Data Processing Agreement

Effective starting: 30 September, 2022

We Are The City LIMITED, “us”, “we”, or “our” refers to WeAreTheCity, WeAreTechWomen and any of our corporate affiliates.

BACKGROUND

Whereas:

1. The Data Processor provides Services to the Data Controller as part of their contractual relationship regulated by one or more separate agreements, written or verbal, (“Principal Agreement”) which currently governs their relationship including that related to the protection and management of data.
2. In providing the Services, the Data Processor may collect or otherwise process Personal Data sourced from the Data Controller within the meaning of Data Protection Laws.
3. The Parties are aware that Regulation (EU) 2016/679 of the European Parliament and of the Council of the 27th of April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation “GDPR”), is the new global bar for privacy rights, security and compliance, entering into force on May 25 2018.
4. The Parties agree to enter into this Data Processing Agreement (“DPA”), which regulates the data protection obligations of the Parties when processing the Personal Data and governs the relationship between the Parties in respect of the processing of Personal Data, and this in order to ensure compliance with the GDPR and other applicable law.
5. The conditions contained within this DPA supplement any Principal Agreement in respect of the aspects related to the processing of data and supersede any provisions of the Principal Agreement in the event of a conflict.
6. Any terms not defined in this DPA shall have the meaning set forth in the Principal Agreement.

NOW THEREFORE BOTH PARTIES AGREE AS FOLLOWS:

1. Definitions

1. The following definitions and rules of interpretation apply within this agreement:
   1. “Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership of either Party, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.
   2. “Anonymous Data”​ means Personal Data that has been processed in such a manner that it can no longer be attributed to an identified or identifiable natural person.
   3. “Authorised Employees” means an Authorised Employee or contractor of either Party, regardless of where they are located worldwide, who has a need to know or otherwise access Personal Data to enable them to perform their obligations under this DPA or the Principal Agreement.
   4. “Data Protection Laws” consists in particular of the GDPR and the Data Protection Act, Chapter 586 of the Laws of Malta and any other relevant data protection and privacy legislation which is applicable during the term of this Agreement, in so far as the same relates to the provisions and obligations of this Agreement
   5. The terms “Data Controller”, “Data Subject”, “Personal Data Breach”, “Data Processor”, “Consent”, “Third Party” shall, from the 25th May 2018 onwards, have the same meaning given to these terms in the GDPR.
   6. “Data Protection Officer” means the person nominated from time to time to hold the responsibility within Data Processor related to the protection of data, where applicable.
   7. “EEA” means, for the purposes of this DPA, the European Economic Area and Switzerland.
   8. “Effective Date” means the effective date of this Data Processing Agreement shall be the date at which this Agreement has been accepted by both Parties, whichever is the earlier.
   9. “Instruction​” means a direction or request for action, either in writing, in textual form (e.g. by email) or by using a software or online tool, issued by the Data Controller to the Data Processor and directing the Data Processor to perform an action with regard to Personal Data, including but not limited to the correction, blocking and deletion of Personal Data, which instruction may thereafter be amended, supplemented or replaced by the Data Controller by separate written or text form instruction.
   10. “Legitimate Business Interest” means a reason that enables the Processing of Personal Data which is necessary for the performance of a contract or provision of an agreed Service.
   11. “Personal Data​“ means any information relating to a Data Subject which the Data Processor Processes on behalf of the Data Controller other than Anonymous Data, which is able to identify an individual and includes Special Categories of Personal Data.
   12. “​Processing​” means any operation or set of operations which is performed upon the Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction. The terms “process”, “processes” and “processed” shall be interpreted accordingly.
   13. “Services” means any product or service provided by the Data Processor to the Data Controller pursuant to the Principal Agreement.
   14. “​Special Categories of Personal Data​” mean Personal Data which reveals:
       1. Racial or ethnic origin;
       2. Political opinions;
       3. Religious
       4. Philosophical beliefs
       5. Trade union membership;
       6. Genetic data;
       7. Biometric data;
       8. Data concerning Health;
       9. Data concerning Sex Life;
       10. Data concerning Sexual Orientation.
   15. “Standard Contractual Clauses” means the standard contractual clauses set forth in EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 as may be amended or superseded from time to time.
   16. “Sub-processor” means any person (including any third party but excluding an employee of the Data Processor) engaged by the Data Processor to assist in fulfilling its obligations with respect to its obligations pursuant to this DPA.
   17. “Supervisory Authority” shall mean the relevant supervisory authority with responsibility for privacy or data protection matters in the jurisdiction in which the Personal Data subject to this DPA agreement is held.
   18. “Technical and Organisational Measures” means those measures aimed at protecting Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, such measures being appropriate to the risks involved.
   19. “Third Party” means an individual or corporate entity other than the Parties.
2. This DPA covers all Affiliates of the respective Party.
3. References to clauses and schedules are to the clauses and schedules of this DPA; references to paragraphs are to paragraphs of the relevant schedule to this DPA.
4. The heads given to any Clause, schedule or paragraph shall not affect the interpretation of this DPA.
5. A person includes an individual, corporate or unincorporated body (whether or not having separate legal personality) and that person’s legal and personal representatives, successors or permitted assigns.
6. A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established.
7. Words in the singular shall include the plural and vice versa.
8. A reference to one gender shall include a reference to the other genders.
9. The word “include” shall be construed to mean include without limitation.
10. A reference to a statute or statutory provision is a reference to it as it is in force for the time being, taking account of any amendment, extension, or re-enactment and includes any subordinate legislation for the time being in force made under it.
11. A reference to writing or written shall be in the form of either a letter or email.
12. The language of this Agreement shall be the English language and for the purposes of interpretation, the provisions as they are stated in English shall be those which are considered binding.

