the processing; (ii) duration of the
Shared Personal Data: has the meaning given in Condition 2.1; processing; (iii) nature and purpose of the processing; (iv) categories of
Sub-processor: means a third party engaged by a processor (or any other personal data; and (v) categories of data subject; for each Service can be
Sub-processor) to carry out processing activities on behalf of the relevant found in the Data Sharing and Processing Agreement at:
controller; https://www.qa.com/legal_documents/workforce-learning-data-sharing-
UK Data Protection Legislation: means all applicable laws and regulations in and-processing-agreement.pdf .
the UK relating to the processing of personal data, including the UK GDPR and 3.3. Supplier acknowledges that it shall only be a processor in respect of the
the Data Protection Act 2018; personal data described in the Data Sharing and Processing Agreement
UK-US Data Bridge: means the UK Extension to the EU-US Data Privacy at: https://www.qa.com/legal_documents/workforce-learning-data-sharing-
Framework; and-processing-agreement.pdf and/or within the Contract.
UK GDPR: means the GDPR as incorporated into UK law in accordance with 3.4. The Supplier shall in relation to personal data that it processes on behalf
the European Union (Withdrawal) Act 2018; and of the Customer as a processor or Sub-processor:
UK SCC Addendum: means the International Data Transfer Addendum (IDTA) 3.4.1. process the personal data only on the documented instructions of the
to the EU Standard Contractual Clauses issued by the IC. Customer as set out in the Contract or as otherwise notified to the
Supplier, unless required to do otherwise by Applicable Laws. If sharing-and-processing-agreement.pdf and with any additional
Supplier is of the opinion that any instruction given by the Customer information provided in the Order.
breaches Data Protection Legislation, Supplier shall inform the 3.4.10. The parties agree that the Supplier shall be entitled to make a
Customer of this; Restricted Transfer:
3.4.2. ensure that its personnel who are authorised to process data are under 3.4.10.1. utilising the UK-US Data-Bridge provided that (i) the Supplier
appropriate obligations of confidentiality; maintains active certification under the DPF including the UK
3.4.3. implement appropriate technical and organisational measures in Extension; (ii) the Supplier Processes Personal Data in compliance
accordance with Article 32 of the GDPR or Article 32 of the UK GDPR with the DPF Principles; (iii) any recipient of Personal Data is self-
(as applicable) in order to ensure an appropriate level of security for the certified under the UK-US Data Bridge and listed on the Data
personal data; Privacy Framework list maintained by the U.S. Department of
3.4.4. assist the Customer by implementing appropriate technical and Commerce; and (iv) the Supplier promptly notifies the Customer if
organisational measures for the fulfilment of the Customer’s obligation its certification lapses or is withdrawn;
to respond to requests for exercising data subject rights; 3.4.10.2. utilising the UK SCC Addendum and the UK SCC Addendum shall
3.4.5. provide assistance to the Customer in ensuring compliance with the be deemed entered into (and incorporated into this Addendum by
Customer’s obligations in Articles 32-36 of the GDPR or Articles 32-36 reference), as set out in Appendix 1 of this Addendum.
of the UK GDPR (as applicable), provided the Customer reimburses the 3.4.11. In the event that any provision of this Addendum contradicts directly or
reasonable costs incurred by the Supplier in providing such assistance; indirectly with the EU Standard Contractual Clauses or the UK SCC
3.4.6. upon request either: (i) destroy the personal data; or (ii) return the Addendum, the provisions of the applicable EU Standard Contractual
personal data to the Customer, upon termination or expiry of the Clauses or the UK SCC Addendum shall prevail over the terms of the
Contract (subject to any legal obligation or internal retention policy that Addendum.
requires such personal data to be retained); 3.4.12. The Supplier shall notify the Customer without undue delay (and in any
3.4.7. provide the Customer with such information as the Customer may event within 48 hours) on becoming aware of any breach of the Data
reasonably request to demonstrate compliance with its obligations Protection Legislation.
under this Condition 3; and 3.5. If Supplier is located outside the UK or the EEA but not in a Permitted
3.4.8. be entitled to make a Restricted Transfer: (i) where the recipient is Jurisdiction, Restricted Transfers shall be subject to (i) the UK-US Data-
located in a Permitted Jurisdiction; or (ii) the transfer is subject to the Bridge; or (ii) the Restricted Transfer Terms shall govern the transfer of
Restricted Transfer Terms; or (iii) in the case of Restricted Transfers to personal data by the Customer to Supplier under the Contract and the
the United States, the Supplier maintains active certification under the Customer and Supplier agree to be bound by the Restricted Transfer
Data Privacy Framework. Terms as data exporter and data importer respectively.
