Snapshot 96717
Normalized text
Scripts and page chrome removed; this is what change detection compares.
NCC GROUP SHORT FORM TERMS AND CONDITIONS to any such Legitimate Recipients, and (ii) the Client ensures that such
FOR THE SUPPLY OF SERVICES Legitimate Recipients are subject to confidentiality obligations no less onerous
than those contained within the Contract.
1 Contract Structure and Interpretation 3.2 The parties and their Affiliates are hereby granted a non-exclusive, non-transferable
licence to use the other party’s pre-existing IPRs in the performance of the Contract.
1.1 The contract pursuant to which NCC Group will provide services is comprised of (in order
of precedence) (i) the Statement of Work (and any documents expressly referred to 4 Fees & Payment
therein as applying or otherwise scheduled, annexed or appended thereto) (ii) the
applicable Service-Specific Module(s) which can be found on the NCC Group Website,
(iii) these Short Form Terms and Conditions; and (iv) the country-specific Schedule as 4.1 Unless agreed otherwise in the Statement of Work, NCC Group shall invoice the Client
appropriate (found at the end of these terms and conditions) (each a “Country for the Services in full after (i) the proposed Statement of Work has been executed by
Schedule”) (together the “Contract”). both parties or (ii) the start date if and as otherwise stated in the Statement of Work
(whichever is the earlier).
1.2 The Statement of Work constitutes an offer by NCC Group to supply the Services to the
Client in accordance with the Contract. The Statement of Work shall be accepted by the 4.2 The Client shall pay each invoice in full and cleared funds to the bank account
Client and come into existence on the earlier of the Client’s written acceptance of the nominated in writing by NCC Group within thirty (30) days of the date of the invoice. All
Statement of Work or upon any act by the Client consistent with its acceptance of the payments due under the Contract shall be made without any deduction by way of set
Statement of Work, including issuance of a purchase order or a request to schedule off, counterclaim, discount or abatement or otherwise.
Services. 4.3 The Tax Clause shall apply.
1.3 The Contract shall constitute the entire agreement between the parties in relation to the 4.4 Withholding tax. Without limiting clause 4.3, the Client must make all payments due
Services and shall supersede any previous understanding or agreement relating to the under the Contract without withholding or deduction of, or in respect of, any Taxes,
Services. It cannot be varied except if in writing, signed by the parties’ respective except as required by Law, in which case, the Client must, when making such payment
authorised signatories. For the avoidance of doubt, no other terms and conditions to NCC Group to which the withholding or deduction relates, pay to NCC Group such
(whether verbal or included on any document issued by the Client after the Statement of additional amount as will ensure that NCC Group receives the same total amount that
Work has been issued, including any purchase order) will apply in any way. it would have received if no such withholding or deduction had been made.
1.4 The definitions contained in clause 13 apply in the Contract. 4.5 The Interest Clause shall apply.
1.5 In the Contract (except where the context otherwise requires):
5 Confidentiality & Publicity
1.5.1 any words following the terms “including”, “include”, “for example” or any
similar expression are by way of illustration and emphasis only and shall not
limit the generality or extent of any other words or expressions; 5.1 The parties shall work together to agree wording prior to making any public
announcement that the Services are being provided.
1.5.2 headings shall not affect the interpretation of the Contract;
5.2 Subject to clauses 5.3 and 5.4, neither party shall disclose (or permit its Affiliates,
1.5.3 unless the context otherwise requires, words in the singular shall include the employees, agents and sub-contractors to disclose) any Confidential Information
plural and in the plural shall include the singular; entrusted to it by the other party.
1.5.4 references to legislation (which includes statute and statutory provisions) 5.3 Clause 5.2 shall not apply to (i) information already in the receiving party’s possession,
includes any modification, extension, replacement or re-enactment of that or (ii) which comes into the public domain, other than by breach of this obligation by the
legislation and any subordinate legislation made (before or after the Contract) receiving party or its Affiliates, any Indirect Clients, employees, agents and sub-
under that legislation; and contractors, or (iii) which is disclosed to the receiving party by a third party lawfully
entitled to disclose the same, or (iv) which is developed by the other party or its Affiliates,
1.5.5 any reference to an English legal term for any action, remedy, method of employees, agents or sub-contractors independently of the Confidential Information or
judicial proceeding, legal document, legal status, court, official or any legal (v) which is required to be disclosed by a court of competent jurisdiction, pursuant to any
concept or thing shall, in respect of any jurisdiction other than England, be law or regulation or by the rules of any stock exchange or (vi) disclosure in the national
deemed to include a reference to that which most nearly approximates to the or public interest.
English legal term in that jurisdiction.
5.4 Each party will, where necessary, be entitled to disclose Confidential Information and
2 Parties’ Duties Personal Data to (i) its Affiliates and its and their employees, agents, sub-contractors,
professional advisors, auditors or insurers, (ii) Indirect Clients, (iii) any third party which
2.1 NCC Group shall: is to support the delivery of Services or NCC Group’s operations, and (iv) regulators,
governmental bodies and certifying bodies, provided that each such party will use all
2.1.1 perform the Services using reasonable skill and care and in accordance with reasonable endeavours to ensure that such a recipient of Confidential Information is
Good Industry Practice; under a duty of confidentiality no less onerous than as set out in the Contract.
2.1.2 use reasonable endeavours to meet any timescales and/or completion dates
as set out in the relevant Statement of Work for provision or completion of the 6 Data Protection
Services or any part of them, however, time shall not be of the essence, and
2.1.3 undertake background screening checks in accordance with any applicable 6.1 Compliance. Each Party must (and must ensure that its personnel):
standards and Good Industry Practice in respect of Consultants as they join 6.1.1 comply with all Privacy Laws;
NCC Group if they will be involved in the delivery of the Services.
6.1.2 without limiting the generality of paragraph 6.1.1 above, and to the extent
2.2 The Client shall: reasonably requested by the other Party, assist the other Party in
2.2.1 comply with its duties and responsibilities contained in the Contract; and complying with the applicable requirements of the Privacy Laws, in
particular, by (without limitation) taking into account the state of the art and
2.2.2 ensure that, where applicable or required, it has the consent of any relevant the nature, scope, context and purposes of processing as well as the risk
third parties to enable the Services to be performed, which may include its of varying likelihood and severity for the rights and freedoms of natural
internet service provider(s), any third-party suppliers of the System and any of persons, ensure that it has in place appropriate technical and
the Client’s personnel who may be monitored, and, where required by the organisational measures (including relevant policies) to protect against
Supplier, complete a technical consent, either in the Statement of Work or via unauthorised or unlawful processing of Personal Data and against
an Authorisation Form, giving its consent to some or all of the Services accidental loss or destruction of, or damage to, Personal Data.
including testing targets, dates and times. Notwithstanding the above, the
Client hereby confirms that it authorises NCC Group to access programs and 6.2 Role of NCC Group. NCC Group can deliver the Services as a ‘processor and/or
data held on the System. controller’, as defined in the Privacy Laws.
2.3 Other than in respect of an Affiliate, or where it has NCC Group’s prior written consent, 6.3 Personal Data Breach Notifications. If and insofar NCC Group acts in the role of
the Client represents and guarantees that it is not procuring, and will not procure, the “controller” as defined in the Privacy Laws, the Client:
Services for a third party. In the event that the Client is procuring the Services on behalf 6.3.1 acknowledges and agrees that NCC Group will be solely responsible for:
of an Affiliate or third party (‘Indirect Client’), the Client is responsible for: (i) ensuring
the compliance of such party with any applicable term of this Contract; and (ii) any (a) determining whether a Personal Data Breach is likely to result in a
breaches of the Contract by Indirect Clients as if they were its own. The Client will bring high risk to the rights and freedoms of natural persons as prescribed
any legal claim or proceeding which an Indirect Client would otherwise have if it were a by the relevant Privacy Law; and
party to the Contract directly against NCC Group on behalf of such Indirect Client.