2. Term

1. This DPA shall commence on the Effective Date and shall continue throughout the entire duration of any applicable, valid agreement covering the provision of Services which is still in force between the Data Controller and the Data Processor.
2. Except for the changes made by this DPA, the Principal Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict.

3. Type and purpose of use of data

1. The Data Processor agrees to Process the Personal Data held by the Data Controller only on documented instructions of the Data Controller, unless required to do so by European Union or Malta law to which the Data Processor is subject. In this case, the Data Processor shall inform the Data Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.
2. The Data Processor shall immediately inform the Data Controller if, in the Data Processor’s opinion, instructions given by the Data Controller infringe applicable European Union or Malta data protection provisions.
3. The Data Processor may process the following type of Personal Data for the following purposes:

1. The Data Controller agrees that the Data Processor’s Authorised Employees shall be granted access by the Data Controller to such Personal Data in the course of the provision of the Services and, in so doing take on the role of persons acting under the authority of the Data Processor.
2. Personal Data shall only be processed for the purposes listed in this DPA and shall not be further processed in a manner that is incompatible with those purposes.

4. Processing of Personal Data

1. The Data Controller is solely responsible for the accuracy, quality and legality of:
   1. the Personal Data provided to the Data Processor by or on behalf of the Data Controller,
   2. the means by which the Data Controller has acquired any such Personal Data, and
   3. the Instructions it provides to the Data Processor regarding the Processing of such Personal Data.
2. The Data Controller shall not provide or make available to Processor any Personal Data in violation of the DPA or otherwise inappropriate for the nature of the Services, and shall indemnify Processor from all claims and losses in connection therewith.

