Privacy policy

Name and contact details of the controller

ibu – insitut für berufsbildung und umschulung gmbh

• Ludwigsluster Straße 3, 19306 Neustadt-Glewe
• Tel.: 038757 5070
• Fax: 038757 50718
• Email: info@ibu-europe.de

Your rights as a data subject

1. The right of access under Article 15 GDPR
2. The right to rectification under Article 16 GDPR
3. The right to erasure under Article 17 GDPR
4. The right to restriction of processing of personal data under Article 18 GDPR
5. The right to data portability under Article 20 GDPR, and
6. The right to object to the processing of personal data under Article 21 GDPR.

Specific information about the right to object under Article 21 GDPR

Under Article 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) GDPR, which permits processing to safeguard the legitimate interests of the controller or a third party.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required to establish, exercise or defend legal claims.

Where processing is for direct marketing purposes, Article 21(2) GDPR gives you the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing. You also have the right to lodge a complaint with a data protection authority under Article 77 GDPR.

Our competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information Mecklenburg-Western Pomerania

• Schloss Schwerin, Lennéstraße 1
• 19053 Schwerin
• Tel.: 0385 59494 0
• Fax: +49 385 59494 58
• Email: info@datenschutz-mv.de
• Website: www.datenschutz-mv.de; www.informationsfreiheit-mv.de
• https://www.datenschutz-mv.de/kontakt/kontaktformular/

You can also contact our data protection officer in confidence:
Contact details of the data protection officer

External data protection officer:

ECOVIS Keller Rechtsanwälte PartG mbB

Lawyer Axel Keller / Senior Associate Karsten Neumann

• August-Bebel-Straße 10-12
• 18055 Rostock
• Tel.: 0381 1288490
• Email: dsb-nord@ecovis.com
• Website: www.ecovis.com/datenschutzberater

1. Privacy information for our website

Thank you for visiting our website. We would like to inform you as fully as possible about the processing of your data in connection with your visit.

When you visit our website, personal data about you is generated. This includes data required for you to use the website or to enable us to take your settings into account. It may also include information that you provide through the contact options offered on these pages.

We use this data to ensure the website operates correctly, to provide all its functions and to answer your enquiries.

Below, we explain which data is collected on our website and the purposes for which it is processed. We also provide information about your rights and contact details for us and our data protection officer.

2. Purposes and legal bases of data processing, processors and transfers to third parties in third countries

We use the personal data you provide only for its intended purposes.

The legal basis for processing your data may in particular be

• your consent under Article 6(1)(a) GDPR, for example when you consent to cookies or web analytics;
• the initiation or performance of a contract under Article 6(1)(b) GDPR, for example when you contact us through the form;
• our legitimate interests under Article 6(1)(f) GDPR, for example in public relations, ensuring the website's necessary functions, IT and internet security, quality assurance, fraud prevention and the prosecution of offences.

If you have given us consent for a specific purpose, you may withdraw it at any time without any formal requirements.

Personal data is transferred to state institutions and authorities only where required by mandatory national legislation.

The people we engage to process data are required to maintain confidentiality and process data lawfully. If we process your personal data further for a purpose other than the original one, we will inform you accordingly.

We use external service providers, acting as processors, to support certain technical processes involving data analysis, processing and/or storage. Both we and the processor must comply with the technical and organisational measures required by Article 32 GDPR. The external service provider is also bound by confidentiality. Processing takes place solely on our behalf and in accordance with our instructions. Any processing of your personal data beyond this commissioned processing requires your express consent or a legal provision or order by an authority or court.

Data is transferred to third countries, meaning countries outside the European Economic Area (EEA), only where necessary to perform a contract, required by law, covered by your consent or necessary to provide certain website functions. Where legally required, we will inform you separately of the details.

3. Data retention period

When you use our website purely for information, we retain the data your browser sends to our server for the period required to resolve disruptions or error messages. It is generally deleted within 7 days of the internet connection ending.

