Snapshot 233190
Normalized text
Scripts and page chrome removed; this is what change detection compares.
GENERAL TERMS AND CONDITIONS FOR SERVICES Force Majeure shall have the meaning given to it under
Section 21 of this Agreement.
Reference is made to the attached or referenced sales order, including, include, in particular, for example or any similar
statement of work, letter of engagement, proposal, or other expression shall be interpreted as illustrative and shall not limit
similar document issued by Ipsos (hereinafter referred to, as the sense of the words preceding those terms.
applicable, the "SOW") between Client and Ipsos for the Indemnitor shall have the meaning given to it under Section 8
provision of market research and advisory services or other of this Agreement.
related services as referenced in such SOW (the "Services"). Indemnitee shall have the meaning given to it under Section 8
1. DEFINITIONS. of this Agreement.
In these T&Cs and the SOW, unless otherwise expressly stated Ipsos means Ipsos MORI UK Limited or its Affiliate (registered
therein the following terms have the following meanings: in the UK or Ireland) who has issued and entered into the SOW.
AI means software, products and services that utilise artificial Ipsos IP refers to Ipsos know-how, technologies, and
intelligence, machine learning, language and statistical proprietary methodologies, including processes, products,
modelling, neural networks and/or other technologies (whether tools, source codes, platforms, formulae, algorithms, lesson
now known or hereafter developed), whether developed, learned presentations, models, databases, computer programs
owned and/or operated by Ipsos or licensed or otherwise and software used, created or developed by Ipsos in
provided to Ipsos by a third party connection with Ipsos’ performance of Services under this
Agreement refers collectively to the T&Cs and SOW Agreement. This includes any derivative works, upgrades,
collectively. updates, modifications or enhancements as well as all
questions and questionnaires, except to the extent that Client
Affiliate shall mean (i) with respect to Ipsos any person, has provided such material.
partnership, joint venture, corporation or other form of
enterprise, domestic or foreign, whether incorporated or not, Litigation Purposes refers to any dispute resolution process,
that the French holding company Ipsos SA, or any of its litigation, arbitration or other legal proceeding of any nature.
subsidiaries, directly or indirectly holds 50% or more of the Non-Affiliated Third Parties refer to third parties that are not
nominal value of the issued share capital or 50% or more of the Affiliates with or related to the Indemnitee.
voting power at general meeting, and either (a) has the power Personal Data means any information or data that is
to appoint a majority of directors, or (b) when by contract or considered as personal data by the Applicable Data Protection
otherwise, can direct or cause the direction, or the Laws.
management or the activities of such entity/Affiliate from time Public Domain refers to any public platform or medium,
to time even if Ipsos SA or any of its subsidiaries has a minority including advertising, marketing or promotional material press
interest in that entity and (ii) with respect to Client any entity releases, press conferences, or any other media.
which Controls, is Controlled by, or is under common Control
with a party. Section refers to the clauses in these T&Cs.
Applicable Data Protection Laws means the UK GDPR, UK Services Data refers to content, information and data obtained
Data Protection Act 2018, and any other law of the United or created while performing the Services. This includes the
Kingdom or of a part of the United Kingdom which relates to results and responses from the Services.
the protection of Personal Data. Syndicated Deliverables refers to syndicated survey research
Business Day means a day that is not a Saturday, Sunday or services containing data collected from the market and not
a UK or Irish national holiday (as relevant) at which retail banks intended for a specific client and therefore independently
are open to the general public. conducted, published and/or sold by Ipsos and/or any deriving
deliverables, data, information, insights and reports from such
Claims refer to all claims and resulting liabilities, losses, services.
damages, costs and expenses of any kind, including
reasonable attorneys’ fees. Term shall have the meaning given to it under Section 3 (a) of
this Agreement.
Client means the person or entity to which the SOW for the
Services has been issued by Ipsos. T&Cs shall mean these terms and conditions.
Confidential Information shall mean all information (written or UK GDPR has the meaning given to it in the Data Protection
oral) disclosed by one Party to another, deemed confidential to Act 2018 as amended from time to time.
the reasonable person including analyses, studies, data related
to intellectual property and business practices such as References in the Agreement to ‘party’ or ‘parties’ shall be
research, methodologies, business plans, financial data, references to the parties to the Agreement or the relevant SOW,
strategic plans and know-how. as applicable.
Control for Client means the ability, directly or indirectly, to
direct the affairs of another entity by means of ownership,
contract or otherwise. 2. SERVICES.
Data Controller means the organisation which, alone or jointly a) These T&Cs shall govern the Services to be provided
with others, determines the purposes and means of the under the SOW. These T&Cs shall not apply to any
Processing of Personal Data. technology services (including Synthesio or Askia
Data Processor means the organisation which processes services) or Ipsos iris services, which will be subject to
Personal Data on behalf of the Data Controller. separate Ipsos terms and conditions.
Data Subject means an identified or identifiable natural b) Client acknowledges and agrees that no other document,
person. in particular Client's own general conditions of purchase or
Deliverables means the presentations, reports, data or other specific conditions, shall prevail over the Agreement even
results of the Services identified in the SOW and specifically though Client may issue its own purchase order for
prepared by Ipsos for the Client. administrative purposes. To the extent that there is an
February 2025 1
inconsistency between the T&Cs and the SOW, the T&Cs b) Each party shall have the right to terminate the
shall prevail over the SOW. Agreement at any time without cause upon ninety (90)
c) Where the Services performed pursuant to this Agreement days prior written notice to the other party.
constitute market, opinion or social research or data c) Either party shall have the right to terminate the
analytics they shall be rendered in accordance with all Agreement, effective immediately, at any time and by
generally accepted professional industry standards and providing prior written notice, if the other party fails to
practices applicable to the market research industry, either perform any material obligation or to cure a
including the ICC/ESOMAR International Code of Market, material breach within fifteen (15) Business Days of
Opinion and Social Research and Data Analytics and receiving written notice by the non-breaching party to
EphMRA’s Code of Conduct. that effect. The termination provisions set out in this
d) Following the commencement of each project, Client shall Section are not exclusive, and are in addition to, and
promptly: not in limitation of either party's rights under the
i. provide Ipsos with any material, document, information or Agreement or at law.
data which may be necessary for the Services or for 4. EFFECTS OF TERMINATION.