5. Data retention

1. Personal Data will be retained by the Data Processor in accordance with the Privacy Policy of the Data Processor applicable at the time, currently available at https://wearethecity.com/privacy-policy,  however any changes to this policy are to be notified to the Controller at least 10 days prior to such change, and the Controller shall have the right to terminate the Services without penalty.
2. The Data Processor shall hold the Controller’s Personal Data only as long as is necessary to provide the Services, including administration, accounting, marketing and reporting in the context of a Legitimate Business Interest, and subject to:
   1. the rights of a Data Subject in terms of the Data Protection Law, such as requests for data access or deletion;
   2. any legal requirement for data retention as specified in any other law of the Republic of Malta;
   3. a request by an authorised Governmental or regulatory authority for an additional retention period.
3. The table below identifies the current Data Processor data retention policy as it relates to different data types:

6. Data Controller’s obligations & rights

1. The Data Controller shall be responsible for assessing whether Personal Data can be processed lawfully and for safeguarding the rights of the Data Subjects. The Data Controller shall ensure in its area of responsibility that the necessary legal requirements are so that the Processor can provide the agreed services in a way that does not violate any legal regulations.
2. In case the Data Controller intends to conduct (or mandate a third party to conduct) an audit at Processor’s working premises, the Data Controller shall give reasonable notice of at least two (2) working days to Processor. The time and duration of the audit shall be agreed to by both Parties. The results of the audit shall be recorded by both Parties in writing.

7. Data Processor’s obligations

1. In fulfilling its obligations, the Data Processor shall:
   1. Ensure that persons authorised to Process the Personal Data (including but not limited to the Data Processor’s Authorised Employees) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and that the said confidentiality obligations are effectively implemented and enforced;
   2. Not engage any Sub-Processors to perform any processing of Personal Data, without informing the Controller of any intended changes concerning the addition or replacement of other processors, thereby giving the Controller the opportunity to object and terminate their Service;
   3. Where the Data Processor engages a Sub-Processor for carrying out specific processing activities on behalf of the Controller, it shall do so by way of a contract which imposes on the Sub-Processor the same data protection obligations set out in this DPA;
   4. Where that Sub-processor fails to fulfil its data protection obligations, the Data Processor shall remain fully liable to the Data Controller for the performance of that Sub-processor’s obligations and for any breach of this DPA, and shall notify the Data Controller of any failure by the Sub-Processor to fulfil its contractual obligations;
   5. Assist the Data Controller, by way of appropriate Technical and Organisational Measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the Data Subject’s rights laid down in Chapter III of the GDPR, taking into account the nature of the processing;
   6. Inform the Data Controller of any Personal Data Breach (including any suspected Personal Data Breach) that the Data Processor becomes aware of, irrespective of whether or not the Personal Data Breach was caused directly or indirectly by the Data Processor;
   7. At the choice of the Data Controller, delete or return all the Personal Data to the Controller after the end of the provision of services relating to processing in terms of the DPA, and delete existing copies unless EU or Maltese law requires storage of the Personal Data;
   8. Make available to the Data Controller all reasonable information necessary to demonstrate compliance with the obligations laid down in this DPA;
   9. Carry out regular tests and self-audits ensuring that the processing of the Data Controller’s Personal Data conforms with the provisions of this DPA;
   10. Allow for and contribute to reasonable audits, including inspections, conducted by the Data Controller or another auditor mandated by the Data Controller for the purpose of and to the extent required for verifying whether the Data Processor complies with Data Protection Laws and the contractually agreed measures in this DPA;
   11. Inform the Data Controller, as soon as possible, in text form (including by email) of any requests from any third parties (including the concerned Data Subjects or from a Supervisory Authority) in any way relating to the Data Controller‘s Personal Data. In case the Data Processor receives any Data Subject access requests and/or any other claims on the basis of any rights under Data Protection Law in connection with the Personal Data covered by this DPA, the Data Processor shall refer the concerned data subject directly to the Controller.