Other deletion periods depend on how you use the website.

If you contact us with an enquiry using our contact options, we retain the personal data collected from the time of collection. We retain it for the duration of our business relationship, including the initiation and performance of a contract. We are also subject to various retention and documentation requirements, including those under the German Commercial Code (HGB), Fiscal Code (AO) and other tax legislation. The prescribed retention periods are up to ten years after the end of the year in which the contractual relationship ended. Finally, retention for defending legal claims and demonstrating compliance with data protection obligations is also determined by statutory limitation periods. Under Sections 195 et seq. of the German Civil Code (BGB), these are generally 3 years from the end of the year in which the claim arose.

Any other deletion periods are explained later in this privacy policy.

4. Website functionality and presentation

• • Cookies

We use cookies. Cookies are text files placed and stored on a computer system through an internet browser.

Cookies contain a cookie ID, which uniquely identifies the cookie. It consists of a string of characters that enables websites and servers to associate the cookie with the specific browser in which it was stored. This enables the websites and servers visited to distinguish your browser from other browsers containing different cookies. A specific browser can be recognised and identified by its unique cookie ID.

Cookies enable us to provide more user-friendly services. They allow information and offers on our website to be adapted to users' needs, for example by recognising a returning user. Users therefore do not have to enter their access details each time they visit, as the website and the cookie stored on their computer handle this.

However, cookies must be distinguished according to their different purposes. Where these small files are strictly necessary for the website to display correctly, their use is not optional. In this case, the legal basis for using the cookies is Article 6(1)(f) GDPR.

The website also uses cookies to analyse user behaviour or for marketing purposes. These are used only if you give your consent under Article 6(1)(a) GDPR when first visiting the website. You can prevent our website from setting cookies at any time by changing your browser settings, thereby permanently objecting to their use. Cookies already set can also be deleted at any time through a browser or other software. All common browsers support this. If cookies are disabled in your browser, some website functions may not be fully available.

The following links provide detailed information about disabling cookies in common browsers:

• Mozilla Firefox
• Internet Explorer
• Google Chrome
• Safari
• Microsoft Edge
  • Server log files

Our website provider automatically collects and stores information in server log files, which your browser sends to us automatically. This may include:

• The browser types and versions used;
• The operating system used by the accessing system;
• The website from which an accessing system reaches our website, known as the referrer;
• Subpages accessed on our website;
• The date and time of access to the website;
• An internet protocol address (IP address);
• The internet service provider of the accessing system; and
• Other data and information used to protect against attacks on our information technology systems.

We do not use this general data and information to draw conclusions about you. Instead, it is needed to:

• Deliver our website content correctly;
• Optimise our website content and its advertising;
• Ensure the continued operation of our information technology systems and website technology; and
• Provide law enforcement authorities with information needed to prosecute a cyberattack.

We therefore analyse this data statistically and to improve data protection and security within our organisation, ultimately ensuring an optimal level of protection for the personal data we process. Processing takes place on the basis of our legitimate interests under Article 6(1)(f) GDPR. Anonymous server log data is stored separately from any personal data you provide and is not combined with other data sources. However, where there is evidence of unlawful use of our website, we may review this data retrospectively.

5. Communication

• • Contacting us and the contact form​

Our website provides details that enable rapid electronic contact and direct communication with our organisation, including a general email address.

We have also included a contact form. You may voluntarily provide your title, first name, surname and telephone number. To communicate with us through the form, however, you must provide your email address and describe your specific enquiry in the message.

If you contact us by email or through the contact form, the personal data you submit is stored automatically. Data provided voluntarily in this way is retained to handle your enquiry or contact you. It is not disclosed to third parties.

Submitting data through the contact form is voluntary and takes place under Article 6(1)(a) GDPR. If processing is necessary to perform a contract or take pre-contractual steps, the legal basis is Article 6(1)(b) GDPR.