incorporation into the Deliverables and requested by Upon any termination of this Agreement for any reason
Ipsos for the performance of the Services, and whatsoever, Client shall continue to be obligated to pay the fees
ii. provide Ipsos with all reasonable assistance and access due (including the pro-rated fees for work undertaken through
to its personnel and all timely approvals required to the effective date of termination) and expenses incurred by
facilitate the provision of the Services and delivery of the Ipsos up to the effective date of termination, as well as any pre-
Deliverables in accordance with the relevant SOW. approved and documented unrecoverable third-party costs
incurred by Ipsos as a result of such early termination.
e) This Agreement does not obligate Client to obtain Services 5. FINANCIAL TERMS.
from Ipsos and Ipsos to provide Services to Client unless
and until a SOW is executed by the parties. Any such SOW a) Ipsos shall invoice Client for all amounts due for the
shall at least set forth a description of the Services, the Services under the SOW as follows: seventy-percent
specifications for the Deliverables, the timing for delivery, (70%) of the fees due for the Services upon execution of
and associated fees. the SOW, and the remaining thirty-percent (30%), plus
f) Any changes to the specifications, scope of Services, or expenses incurred by Ipsos, upon completion of the
Deliverables requested by Client must be agreed upon in Services, except for Services consisting of tracking
writing by both parties before work related to such changes surveys or other long term surveys, in which case either
begins. This includes any additional charges to Client. Ipsos will define different project phases in the SOW and
g) For purposes of clarity, Ipsos retains the right to charge will invoice Client the full amount of the fees corresponding
Client additional fees for any Client-requested alterations to each phase at the beginning of each such phase or
made to the originally agreed upon program specifications, Ipsos shall invoice Client on a monthly or quarterly basis.
including: In addition, unless otherwise specified in a SOW or rate
i. questionnaire design and contents, sample size, survey card annex, in any instance where a project under a SOW
duration, and quota requirements; has a duration of more than one year (including any
renewals or extensions), Client agrees that on the
ii. project materials, including survey links and incentives; anniversary date of any such annual renewal or extension,
and the fees specified in the SOW shall be adjusted for inflation
based on the Consumer Price Index included in the World
iii. modifications to the volume, format, or content of
Economic Outlook report issued by the International
Deliverables, which may include data sets, tables,
Monetary Fund for the relevant country.
reports, and dashboards.
b) All invoices shall be due and payable in full within thirty (30)
h) Any Client-requested modifications to the specifications, days of date of invoice. Invoices not paid within thirty (30)
materials, or Deliverables may also result in corresponding days after the invoice date shall bear interest at a rate of
revisions to the project timelines, which shall be one and one-half percent (1.5%) per month or the
communicated to Client in writing. maximum rate permitted by applicable law, whichever is
i) If Client delays, postpones the Services, or fails to provide less, plus monetary restatement according to official
accurate information or instructions, Client must pay for inflation rate when applicable, such additional amount to
any documented unrecoverable costs incurred by Ipsos as be calculated from the end of the thirty (30) days until all
a result of such delay or postponement. past due amounts have been paid and, in addition, Ipsos
j) Client acknowledges and agrees that Ipsos may develop may, in its sole discretion, and without prejudice to its other
and use AI in connection with its provision of Services rights under the Agreement, suspend the performance of
under the Agreement. the Services and/or the delivery of the Deliverables (as
k) Neither Ipsos nor any Ipsos Affiliate will have joint and defined in Section 12 below) and require the restitution of
several liability with respect to one another or will be those Deliverables that may have been already provided
regarded as a guarantor of one another. to Client.
3. TERM AND TERMINATION. c) Payments will be in the currency specified in the SOW. If
a) The Agreement will become effective on the earlier of the SOW specifies that Ipsos shall invoice in a currency
(i) the effective or commencement date set out in the other than its national currency, then Ipsos shall have the
SOW; (ii) the date of execution by Client of the SOW; right to increase or decrease all fees under the applicable
or (iiii) other document provided by Ipsos or Client to SOW if, on the date of invoice the rate of exchange of the
confirm Client’s instructions to Ipsos to deliver the two currencies has changed so that the value of the
Services, and shall remain in force until completion of currency specified in the invoice compared to the national
the Services (the "Term"). currency of Ipsos has increased or decreased by more
than three percent (3%) from the date of the SOW. The
February 2025 2
adjustment shall fully compensate Ipsos or Client for the deadlines, but it does not guarantee meeting those
increase or decrease in the value of the currency invoiced deadlines. All time frames included in the Agreement with
compared to Ipsos’ national currency. For purposes of this respect to the timing of Deliverables are approximations.
Agreement, the prevailing exchange rates shall be the c) Where any element of the Services includes advisory
rates specified by the National Bank of the country in which services, Client agrees: (i) it shall make its own
Ipsos is located on the date of the SOW and the invoice independent decisions as a result of any such advice, and
date, respectively. as to whether any actions or inactions are appropriate or
d) In the event that Ipsos is required to incur any out of pocket proper for it based upon its own judgment; (ii) it does not
or third-party pass through expenses (including honoraria rely on any communication (written or oral) from Ipsos as
and focus group facility and moderator expenses) or a recommendation for such action or inaction; (iii) that no
additional costs (including travel and lodging) which are not communication (written or oral) received from Ipsos will be
set forth in the SOW, then, provided that Client is notified deemed to be an assurance or guarantee as to the
of and reasonably approves all such expenses in advance, expected results of Client's actions or inactions; and (iv) it
Client shall reimburse Ipsos for such expenses within thirty is capable of assessing the merits of and understands and
(30) days of the date of invoice. accepts, the terms, conditions and risks of any such
e) All prices are subject to a +/-10% cost contingency unless advice.
otherwise noted in a SOW. d) Client acknowledges that it has entered into the Agreement
6. TAXES. When applicable, government sales tax, use in reliance only on the representations, warranties
and/or value added taxes shall be paid by Client in addition to promises and terms contained in the Agreement and, save
the fees due under this Agreement. Client shall in no event be as expressly set out in the Agreement, Ipsos shall have no
liable for payment of any taxes based on Ipsos’ net income or liability in respect of any other representation, warranty or
personal property. In addition, all fees due under this promise made prior to the date of this Agreement and in
Agreement shall be made free and clear of, and without particular
deduction or withholding for or on account of, any present or e) Except as expressly provided in this Agreement and to the
future tax, levy, impost, duty or other charge or withholding of a fullest extent permitted by law, Ipsos hereby disclaims all
similar nature (including any related penalty, fine, surcharges or warranties, conditions or other terms implied by statute or
interest payable in connection with any failure to pay or delay in common law with respect to the Services and or the
paying any of the same) except to the extent required by law. In Deliverables, including any implied warranty of fitness for
the event that Client is required by law to deduct any withholding a particular purpose.
or other similar taxes from any amount due to Ipsos hereunder, 8. INDEMNIFICATION.