(b) notifying any relevant Authority and affected individuals regarding the
2.4 Neither party shall, during the Term and for a period of six (6) months thereafter, solicit Personal Data Breach, based on NCC Group’s assessment made
or offer any inducement to work to any employee the other party, or the other party’s pursuant to clause 6.3.1(a) above;
Affiliates, with whom they have had contact with in relation to the Contract or delivery 6.3.2 if required, must co-operate with NCC Group to assist it in making the
of the Services. determination referred to in paragraph 6.3.1 above; and
3 Intellectual Property Rights 6.3.3 must not disclose to any third party (including any Authority) the existence
or circumstances surrounding any Personal Data Breach without the prior
3.1 The parties agree that: written approval of NCC Group, except as otherwise required by Law.
3.1.1 the ownership of IPRs which were in existence before the Start Date or which 6.4 Data Processing Agreement. If and insofar as NCC Group acts in the role of
do not solely relate to the Client shall not transfer by virtue of the Contract save “processor” as defined in the Privacy Laws, the Data Processing Agreement will apply
that those IPRs may be licensed in accordance with clause 3.1.23.1.2 to the and forms part of the Contract.
extent incorporated into a Deliverable;
3.1.2 The Parties acknowledge and agree that all IPRs in and to any Deliverables 7 Liability
provided to the Client in connection with a Statement of Work will be owned
by NCC Group. Subject to payment of the Fees, NCC Group grants to the 7.1 Neither party excludes nor limits any liability for (i) death or personal injury to the extent
Client a non-exclusive, limited, non-transferable licence (without the right to that it results from negligence; (ii) any fraud or fraudulent misrepresentation; or (iii) any
sublicence, except to a Legitimate Recipient as set out below) to copy and other liability that cannot be excluded by law.
use the Deliverables: (i) for its internal purposes; (ii) to the extent required to
receive the benefit of the NCC Group Services for the purpose for which they 7.2 Except as provided for in clause 7.1, and subject to clause 7.3 and any exclusions
are supplied; and (iii) otherwise, in accordance with NCC Group’s prior written contained in the Statement of Work, each party’s total liability shall not exceed the greater
consent from time to time (such consent not to be unreasonably withheld or of: (i) 150% of the Fees or (ii) the Liability Sum.
delayed); 7.3 Except as provided in clause 7.1 above, neither party shall be liable for loss of actual or
3.1.3 A Legitimate Recipient is: the Client’s regulator, insurers, any Indirect Client(s) anticipated profits or revenue; loss of goodwill or damage to reputation; loss of business
and other professional advisors provided that: (i) NCC Group shall not be liable or contracts; loss of anticipated savings; loss, deletion or corruption of any data and/or
All Rights Reserved. © NCC Group 2024 Effective: 02 December 2024
1
undertaking the restoration and/or recovery of data or software restoration; wasted extent as if those obligations, services, functions, acts or omissions were
expenditure or any special, indirect or consequential loss. Each such liability is excluded performed (or not performed) by NCC Group.
whether it is foreseeable, known, foreseen or otherwise.
7.4 Except as provided in clause 7.1 above, NCC Group shall not be liable for any loss, claims, 12 General
demands, actions, costs, expenses or liabilities arising from or in connection with any
materials and/or instructions supplied by the Client, or any third party acting on behalf of 12.1 Both parties will comply with all applicable Anti-Bribery Laws and any applicable anti-
the Client, which are incomplete, incorrect, inaccurate, illegible or defective in any other slavery legislation.
way.
12.2 All other terms and conditions express or implied by statute or otherwise, are excluded
to the fullest extent permitted by law. Subject to clause 7.1, neither party has entered
8 Termination into the Contract in reliance upon, and it will have no remedy in respect of, any
misrepresentation, representation or statement (whether made by the other party or any
8.1 The Client acknowledges and agrees that: other person) which is not expressly set out in the Contract and the only remedies
available for any misrepresentation or breach of any representation or statement which
8.1.1 NCC Group may, with as much prior notice to the Client as is reasonably was made prior to entry into the Contract and which is expressly set out in the Contract
practicable in the circumstances, suspend, delay or withdraw the provision of will be for breach of contract.
the Services to the Client and any Indirect Client, if:
12.3 A delay in exercising, or failure to exercise, a right or remedy under or in connection with
(i) NCC Group requires, with Notice to the Client, information, direction, the Contract will not constitute a waiver of, or prevent or restrict future exercise of, that
approval, consent and guidance that NCC Group reasonably considers or any other right or remedy, nor will the single or partial exercise of a right or remedy
is required for the proper performance of the Services (‘Client Input’); prevent or restrict the further exercise of that or any other right or remedy. A waiver of
and any right, remedy, breach or default will only be valid if it is in writing and signed by the
(ii) the Client fails to provide NCC Group with that Client Input in the time party giving it and only in the circumstances and for the purpose for which it was given
requested, or the Client Input is materially incomplete or inaccurate; and will not constitute a waiver of any other right, remedy, breach or default.
and 12.4 If any term of the Contract is found by any court or body or authority of competent
8.1.2 NCC Group will not be liable to the Client for any losses suffered or incurred by jurisdiction to be illegal, unlawful, void or unenforceable, such term will be deemed to be
the Client or any Indirect Client as a result of any suspension or withdrawal of, severed from the Contract and this will not affect the remainder of the Contract which will
or delay in providing, the Services affected pursuant to this clause 8.1. continue in full force and effect.
8.2 NCC Group may terminate the Contract (and any licence granted under clause 3.1.2) 12.5 The Governing Law and Jurisdiction Clause shall apply.
immediately by giving notice to the Client if (i) the Client fails to pay any amount due
under the Contract by the due date for payment, and (ii) it remains in default five (5) or 13 Definitions
more Business Days after the Client has been notified that the payment is overdue.