8. Sub-Processors

1. The Data Controller acknowledges, agrees and is hereby providing a general written authorisation allowing the Processor to engage Sub-Processors to access and Process Personal Data in connection with the Services and solely on the instructions of the Data Processor in line with Article 28 GDPR.
2. A list of the Data Processor’s current Sub-Processors are listed below:
   1. Mailchimp
   2. Creative Force – Used for nominations for the awards programmes on both WeAreTheCity and WeAreTechWomen
3. In line with the same Article 28, GDPR, at least ten (10) days before instructing any Third Party, other than the current Sub-Processors, to access or participate in the Processing of Personal Data as Sub-Processors, the Data Processor will notify the Data Controller of such a change and:
   1. Should the Data Controller object, Data Processor warrants to allow the Controller to terminate its use of the Services without loss as long as this is done within ten (10) days of receipt by Controller of the aforementioned notice;
   2. Termination shall not relieve Data Controller of any fees previously owed to Data Processor under the Principal Agreement or any other Agreement signed between the Parties.
   3. If the Data Controller does not object to the engagement of a Sub-Processor in accordance with this Section of the DPA within ten (10) days of notice by the Data Processor, such Third Party will be deemed a Sub-Processor for the purposes of this DPA.
4. In any case, the objection by the Data Controller to the engagement of a potential Sub-Processor shall be based on reasonable grounds relating to data protection.
5. The Data Processor shall, through implementation of a contract with the Sub-Processor, ensure that every Sub-Processor is subject to obligations regarding the Processing of Personal Data that are equal to, and no less onerous than, those to which the Data Processor is subject under this DPA.
6. At the Data Controller’s request, the Data Processor shall provide a copy of the agreement in place with the Sub-Processor and any subsequent amendments to the Data Controller. To the extent necessary to protect business secrets or other confidential information, including personal data, the Data Processor may redact the text of the agreement prior to sharing the copy of the same.
7. The Data Processor shall agree a third party beneficiary clause within the agreement with the Sub-Processor whereby – in the event that the Data Processor has factually disappeared, ceased to exist in law or has become insolvent – the Data Controller shall have the right to terminate the Sub-Processor contract and to instruct the Sub-Processor to erase or return the Personal Data.

9. Rights of Data Subjects

1. The Parties recognise and acknowledge the rights of Data Subjects to their Personal Data as defined within Data Protection Law including rights of access, rectification, restriction of Processing, erasure, data portability, restriction or cessation of Processing, withdrawal of consent to Processing, and/or objection (such requests individually and collectively “​Data Subject Request(s)​”).
2. The Data Processor shall, to the extent permitted by law, promptly notify the Controller upon receipt of a request by a Data Subject to exercise any of these Data Subject’s rights.
3. The Data Processor shall, at the request of the Controller, and taking into account the nature of the Processing applicable to any Data Subject request, subject to a charge based on its then current charge rates, apply appropriate Technical and Organisational Measures to assist the Controller in complying with the Controller’s obligation to respond to such Data Subject Request and/or in demonstrating such compliance, where possible, ​provided that:
   1. The Controller is itself unable to respond without the Data Processor’s assistance and
   2. The Data Processor is able to do so in accordance with all applicable laws, rules, and regulations.

10. Transferring data outside the EEA

1. The Data Processor is located within the European Economic Area (EEA), and shall endeavour to process the Data Controller’s Personal Data within the EEA. The Data Controller however authorises the storage of Personal Data to locations outside of the EEA, as set out within Schedule A to this DPA where server hosting and data storing is housed in the United States of America.
2. Where the Personal Data is processed by the Data Processor and/or Sub-Processors in a manner which constitutes a transfer in accordance with the terms of the GDPR, the Data Processor shall ensure that such transfer of data to a third country or an international organisation shall be done only on the basis of documented instructions from the Data Controller or in order to fulfil a specific requirement under EU or Malta law to which the Data Processor is subject.
3. The Data Controller agrees that where the Data Processor engages a Sub-Processor in accordance with Clause 8, for carrying out specific processing activities on behalf of the Data Controller, and those processing activities involve a transfer of Personal Data outside of the EEA, the Data Processor and Sub-Processor shall ensure compliance with the provisions of the GDPR by using Standard Contractual Clauses, provided the conditions for the use of those Standard Contractual Clauses are met.
4. Where the Data Processor effects a data transfer outside the EEA in accordance with Clause 10.2, the Data Processor binds itself that this Personal Data will be stored and processed in conformity with Data Protection Laws and that all appropriate Technical and Organisational Measures are taken by the Data Processor and its Sub-Processors.
5. Through this DPA, the Data Controller is consenting to the storage of Personal Data in all the locations as defined in Schedule A to this DPA.