Client shall increase the amount due to Ipsos to the extent a) Each party (the "Indemnitor") shall indemnify, defend and
necessary to ensure that, after deducting any such taxes, Ipsos hold harmless the other party (the "Indemnitee"), its
receives and retains a net amount equal to the original amount Affiliates and each of their respective officers, directors,
that it would have received had no such deduction been made. employees and agents from and against all Claims initiated
7. REPRESENTATIONS AND WARRANTIES. by or on behalf of Non-Affiliated Third Parties to the extent
a) Each party represents and warrants that (i) it will comply arising out of any breach or violation by the Indemnitor of
with all applicable laws, rules and regulations, including its representations and warranties or other terms of the
applicable privacy and data protection laws; (ii) it has Agreement.
obtained any and all permits, licenses and third party b) Client shall indemnify, defend and hold harmless Ipsos, its
consents or approvals necessary in connection with the affiliated companies and each of their respective officers,
use of materials furnished to the other party, including in directors, employees and agents from and against all
the case of Client, any materials furnished to Ipsos by a Claims by Non-Affiliated Third Parties to the extent arising
third party acting upon Client’s behalf, and that it has the out of the use of the Deliverables by Client, or the
legal right to disclose such materials to the other party in conclusions drawn therefrom, except for Claims arising
connection with the Services, including any consents from Ipsos’ negligence.
required under applicable privacy and data protection law; c) In the event that the Agreement provides for the testing by
and (iii) any such materials disclosed to the other party respondents of products, Client shall indemnify, defend
shall not violate, misappropriate, or infringe upon the and hold harmless Ipsos, its affiliated companies and each
trademark, copyright, patent or other intellectual property of their respective officers, directors, employees and
rights, right of privacy or publicity, or any other proprietary agents from and against all Claims arising directly or
right of any third party; provided that, with respect to indirectly from the packaging, distribution, consumption,
materials generated by AI, Ipsos makes all the foregoing use of or contact with any such product used in connection
representations and warranties only to the extent of its with said product test, except for any Claim arising from
knowledge. Ipsos’ proven negligence. Ipsos shall be deemed to have
b) As the nature of the Services is based upon samples and acted negligently only to the extent Ipsos, its employees
statistical treatment of information, Ipsos does not warrant and agents fail in any material respect to follow any written
the total accuracy of the Deliverables, or the data instructions given by Client for the handling, storage,
contained therein. Client acknowledges and agrees that packaging, use, or delivery of the product.
Ipsos does not predict or assure any particular substantive d) The Indemnitee shall promptly notify the Indemnitor in
results of its research in advance, nor does Ipsos accept writing of any Claim by a Non-Affiliated Third Party under
any liability for (i) Client’s interpretation of Ipsos’ reports or subsections (a) through (c) above. The Indemnitor shall
of other data furnished to Client by Ipsos, (ii) any errors control the defence and settlement, at its own expense, of
caused by AI or errors in data provided to Ipsos, (iii) any such Claim. The Indemnitee shall: (i) at the
improper use of simulation software or improper Indemnitor’s expense and request, cooperate fully with the
interpretation of simulation software results by Client, or Indemnitor and its legal representatives in the investigation
(iv) resale of survey results or other data by Client. Ipsos and defence of any such Claim; and (ii) permit the
will use commercially reasonable efforts to meet all project Indemnitor to settle any such Claim (provided that such
February 2025 3
settlement does not adversely affect the Indemnitee’s possession at the time of receipt thereof from the
rights hereunder or impose any obligations on the disclosing party and was not acquired from the disclosing
Indemnitee in addition to those set forth herein). party; (iii) is acquired or rightfully received without
9. LIABILITY. confidential limitation by the receiving party from a third
a) Except as set out in Section 9(d)below, neither party shall party; (iv) is independently developed by the receiving
be liable to the other party for any indirect, incidental, party without breach of the Agreement; or (v) is required to
punitive, special or consequential damages, including loss be disclosed pursuant to court order or applicable law,
of profits, arising out of, or in connection with, the provided that the receiving party first gives the disclosing
Agreement whether or not such party was advised of the party reasonable notice of such court order or law (to the
possibility of such damage and whether based in breach of extent permitted by applicable laws) and an opportunity to
contract, tort, or any other theory at law or in equity. oppose and/or attempt to limit such production.
b) Except as set out in Section 9(d)below, the total aggregate c) Notwithstanding the foregoing, Client acknowledges and
liability of Ipsos for any and all Claims made by Client agrees that certain Services require Ipsos to expose,
under or in connection with the Agreement shall not reveal, disclose or describe Client’s Confidential
exceed the amount of fees paid by Client under the Information to survey respondents, including Client’s new
Agreement. concepts, products, services, advertising campaigns or
c) Notwithstanding anything to the contrary set forth herein, designs. Client hereby waives and releases Ipsos from
Ipsos will not be liable to Client for any Claim if it is caused and against any and all Claims resulting from or related to
by: (i) combining, operating, or using the Deliverables with Ipsos’ authorised disclosure of Client’s Confidential
other materials (including materials supplied by Client or Information to survey respondents in connection with the
its representative), and the Deliverables alone would not Services.
be infringing; (ii) Client using the Deliverables in an d) Except as otherwise provided below, no right, title, interest
application, environment or software not specifically set or license to the receiving party is either granted or implied
out in the SOW; (iii) Ipsos following Client's specifications under any trademark, patent, copyright or any other
or instructions; or (iv) modifications to the Deliverables intellectual property right by the disclosure of the
made by Client or its agents, if the original Deliverables Confidential Information hereunder.
would not have been infringing. 11. PERSONAL DATA.