3.4.9. For the purposes of Condition 3.4.8 and 3.4.10 the Restricted Transfer 3.6. The Customer consents to the use by the Supplier of the Sub-Processors
Terms shall be deemed entered into (and incorporated into this detailed in the Data Sharing and Processing Agreement at
Addendum by reference) and completed as follows: https://www.qa.com/legal_documents/workforce-learning-data-sharing-
and-processing-agreement.pdf .
EU Standard Contractual Clauses 3.7. The Customer gives general authorisation to the Supplier to engage
additional Sub-processors under the conditions set forth below and
(i) Module Two (Controller to Processor) shall apply where the Supplier shall:
Customer is a Controller of Shared Personal Data and the Supplier is 3.7.1. require its Sub-Processors to enter into a written agreement on
processing Shared Personal Data; substantially the same terms as those set out in this Condition 3;
3.7.2. remain fully liable to the Customer for the performance of its Sub-
(ii) Module Three (Processor to Processor) shall apply where the Processors’ obligations;
Customer is a Processor of Shared Personal Data and the Supplier is 3.8. provide a list of its Sub-Processors to the Customer upon request; and
a sub-processor of Shared Personal Data; 3.9. inform the Customer, prior to the appointment of a new Sub-Processor, so
as to give the Customer an opportunity to object to the change. If the
(iii) Clause 7 of the EU Standard Contractual Clauses (Optional Customer does not notify Supplier that it objects to the appointment of a
Docking Clause) shall not apply; new Sub-Processor within fourteen (14) days of Supplier’s notice of the
proposed appointment, the Customer will be deemed to have accepted
(iv) In Clause 9 of the EU Standard Contractual Clauses Option 2 the appointment. The parties shall discuss any objections raised by the
shall apply and the time period for providing notice of a Sub- Customer in good faith. Notification of new Sub-Processors by Supplier
Processors shall be as specified in Condition 3.9; will be made by way of update to the Data Sharing and Processing
Agreement at https://www.qa.com/legal_documents/workforce-learning-
(v) The Optional Language within Clause 11 of the EU Standard data-sharing-and-processing-agreement.pdf and where applicable
Contractual Clauses shall not apply; notification shall be made by way of a service delivery message to the
Customer.
(vi) In Clause 17 of the EU Standard Contractual Clauses Option 1 3.10. Sub-Processors may make Restricted Transfers of personal data for the
shall apply and the EU Standard Contractual Clauses shall be purpose of providing the Services to the Customer in accordance with the
governed by Irish law; Contract. The Supplier shall ensure that such Sub-Processors: (i) are
located in a Permitted Jurisdiction; or (ii) have entered into the applicable
(vii) In Clause 18(b) of the EU Standard Contractual Clauses disputes Restricted Transfer Terms with the Supplier.
shall be dealt with by the courts of Ireland;
(viii) Annex I of the EU Standard Contractual Clauses shall be
deemed completed with the information specified in the Data Sharing
and Processing Agreement at
https://www.qa.com/legal_documents/workforce-learning-data-
sharing-and-processing-agreement.pdf and with any additional
information provided on the Order;
(ix) Annex II of the EU Standard Contractual Clauses shall be deemed
completed with the obligations specified in Condition 3.4.3, Appendix
2 and any additional information provided in the Order; and
(x) Annex III of the EU Standard Contractual Clauses shall be
deemed completed with the information specified in the Data Sharing
and Processing Agreement at
https://www.qa.com/legal_documents/workforce-learning-data-
Appendix 1
UK STANDARD CONTRACTUAL CLAUSES ADDENDUM
1. This Appendix 1 hereby incorporates Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the IC and
laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 28 January 2022, as it is revised under Section 18 of those Mandatory Clauses.
2. The following tables set out the information required by Part 1 of the Approved Addendum:
Start date commencement of the Contract
The Parties Exporter (who sends the Restricted Transfer) Importer (who receives the Restricted Transfer)
Parties’ details Full legal name: As set out in the Order Full legal name: As set out in the Order
Trading name (if different): N/A Trading name (if different): N/A unless specified on the Order
Main address (if a company registered address): Main address (if a company registered address): As set out in the Order
As set out in the Order
Official registration number (if any) (company number or similar identifier): As
Official registration number (if any) (company set out in the Order
number or similar identifier): As set out in the Order
Key Contact Full Name (optional): As set out in the Order Full Name (optional): As set out in the Order
Job Title: As set out in the Order Job Title: As set out in the Order
Contact details including email: As set out in the Contact details including email: As set out in the Order
Order
Signature (if required The Exporter confirms agreement to be bound by The Importer confirms agreement to be bound by this UK Standard
for the purposes of this UK Standard Contractual Clauses Addendum Contractual Clauses Addendum by signing the Order.