We use an external service provider, acting as a processor, for this technical process. Both we and the processor must comply with the technical and organisational measures required by Article 32 GDPR. The external provider is also bound by confidentiality. Processing takes place solely on our behalf and in accordance with our instructions.

6. Analytics tools

Google Analytics with IP anonymisation

We have integrated Google Analytics with IP anonymisation into our website. Data is processed with your prior consent under Article 6(1)(a) GDPR. You may withdraw consent at any time.

The operator is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics is a web analytics service. Web analytics involves collecting and analysing data about website visitors' behaviour. This includes the website from which a visitor arrives, known as the referrer, which subpages they access, and how often and for how long they view a subpage.

The Google Analytics component analyses visitor traffic on our website. Google uses the data and information collected to evaluate use of the website, compile online reports about activity on it, and provide other services connected with website use.

Google Analytics places a cookie on your system. Whenever you access a page containing the Google Analytics component, your browser automatically sends data to Google for online analysis. The cookie stores personal information such as access time, the location from which access originated, how frequently you visit our website, preferred language and browser. On each visit, this personal data, including your IP address, is transferred to and stored by Google.

With IP anonymisation, Google shortens your IP address. The IP address sent by your browser through Google Analytics is not combined with other Google data.

Under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, transfers to the USA rely on standard contractual clauses. See business.safety.google/gdprcontrollerterms/ and business.safety.google/gdprcontrollerterms/sccs/.

You can prevent cookies from being set at any time through your browser settings, thereby permanently objecting to their use.

You can also prevent Google Analytics from collecting and processing data about your use of this website by downloading and installing the browser add-on available at tools.google.com/dlpage/gaoptout .

Further information and Google's applicable privacy policy are available at policies.google.com/privacy and policies.google.com/terms . Google Analytics is explained in more detail at www.google.com/intl/de_de/analytics/ .

The EU General Data Protection Regulation requires us to provide comprehensive information about the processing of your personal data. To fulfil this obligation, we inform you as follows:

Scope of processing

We process your personal data to manage our business relationship, including communication between us, particularly payments, accounting and the fulfilment of our contractual obligations.

We generally collect your data directly from you. In the course of our activities, we also receive data from third parties, particularly legal or other representatives, pension insurers, authorities and public bodies such as the Federal Employment Agency or jobcentres. As a rule, we do not collect personal data from public sources.

We process your data where necessary to perform a contract you have concluded with us under the first alternative of Article 6(1)(b) GDPR, or to take pre-contractual steps under the second alternative of Article 6(1)(b) GDPR.

This covers the following purposes:

• Delivering and administering training and continuing education
• Recording and documenting completed training and continuing education
• Managing our business relationship, including communication between us, particularly payments, accounting and the fulfilment of our contractual obligations
• Fulfilling our legal obligations

Depending on the circumstances, we may process the following categories of data: title, name, gender, contact details, address, date and place of birth, customer number, occupation, employer's name and contact details, attendance, qualifications, professional qualifications, programme start and end dates, contractual data, signature, identity documents where applicable, payment information where applicable, and agreements.

The data we collect is generally essential to establish and manage a business relationship and fulfil the resulting obligations. There is generally no other obligation to provide data.

In some cases, we are legally required to process data. In these circumstances, we process your data under Article 6(1)(c) GDPR.

A legal obligation may arise:

• From a contract you have concluded with us, where data collection serves its performance;
• From legislation applicable to us or, under Article 6(2) and (3) GDPR, from European Union law or the law of its Member States;
• From general duties to assist or ancillary contractual duties not specifically concerned with data collection, such as the failure to provide assistance provisions in Section 323c of the German Criminal Code (StGB).

If a life-threatening emergency occurs and you require medical assistance, we base processing on Article 6(1)(d) GDPR to protect your vital interests.

Where applicable, data processing serves our legitimate interests under Article 6(1)(f) GDPR.