d) Nothing in this Agreement shall limit or exclude either a) If Client, for the purposes of the Services, provides Ipsos
party's liability for (i) any Claims by Non-Affiliated Third with Personal Data, Client hereby warrants that such
Parties covered under each party’s indemnification provision complies with all Applicable Data Protection
obligations set forth in Section 8(Indemnification), (ii) death Laws, and represents that it has the rights and
or personal injury caused by its negligence; (iii) its fraud or authorisations necessary to provide said Personal Data to
wilful default; (iv) Ipsos’ losses arising from Client’s breach Ipsos. It is the responsibility of Client to complete any
of Section 12(b); or (v) anything else which it cannot by law appropriate formalities so that Ipsos has the right to
limit or exclude its liability. process any Personal Data, and (where applicable) to
10. CONFIDENTIALITY. prove that individuals have given their valid consent to be
a) Neither party receiving Confidential Information from the contacted for the purposes of the Services. Ipsos accepts
other party shall (i) use Confidential Information received no liability and shall not bear any costs resulting from any
from the other party under this Agreement for any purpose failure by Client to fulfil its obligations under Applicable
other than to fulfil its obligations under this Agreement; (ii) Data Protection Laws, except where such failure is the
disclose such Confidential Information to any third party, result of a breach by Ipsos of this Section 11. Ipsos shall
except for those of its employees with a need to know the notify Client of any breach of security leading to the
information in order to perform their obligations hereunder accidental or unlawful destruction, loss, alteration, or un-
and provided that they are made aware of and agree to be authorised disclosure for access to the Personal Data
bound by the obligations of confidentiality contained provided to Ipsos as soon as reasonably possible, but in
herein; (iii) reverse-engineer, decompile, or disassemble any event no later than seventy-two (72) hours after its
any Confidential Information; or (iv) remove, overprint or discovery.
deface any notice of confidentiality, copyright, trademark, b) When Processing Personal Data pursuant to sub-section
logo, legend or other notice of ownership or confidentiality a) above, Ipsos in its capacity as Data Processor will only
from any originals or copies of Confidential Information. process
The receiving party further agrees to use the same degree i. these Personal Data as per Client’s documented
of care in safeguarding the Confidential Information as its instructions or as may be required by Applicable Data
uses for its own information, but in no event less than a Protection Laws;
reasonable degree of care. Upon written request, the ii. subject to the technical and operational measures set out
receiving party shall return all Confidential Information to in Appendix 1, which Client acknowledges are
the disclosing party. Notwithstanding the foregoing, the appropriate. Unless Client has no relevance in terms of
receiving party may retain one copy of Confidential Applicable Data Protection Laws, Client and Ipsos shall
Information in its archives for routine backup, security document the description of the Personal Data processed
and/or disaster recovery purposes only, and the by Ipsos as set forth in Appendix 1;
obligations of confidentiality relating to such retained
materials shall continue for as long as such materials are iii. in accordance with the Applicable Data Protection Laws;
retained.
iv. for the purpose they were provided; and
b) The obligation of confidentiality, however, shall not apply
to information which: (i) is, at the time of receipt or v. for as long as they are required for the purpose in iv
dissemination, or thereafter becomes generally available above.
to the public other than through a breach of the Agreement
by the receiving party; (ii) is in the receiving party’s
February 2025 4
c) Where the Services involve either the Processing of IP that is incorporated into the Deliverables solely to the
Personal Data on behalf of the other contracting party extent necessary for Client to use, view or access the
(Data Controller to Data Processor relationship) or the Deliverables for Client's internal business purposes.
provision of personal data (Data Controller to Data b) Notwithstanding the foregoing, to the extent that a SOW
Controller relationship) and Applicable Data Protection specifies that the Services include Syndicated
Laws requires additional terms to enable such data Deliverables, Client hereby agrees and understands that
transfers between the contracting parties, they shall enter (i) Ipsos shall at all times retain sole and exclusive
into such standard contractual clauses as may be ownership rights in the Syndicated Deliverables as well as
prescribed by relevant public authorities, including the all Ipsos IP; (ii) Client may not sell, distribute, copy or
relevant module(s) of the Standard Contractual Clauses reproduce in full or in part any of the Syndicated
pursuant EU Commission decision 2021/914, which shall Deliverables, without written authorization from Ipsos,
be attached to the relevant SOW. which Ipsos may withhold in its sole discretion; and (iii) this
d) Notwithstanding Section 11(c) above applies, when Agreement constitutes a revocable, non-exclusive license
Processing Personal Data pursuant to Section 11(a), from Ipsos to Client to use the Syndicated Deliverables
Client authorises Ipsos to transfer the Personal Data to its solely for internal purposes, subject at all times to the
approved subcontractors (whether in the same or another ownership rights of Ipsos set forth herein.
jurisdiction), who are required to adhere at least to the c) This Agreement shall not apply where Client requests
same technical and operational measures as set out in Ipsos to create or develop a new tool, software, product,
Appendix 1. research technology, process, model, database or other
e) Where applicable, Ipsos will keep and maintain a record of proprietary methodology for which Client intends to own or
Processing as required under Applicable Data Protection have rights of use. In such event, the parties will negotiate
Laws. and enter into a separate written agreement applicable to
f) Ipsos agrees to provide Client with all reasonable such services.
assistance to respond to all requests (i) related to a Data d) Notwithstanding anything to the contrary in this
Subject’s Personal Data rights or (ii) initiated by any Agreement, and without limiting Ipsos' rights at law or
relevant supervisory authority. elsewhere under this Agreement, Client agrees that Ipsos
g) Client agrees not to use the Deliverables unless Section may maintain and use Services Data, including results and
11(i) below applies, either on their own or together with responses obtained from the Services, for the following
other data available to Client to re-identify any Data purposes: (i) industry studies, modelling, testing, analytics,
Subject. creation of anonymized statistics and benchmarking
h) Furthermore, in accordance with its professional rules and purposes, and (ii) improving and developing its
its contractual obligations to respondents, Ipsos is under a professional norms and standards, methodologies,
duty to preserve the anonymity of the respondents when platforms, and technologies (whether now known or
providing market, opinion and social research and data hereafter developed, and whether or not owned by Ipsos),
analytics services. Accordingly, Ipsos shall only provide provided that (i) Ipsos will only use Services Data in an
Client with aggregate data or otherwise anonymized data. aggregated form (if at all), and (ii) Ipsos will never identify
Client hereby undertakes to respect this anonymity and Client as the source of any Services Data. Without
undertakes not to attempt to link the data provided by Ipsos limitation of the foregoing, Ipsos may retain one copy of the
to the identity of the respondents. Ipsos will only provide Deliverables for archiving purposes.
Personal Data to Client as permitted by and in accordance
with its professional rules and Applicable Data Protection 13. PUBLICITY AND USE OF DELIVERABLES.
