Snapshot 67108
Normalized text
Scripts and page chrome removed; this is what change detection compares.
(May 2022 update)
WORLDLINE RETAIL ENTERPRISE (UK) LIMITED “WORLDLINE” DATA PROCESSING CONDITIONS
1. Definitions
1.1 “Data Protection Legislation” means the Data Protection Act 2018 and the General Data Protection
Regulation (EU) 2016/679 as each is amended in accordance with the Data Protection, Privacy and
Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (as amended by SI 2020
no. 1586) and incorporated into UK law under the UK European Union (Withdrawal) Act 2018. Each
shall be referred to as the "DPA 2018" and the "UK GDPR" accordingly;
1.2 “Data Transfer Agreement” means an agreement which incorporates the “Standard Contractual
Clauses” (or any variation substitution or replacement of the Standard Contractual Clauses) being the
clauses contained in European Commission Decision 2010/87/EU of 5 February 2010 for the transfer
of personal data to third countries (or any successor or replacement safeguard under Article 46 of the
UK GDPR);
1.3 The terms "Controller", "Data Subject", “Personal Data”, "Personal Data Breach", "Processing"
and "Processor" shall have the meanings given to them in the Data Protection Legislation, and
"Process" and "Processed" shall be construed accordingly;
2. Data Processing Particulars
2.1 The Parties shall each Process the Personal Data. The Parties acknowledge that the factual
arrangement between them dictates the classification of each Party in respect of the Data Protection
Legislation. Notwithstanding the foregoing, the Parties acknowledge that the CLIENT has selected the
WORLDLINE solution as the most appropriate means to perform the Processing of Personal Data for
the purposes specified in Condition 2.3 and therefore the Parties anticipate that the CLIENT shall act
as a Controller and WORLDLINE shall act as a Processor, to the extent it is Processing the Personal
Data in relation to the provision of services under and in accordance with an Order (the “Services”).
2.2 Each Party shall in relation to the Processing of the Personal Data comply with its respective
obligations under the Data Protection Legislation.
2.3 The scope of the Processing of Personal Data to be carried out by WORLDLINE under an Order is as
follows:
2.3.1 scope, nature and purpose of processing: as required in the course of providing the Services;
2.3.2 duration: for the term of an Order; and
2.3.3 types of Personal Data and categories of data subjects: names, addresses and contact
details of the User and their personnel.
3. CLIENT Obligations
3.1 Without limitation to the generality of Condition 2.2, the CLIENT shall:
3.1.1 where required to do so under the Data Protection Legislation make notification(s) to the
relevant data protection authorities in relation to its Processing of the Personal Data;
3.1.2 ensure it is not subject to any prohibition or restriction which would prevent or restrict the
access or use of the Personal Data by WORLDLINE as required for WORLDLINE to perform
the Services;
3.1.3 ensure that all fair processing notices have been given (and/or, as applicable, consents
obtained) and are sufficient in scope to enable WORLDLINE to Process the Personal Data
Page 1 of 4
as required in connection with the provision of the Services in accordance with the Data
Protection Legislation;
3.1.4 maintain technical and organisational security measures sufficient to comply at least with
the obligations imposed on the Controller by the Data Protection Legislation;
4. WORLDLINE Obligations
4.1 To the extent that WORLDLINE is acting as a Processor for and on behalf of the CLIENT as the
Controller in relation to the Processing that it is carrying out arising out of, or in connection with, the
performance of its obligations under an Order, it shall:
4.1.1 Process the Personal Data for and on behalf of the CLIENT for the purposes of performing
its obligations under an Order, and only in accordance with the terms of an Order and any
reasonable and lawful instructions from the CLIENT. Unless prohibited by law, WORLDLINE
shall promptly notify the CLIENT if:
(a) it is required by applicable law to act other than in accordance with the instructions
of the CLIENT; and/ or
(b) it considers, in its opinion, that any of the CLIENT's instructions infringe the Data
Protection Legislation.
4.1.2 not transfer any Personal Data to a country located outside both the United Kingdom and
the European Economic Area which does not have an adequate level of protection except
in accordance with Condition 5.4;
4.1.3 take all reasonable steps to ensure the reliability of WORLDLINE personnel who have
access to the Personal Data, and ensure that any WORLDLINE personnel who have access
to the Personal Data have entered into appropriate contractually-binding confidentiality
undertakings;
4.1.4 maintain technical and organisational security measures sufficient to comply at least with
the obligations imposed on the CLIENT by the Data Protection Legislation;
4.1.5 not disclose or allow access to the Personal Data to a third party except in accordance with
Condition 5.