Where legally permitted, we retain your personal data if necessary to establish or defend legal claims.

1. Our legitimate interests in processing data are:

• The existence of a legal relationship between us;
• Fraud prevention;
• Measures to ensure and improve IT system security;
• Measures to protect our organisation against unlawful acts; and
• The assertion of claims for damages.

We do not use automated monitoring or assessment systems when processing data within our organisation.

2. The personal data we collect is retained in accordance with our deletion policy until statutory retention periods expire and is then deleted, unless Article 6(1), first sentence, point (c) GDPR requires longer retention under tax and commercial retention and documentation requirements arising from the German Commercial Code (HGB), Criminal Code (StGB) or Fiscal Code (AO), or you have consented to further retention under Article 6(1), first sentence, point (a) GDPR.

3. Subject to such retention requirements, data is deleted when the purpose for which it was collected no longer applies.

4. Where legally permitted, data is also retained if necessary to establish or defend legal claims.

5. Disclosure and international transfers

Recipients or categories of recipients of personal data

The data we collect may be disclosed to recipients or third parties in accordance with the law. These recipients may include:

Internally:

• Management
• Secretariat
• Internal quality assurance

Externally:

1. Tax advisers
2. Auditors
3. Tax authorities
4. The Federal Employment Agency
5. Our legal representatives
6. External quality assurance
7. Insurers; accounting/bookkeeping
8. External data processors under Article 4(8) GDPR
1. Accounting/bookkeeping: R&R Immobilienverwaltung
2. IT service providers
3. Document destruction company Reisswolf
4. Website maintenance: mv-soft

Your personal data is not transferred to a third country, and no such transfer is intended.

Dear applicants,

During the application process, you may share highly personal information with us. This notice explains how we handle your data and your rights in connection with its processing within our organisation.

I. Scope of processing

We generally collect the personal data listed below directly from you. Where necessary to assess your application, we may also process data lawfully obtained from other bodies, other third parties or publicly accessible sources for the following purposes:

We process your data where necessary to take pre-contractual steps under Article 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG).

This covers the following pre-contractual purposes:

• Reviewing and assessing your suitability for the vacancy;
• Assessing performance and conduct to the extent permitted by law;
• Registering and authenticating applications through our website, where applicable;
• Preparing an employment contract, where applicable;
• Ensuring transactions can be documented;
• Managing travel and events, travel bookings and expense claims, access permissions and identification cards;
• Recording and controlling costs;
• Communicating with you about the contract, including arranging appointments.

In this context, we process the data you provide in your application. To assess your suitability for the vacancy, we generally process: title/gender, address details, personal information, residential address, professional activities, current employment, nationality, vocational qualifications, professional experience, employment start and end dates, career development, parental status and date of birth.

This data is required to conduct the selection process properly. If you do not provide it, we may be unable to consider your application. There is no legal obligation to provide the data.

We process your data where you have given consent under Article 6(1)(a) or Article 9(2)(a) GDPR.

You may give consent for:

• Obtaining references from former employers;
• Retaining your application longer in an applicant pool for future vacancies.

Where applicable, we obtain your consent separately. You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn.

If a life-threatening emergency occurs and you require medical assistance, we base processing on Article 6(1)(d) GDPR to protect your vital interests.

This includes, in particular, sharing relevant data with paramedics, doctors or other emergency personnel.

Where applicable, data processing serves our legitimate interests under Article 6(1)(f) GDPR.

Our legitimate interests in processing data are:

• Fraud prevention;
• Measures to ensure and improve IT system security;
• Measures to protect our organisation against unlawful acts;
• The assertion of claims for damages;
• Internal administrative purposes, particularly information exchange within our organisation;
• Establishing legal claims and defending legal disputes, including disclosure to our legal representatives where applicable;
• Ensuring consistent applicant management and quality standards within our organisation.

We do not use automated assessment systems when processing data within our organisation.