Laws. In any instance of such permitted disclosure, Client a) Neither party shall use the other party’s name, trademarks
hereby agrees to maintain the confidentiality of such or logos in the Public Domain without the prior written
Personal Data. Where such Personal Data is provided by consent of the other party.
Ipsos, acting as a Data Controller, to Client, Client warrants b) In addition, in accordance with the ICC/ESOMAR
that it will cease further use or processing of the Personal International Code of Market and Social Research, Client
Data upon notice from Ipsos, and shall comply with all shall not publish the Deliverables in the Public Domain
instructions included in such notice, including deletion of without the prior written consent of Ipsos. If Client or its
any or all relevant Personal Data. agents wish to publish the Deliverables in the Public
i) Where Personal Data are provided by Ipsos to Client, Domain, it must come to a written agreement with Ipsos on
Client will become a several Data Controller, subject to the the form and content of the disclosure, which Ipsos may
limitation in any separate agreement to that effect and the only withhold on the basis that the Deliverables are used
conditions under which the Personal Data were collected. or presented in a misleading or illegal manner, or in any
Further, Client warrants that it will delete any and all manner which would adversely impact upon the reputation
relevant Personal Data, leaving only anonymous data, or goodwill of Ipsos. Ipsos reserves the right to publish a
latest after one year for ad hoc studies and three (3) years correction in the event of such improper use or
for continuous studies from the completion of the Services. presentation.
12. OWNERSHIP. c) Unless Client informed Ipsos prior to the commission of the
a) Provided that Client has paid the full amount due for the Services and the execution of any such SOW that Client
related Services, Ipsos will transfer to Client and Client intends to use the Deliverables in relation to any public
shall own all intellectual property rights in the Deliverables promotion or broad publication, including for publication of
Client acknowledges and agrees that all Ipsos IP shall claims testing results, Client may not use any Deliverables
remain the sole and exclusive property of Ipsos. Further, for such purposes.
Client will not (i) reverse-engineer, decompile or d) Client shall inform Ipsos prior to the commission of the
disassemble any Ipsos IP or (ii) market, distribute, sell or Services and the execution of the SOW if Client intends to
resell any Ipsos IP. Ipsos hereby grants to Client a non- use the Deliverables in connection with any Litigation
exclusive, worldwide, royalty-free license to use any Ipsos Purposes. Client acknowledges that use of the
February 2025 5
Deliverables for Litigation Purposes may affect Ipsos' the foregoing, the following shall constitute events or conditions
recommended methodological approach and study costs. of Force Majeure: acts of State or governmental action,
In addition, if Client decides after the Services have been terrorism, riots, disturbances, war, strikes, lockouts, slowdowns,
completed that it wishes to use the Deliverables for prolonged shortage of energy supplies, epidemics, pandemics,
Litigation Purposes, it must first obtain the prior written fire, flood, hurricane, typhoon, earthquake, lightning and
consent of Ipsos, which Ipsos may withhold in its sole explosion or any other cause beyond Ipsos’ reasonable control.
discretion. b) Should an event of Force Majeure last for more than thirty
(30) days, then Ipsos shall have the right to terminate this
14. WAIVER. If either party fails to fully exercise any right, Agreement or the relevant SOW without liability to Client.
power or remedy under the Agreement, such right, power or Unless this Agreement or the relevant SOW has been
remedy shall not be waived. No express waiver or assent by terminated as set forth herein, both parties’ obligations
either party with respect to any breach or default under any hereunder shall resume upon the cessation of the event of Force
provision of the Agreement shall constitute a waiver or assent Majeure.
with respect to any subsequent breach or default under that or 22. NOTICES.
any other provision. No waiver shall be effective unless in writing All notices and other communications under the Agreement
signed by the party waiving its rights hereunder. shall be given in writing to the parties at the addresses
15. SEVERABILITY. If any provision of the Agreement is held appearing in the Agreement, or to such other address specified
by a court of competent jurisdiction to be illegal, invalid or in writing to the notifying party after the date of the Agreement
unenforceable, the legality, validity and enforceability of the and shall be deemed given on the date delivered in person, or
remaining provisions of the Agreement shall not be affected and on the next Business Day following delivery to a reputable
those provisions shall remain in full force and effect. If a court overnight courier for next day delivery, or on the third Business
or other decision-maker should determine that any provision of Day following mailing by certified mail, return receipt requested.
the Agreement is overbroad or unreasonable, such provision Notices to Ipsos must be accompanied by a copy of the notice
shall be given effect to the maximum extent possible by being sent by email to UKnotice@ipsos.com in order to be
narrowing or enforcing in part that aspect of the provision found deemed valid.
overbroad or unreasonable. 23. GOVERNING LANGUAGE.
16. GOVERNING LAW. The Agreement shall be governed English shall be the governing language of this Agreement. In
by, and interpreted and construed in accordance with, the laws the event there is a conflict between the English version and any
of England and Wales without regard to conflicts of law translated version, the English version shall prevail.
principles that would require the application of any other law.
24. ENTIRE AGREEMENT; SURVIVAL.
17. JURISDICTION AND VENUE. In the event of any dispute
arising out of or relating to the Agreement, the parties hereby The Agreement contains the sole and entire agreement and
consent to the exclusive jurisdiction of, and venue in, the courts of understanding between the parties and supersedes all prior
England and Wales. The prevailing party in any litigation relating agreements, understandings or arrangements (whether oral or
to the Agreement shall be entitled to recover its court costs and written) with respect to its subject matter and shall not be
expenses, including reasonable attorneys’ fees. modified except by a written instrument signed by Client and
Ipsos. In the event of the termination of the Agreement,
18. ASSIGNMENT AND SUCCESSORS. Neither party may Sections 3, 4, 5, 7 through to 19 (inclusive), and 21 through 24
assign any rights or delegate any obligations to any third party shall survive such termination.
under the Agreement without the prior written consent of the
other party, which shall not be unreasonably withheld or
delayed. Any attempted assignment in violation of this Section
shall be void. Notwithstanding the foregoing, a party may assign
the Agreement without the other’s consent to: (a) an Affiliate; or
(b) to any person, firm, organisation, corporation, or other entity
which succeeds to the business of such party by acquisition,
merger, reorganisation, or otherwise. The Agreement shall
inure to the benefit of and be binding upon Ipsos and its
permitted successors and assigns, and Client and its permitted
successors and assigns.