Section 2) by signing the Order.
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCC ☒ The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the
Appendix Information:
Date:
Reference (if any):
Other identifier (if any):
Or
☐ the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or
optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum: N/A
Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than
the Parties), and which for this Addendum is set out in:
Annex 1A: List of Parties: As specified on the Order
Annex 1B: Description of Transfer: See Data Sharing and Processing Agreement at: https://www.qa.com/legal_documents/workforce-learning-data-sharing-
and-processing-agreement.pdf
Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: The Supplier will
implement appropriate technical and organisational measures in accordance with Appendix 2 and any additional terms specified on the Order.
Annex III: List of Sub processors (Modules 2 and 3 only): See Data Sharing and Processing Agreement at: https://www.qa.com/legal_documents/workforce-
learning-data-sharing-and-processing-agreement.pdf
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Addendum when Which Parties may end this Addendum as set out in Section 19:
the Approved Addendum
changes
☐ Importer
☐ Exporter
☒ neither Party
Appendix 2
Information Security
1. INFORMATION SECURITY
1.1. The Supplier shall:
1.1.1. have in place an information security policy which covers the scope of the Services and meets ISO27001 standards (the “Security Policy”);
1.1.2. ensure the Security Policy is reviewed at least annually by the Supplier and communicated to all relevant staff and/or contractors;
1.1.3. procure the maintenance of independent external security certifications and assurances, including ISO27001, Cyber Essentials Plus, and the UK
Government’s IT Health Check (‘CHECK’) scheme;
1.1.4. have a documented IT asset disposal policy; and
1.1.5. have in place an acceptable use policy for the use of Supplier systems including email and internet; such policy shall cover misuse of resources and the
downloading and installing of unauthorised software.
1.2. The Supplier shall ensure it maintains sufficient resources, skills and facilities to meet its responsibilities under this Appendix.
2. RECORDS, AUDIT AND NOTIFICATIONS
2.1. The Supplier shall:
2.1.1. conduct internal and external audits of its security controls and the Security Policy;
2.1.2. provide independent third-party audit reports to Customer (such reports are at the Supplier’s discretion and may be a summary or redacted reports); and
2.1.3. notify the Customer promptly of becoming aware of any incident that has materially impacted the security of the Customer’s information or data.
3. DATA DELETION
3.1. The Supplier shall ensure:
3.1.1. it has the ability to sanitize computing resources of data at an appropriate time; and
3.1.2. it has processes and procedures in place for the secure deletion of Customer data upon request by the Customer.
4. DATA ACCESS
4.1. The Supplier shall ensure that people that are not directly involved in the provision of the Services or who do not have a legitimate need to access Customer
Data shall not have unsupervised access to the Customer Data or systems involved in the provision of Services to the Customer.
4.2. The Supplier shall have in place systems and processes for individuals which may have access to Customer data or information.
4.3. The Supplier shall review all system users’ and administrators’ access rights to Customer and Supplier data at reasonable intervals.
5. SECURITY
5.1. Throughout the Term the Supplier shall take appropriate measures to guard against unauthorised or unlawful processing of Customer data and against
accidental corruption, loss or destruction of or damage to Customer data.
5.2. The Supplier shall have appropriate operational security risk management processes and procedures in place for the identification, mitigation and
management of security risks as they pertain to the Services.
5.3. The Supplier shall have in place systems and tools to protect Customer data and information from malicious attack.
5.4. The Supplier shall ensure it has appropriate information security protection in place for all locations processing Customer Data, as set forth by applicable
legislation, regulations, and industry best practice.
6. INCIDENT MANAGEMENT
6.1. The Supplier shall:
6.1.1. have in place a robust security incident management policy which is implemented upon the occurrence of any security incident or risk;
6.1.2. without undue delay notify the Customer of any security incident relating to Customer data;
6.1.3. provide Customer with such information Customer reasonably requires to understand the scale and scope of any relevant security incident and to remediate
its impact;
6.1.4. deal with any security incident in accordance with good industry standards;
6.1.5. have in place appropriate business continuity plans to ensure, so far as is reasonably practicable, the continuity of the Services despite any security incident;
6.1.6. ensure that Customer data is appropriately backed up and is capable of restoration upon loss or damage; and
6.1.7. ensure all back up data is appropriately stored to the same standards as other data.
7. CHANGES
7.1. The Customer acknowledges that the Supplier may be required to update this Addendum from time to time to deal with changes in Applicable Laws, any new
security threats or a change in the Customer’s or the Supplier’s business and as such the Supplier agrees to comply with any updated version of this
Addendum from time to time