8.3 Either party may at any time terminate the Contract by giving written notice to the other “Affiliate” means, in respect of a party, any entity that directly or indirectly Controls or
if: is Controlled by, or is under common Control with, another entity;
8.3.1 the other breaches any condition; or “Anti-Bribery Laws” means any and all statutes, statutory instruments, by-laws,
orders, directives, treaties, decrees and laws (including any common law, judgment,
8.3.2 subject to clause 8.3.1 above, the other commits any material breach of the demand, order or decision of any court, regulator or tribunal) the aim of which is to
Contract and (if capable of remedy) fails to remedy the breach within thirty prevent bribery and/or corruption in any jurisdiction;
(30) days after being required by written notice from the other party to do so;
or “Approved Delivery Location” includes Australia, Canada, the European Economic
Area (EEA), Singapore, Philippines, the United Kingdom, the United States of America;
8.3.3 the other party stops trading, is unable to pay its debts and/or an Insolvency
Situation arises. “Authorisation Form” found at https://www.nccgroup.com/au/terms-and-conditions/
and provided to the Client by NCC Group, that authorises NCC Group to, in the course
8.4 Without prejudice to the Statement of Work, the Client shall be liable for any Fees and of providing the Services, do any thing or omit to do any thing that may otherwise breach
cancellation fees, where applicable, up to and including the date of any suspension, Computer Misuse Act 1990 (UK), Part 10.7 of the Criminal Code Act 1995 (Cth)
delay, withdrawal or termination and these may be invoiced immediately despite any (Australia), Computer Misuse Act 1993 (Singapore), Computer Fraud and Abuse Act
other provision in the Contract. 1986 (US), Article 138ab of the Dutch Penal Code (Netherlands) or any other similar or
analogous legislation in any relevant jurisdiction;
9 Third Party Rights “Authority” means any Commonwealth, State, regional or local government
department, body or instrumentality or any other public authority, statutory body or
9.1 The parties do not intend that any term of the Contract will be enforceable by any person certifying body which has relevant jurisdiction, and includes any Regulator (where
who is not a party to the Contract under the Contracts (Rights of Third Parties) Act 1999 “Regulator” means any entity or body having regulatory or supervisory authority over
other than NCC Group’s Affiliates. any part of the business or affairs of the Client and/or the Client’s Affiliates or NCC
Group and/or NCC Group’s Affiliates (as the case may be), including, but not limited to,
10 Force Majeure the Office of the Australian Information Commissioner, the Ministry of Communications
and Information, the UK Information Commissioner, and the Central Intelligence
Agency);
10.1 Neither party shall be in breach of this agreement or otherwise liable for any failure or
delay in the performance of its obligations if such delay or failure results from events, “Business Day” means a day other than a Saturday, Sunday or public holiday in
circumstances or causes beyond its reasonable control. The time for performance of England;
such obligations shall be extended accordingly. If the period of delay or non-performance
continues for fifteen (15) days, the party not affected may terminate this agreement “Client” means the individual(s) and/or organisation(s) detailed as such in the
immediately by giving written notice to the affected party. Statement of Work;
“Client Data” means any data, information and other materials provided to NCC Group
11 Global Delivery relating to the Client or any of its operations, administration, facilities, suppliers,
customers, personnel, strategic or marketing plans, assets and programs, and includes
11.1 Global delivery. Without limiting clause 11.1.2 below: administrative data, Services data and Personal Data;
11.1.1 the Customer acknowledges that NCC Group is part of a global organisation “Confidential Information” means Information that relates (in whole or in part) to a
that may deliver the Services to Clients from an Approved Delivery Location party, its business, its Affiliates or their respective businesses in connection with the
and agrees that NCC Group may provide all or part of the Services: Contract and/or the provision of the Services, however disclosed;
(i) using one or more members of the NCC Group (each being an “NCC “Consultant” means the identified individual(s) provided by NCC Group for the
Group Member”); and/or performance of the Services;
(ii) Client Data may be accessed through different NCC Group Members and “Control” means the ability to direct the affairs of an entity, whether by virtue of the
from the Approved Delivery Locations. ownership of the majority of shares in that entity or the legal power to direct or cause
the direction of the general management of that entity and “Controls” and “Controlled”
11.1.2 if an NCC Group Member is delivering any part of the Services from an shall be construed accordingly;
Approved Delivery Location, and as a result, any Client Data is processed,
including but not limited to disclosed or transferred to, stored in or handled or “Data Processing Agreement” means NCC Group’s data processing agreement
accessed from that NCC Group Delivery Location (“Transfer”), then the Client which can be found at https://www.nccgroup.com/media/pginoqx1/ncc-group-global-
consents to any included Personal Data forming part of the relevant Transfer; data-processing-agreement-client-11.pdf;
and “Deliverables” means all reports, documents, papers, designs, software, and all other
11.1.3 if NCC Group is delivering the Services via an NCC Group Member, then the materials in whatever form, including hard copy and electronic form, agreed to be
Client acknowledges that: prepared by NCC Group as part of the Services;
(i) NCC Group will not be relieved from any liability under the Contract due “Fees” means (i) NCC Group’s fees for the Services as detailed in the Statement of and
to any such arrangement; all reasonable expenses incurred in relation to the Services;
(ii) NCC Group remains responsible and liable for all obligations, services “Good Industry Practice” means the exercise of that degree of skill, diligence,
and functions performed by, and acts and omissions of, the relevant prudence and foresight which would reasonably and ordinarily be expected from a
NCC Group Member, to the same extent as if those obligations, skilled and experienced operator engaged in providing services of the same kind as the
services, functions, acts or omissions were performed (or not Services;
performed) by NCC Group; and “Governing Law and Jurisdiction Clause” means the governing law and jurisdiction
(iii) it must not make any claim for Losses against the relevant NCC Group to be inserted into the Contract via the relevant Country Schedule;
Member and agrees that any claim by the Client in relation to an NCC “Information” means confidential or proprietary information (whether written, oral, in
Group member must be brought directly against NCC Group. electronic form or in any other media), including all tangible and intangible information
11.2 Third Party Subcontracting. The Client acknowledges and agrees that NCC Group may, designated as confidential by the discloser in writing and all other information which
with notice to the Client, subcontract any of its obligations under the Contract to any other may, by its nature, be reasonably regarded as confidential but excluding personal data;
person, provided that NCC Group: “Insolvency Situation” means a party:
11.2.1 will not be relieved from any liability under the Contract due to any
(a) enters liquidation;
subcontracting arrangement entered into pursuant to this clause; and
(b) has a receiver, liquidator, administrator, trustee or an individual with a similar role
11.2.2 remains responsible and liable for all obligations, services and functions
appointed over any of its assets;
performed by, and acts and omissions of, any subcontractor, to the same
All Rights Reserved. © NCC Group 2024 Effective: 02 December 2024
2
(c) proposes to make arrangements with its creditors or goes into liquidation; or Schedule 1: The United Kingdom
(d) suffers an event which is equivalent to any of the acts or events specified above in
any jurisdiction; In respect of where the Services are supplied by NCC Group Security Services Limited, the
following additional terms and conditions apply:
“Intellectual Property Rights” (or “IPRs”) means patents, rights to inventions,
copyright and related rights, moral rights, trade marks, business names and domain 1. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13,
names, rights in get-up and trade dress, goodwill and the right to sue for passing off or is as follows:
unfair competition, rights in designs, rights in computer software, database rights, rights 4.3 All prices quoted exclude VAT (or any other applicable sales tax) unless
to use, and protect the confidentiality of, confidential information (including know-how otherwise stated and VAT (or any other applicable sales tax) shall, where
and trade secrets) and all other intellectual property rights, in each case whether applicable, be payable on all Fees and, where applicable, cancellation fees.
registered or unregistered and including all applications and rights to apply for and be
granted, renewals or extensions of, and rights to claim priority from, such rights and all 2. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
similar or equivalent rights or forms of protection which subsist or will subsist now or in clause 13, is as follows:
the future in any part of the world;
4.5 If any sum payable under the Contract is not paid on or before the due date
“Interest Clause” means the interest clause to be inserted into the Contract via the for payment the non-defaulting party will be entitled to charge the defaulting
relevant Country Schedule; party interest on that sum at 3% per annum above the Bank of England
Bank Rate from time-to-time, from the due date until either (i) the date of
“Law” means any statute, regulation, rule, by-law, ordinance or subordinate legislation payment, if prior to a relevant judgment or (ii) the date of a relevant
in force from time to time in the relevant jurisdiction and includes any regulatory regime judgment (whichever is earlier), such interest to accrue on a daily basis.
or industry code of conduct;
3. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
“Liability Sum” means the figure to be inserted into the Contract via the relevant 13, is £1,000,000 (one million pounds).
Country Schedule;
“NCC Group” means one of the following NCC Group entities which is providing the 4. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the
Services as set out in the relevant Statement of Work: definition of Governing Law and Jurisdiction Clause in clause 13, is as follows:
The United Kingdom: NCC Group Security Services Limited 12.5 The Contract shall be governed by the laws of England and the parties
hereby submit to the exclusive jurisdiction of the English courts, except for
The Netherlands: Fox-IT B.V. enforcement proceedings where the English courts shall have non-exclusive
jurisdiction.
The United States: NCC Group Security Services, Inc.