19. SUBCONTRACTING. From time to time, Ipsos may, where
appropriate, subcontract all or part of the Services to be
provided hereunder to one of its approved suppliers or to an
Affiliate. In any event of subcontracting, Ipsos shall remain fully
liable to the Client or the acts of the subcontractor
20. NO JOINT VENTURE. Ipsos is an independent contractor
and shall not be deemed a partner, joint-venturer, agent or legal
representative of Client for any purpose whatsoever.
21. FORCE MAJEURE.
a) Under no circumstance shall Ipsos be responsible to Client for
failure to provide the Services or for its delay in performance in
accordance with the Agreement due to any event or condition,
not existing as of the date of signature of this Agreement, not
reasonably within the control of Ipsos as of such date, which
prevents in whole or in material part the performance by Ipsos
of its obligations hereunder (“Force Majeure”). Without limiting
February 2025 6
APPENDIX 1 – Data Processing Obligations of the Client and Supplier
ADDITIONAL DEFINITIONS: notifications, Data Protection Impact Assessments and
consultations with Supervisory Authorities or regulators;
1.4.5. notify the Client without undue delay on becoming aware of a
Client Personal Data: any Client provided Personal Data which Ipsos processes Personal Data breach involving the Client Personal Data;
in connection with the agreement to which this Appendix 1 is attached, as the 1.4.6. at the written direction of the Client, delete Client Personal
Client’s Processor. Data and copies thereof to the Client on termination of the
agreement unless Ipsos is required by Applicable Law to
Controller, Data Protection Impact Assessment, Processor, Joint Controller, continue to process that Client Personal Data. For the
Data Subject, Personal Data, Personal Data Breach, Supervisory Authority purposes of this clause 1.4.6 Client Personal Data shall be
and Processing shall have the meaning given to them in the UK GDPR. considered deleted where it is put beyond further use by Ipsos;
and
EEA: the European Economic Area.
1.4.7. maintain records as required under UK GDPR or as set out
specifically herein.
EU GDPR: the European Union’s General Data Protection Regulation ((EU)
1.5. Any audit or inspection permitted following a request for audit
2016/679) as amended from time to time.
accepted by Ipsos and where Ipsos is deemed as the Processor, is
not intended to include:
Purpose: the purposes for which the Client Personal Data are processed, as set
1.5.1. any information related to Ipsos’ provision of services to other
out in clause 1.4.1.
clients or other client’s Data; or
1.5.2. (ii) supplier’s general operating costs, overhead costs, or
Ipsos Personal Data: any Personal Data which Ipsos processes in connection
salary, timecards or other employee, personnel, and/or
with this agreement as a Controller.
individual compensation records, or Ipsos’ profit and loss
reports or other corporate records of Ipsos.
1.6. The Client agrees that any agreed audit or access to Ipsos’ premises,
1. DATA PROTECTION in accordance with clause 1.5, will be in a manner that minimises
1.1. Both parties will comply with all applicable requirements of Applicable interference with Ipsos’ business operations, and that any request by
Data Protection Laws. This Appendix is in addition to, and does not the Client for an audit or access to Ipsos’ premises may not be
relieve, remove or replace, a party's obligations or rights under granted by Ipsos more than once in any 12-month period.
Applicable Data Protection Laws. 1.7. Where requested or required by Ipsos, the Client shall provide its
1.2. Where Client Personal Data is transferred to Ipsos, without prejudice authorisation for Ipsos or its Affiliate/s to appoint Processors to
to the generality of clause 1.1, the Client will ensure that it and/or the process the Client Personal Data, provided that Ipsos or its Affiliates:
organisation that supplies the Client Personal Data has the necessary 1.7.1. shall ensure that the terms on which it appoints such
appropriate legal basis and notice(s) in place to enable lawful transfer Processors comply with Applicable Data Protection Laws, and
of Client Personal Data to Ipsos for the duration and purposes of this are consistent with the obligations imposed on Ipsos in this
Appendix. Appendix;
1.3. In relation to the Client Personal Data, Schedule 1 sets out the scope, 1.7.2. shall remain responsible for the acts and omission of any such
nature and purpose of Processing by Ipsos, the duration of the Processor as if they were the acts and omissions of Ipsos; and
Processing and the types of Personal Data and categories of Data 1.7.3. shall inform the Client of any intended changes concerning the
Subject. addition or replacement of the Processors as listed in
1.4. In relation to Client Personal Data and without prejudice to the Schedule 2, thereby giving the Client the opportunity to object
generality of clause 1.1, Ipsos shall: to such changes provided that if the Client objects to the
1.4.1. process the Client Personal Data only on the documented changes and cannot demonstrate, to Ipsos’ reasonable
instructions of the Client and only for the purposes set out in satisfaction, that the objection is due to an actual or likely
Schedule 1 , unless Ipsos is required otherwise by Applicable breach of Applicable Data Protection Law, the Client shall
Data Protection Laws. Where Ipsos is relying on Applicable indemnify Ipsos for any losses, damages, costs (including
Data Protection Laws as the basis for Processing Client legal fees) and expenses suffered by Ipsos in accommodating
Personal Data, Ipsos shall notify the Client of this before the objection; and
performing the Processing required by the Applicable Data 1.7.4. transfer Client Personal Data outside of the UK and EEA as
Protection Laws unless those Applicable Data Protection Laws required for the Purpose, provided that Ipsos shall ensure that
prohibit Ipsos from so notifying the Client on important grounds all such transfers are effected in accordance with Applicable
of public interest. Ipsos shall use reasonable endeavours to Data Protection Laws. For these purposes, Ipsos shall
inform the Client if, in the opinion of Ipsos, the instructions of promptly comply with any reasonable request of the Client,
the Client infringe Applicable Data Protection Laws; including any request to enter into an international data
1.4.2. implement the technical and organisational measures set out sharing agreement as issued by the Commissioner (where the
in Schedule 2 to protect against unauthorised or unlawful UK GDPR applies to the transfer) or the standard contractual
Processing of Client Personal Data and against accidental loss clauses adopted by the Commissioner from time to time along
or destruction of, or damage to, Client Personal Data, which with the Addendum to the standard contractual clauses
the Client has reviewed and confirms are appropriate to the adopted by the Commissioner from to time (where the EU
harm that might result from the unauthorised or unlawful GDPR applies to the transfer), if these are not already in place.