II. Data retention period

We retain data collected for an application for 6 months after the application process ends. After that period, the data is deleted or, where deletion is not possible, blocked. If you consent to further retention, we add your data to our applicant pool, where it is deleted after two years. If contact was established through an agency or adviser, we retain your master data until our contract with that intermediary expires so that commission claims can be checked. If your application is successful, data is transferred from the applicant system into our personnel information system and used to prepare your employment contract.

III. Disclosure and international transfers

The data we collect may also be disclosed to third parties for specific purposes in accordance with the law. Possible recipients include:

Internally:

1. Management
2. Secretariat

Externally:

1. The Federal Employment Agency
2. Our legal representatives, where applicable;
3. External data processors under Article 4(8) GDPR, where applicable.
1. Accounting/bookkeeping: R&R Immobilienverwaltung
2. IT service providers
3. Document destruction company Reisswolf
4. Website maintenance: mv-soft

Your personal data is not transferred to a third country, and no such transfer is intended.

The EU General Data Protection Regulation requires us to provide comprehensive information about the processing of your personal data. To fulfil this obligation, we inform you as follows:

V. Scope of processing

In our business relationship, depending on the specific purpose of collection, we regularly process personal data even where you are a legal entity. This is the case, for example, when we collect data about members of management or named contacts at your organisation.

We generally collect data directly from the data subject. However, you may also provide data about people in your organisation who are responsible for working with us.

We process your data where necessary to perform a contract you have concluded with us under the first alternative of Article 6(1)(b) GDPR, or to take pre-contractual steps under the second alternative of Article 6(1)(b) GDPR.

This covers the following purposes:

• Managing our business relationship, including payments, accounting and fulfilling our contractual obligations
• Communication
• Appointment management

In this context, the following categories of data may be processed: company, name, business address details, business contact details, role in the organisation, signature, professional activity, and complaints/incidents.

The data we collect is generally essential to establish and manage a business relationship and fulfil the resulting obligations. There is generally no other obligation to provide data.

In some cases, we are legally required to process data. In these circumstances, we process your data under Article 6(1)(c) GDPR.

A legal obligation may arise:

• From a contract you have concluded with us, where data collection serves its performance;
• From legislation applicable to us or, under Article 6(2) and (3) GDPR, from European Union law or the law of its Member States;
• From general duties to assist or ancillary contractual duties not specifically concerned with data collection, such as the failure to provide assistance provisions in Section 323c of the German Criminal Code (StGB).

If a life-threatening emergency occurs and you require medical assistance, we base processing on Article 6(1)(d) GDPR to protect your vital interests.

Where applicable, data processing serves our legitimate interests under Article 6(1)(f) GDPR.

Where legally permitted, we retain your personal data if necessary to establish or defend legal claims.

Our legitimate interests in processing data are:

• Processing the contact details of contact persons
• The existence of a legal relationship between us;
• Fraud prevention;
• Measures to ensure and improve IT system security;
• Measures to protect our organisation against unlawful acts; and
• The assertion of claims for damages.

Not providing personal data about people working for your organisation generally only means that communication between us becomes significantly more difficult or, for example in the case of email, impossible.

We do not use automated monitoring or assessment systems when processing data within our organisation.

V. Data retention period

The personal data we collect is retained in accordance with our deletion policy until statutory retention periods expire and is then deleted, unless Article 6(1), first sentence, point (c) GDPR requires longer retention under tax and commercial retention and documentation requirements arising from the German Commercial Code (HGB), Criminal Code (StGB) or Fiscal Code (AO), or you have consented to further retention under Article 6(1), first sentence, point (a) GDPR.

Subject to such retention requirements, data is deleted when the purpose for which it was collected no longer applies.

Where legally permitted, data is also retained if necessary to establish or defend legal claims.