11. Third party requests for disclosure of Personal Data

1. Unless prohibited by applicable law, the Data Processor shall promptly notify the Data Controller of:
   1. Any request for the transfer of Personal Data covered by the DPA, by any governmental, regulatory, Supervisory Authority;
   2. Any request for access received directly from a Third Party;
   3. Any requirement by law, court order, warrant, subpoena, or other legal judicial process to disclose any Personal Data to any person or entity other than the Controller.
2. The Data Processor shall provide all reasonable assistance to the Data Controller, subject to a charge based on its then current charge rates, to enable the Data Controller to respond, object or challenge any such demands, inquiries, communications, requests or complaints and to meet applicable statutory or regulatory deadlines.

12. Security

1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall implement appropriate Technical and Organisational Measures to protect any Personal Data that may be processed on behalf of the Data Controller against accidental destruction or loss or unlawful forms of processing, which Measures are listed in Schedule B of this DPA.
2. The Data Controller is responsible for reviewing the information made available by the Data Processor relating to data security and making and independent determination as to whether the Measures meet the Data Controller’s requirements and legal obligations under Data Protection Laws. The Data Controller acknowledges that the Technical and Organisational Measures are subject to technical progress and development and that the Data Processor may update or modify the Technical and Organisational Measures it has in place provided that such updates and modifications do not result in the degradation of the overall security of the Services.
3. The Data Processor shall keep the Data Controller’s Personal Data logically separate to Personal Data Processed on behalf of any other Third Party or its own behalf.

13. Reliability of personnel

1. The Parties shall take all reasonable steps to ensure the reliability of any Authorised Employees and staff of Sub-Processors who may have access to the Data Controller’s Personal Data, ensuring in each case that access is limited to those individuals who need to know and to access the relevant Personal Data, as necessary for the purposes of the Principal Agreement.
2. The Data Processor shall ensure that all Authorised Employees and Sub-Processors are made aware of the confidential nature of the Personal Data and have executed confidentiality agreements that prevent them from disclosing or otherwise Processing, both during and after their engagement with the Data Processor, any Personal Data except in accordance with their obligations in connection with the Services and as may be enforced by relevant laws.

14. Personal Data breach and notification

1. In the event of a Personal Data Breach, the Data Processor shall cooperate with and assist the Data Controller for the Data Controller to comply with its obligations as arising under the GDPR.
2. In the event of a Personal Data Breach concerning Personal Data processed by the Data Controller, the Data Controller shall agree to inform the Data Processor in writing upon it becoming aware of any Personal Data Breach within 72 hours, and the Data Processor shall assist the Data Controller in notifying the Personal Data Breach to the relevant Supervisory Authority.
3. In the event of a Personal Data Breach concerning Personal Data processed by the Data Processor, the Data Processor shall without undue delay inform the Controller in writing upon it or any Sub-Processor becoming aware of any Personal Data Breach.
4. The notification as considered in Clause 14.3 shall include:
   1. a detailed description of the Personal Data Breach;
   2. the type of data that was the subject of the Personal Data Breach;
   3. the identity of each affected person (or, where not possible, the approximate number of Data Subjects and of Personal Data records concerned);
   4. the name and contact details of the Data Processor’s Data Protection Officer, where applicable, or other point of contact where more information can be obtained;
   5. a description of the likely consequences of the Personal Data Breach;
   6. a description of the measures taken or proposed to be taken by the Data Processor to address the Data Breach, including, where appropriate, measures to mitigate its possible adverse effects;
5. The Data Processor agrees to provide the Controller with any and all information reasonably necessary for the compliance with the Controller’s own obligations pursuant to the GDPR.
6. The Data Processor agrees to cooperate with the Controller or their representatives and take such reasonable commercial steps to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
7. The Parties shall not release or publish any filing, communication, notice, press release, or report concerning any Personal Data Breach without the other Party’s written approval.