Australia: NCC Group Pty Limited Schedule 2: The Netherlands
Singapore: NCCGroup Private Limited
In respect of where the Services are supplied by Fox-IT B.V, the following additional terms and
The Philippines: NCC Group Asia Inc conditions apply:
“NCC Group Website” includes: The United Kingdom: 1. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13,
https://www.nccgroup.com/uk/terms-and-conditions/; The Netherlands: is as follows:
https://www.fox-it.com/nl/algemene-voorwaarden/; The United States:
https://www.nccgroup.com/us/terms-and-conditions/; Australia: 4.3.1 In this clause 4.3, a word or expression defined in the Dutch Turnover Tax Act
https://www.nccgroup.com/au/terms-and-conditions/; Singapore: 1968 (Wet op de Omzetbelasting 1968, hereinafter: “Act”) has the meaning
https://www.nccgroup.com/sg/terms-and-conditions/; given to that word or expression in the Act.
“Personal Data” is as defined in the Data Processing Agreement; 4.3.2 The Parties acknowledge and agree that all consideration provided by the
Client to NCC Group under the Contract is exclusive of TTA (where TTA
“Personal Data Breach” has the meaning given to that term in the Privacy Laws; means any goods and services tax imposed by the Dutch Turnover Tax Act
1968 (Wet op de omzetbelasting 1968), unless such consideration is
“Privacy Law” or “Privacy Laws” means any Law (to the extent that either Party is specifically expressed to be GST inclusive.
subject to it), which affects privacy or any Personal Data (including the collection,
storage, use or processing of that Personal Data) including: 4.3.3 If NCC Group makes a taxable supply to the Client under or in connection with
the Contract, then the Client will pay NCC Group an additional amount equal
a. United Kingdom: EU General Data Protection Regulation 2016/679 of the to the TTA payable on that supply (unless the consideration for the taxable
European Parliament and of the Council as transposed into United Kingdom supply was specified to include GST), by the later of:
national law and other data protection or privacy legislation in force from time to
time in the United Kingdom; (a) the date when any consideration for the taxable supply is first paid or
provided; and
b. European Union: EU General Data Protection Regulation 2016/679 of the
European Parliament and of the Council; (b) the date when NCC Group issues a tax invoice to the Client.
c. United States: U.S. federal, state and local privacy laws, rules and regulations; 4.3.4 If an adjustment event varies the amount of TTA payable by NCC Group under
the Contract, then:
c. Australia: the Privacy Act 1988 (Cth), the Australian Privacy Principles made
under that Act and any ancillary legislation codes of conduct recommendations (a) NCC Group must adjust the amount payable by the Client to take
or directives made pursuant to that Act; account of that adjustment event and any resulting payment must be
paid by NCC Group to the Client, or the Client to NCC Group (as the
d. Singapore: the Personal Data Protection Act 2012 and any ancillary legislation, case may be) within 10 Business Days of NCC Group becoming
codes of conduct, recommendations or directives made pursuant to that Act; aware of the adjustment event; and
f. the Privacy Laws, as that term is defined in the Data Processing Agreement; and (b) any payment under this clause is to be treated as an increase or
g. any other Law giving right to an actionable right of privacy; decrease of the additional amount payable under clause 4.3.2 above.
“Services” means the services to be performed by NCC Group in accordance with the 4.3.5 Subject to an express provision in the Contract to the contrary, any payment,
Contract; reimbursement or indemnity required to be made to a Party (Payee) under the
Contract, which is calculated by reference to an amount paid or payable by the
“Statement of Work” NCC Group’s proposal for the Services (excluding any summary Payee to a third party (Outgoing) will be calculated by reference to that
or overview sections), as may be later defined in more detail in a separate document Outgoing, inclusive of TTA, less the amount of any input tax credit which the
entitled ‘Statement of Work’ or any similar document(s) that sets out the Services and Payee (or the representative member of a TTA group of which the Payee is a
the Fees; member) is entitled to claim on that Outgoing.
“System” means the systems and networks which are relevant to the Services, together 4.3.6 If part of a supply is a separate supply under the Act, then that part is a
with any software, systems, networks, premises, equipment, data structures, protocols, separate supply for the purposes of this clause 4.3.
computers, hardware and firmware linked to the same and data passing across or
contained in any of the foregoing; 2. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
clause 13, is as follows:
“Taxes” means all duties, taxes, imposts, deductions, charges and withholdings
imposed with respect to any transaction contemplated under the Agreement, including: 4.5 If any sum payable under the Contract is not paid on or before the due date
for payment the non-defaulting party may charge the defaulting party interest
(i) value added, goods and services, sales, use, service, consumption or business on the overdue amount, at a rate equal to the Dutch statutory commercial
taxes; interest rate from the date that the relevant amount becomes payable, until
such amount has been paid in full.
(ii) excise, customs duties and other like taxes, fees or surcharges (including regulatory
fees and surcharges); and 3. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
13, is €1,000,000 (one million euros).
(iii) any interest, penalties, charges, fees or other amounts payable on or in relation to
the taxes referred to in paragraphs (i) and (ii) above; 4. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the definition
“Tax Clause” means the tax clause to be inserted into the Contract via the relevant of Governing Law and Jurisdiction Clause in clause 13, is as follows:
Country Schedule. 12.5 The Contract is governed by the Law of the Netherlands and each Party
irrevocably and unconditionally submits to the exclusive jurisdiction of the
courts of The Hague, the Netherlands and the courts having appeal from
them.
Schedule 3: The United States
In respect of where the Services are supplied by NCC Group Security Services, Inc, the
following additional terms and conditions apply:
1. Clause 2.2.3 is added:
2.2.3 Export Controls.
(a) The Client warrants and represents that neither the Client’s provision of any
software, technology, technical data, or material to NCC Group during the
course of the NCC Group Services, nor NCC Group’s performance of the NCC
Group Services, will breach, or cause NCC Group to breach, any applicable
All Rights Reserved. © NCC Group 2024 Effective: 02 December 2024
3
import, re-import, export or re-export controls, laws or regulations of the United (a) the date when any consideration for the taxable supply is first paid or
States, including export controls on “deemed exports” (collectively, Trade provided; and
Control Laws).
(b) the date when NCC Group issues a tax invoice to the Client.
(b) Unless the Statement of Work expressly provides otherwise and the proper
export license or authorisation has been obtained, the Client shall not provide, 4.3.4 If an adjustment event varies the amount of GST payable by NCC Group under
cause to provide, or otherwise allow the provision of any software, technology, the Contract, then:
technical data, or material to NCC Group which would necessarily require an (a) NCC Group must adjust the amount payable by the Client to take
export license or authorization to NCC Group or any individual officer, agent, account of that adjustment event and any resulting payment must be
sub-contractor or employee of NCC Group. paid by NCC Group to the Client, or the Client to NCC Group (as the
(c) If the Client intends to or will provide NCC Group software, technology, case may be) within 10 Business Days of NCC Group becoming
technical data or material subject to Trade Control Laws (including items aware of the adjustment event; and
subject to the U.S. Export Administration Regulations), the Client must (b) any payment under this clause is to be treated as an increase or
promptly and prior to providing any such software, technology, technical data decrease of the additional amount payable under clause 4.3.2 above.
or material subject, provide the applicable export control classifications to NCC
Group. NCC Group will have no obligation to undertake any actions in relation 4.3.5 Subject to an express provision in the Contract to the contrary, any payment,
to any software, technology, technical data or material if to do so would put it reimbursement or indemnity required to be made to a Party (Payee) under the
in breach (or potential breach) of Trade Control Laws. The Client assumes the Contract, which is calculated by reference to an amount paid or payable by the
responsibility to obtain any necessary export license or other authorisation Payee to a third party (Outgoing) will be calculated by reference to that
under Trade Control Laws, and releases NCC Group from any contractual Outgoing, inclusive of GST, less the amount of any input tax credit which the
responsibility to do so. Payee (or the representative member of a GST group of which the Payee is a
member) is entitled to claim on that Outgoing.