1. Disclosure and international transfers

Recipients or categories of recipients of personal data

The data we collect may be disclosed to recipients or third parties in accordance with the law. These recipients may include:

Internally:

1. Management
2. Heads of department
3. Accounting/bookkeeping

Externally:

1. Tax advisers
2. Tax authorities
3. Insurers
4. Our legal representatives
5. External processors under Article 4(8) GDPR
1. Accounting/bookkeeping: R&R Immobilienverwaltung
2. Document destruction company Reisswolf
3. IT service providers
1. Website maintenance: mv-soft

Your personal data is not transferred to a third country, and no such transfer is intended.

Contents

LinkedIn Data Processing Agreement (DPA)

Annex A: description of the transfer

Annex B: CCPA addendum

Annex C: specific terms and additions for Glint

Annex D: technical and organisational measures, including measures to ensure data security

This Data Processing Agreement (“DPA”), entered into between the LinkedIn customer identified in the applicable ordering document for LinkedIn services (“Customer”) and the LinkedIn entity identified in that document, together with its affiliates (“LinkedIn”), governs the processing of personal data that Customer uploads or otherwise provides to LinkedIn in connection with the services, LinkedIn's processing of personal data on Customer's behalf in connection with the services, and any personal data that LinkedIn uploads or otherwise provides to Customer in connection with the services. Terms specific to LinkedIn's Glint services are set out in Annex C to this DPA.

This DPA is incorporated into the applicable LinkedIn services agreement attached to or incorporated by reference in the ordering document previously executed by Customer, referred to in this DPA as the “LinkedIn Agreement”. This DPA, including the Standard Contractual Clauses defined herein, the LinkedIn Agreement and the associated ordering documents are referred to collectively as the “Agreement”. In the event of conflict or inconsistency between its terms, the following documents prevail in this order: (a) the Standard Contractual Clauses; (b) the ordering document associated with the LinkedIn Agreement; (c) this DPA; and (d) the LinkedIn Agreement. Except as expressly amended by this DPA, the LinkedIn Agreement and applicable order form remain unchanged and in full force and effect.

1. DEFINITIONS

“CCPA” means the California Consumer Privacy Act of 2018, together with any subordinate legislation or regulations.

“Customer Personal Data” means personal data that Customer uploads or otherwise provides to LinkedIn in connection with its use of LinkedIn services.

“Data Protection Requirements” means the GDPR and all applicable laws, rules and other provisions concerning (a) privacy, data security and personal data protection; and (b) the processing of personal data. These requirements include the UK GDPR, the Swiss Federal Act on Data Protection 2020, Brazil's General Data Protection Law (Lei Geral de Proteção de Dados) and the CCPA.

“EU Personal Data” means personal data whose transfer under this Agreement is governed by the GDPR.

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council, together with any subordinate legislation or regulations implementing it.

“Personal Data” means data and information about a person that (a) can be used to identify, contact or locate a specific person; (b) can be combined with other data that can be used to identify, contact or locate a specific person; or (c) is defined as “personal data” or “personal information” by applicable laws or regulations governing the collection, use, storage or disclosure of information about an identifiable person.

“Personal Data Breach” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data.

“Processing” and related terms mean any operation or set of operations performed on personal data, with or without automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Standard Contractual Clauses” means the European Commission's standard contractual clauses entered into by the parties under the Agreement.

“Subprocessor” means any legal entity providing processing services to LinkedIn in support of LinkedIn's processing of Customer Personal Data.

“Supervisory Authority” means an independent authority established by an EU Member State under Article 51 GDPR, or a public authority responsible for data protection with supervisory powers and jurisdiction over Customer.

“UK GDPR” means the United Kingdom General Data Protection Regulation, supplemented by the Data Protection Act 2018.

“UK Personal Data” means personal data whose transfer under this Agreement is governed by the UK GDPR.

2. NATURE OF DATA PROCESSING

Each party undertakes to process personal data received under the Agreement solely for the purposes set out in it. For clarity, the categories of personal data processed and data subjects covered by this DPA are described in Annex A.