15. Modifications & notices

1. Notices sent in pursuit of this DPA are to be effected in writing, sent to the official place of business of the Party concerned or to its then current registered office address, or via email addressed to the principle contact of record for the Controller.
2. The Parties undertake to keep each other informed of any change in the contact details of the person to whom notices are to be sent.

16. Non-compliance & termination

1. In the event that the Data Processor is in breach of its obligations under this DPA, the Data Controller may instruct the Data Processor to suspend the processing of the Personal Data until the latter complies with the Clauses of this DPA or the DPA is terminated. The Data Processor shall promptly inform the Data Controller in case it is unable to comply with the Clauses of this DPA, for whatever reason.
2. The Data Controller shall be entitled to terminate the DPA insofar as it concerns the processing of personal data in accordance with these Clauses if:
   1. The processing of Personal Data by the Data Processor has been suspended by the Data Controller pursuant to Clause 16.1. and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;
   2. The Data Processor is in substantial or persistent breach of these Clauses or its obligations under the GDPR;
   3. The Data Processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or the GDPR.
3. The Data Processor shall be entitled to terminate the DPA insofar as it concerns processing of personal data under these Clauses where, after having informed the Data Controller that its instructions infringe applicable legal requirements in accordance with Clause 3.2, the Data Controller insists on compliance with the instructions.
4. On termination of the Services or termination of the DPA in accordance with Clause 16, the Data Processor shall:
   1. Upon the Data Controller’s request, furnish the Data Controller with all of the Data Controller’s Personal Data under its control in a format priorly agreed by the Parties which is appropriate to facilitate its use by the Data Controller and taking into consideration the format agreed and the amount of Personal Data, subject to a charge based on the Data Processor’s then current charge rate for such a service.
   2. Subject to the then applicable data retention policy, securely delete any of the Data Controller’s Personal Data in its possession.

17. Force majeure

1. The Parties shall have no liability to each other under this DPA if they are prevented from or delayed in performing their obligations under this Agreement, or from carrying on their business, by acts, events, omissions or accidents beyond their reasonable control, including, without limitation, strikes, lock-outs or other industrial disputes, failure of a utility service or transport or telecommunications network, act of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of suppliers or subcontractors, provided that the other Party is notified of such an event and its expected duration.

19. Severance

1. If any provision (or part of a provision) of this DPA is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the other provisions shall remain in force.
2. If any invalid, unenforceable or illegal provision would be valid, enforceable or legal if some part of it were deleted, the provision shall apply with whatever modification is necessary to give effect to the commercial intention of the Parties.

20. Governing law, jurisdiction and dispute resolution

1. This DPA and any disputes or claims arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) are governed by, and construed in accordance with, the laws of the United Kingdom.

Schedule A

Type of processing

The table below defines a list of types of processing related to Personal Data, and the storage location for that processing.

Schedule B

Technical & organisational measures

Following are technical and organisational measures the Data Processor has implemented and will maintain for the processing of Personal Data.