Processing or accidental loss, destruction or damage and the 1.8. To the extent the parties act as Joint Controllers in respect of any
nature of the Client Personal Data to be protected, having Personal Data pursuant to the agreement, to which this Appendix is
regard to the state of technological development and the cost attached, the parties have agreed to allocate responsibility for each
of implementing any measures; of their Controller obligations under Applicable Data Protection Laws
1.4.3. ensure that any personnel engaged and authorised by Ipsos in accordance with Schedule 3 .
to process Client Personal Data have committed themselves 1.9. The Client hereby indemnifies, and shall keep indemnified, Ipsos from
to confidentiality or are under an appropriate statutory or and against any and all costs, damages and expenses of any kind
common law obligation of confidentiality; arising from any claim or demand brought by any person, Data
1.4.4. assist the Client insofar as this is possible (taking into account Subject or Supervisory Authority as a result of any breach or alleged
the nature of the Processing and the information available to breach by the Client of any Applicable Data Protection Law or its
Ipsos), and at the Client's cost and written request, in obligations under this Appendix This indemnity shall not be subject to
responding to any request from a Data Subject and in ensuring any limits or exclusions of liability that may otherwise apply, or be
the Client's compliance with its obligations under Applicable imposed, under the agreement to which this Appendix is attached.
Data Protection Laws with respect to security, breach
February 2025 7
Schedule 1- Description of Personal Data Processing
Subject matter of the The Personal Data transferred concern the
Processing of Personal following categories of Data Subjects: (*)
Data Sub-Processors List *
Duration of the Ipsos will process Personal Data during the term of Name of Sub- Localization Type of Processing
Processing of Personal the agreement to which this Appendix applies. Processor(s)
Data
Rackspace UK Limited Unit 8, Millington Managed Hosting
Nature of the (*) Road, Hyde Park Services
Processing of Personal Hayes, UB3 4AZ
Data Google Cloud Platform London (Europe-west All Applications
2) (including Data
Purpose of the Ipsos will process Personal Data of data subjects Dimensions Multimode
Processing of Personal for the purpose of providing the services in Platform) Hosting – {pls
Data accordance with the agreement to which this delete this highlighted
Appendix applies, including: text if not using
Market research Dimensions Multimode
Client satisfaction survey (CATI/CAPI)}
Employee survey Google Cloud Platform Frankfurt (Europe- Dimensions Online
(other*) west 3) Platform Hosting - {Pls
delete this highlighted
Categories of Personal Client customer data
Data being processed Client employee data text if not using
(other *) Dimensions Online
Cluster V7.5}
Microsoft Azure UK West, UK South File Storage
Location of Personal [If the location of any Processing of Personal Data Amazon Web Services Europe (London) EU Select Applications
Data Processing is outside of any area considered to be adequate West 2 (including Mediacell)
by the originating jurisdiction, such location must [Additional sub-processors [To Be Completed] [To Be Completed]
be specifically identified as such. E.g. the list of to be added by Ipsos]
countries and schemes having an adequacy
decision issued by the European Commission
[Add detail of any known Sub-Processors (including other Ipsos companies) who
which can be found at:
will Process the Personal Data. Include a description of what each Sub-Processor
https://commission.europa.eu/law/law-topic/data-
will do with the data (e.g. host, provide support, etc.)]
protection/international-dimension-data-
*Any modification in the sub processor listing shall be agreed in writing between
protection/adequacy-decisions_en.
the Parties, either through an amendment to this Agreement or included in the
applicable SOW or other relevant project agreement. If only the category of sub-
For UK-US transfers, the “Data Bridge” exists for
processor is known, but the specific processor has not yet been selected, state the
relevant certified US entities. Other jurisdictions
category of sub-processor and likely location(s).
have their own adequacy decisions and/or
requirements. If no transfer will be from the United
1. Maximum Duration of Personal Data Retention and Deletion Rules
Kingdom (UK) and/or European Economic Area
(EEA) to outside of the UK and/or EEA or the
countries listed above, the following sentence shall To Be Completed
be included: “No Personal Data will be transferred
outside the area providing an adequate level of 2. Notices
protection."
If to Ipsos: If to the Client:
Data Protection Officer For Ipsos: dpo.unitedkingdom@ipsos.com Name & Position: [insert name & Name & Position: [insert name &
or when not applicable For {Client}: {name and email address} position of applicable DPO] position]
any other person acting Address: [insert address] Address: [insert address]
as single point of E-mail: [insert email address] E-mail: [insert email address]
contact on privacy or Telephone No: [insert telephone Telephone No: [insert telephone
data protection matters number] number]
(*) or * Please specify or delete as appropriate
Processors List **
Processor(s) Name Location Type of
Processing
[To Be Updated] [To Be Updated] [To Be Updated]
Rackspace UK Limited, Unit 8, Millington Road, Managed Hosting
Hyde Park Hayes, UB3 4AZ Services {and
Data Collection
Dimensions
Platform hosting
– pls delete if not
highlighted text if
not using
Dimensions}
[Add detail of any known Processors (including other Ipsos companies) who
will process the Personal Data. Include a description of what each processor
will do with the data (e.g. host, provide support, etc.)
**Any modification in the Processor listing shall be agreed in writing between
the parties, either through an Amendment to this Agreement or included in the
applicable Sales Order or other relevant project agreement. If only the category
of Processor is known, but the specific processor has not yet been selected,
state the category of Processor and likely location(s).
February 2025 8
Schedule 2 - Ipsos Technical and organisational measures • Ensure all user/system/service/administrator accounts and
passwords are never shared.
Ipsos and all sub-processors agreed with the Client and as listed in
Schedule 1 will have in place appropriate organisational and technical Physical and Environmental Security
measures to safeguard the Personal Data being processed under this Ipsos assets are protected from:
data transfer agreement. The organisational, operational and • Natural disasters,
technological processes and procedures adopted are required to comply • Theft, physical intrusion, unlawful and unauthorized physical
with the requirements of ISO/IEC 27002 (ISO/IEC 17799) as appropriate access,
to the services being provided. Ipsos will use ISO/IEC 27002 as a basis • Ventilation, Heat or Cooling problems, power failures or
for auditing compliance with the guarantees Ipsos provides in relation to outages.
this obligation.
The measures in place will include the following minimum mandatory
requirements: Operations Management
Organizational Safeguards
• Ipsos has an appointed data protection officer who has data Network Security:
protection and information security responsibilities set out as Ipsos deploys an intrusion detection system in the data centre
part of her duties and heads up a dedicated Compliance monitoring the perimeter points, additional controls include layered anti-
Department. virus approach.