3. COMPLIANCE WITH LAWS

Each party will fulfil its respective obligations under all applicable Data Protection Requirements.

4. CUSTOMER OBLIGATIONS

4.1 Customer agrees to: (i) determine the purposes and general means of LinkedIn's processing of Customer Personal Data in accordance with the Agreement; and (ii) comply with the protection, security and other obligations relating to Customer Personal Data imposed on controllers by Data Protection Requirements.

4.2 At LinkedIn's request, Customer will designate a central contact person, the “Master Administrator”, responsible for (i) receiving and responding to data subject requests that LinkedIn receives concerning Customer Personal Data; and (ii) informing LinkedIn of Customer's intended response to requests for access, correction, erasure, restriction, portability, blocking or deletion of Customer Personal Data processed by LinkedIn, and authorising LinkedIn to respond on Customer's behalf.

5. LINKEDIN OBLIGATIONS

5.1 Processing requirements. LinkedIn will:

1. Process Customer Personal Data (i) solely to provide, support and improve LinkedIn services, including insights and other reports, using appropriate technical and organisational security measures; and (ii) in accordance with Customer's instructions. LinkedIn will not use or process Customer Personal Data for other purposes. If LinkedIn cannot meet the requirements of Sections 5 to 8 of this DPA, it will promptly inform Customer in writing. Customer may then terminate the Agreement or take other appropriate measures, including suspending processing;
2. Promptly inform Customer if, in LinkedIn's opinion, a Customer instruction infringes applicable Data Protection Requirements;
3. Follow Customer's instructions on collecting Customer Personal Data, including notice and choice requirements, when collecting it from individuals on Customer's behalf;
4. Take commercially reasonable steps to ensure that LinkedIn employees and others acting on LinkedIn's behalf comply with the Agreement;
5. Ensure that LinkedIn employees, authorised representatives and subprocessors are required to observe, acknowledge and respect the confidentiality of Customer Personal Data, including after their employment, contract or engagement ends;
6. When engaging subprocessors to assist LinkedIn in fulfilling this DPA or delegating processing in whole or part: (i) obtain Customer's prior written consent, not to be unreasonably withheld, except for subprocessors on the online list maintained by LinkedIn and its affiliates, currently at https://legal.linkedin.com/customer-subprocessors, whose use Customer approves; (ii) remain liable to Customer for subprocessors' data protection acts and omissions where they act on LinkedIn's instructions; and (iii) enter into contracts requiring subprocessors to provide the same level of data protection and information security as this Agreement; and
7. On request, provide Customer with a mapping of LinkedIn's security policies to the controls specified in ISO/IEC 27001 of the International Organization for Standardization and the International Electrotechnical Commission.

5.2 Notification to Customer.

LinkedIn will inform Customer if it becomes aware of:

1. Non-compliance by LinkedIn or its employees with Sections 5 to 8 of this DPA or with Data Protection Requirements concerning the protection of Customer Personal Data under this DPA;
2. A legally binding request from a law enforcement authority to disclose Customer Personal Data, unless LinkedIn is legally prohibited from informing Customer, for example to preserve the confidentiality of an investigation.

STANDARD CONTRACTUAL CLAUSES

SECTION I

1) Purpose and scope

1. a) The purpose of these standard contractual clauses is to ensure compliance with the

requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council

of 27 April 2016 on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data (General Data Protection

Regulation) for the transfer of personal data to a third country.

1. a) The Parties
2. i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies

(hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A.

(hereinafter each “data exporter”), and

1. ii) the entity/ies in a third country receiving the personal data from the data

exporter, directly or indirectly via another entity also Party to these Clauses, as

listed in Annex I.A. (hereinafter each “data importer”)

have agreed to these standard contractual clauses (hereinafter: “Clauses”).

1. b) These Clauses apply with respect to the transfer of personal data as specified in Annex

I.B.

1. c) The Appendix to these Clauses containing the Annexes referred to therein forms an

integral part of these Clauses.