(d) The Client shall indemnify and hold harmless NCC Group and its officers,
agents, sub-contractors and employees from and against any and all liability, 4.3.6 If part of a supply is a separate supply under the GST Law, then that part is a
loss, damages, costs, legal costs (including reasonable attorney’s fees), separate supply for the purposes of this clause 4.3.
professional and other expenses, and any other liabilities of whatever nature,
awarded against or agreed to be paid or otherwise suffered, incurred or 2. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
sustained by NCC Group, whether direct, indirect or consequential arising out clause 13, is as follows:
of the Client’s breach of this clause 2.2.3. 4.5 If any sum payable under the Contract is not paid on or before the due date
2. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13, for payment the non-defaulting party may charge the defaulting party interest
is as follows: on the overdue amount, at a rate equal to the Reserve Bank of Australia's cash
rate target from time to time, plus 3% (compounding daily), from the date that
4.3.1 As used herein, Taxes has the meaning given to it in clause 13. the relevant amount becomes payable, until such amount has been paid in full.
4.3.2 The Parties acknowledge and agree that all consideration provided by the 3. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
Client to NCC Group under the Contract is exclusive of Taxes, unless such 13, is A$2,000,000 (two million Australian dollars).
consideration is specifically expressed to be inclusive of Taxes.
4. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the definition
4.3.3 If NCC Group makes a taxable supply to the Client under or in connection with of Governing Law and Jurisdiction Clause in clause 13, is as follows:
the Contract, then the Client will pay NCC Group an additional amount equal
to the Taxes payable on that supply (unless the consideration for the taxable 12.5 The Contract is governed by the Law of New South Wales, Australia and each
supply was specified to include Taxes), by the later of: Party irrevocably and unconditionally submits to the exclusive jurisdiction of
the courts of New South Wales and the courts having appeal from them.
(a) the date when any consideration for the taxable supply is first paid or
provided; and
Schedule 5: Singapore
(b) the date when NCC Group issues a tax invoice to the Client.
4.3.4 If an adjustment event varies the amount of Taxes payable by NCC Group In respect of where the Services are supplied by NCCGroup Private Limited, the following
under the Contract, then: additional terms and conditions apply:
(a) NCC Group must adjust the amount payable by the Client to take 1. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13,
account of that adjustment event and any resulting payment must be is as follows:
paid by NCC Group to the Client, or the Client to NCC Group (as the 4.3.1 In this clause 4.3, a word or expression defined in the Goods and Services Tax
case may be) within 10 Business Days of NCC Group becoming Act 1993 has the meaning given to that word or expression in the relevant Act.
aware of the adjustment event; and
4.3.2 The Parties acknowledge and agree that all consideration provided by the
(b) any payment under this clause is to be treated as an increase or Client to NCC Group under the Contract is exclusive of GST (where GST
decrease of the additional amount payable under clause 4.3.2 above. means any goods and services tax imposed by legislation under the Goods
4.3.5 Subject to an express provision in the Contract to the contrary, any payment, and Services Tax Act 1993), unless such consideration is specifically
reimbursement or indemnity required to be made to a Party (Payee) under the expressed to be GST inclusive.
Contract, which is calculated by reference to an amount paid or payable by the 4.3.3 If NCC Group makes a taxable supply to the Client under or in connection with
Payee to a third party (Outgoing) will be calculated by reference to that the Contract, then the Client will pay NCC Group an additional amount equal
Outgoing, inclusive of Taxes, less the amount of any input Tax credit which to the GST payable on that supply (unless the consideration for the taxable
the Payee (or the representative member of a Taxes group of which the Payee supply was specified to include GST), by the later of:
is a member) is entitled to claim on that Outgoing.
(a) the date when any consideration for the taxable supply is first paid or
4.3.6 If part of a supply is a separate supply under Tax Law, then that part is a provided; and
separate supply for the purposes of this clause 4.3.
(b) the date when NCC Group issues a tax invoice to the Client.
3. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
clause 13, is as follows: 4.3.4 If an adjustment event varies the amount of GST payable by NCC Group under
the Contract, then:
4.5 If any sum payable under the Contract is not paid on or before the due date
for payment the non-defaulting party may charge the defaulting party interest (a) NCC Group must adjust the amount payable by the Client to take
on the overdue amount, at a rate equal to (i) 1.5% per month or (ii) the account of that adjustment event and any resulting payment must be
maximum rate permitted by law, whichever is lower, from the date that the paid by NCC Group to the Client, or the Client to NCC Group (as the
relevant amount becomes payable, until such amount has been paid in full. case may be) within 10 Business Days of NCC Group becoming
aware of the adjustment event; and
4. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
13, is $1,000,000 (one million US dollars). (b) any payment under this clause is to be treated as an increase or
decrease of the additional amount payable under clause 4.3.2 above.
5. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the definition
of Governing Law and Jurisdiction Clause in clause 13, is as follows: 4.3.5 Subject to an express provision in the Contract to the contrary, any payment,
reimbursement or indemnity required to be made to a Party (Payee) under the
Contract, which is calculated by reference to an amount paid or payable by the
12.5 The Contract is governed by the Law of the State of New York and each Party Payee to a third party (Outgoing) will be calculated by reference to that
irrevocably and unconditionally submits to the exclusive jurisdiction of the Outgoing, inclusive of GST, less the amount of any input tax credit which the
courts of the State of New York and the courts having appeal from them. Payee (or the representative member of a GST group of which the Payee is a
member) is entitled to claim on that Outgoing.
Schedule 4: Australia 4.3.6 If part of a supply is a separate supply under the GST Law, then that part is a
separate supply for the purposes of this clause 4.3.
In respect of where the Services are supplied by NCC Group Pty Limited, the following
additional terms and conditions apply: 2. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
clause 13, is as follows:
1. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13,
is as follows: 4.5 If any sum payable under the Contract is not paid on or before the due date
for payment the non-defaulting party may charge the defaulting party interest
4.3.1 In this clause 4.3, a word or expression defined in the A New Tax System on the overdue amount, at a rate equal to the Singapore Overnight Rate
(Goods and Services Tax) Act 1999 (Cth) has the meaning given to that word Average from time to time, plus 3% (compounding daily), from the date that
or expression in that Act. the relevant amount becomes payable, until such amount has been paid in full.
4.3.2 The Parties acknowledge and agree that all consideration provided by the 3. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
Client to NCC Group under the Contract is exclusive of GST (where GST 13 is SGD$2,000,000 (two million Singapore dollars).
means any goods and services tax imposed by legislation enacted by the
Commonwealth of Australia including a tax imposed by the A New Tax System 4. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the definition
(Goods and Services Tax) Act 1999 (Cth) and the related imposition Acts of of Governing Law and Jurisdiction Clause in clause 13, is as follows:
the Commonwealth), unless such consideration is specifically expressed to be
GST inclusive. 12.5 (a) The Contract, any noncontractual obligation arising out of or in connection
with it, and any Dispute arising out of or in connection with it, shall be
4.3.3 If NCC Group makes a taxable supply to the Client under or in connection with governed by, and construed in accordance with the Law of Singapore.
the Contract, then the Client will pay NCC Group an additional amount equal
to the GST payable on that supply (unless the consideration for the taxable
supply was specified to include GST), by the later of:
All Rights Reserved. © NCC Group 2024 Effective: 02 December 2024
4
(b) Nothing in the Contract will prevent a Party from seeking (including 4.3 All prices quoted exclude VAT (or any other applicable sales tax and
obtaining or implementing) interlocutory or other interim relief, including in the withholding tax) unless otherwise stated and VAT (or any other applicable
courts of any other appropriate jurisdiction. sales tax) shall, where applicable, be payable on all Fees and, where
applicable, cancellation fees.