• Ipsos will appoint a representative in the Union to meet EU
GDPR requirements. System Security:
• Physical access to the building is limited by various access Ipsos has processes in place to apply and manage security updates,
control mechanisms (e.g. key cards) and in most cases patches, fixes upgrades, (collectively referred to as "Patches") on all
entrances to Ipsos’ offices are staffed by Ipsos IT systems.
receptionists/security staff.
• Ipsos’ employees are instructed on data protection and Ipsos ensures that Malware, Virus, Trojan and Spyware protection
information security matters upon commencing employment programs are also deployed on IT systems.
with Ipsos and are subject to confidentiality obligations.
• Ipsos’ employees are not permitted to record Personal Data Disaster recovery
on a storage medium (e.g. disk) to enable them to re-access • Ipsos has appropriate disaster recovery measures to ensure
the information in premises that are not controlled by Ipsos. In that the Personal Data it processes can be re-instated in the
the event that Personal Data is held in hard copy format, any event of loss or destruction of that data.
employees dealing with such Personal Data operate a clear • The disaster recovery plan which will implement the disaster
desk policy, so that no Personal Data is left unattended in their recovery measures defines RTO (Recovery Time Objectives)
absence. Personal Data in hard copy form is stored securely and RPO (Recovery Point Objectives) where appropriate to
to prevent any unauthorized access. the service being provided.
• Ipsos has business continuity plans in place, which are tested • Ipsos reviews these technical safeguards periodically to
annually. ensure their continued suitability in light of the data it
processes and technological advances.
Information Security Risk Management
• Ipsos periodically assesses risk within Information
Technology specifically toward assets associated/involved in Data management
the services/products delivered. The implemented risk
management framework is in agreement with the Data Security
requirements of the ISO 27001 & ISO 27002. • Confidential information is encrypted and encryption must
meet a minimum standard of AES-256-bit encryption.
Information Security Policy • If a password/passphrase is used in the encryption of the
• Ipsos has in place an information security policy and other document, the password/passphrase for the encrypted
additional policies to ensure that controls are in place. document is communicated, either:
• Ipsos regularly review its information security policy. Face to face, or
• Ipsos follows Information Security programmes that are based By phone or SMS, or
on the following frameworks: A previously agreed password/passphrase
• ISO 27001 & ISO 27002 standards (Ipsos is certified to ISO
27001) Transferring of Data
Acceptable Methods of Data Transfer:
Asset Management • Secure File Transfer Protocol (sftp) – tcp port 22.
• Ipsos has documented and implemented rules with regards to • HTTPS – tcp port 443.
acceptable use of assets. • Suitable access controls in place
Human Resources Security Handling of Data
• Ipsos ensures that employees, contractors, and • Ipsos has in place documented information labelling and
subcontractors who access Ipsos assets are screened prior to handling procedures, that must be followed by all employees.
employment; this meets the UK HMG Baseline Personnel • Only those staff assigned to a specific project for which the
Security Standard. Screening includes Criminal, financial sample is intended may handle/ have access to the Client
(where applicable), employment background screening Personal Data.
processes, where applicable with legislation.
• Ipsos has processes in place to periodically screen personnel Storage of Data
during employment for anyone who accesses Regulated, • Client Personal Data is stored on a server that is physically
Confidential, or Personal information. secured and is only accessed by authorized staff. Ipsos stores
• Ipsos ensures that an Information Security awareness Client Personal Data on a server that is protected behind a
campaign is provided to everyone who has access to Ipsos firewall and that is properly patched with the latest OS and
assets. Security patches.
• Ipsos ensures that all user IDs, tokens or physical-access
badges are assigned to a unique Ipsos employee or Ipsos
subcontractor. Data destruction process
February 2025 9
Ipsos assures that: Access Management
• Working storage media will either be wiped, shredded, stored • Ipsos uses authentication and authorization technologies for
or degaussed; service, user and administrator level accounts.
• Non-working storage media will be stored securely and • Ipsos ensures that IT administrators are provided and using
shredded. separate and unique administrator accounts that are only
• Industry best practice standards to be used. used for administration responsibilities. Non-administrator
tasks are always performed using non-administrator user
Data Breach Procedure accounts.
• Ipsos has a password policy and other standards in place.
In the event that any Personal Data supplied to Ipsos by Client is
accidentally or unlawfully destroyed, lost, altered, or an unauthorised Vulnerability Testing
disclosure or access to Personal Data occurs, Ipsos will carry out the • Ipsos ensures that infrastructure, network and application
following incidence response as soon as they become aware: vulnerability assessments are periodically conducted and
• Ipsos shall notify the Client of the breach. follow industry acceptable vulnerability management
• Ipsos will immediately launch an investigation into the data practices
breach in line with its documented Personal Data Breach
Procedures. Information Security Incident Management
• Ipsos will co-operate with the Client in the investigation and • Ipsos ensures access and activity audit and logging
will share all relevant system logs and evidence with the procedures, including access attempts and privileged access,
Client. exist.
• The investigation will include root cause analysis and
recommendations for improving Information Security in order • Ipsos ensures that logging includes all facility, application,
to prevent future incidences; this will be included in the final server, network device and IDS/IPS logs are centrally
Personal Data Breach report. managed and maintained.
• Ipsos ensures that security incident response planning and
notification procedures exist to monitor, react, notify and
investigate any incident related to Ipsos assets.
February 2025 10
Schedule 3 - Joint Controller Allocation of Responsibilities
Responsibility for making policy Responsibility for implementing policy
and decisions and decisions
Activity
Legal basis for Processing of personal data and of
special categories of personal data (if any) (Article[s] 6, 9
and 10)
Purposes for which Personal Data may be collected
(Article 5(1)(b))
Data minimisation (Article 5(1)(c))
Data accuracy (Article 5(1)(d))
Data storage limitation (Article 5(1)(e))
Integrity and confidentiality (Article 5(1)(f))
Accountability (Article 5(2))
Information notices (Articles 13 and 14)
Data subject rights (Articles 15 to 22)
Data protection by design and default (Article 25)
Appointment of processor (Article 28)
Records of Processing activities (Article 30)
Co-operation with Supervisory Authority (Article 31)
Security of Processing (Article 32)
Notification of data breach (Articles 33 and 34)
Impact assessments (Articles 35 and 36)
February 2025 11