4.1.6 notify the CLIENT promptly (and in any event within five (5) Working Days) following its
receipt of any request relating to the Personal Data from the Data Subject, the data
protection authorities or any third party (Data Request), and shall:
(a) not disclose any Personal Data in response to any Data Request without the
CLIENT's prior written consent; and
(b) provide all reasonable co-operation and assistance required by the CLIENT in
relation to any such Data Request;
4.1.7 notify the CLIENT promptly (and in any event within seventy-two (72) hours) upon becoming
aware of any Personal Data Breach and implement any measures reasonably necessary to
restore the security of compromised Personal Data;
4.1.8 permit the CLIENT (upon giving at least six (6) weeks’ written notice to WORLDLINE) to
audit and inspect WORLDLINE’s compliance with this Condition 4 (subject to the Parties
agreeing the scope, timing, planning, reference criteria and costs in advance, and provided
that no more than one (1) audit shall be permitted per calendar year);
Page 2 of 4
4.1.9 At the choice of the CLIENT and provided retention of the Personal Data is not required by
applicable law, delete all Personal Data or return all Personal Data to the CLIENT at the end
of the Agreement or at the end of the retention period and destroy all existing copies;
4.1.10 at the CLIENT's reasonable request, use its reasonable endeavours to assist the CLIENT to
comply with obligations imposed on the CLIENT under the Data Protection Legislation,
including in relation to making notifications or responding to requests from data protection
authorities or Data Subjects, provided that WORLDLINE shall be entitled to charge
reasonable fees to the CLIENT in respect of providing any such assistance to the CLIENT.
5. Transfers
5.1 The CLIENT approves WORLDLINE using its parent company or any subsidiary of its parent company
to carry out all or any part of the Processing activities under an Order.
5.2 WORLDLINE may also appoint external subcontractors in relation to the Processing of Personal Data
under an Order, provided it notifies the CLIENT at least ninety (90) days in advance, in order to enable
the CLIENT to evaluate the appointment of a subcontractor. The Client will have a period of thirty (30)
days from the notification made by WORLDLINE to notify WORLDLINE in writing of any objections
(the "Notice of Objections"). The Parties will work together in good faith to find a mutually satisfactory
solution to the CLIENT objection, however the CLIENT acknowledges that WORLDLINE provides the
Services under an Order as part of a shared infrastructure with its other Clients. If the Parties cannot
agree on an alternative solution to such objections, the Agreement may be terminated automatically
by either Party upon providing written notice to be carried out at the latest within thirty (30) days
following the Notice of Objections being received. This termination will be effective after a period of
thirty (30) days from the date of notification of the termination of the Agreement and the CLIENT will
no longer be able to use the Services from that date. Such termination will be without any charge or
liability to either Party. In the absence of a Notice of Objections from the CLIENT within the
aforementioned thirty (30) day period, the Services will continue to be provided to the CLIENT by
WORLDLINE under the new conditions.
5.3 Notwithstanding Condition 5.2, WORLDLINE shall be entitled to appoint a new or alternative
subcontractor in relation to the Processing of Personal Data in cases of emergency, this being defined
as circumstances which make the provision of the Services in accordance with an Order excessively
onerous, from a practical or commercial perspective. In such case, WORLDLINE shall provide the
notice of this change to the CLIENT as soon as reasonably practical and the provisions of Condition
5.2 regarding Notice of Objections and the CLIENT’S right to terminate shall apply in the same way.
5.4 In the event that WORLDLINE appoints a subcontractor in accordance with this Condition 5, to the
extent that this requires the transfer of Personal Data to a country located outside both the United
Kingdom and the European Economic Area which does not have an adequate level of protection,
WORLDLINE undertakes to implement a management solution for this transfer in accordance with the
provisions of the Data Protection Legislation.
5.5 Where WORLDLINE transfers Personal Data under a Data Transfer Agreement:
5.5.1 unless the Data Transfer Agreement may be entered into by WORLDLINE as a Processor,
the CLIENT hereby provides to WORLDLINE the mandate to sign on CLIENT’s behalf and
for CLIENT’s account, the Data Transfer Agreement. The CLIENT agrees WORLDLINE
may, on CLIENT’s behalf, agree to supplement but not vary or modify the Data Transfer
Agreement;
5.5.2 WORLDLINE shall be entitled to replace the Standard Contractual Clauses in the Data
Transfer Agreement with any appropriate alternative transfer mechanism under the Data
Protection Legislation (including new Standard Contractual Clauses) at any time;
Page 3 of 4
5.5.3 in the event of a conflict between the Data Transfer Agreement and this Agreement, the
terms of the Data Transfer Agreement shall prevail only to the extent that they conflict with
this Agreement in relation to the relevant data transfers; and
5.5.4 WORLDLINE will not disclose or provide access to the Personal Data pursuant to a third
party request unless it is required to do so by law. If it receives a third party request,
WORLDLINE will:
(a) use every reasonable effort to redirect the requester to the CLIENT. WORLDLINE
may share relevant contact details of the CLIENT for this purpose;
(b) promptly notify the CLIENT unless legally prohibited from doing so and, if
prohibited from notifying the CLIENT, use all lawful efforts to obtain a waiver to
such prohibition; and
(c) use all lawful efforts, at the CLIENT's sole cost and expense, to challenge the third
party request on the basis of any legal deficiencies under the laws of the requestor
or any relevant conflicts with Data Protection Legislation. Lawful efforts do not
include actions that would result in civil or criminal breach or penalty such as
contempt of court under the laws of the relevant jurisdiction.
5.6 In any event, to the extent that WORLDLINE appoints a subcontractor to carry out processing of
Personal Data under this Condition 5 in connection with the provision of the Services to the CLIENT,
obligations no less onerous than those relating to the protection of Personal Data as are set out in the
Agreement will be imposed on that subcontractor, in particular with regard to providing sufficient
guarantees for the implementation of appropriate technical and organisational measures in a manner
that meets the requirements of the Data Protection Legislation. WORLDLINE remains fully liable to
the CLIENT for the performance of its subcontracted obligations under an Order.
Page 4 of 4