(c) Subject to clause 12.5(b), any Disputes arising out of or in connection with
the Contract, including any question regarding its existence, validity or 5. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
termination, shall be referred to and finally resolved by arbitration clause 13, is as follows:
administered by the Singapore International Arbitration Centre (SIAC) under
the Arbitration Rules of the SIAC (Rules) for the time being in force, which 4.5 If any sum payable under the Contract is not paid on or before the due date
Rules are deemed to be incorporated by reference in this clause. for payment the non-defaulting party may charge the defaulting party interest
on the overdue amount, at a rate equal to the European Central Bank Rate
(d) The seat of arbitration shall be Singapore. The number of arbitrators shall from time to time (as defined within Article 7.2 of Spanish Law 3/2004), plus
be three. Each Party shall nominate one arbitrator and the third arbitrator shall 8% per annum, from the date that the relevant amount becomes payable,
be nominated by mutual agreement of the Parties. If a Party fails to nominate until such amount has been paid in full.
an arbitrator or the Parties fail to nominate the third arbitrator within 14 days
of receipt of a request to appoint, or such period as otherwise agreed by the 6. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
Parties or set by the Registrar of the Court of Arbitration of SIAC, the 13, is €1,000,000 (one million euros).
President of the Court of Arbitration of SIAC shall appoint the arbitrator on
their behalf. The language to be used in the arbitral proceedings shall be 7. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the definition
English. This arbitration agreement shall be governed by the Law of of Governing Law and Jurisdiction Clause in clause 13, is as follows:
Singapore. 12.5 The Contract is governed by the laws of Spain, as applied in the city of Madrid
(Spain) and each Party irrevocably and unconditionally submits to the
Schedule 6: The Philippines exclusive jurisdiction of the Spanish courts of the city of Madrid (Spain).
In respect of where the Services are supplied by NCC Group Asia Inc, the following additional
terms and conditions apply:
1. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13,
is as follows:
4.3 All prices quoted exclude VAT (or any other applicable sales tax) unless
otherwise stated and VAT (or any other applicable sales tax) shall, where
applicable, be payable on all Fees and, where applicable, cancellation fees.
2. The Interest Clause, pursuant to clause 4.5 and the definition of Interest Clause in
clause 13, is as follows:
4.5 If any sum payable under the Contract is not paid on or before the due date
for payment the non-defaulting party will be entitled to charge the defaulting
party interest on that sum at 12% per annum, from the due date until either
(i) the date of payment, if prior to a relevant judgment or (ii) the date of a
relevant judgment (whichever is earlier), such interest to accrue on a daily
basis.
3. The Liability Sum, pursuant to clause 7.2 and the definition of Liability Sum in clause
13, is PHP75,000,000 (seventy five million Philippine Pesos).
4. The Governing Law and Jurisdiction Clause, pursuant to clause 12.5 and the definition
of Governing Law and Jurisdiction Clause in clause 13, is as follows:
12.5 (a) The Contract, any noncontractual obligation arising out of or in connection
with it, and any Dispute arising out of or in connection with it, shall be
governed by, and construed in accordance with the Law of Singapore.
(b) Nothing in the Contract will prevent a Party from seeking (including
obtaining or implementing) interlocutory or other interim relief, including in the
courts of any other appropriate jurisdiction.
(c) Subject to clause 12.5(b), any Disputes arising out of or in connection
with the Contract, including any question regarding its existence, validity or
termination, shall be referred to and finally resolved by arbitration
administered by the Singapore International Arbitration Centre (SIAC) under
the Arbitration Rules of the SIAC (Rules) for the time being in force, which
Rules are deemed to be incorporated by reference in this clause.
(d) The seat of arbitration shall be Singapore. The number of arbitrators shall
be three. Each Party shall nominate one arbitrator and the third arbitrator shall
be nominated by mutual agreement of the Parties. If a Party fails to nominate
an arbitrator or the Parties fail to nominate the third arbitrator within 14 days
of receipt of a request to appoint, or such period as otherwise agreed by the
Parties or set by the Registrar of the Court of Arbitration of SIAC, the
President of the Court of Arbitration of SIAC shall appoint the arbitrator on
their behalf. The language to be used in the arbitral proceedings shall be
English. This arbitration agreement shall be governed by the Law of
Singapore.
Schedule 7: Spain
In respect of where the Services are supplied by NCC Group Security Services Espana SLU
the following additional terms and conditions apply:
1. Clause 2.1.3 is amended to read as follows:
“undertake background screening checks in accordance with any applicable standards
and Good Industry Practice, and EU's General Data Protection Regulation 2016/679
("GDPR") and Spanish Fundamental Act 3/2018 for the Protection of Personal Data
and the Guarantee of Digital Rights, in respect of Consultants as they join NCC Group
if they will be involved in the delivery of the Services.”
2. Clause 2.2 is amended to read as:
“ensure that, where applicable or required, it has the consent of any relevant third
parties to enable the Services to be performed, which may include its internet service
provider(s), any third-party suppliers of the System and any of the Client’s personnel
who may be monitored (and/or, in the case of data subjects, ensure an appropriate
lawful basis for processing does apply), and, where required by the Supplier, complete
a technical consent, either in the Statement of Work or via an Authorisation Form,
giving its consent to some or all of the Services including testing targets, dates and
times, the Client ensuring full compliance with the GDPR and Spanish Fundamental
Act 3/2018 for the Protection of Personal Data and the Guarantee of Digital Rights.
Notwithstanding the above, the Client hereby confirms that it authorises NCC Group to
access programs and data held on the System.”
3. Clause 7.1 is amended to read as:
“Neither party excludes nor limits any liability for (i) personal injury, death or property
damage caused by willful misconduct or gross negligence; (ii) any fraud or fraudulent
misrepresentation; or (iii) any other liability that cannot be excluded by law.”
4. The Tax Clause, pursuant to clause 4.3 and the definition of Tax Clause in clause 13,
is as follows:
All Rights Reserved. © NCC Group 2024 Effective: 02 December 2024
5
Annex A - Data Processing Agreement Client (Global)
1. Interpretation & definitions (iv) NCC Group Deutschland GmbH;
In this Schedule: in which the DPA will be governed by and construed in accordance with
(a) the terms ‘Controller’, ‘Processor’, ‘Data Exporter’, ‘Data Importer’, the laws of the Netherlands and will be subject to the exclusive
‘Data Subject’, ‘Personal Data’, ‘Personal Data Breach’, ‘Processing’, jurisdiction of the Dutch courts; and
‘(Supervisory) Authority’ and ‘appropriate technical and
organisational measures’ have the meanings given to those terms, or (b) except where and to the extent otherwise required by Applicable Data
any equivalent terms, in the Privacy Laws.; Protection Laws.
(b) Adequacy Decision means a determination by an Authority in
accordance with Article 45 of the GDPR; 2.2 Application of this Data Processing Agreement
(c) Agreement: When not explicitly referenced otherwise, this refers to the (a) The Parties acknowledge and agree that this DPA is applicable if and
complete set of documents agreed upon within the framework of the insofar as NCC Group processes Personal Data on behalf of the Client in
services as offered by NCC and procured by the Client, including the connection with the Agreement or a particular Statement of Work.