1. Intrusion prevention
   1. Network firewall to protect Data accessible via the internet.
   2. Systems and software are kept up-to-date with the latest available upgrades, updates, bug fixes, new versions and other modifications necessary to ensure security of Data.
   3. Anti-malware software, kept up-to-date.
2. Physical access control
   1. Services and data are hosted in Amazon Web Services (“AWS”) facilities in Australia, Canada, Europe and the USA, and protected by AWS in accordance with their security protocols.
3. Logical access controls
   1. A unique ID is assigned to each of the Data Processor’s Authorised Employees, and Identity Providers are used to manage their access to systems processing Data.
   2. Multi Factor Authentication (MFA) is used to protect all systems processing Data.
   3. Access to Data is restricted to only those people with a “need-to-know” for a permitted purpose and following least privileges principles.
   4. Reviews at least annually of the list of people and systems with access to Data, and removal of accounts upon termination of employment or a change in job status that results in employees no longer requiring access to Data.
   5. System-enforced “strong passwords” in accordance with the best practices described below, on all systems hosting, storing, processing, or that have or control access to Data.
      1. All employee passwords and access credentials are required to be kept confidential and not shared.
      2. User passwords must contain at least 12 characters.
   6. Account lockout when a User exceeds five consecutive incorrect password log in attempts.
   7. Virtual Private Network (“VPN”), strong passwords and MFA, are requirements for access to Data Processor resources, by Authorised Employees only.
   8. Monitoring of production systems, with security controls and procedures designed to prevent, detect and respond to identified threats and risks.
   9. Strict privacy controls exist in the application code that are designed to ensure Data privacy and to prevent one Client from accessing another Client’s data (i.e. logical separation).
4. Storage and transmission security
   1. All Data in transit is encrypted using TLS 1.3.
   2. All Data at rest is encrypted using AES 256-bit encryption.
   3. All datastores used to process Data are configured and patched using commercially reasonable methods according to industry-recognised system-hardening standards.
5. Disaster recovery and backup controls
   1. Data is permanently stored in either, Europe or the USA and is backed up for disaster recovery.
   2. Leveraging AWS, a reputable Infrastructure-As-A-Service provider, and their portfolio of globally redundant services to ensure Services run reliably. Our implementation of AWS services allows us to dynamically scale up, or completely re-provision infrastructure resources on an as-needed basis, across multiple geographical areas, using the same vendor, tools, and APIs. Our infrastructure scales up and down on demand as part of day to day operations and does so in response to any changes in our Clients’ needs. This includes compute resources, storage and database resources, networking, security, and DNS. Every component in our infrastructure is designed and built for high availability.
   3. Implementation of AWS services is designed to ensure high availability, built-in redundancy and protection of Data from accidental loss or destruction. Our Disaster Recovery Plan incorporates geographic failover between regional data centers. Service restoration is within commercially reasonable efforts and is performed in conjunction with AWS’s ability to provide adequate infrastructure at the prevailing failover location. Recovery and resilience mechanisms are tested regularly and processes are updated as required.
   4. Incident management process for 24×7 on-call response to mitigate critical issues impacting Clients.
   5. No reliance on specific office locations to sustain operations. All operational access to production resources can be exercised at any location with internet access. Our employees are all remote worker and leverage our toolkit of best-of-breed technologies and cloud tools.
   6. Disaster recovery from ground zero to full operation of all platforms, applications and architecture is tested to be achievable within a 4 hour period.
   7. All Data deleted by Instruction is fully expunged from AWS datastores and our Data backups within 28 days.
6. Business continuity and security incident response plan
   1. Formal procedure for handling security events. When security events are detected, relevant parties are notified and assembled online to rapidly address the event. After a security event is contained and mitigated, relevant teams document an analysis of the event, which is reviewed and distributed across the company and includes action items to prevent repeat or similar events in the future.
7. Audits and risk assessments
   1. Information Security Management Systems (“ISMS”) audited internally, annually, to ensure compliance with ISO 27001.
   2. Application vulnerability scans carried out internally every day.
      1.  Vulnerability remediation is prioritised based on risk.
   3. Prior to engaging new 3rd party service providers or vendors who will have access to Data, Data Processor conducts a risk assessment of vendors’ data security practices.
8. Change and configuration management
   1. Continuous automation for application and operating systems deployment for new releases. Integration testing and unit testing are done upon every build with safeguards in place to ensure availability and reliability.
   2. Process for critical fixes to be deployed within minutes.
9. Personnel security
   1. Criminal background checks are carried out on all Data Processor employees.
   2. Security and privacy training for all Data Processor’s employees with access to Data.
   3. Contracts with employees that ensure:
      1. adherence to Data Processor policies, including security and data protection policies;
      2. non-disclosure of information.
10. Secure disposal

Permanent and secure deletion of all online and network accessible instances of Data within 28 days of Client’s Instruction.