Statement of Work. (b) To the extent this DPA is applicable in accordance with clause 2.2(a) above,
(d) Authority means any Commonwealth, State, regional or local the parties acknowledge and agree that:
government department, body or instrumentality or any other public (i) the Client is assigned the role of Controller and NCC Group is assigned
authority, statutory body or certifying body which has relevant the role of Processor within the meaning of the GDPR; and
jurisdiction, and includes any Regulator; (ii) they shall further specify the Personal Data Processing activities in a
(e) Business Days means a day that is not a Saturday, Sunday or public DPA Appendix as part of this DPA; and
holiday in the applicable country where NCC Group Services are (iii) clause 5 below will apply in respect of any Third Country Transfers of
performed; Personal Data effected in connection with the relevant Statement of
(f) Business Hours means 9.00am to 5.00pm on a Business Day; Work.
(g) Delete means deletion, destruction or, in the context of back-ups of data, The parties acknowledge and agree that this DPA does not apply if and insofar
ensuring said data is not readily available or accessible (for example, by NCC Group acts in the capacity of a Controller.
only holding it as part of an encrypted general system back-up);
(h) DPA means this Data Processing Agreement, including a DPA Appendix 2.3 DPA Appendix
as required by Article 28(3) of the GDPR; The Parties acknowledge and agree that:
(i) DPA Appendix means the annex to this DPA that sets out the details of (a) by signing the Agreement or a particular Statement of Work, the Client
the Processing activity such as subject matter, duration, nature and acknowledges that the DPA including DPA Appendix forms part of the
purpose of the Processing, the type of Personal Data and categories of Agreement. Insofar NCC Group acts as a Processor, it is bound by the
Data Subjects, and if applicable, any Sub-Processors and data transfers; instructions of the Client as described under the details of Processing
(j) GDPR means the European Union General Data Protection Regulation activity in the DPA Appendix
2016/679; (b) to the extent that there is any inconsistency between the details of the
(k) Notice means a notice, demand, consent, approval or communication in processing activity as described in the DPA Appendix and the
writing, in English, signed by a person duly authorised by the sender, Agreement, the DPA Appendix will govern, where a specific Statement of
and, hand delivered, or sent by prepaid post or email to the recipient’s Work may supplement;
registered address for Notices specified in the Agreement; (c) the Client must immediately notify NCC Group of any changes relating to
(l) Party means, either NCC Group or the Client (as the context requires) the Processing of Personal Data by NCC Group in connection with the
and in each case, Parties means both of them; Agreement; and
(m) Privacy Laws means all applicable legislation, regulations, regulatory (d) unless explicitly approved or confirmed by an authorised representative
guidance, or requirements in any jurisdiction (to the extent that either of NCC Group, this DPA and the DPA Appendix may not be amended or
Party is subject to it), which affects data protection, privacy, supplemented, nor shall any of its provisions be deemed to be waived or
confidentiality or any Personal Data (including the collection, storage, otherwise modified.
use or Processing of that Personal Data) including but not limited to:
(i) the GDPR together with any transposing, implementing or 3. NCC Group obligations
supplemental legislation; 3.1 Processing of Personal Data as a Processor
(ii) any ancillary legislation, codes of conduct, recommendations or Where the Client is a Controller and NCC Group is a Processor within the
directives made pursuant to the Laws contemplated above; and meaning of the GDPR, in regard to Personal Data disclosed by the Client, NCC
(iii) any other Law giving right to an actionable right of privacy; Group will:
(n) Standard Contractual Clauses means, in respect of the: (a) process the Personal Data only on documented instructions from the
(i) European Union, the ‘Standard Contractual Clauses’ set out in the Client, unless Processing is required by law and regulations to which
Commission Implementing Decision (EU) 2021/914 of 4 June NCC Group is subject. In such a case, NCC Group shall inform the Client
2021 on standard contractual clauses for the transfer of Personal of that legal requirement before Processing, insofar as this is permitted;
Data to third countries pursuant to the GDPR, found here, as (b) only undertake a Third Country Transfer if the conditions as set out in the
amended or replaced from time to time by a competent Authority Privacy Laws have been met, for instance:
under the relevant Privacy Laws (EU SCCs); or (i) an Adequacy Decision has been made in respect of the relevant
(ii) United Kingdom, the: country; or
(A) EU SCCs, as amended by the International Data Transfer (ii) NCC Group has entered into an agreement with the recipient of
Addendum to the EU SCCs issued by the UK Information the Third Country Transfer, which ensures a level of protection for
Commissioner; or Personal Data which is equivalent to the GDPR, such as the EU
(B) the UK IDTA, SCC’s or UK IDTA;
each found here, as amended or replaced from time to time, (c) put in place appropriate technical and organisational measures in such a
pursuant to Article 46 of the UK GDPR (in each case, the UK manner that any Processing undertaken by NCC Group in connection
SCCs); with the Agreement ensures a level of security appropriate to the risk,
(o) Third Country Transfer has the meaning a Personal Data transfer from taking into account the state of the art, the costs of implementation and
either the Client to NCC Group; or NCC Group (as Processor) to a Sub- the nature, scope, context and purposes of Processing as well as the risk
Processor); and concerning a transfer from of varying likelihood and severity for the rights and freedoms of natural
(i) EEA to any country, territory, or international organisation outside persons; which does not prejudice the Client’s responsibilities to take
of the EEA (under the GDPR) appropriate technical and organisational measures, in particular with
(ii) UK to any country, territory, or international organisation outside regard to information Processing systems of the Client or any party for
of the UK (under the UK GDPR) which the Client is responsible.
(p) UK GDPR means the GDPR, as transposed into the national law of the (d) ensure that persons authorised to process the Personal Data received
United Kingdom through the operation of section 3 of the European from the Client have committed themselves to confidentiality or are under
Union (Withdrawal) Act 2018 (UK) and as amended by the Data an appropriate statutory obligation of confidentiality;
Protection, Privacy and Electronic Communications (Amendments etc.) (e) notify the Client as soon as reasonably practicable of NCC Group
(EU Exit) Regulations 2019 (UK); becoming aware of a Personal Data Breach (“Data Breach”) by NCC
(q) UK ITDA means the International Data Transfer Agreement issued by Group or its Sub-Processors. NCC Group will investigate such Data
the UK Information Commissioner, as amended or replaced from time to Breach and provide a report to the Client with the results of such
time, pursuant to Article 46 of the UK GDPR. investigation as soon as reasonably practicable. If a Data Breach was
caused, in whole or in part, by the Client’s actions, the Client will pay for
2. Application and scope the work part of such investigation by or at the instructions of NCC
2.1 Governing law and courts Group. Such work shall be compensated by the Client in accordance
The Parties acknowledge and agree this DPA will be governed by and construed with the applicable (hourly) rates;
in accordance with the laws of England and Wales and will be subject to the (f) provide reasonable assistance to the Client or shall make available
exclusive jurisdiction of the English courts; information requested on reasonable grounds and that is necessary to
(a) except insofar the Agreement is with one of the following entities: demonstrate fulfilment by NCC Group of the obligations set forth in the
(i) Fox-IT B.V.; Privacy Laws, where the Privacy Laws require NCC Group (as the
Processor) to do so, taking into account the nature of Processing and the
(ii) NCC Group A/S;
information available to NCC Group, including by providing reasonable
(iii) NCC Group Cyber Security Portuguesa Unipessoal LDA; or assistance to the Client in relation to its obligations regarding:
© NCC Group 2024 | Data Processing Agreement Client (Global)
All Rights Reserved. Page 1 of 2 Effective: 2 December 2024
(i) keeping Personal Data secure; (v) the frequency of the Third Country Transfer may be continuous as
(ii) notifying Data Breaches to the relevant Authority; necessary to fulfil the obligations of the Agreement; and
(iii) notifying Data Breaches to relevant Data Subjects; (vi) retention of Personal Data by NCC Group will be determined by
insofar as the Client itself does not have access to the relevant the Client, except where NCC Group is required by Law to retain
information and NCC Group has that information available, and provided such Personal Data or the required retention is not technically
that the Client acknowledges and agrees that NCC Group will not be feasible in which parties will consult.
required to assist with the Client’s own compliance, security, technology
and related processes, in respect of which NCC Group has no insight, 5.2 UK GDPR Third Country Transfers
other than as required by the Privacy Laws. NCC Group may require that The Parties acknowledge and agree that, with respect to Third Country
the information be reviewed at NCC Group’s premises only and is Transfers subject to the UK GDPR:
entitled to impose reasonable further conditions to such request in order (a) the UK SCCs are hereby incorporated into this DPA by reference;
to safeguard the confidentiality and integrity of such information. (b) the description of such Third Country Transfer is as set out in the DPA
(g) assist the Client by appropriate technical and organisational measures, Appendix and/or the relevant Statement of Work (as the case may be);
insofar this is possible and applicable, to assist the Client to respond to and
requests from individuals to exercise their rights under the Privacy Laws (c) for the purposes of Annex B of the Controller UK SCCs and Appendix 1
(“Data Subject Rights”). NCC Group will notify the Client without delay if of the Processor UK SCCs and/or any equivalent UK IDTA:
NCC Group receives a request from a Data Subject under the Privacy (i) where the Client acts as Controller (Data Importer) under the
Laws if it relates to Personal Data processed in the performance of its Controller UK SCCs:
obligations under the Agreement, and shall not respond to such request, (A) at clause 2(h) of the Controller SCCs, the Parties select
except based on the Client’s documented instructions or where this is option (iii);
required by applicable law and/or legislation, in which case NCC Group (B) the Data Subjects, categories of Personal Data and the
will notify the Client of that legal obligation before accommodating the purposes of the relevant Third Country Transfer are as
request, insofar this is permitted. specified in the DPA Appendix and/or the relevant
(h) permit and contribute to the Client (or its nominee auditor) conducting Statement of Work;
audits and inspections as required by the Privacy Laws (including in (C) the recipients are the recipients to whom it is necessary to
respect of the scope of such audits): disclose data to achieve the relevant purposes; and
(i) not more frequently than once a year; (D) the contact points for data protection enquiries are the
(ii) on the provision of not less than ten Business Days’ Notice to usual business contacts for each Party; and
NCC Group; (ii) where NCC Group acts as Processor (Data Importer) under the
(iii) during Business Hours only; and Controller UK SCCs, Appendices 1 and 2 of the Processor SCCs
(iv) at the Client’s expense, shall be deemed to incorporate respectively, the:
provided that the Client acknowledges and agrees that NCC Group will (A) relevant Data Subjects;
not be required to provide any assistance, or disclose any information to (B) categories of Personal Data and Processing operations set
the Client (or its auditors) in connection with such an audit, if doing so out in the DPA Appendix and/or the relevant Statement of
may (in the opinion of NCC Group) cause NCC Group to breach any Work; and
obligation of confidentiality or privacy owed to any person, or (C) organisational and technical measures described in
compromise the functionality, availability, quality or security of NCC clauses 3.1(c) and 3.1(f) above.
Group Services or NCC Group’s systems.
6. Client obligations
4. Third parties Processing 6.1 Warranties
4.1 Sub-Processors The Client warrants to NCC Group that, in order to disclose any Personal Data to
Where the Client is a Controller and NCC Group is a Processor of any Personal NCC Group and to otherwise allow NCC Group to carry out its obligations under
Data disclosed by the Client to NCC Group for the purposes of the Agreement, and incidental to the Agreement, the Client:
NCC Group may engage another party to perform Processing activities on behalf (a) has all requisite Authority and has obtained and will maintain (including
of NCC Group (Sub-Processor). This means that the Client acknowledges and by way of incorporating into all materials and processes through which
agrees that: Personal Data is captured) all necessary consents required, or otherwise
(a) as part of Global Service Delivery, Personal Data may be accessed has a valid lawful basis for such disclosure in accordance with the
through different NCC Group entities and locations; Privacy Laws, in respect of the disclosure of Personal Data in connection
(b) its entry into this agreement constitutes the Client’s general written with the Agreement;
authorisation for NCC Group to appoint Sub-Processors as listed at (b) will immediately notify NCC Group should any such consents be
https://www.nccgroup.com/uk/terms-and-conditions/sub-processors/ and revoked, including where any Data Subjects exercise their right to object
within the relevant DPA Appendix. to the Processing of their Personal Data by NCC Group or its Sub-
(c) NCC Group will: Processors;
(i) ensure such Processing by any Sub-Processor is governed by an (c) has complied with, and will comply with, all of its obligations under the
agreement with that Sub-Processor including sufficient Privacy Laws; and
guarantees that the Sub-Processor will implement appropriate (d) will not do, or omit to do, anything that would place NCC Group in breach
technical and organisational measures in a manner compliant with of the Privacy Laws.
the Privacy Laws;
(ii) notify the Client of any intended changes concerning the addition 6.2 Client breach
or replacement of Sub-Processors at least 20 Business Days in The Client acknowledges and agrees that if it:
advance, thereby giving the Client the opportunity to object to (a) does not complete the DPA Appendix in accordance with clause 2.1 (b)
such changes on reasonable grounds, which Notice the Parties above; or
expressly agree may be provided via any medium, including (b) fails to comply with any obligations or requirements set out in this DPA;
email, a public website or a web-based client portal or
(iii) insofar as that contract involves a Third Country Transfer, ensure (c) gives NCC Group the Notice contemplated at clause 6.1(b) above,
the conditions of the Privacy Laws for data transfers are then NCC Group may:
incorporated into the agreement between NCC Group and the (i) proceed to deliver NCC Group Services without Processing any Personal
Sub-Processor, in accordance with clause 3.1 under b above. Data on behalf of the Client, to the extent technically possible and
commercially reasonable and in doing so, the Fees shall remain payable
5. Third Country Transfers in full in accordance with the Agreement; or
5.1 GDPR Third Country Transfers (ii) terminate the Agreement or relevant Statement of Work with Notice to
The Parties acknowledge and agree that, with respect to Third Country Transfers the Client.
subject to the GDPR:
(a) the EU SCCs are hereby incorporated into this DPA by reference; 7. Retention and deletion
(b) the description of such Third Country Transfer (Annex 1 of the EU SCCs) 7.1 Retention, deletion and return of Personal Data
is as set out in the DPA Appendix and/or Agreement; and Unless otherwise required or permitted by applicable laws or otherwise agreed
(c) for the purposes of Modules 2 and 3 of the EU SCCs where NCC Group (and only to the extent so required or permitted), NCC Group will, at the end of
acts as a Processor (Data Importer): the relevant Service Term:
(i) clause 7 of the EU SCCs and the optional language in clause (a) at the Client’s choice and expense, delete or return the processed
11(a) of the EU SCCs shall not apply; Personal Data to the Client within a reasonable timeframe; and/or
(ii) for the purposes of clause 9 of the EU SCCs, the Parties select (b) delete existing copies of processed Client Personal Data;
Option 2 (general authorization); If, upon termination of the Contract, the Client has failed to announce in writing
(iii) the Authority for the purposes of clause 13(a) of the EU SCCs that it wants to have the Personal Data returned, NCC Group is entitled to
shall be the Netherlands; delete the Personal Data or arrange for the data to be deleted.
(iv) the governing Law and choice of forum and jurisdiction shall be
that of the Netherlands and the technical and organisational
security measures set out in this DPA shall apply;
© NCC Group 2024 | Data Processing Agreement Client (Global)
All Rights Reserved. Page 2 of 2 Effective: 2 December 2024