 

2) Effect and invariability of the Clauses

1. a) These Clauses set out appropriate safeguards, including enforceable data subject rights

and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation

(EU) 2016/679 and, with respect to data transfers from controllers to processors and/or

processors to processors, standard contractual clauses pursuant to Article 28(7) of

Regulation (EU) 2016/679, provided they are not modified, except to select the

appropriate Module(s) or to add or update information in the Appendix. This does not

prevent the Parties from including the standard contractual clauses laid down in these

Clauses in a wider contract and/or to add other clauses or additional safeguards, provided

that they do not contradict, directly or indirectly, these Clauses or prejudice the

fundamental rights or freedoms of data subjects.

1. b) These Clauses are without prejudice to obligations to which the data exporter is subject

by virtue of Regulation (EU) 2016/679.

3) Third-party beneficiaries

1. a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against

the data exporter and/or data importer, with the following exceptions:

1. i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
2. ii) Clause 8 - Clause 8.1(b), 8.9(a), (c), (d) and (e);

iii) Clause 9 - Clause 9(a), (c), (d) and (e);

1. iv) Clause 12 - Clause 12(a), (d) and (f);
2. v) Clause 13;
3. vi) Clause 15.1(c), (d) and (e);

vii) Clause 16(e);

viii) Clause 18 - Clause 18(a) and (b);

1. b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU)

2016/679.

4) Interpretation

1. a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms

shall have the same meaning as in that Regulation.

1. b) These Clauses shall be read and interpreted in the light of the provisions of Regulation

(EU) 2016/679.

1. c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations

provided for in Regulation (EU) 2016/679.

5) Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into

thereafter, these Clauses shall prevail.

6) Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are

transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

7) Docking clause

1. a) An entity that is not a Party to these Clauses may, with the agreement of the Parties,

accede to these Clauses at any time, either as a data exporter or as a data importer, by

completing the Appendix and signing Annex I.A.

1. b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall

become a Party to these Clauses and have the rights and obligations of a data exporter or

data importer in accordance with its designation in Annex I.A.

1. c) The acceding entity shall have no rights or obligations arising under these Clauses from

the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

8) Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data

importer is able, through the implementation of appropriate technical and organisational

measures, to satisfy its obligations under these Clauses.

8.1 Instructions

1. a) The data importer shall process the personal data only on documented instructions from

the data exporter. The data exporter may give such instructions throughout the duration of

the contract.

1. b) The data importer shall immediately inform the data exporter if it is unable to follow

those instructions.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the

transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as

completed by the Parties, available to the data subject free of charge. To the extent necessary

to protect business secrets or other confidential information, including the measures described

in Annex II and personal data, the data exporter may redact part of the text of the Appendix

to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the

data subject would otherwise not be able to understand the its content or exercise his/her

rights. On request, the Parties shall provide the data subject with the reasons for the

redactions, to the extent possible without revealing the redacted information. This Clause is

without prejudice to the obligations of the data exporter under Articles 13 and 14 of

Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has

become outdated, it shall inform the data exporter without undue delay. In this case, the data

importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B.

After the end of the provision of the processing services, the data importer shall, at the choice

of the data exporter, delete all personal data processed on behalf of the data exporter and

certify to the data exporter that it has done so, or return to the data exporter all personal data

processed on its behalf and delete existing copies. Until the data is deleted or returned, the

data importer shall continue to ensure compliance with these Clauses. In case of local laws

applicable to the data importer that prohibit return or deletion of the personal data, the data

importer warrants that it will continue to ensure compliance with these Clauses and will only

process it to the extent and for as long as required under that local law. This is without

prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e)

to notify the data exporter throughout the duration of the contract if it has reason to believe

that it is or has become subject to laws or practices not in line with the requirements under

Clause 14(a).

8.6 Security of processing

1. a) The data importer and, during transmission, also the data exporter shall implement

appropriate technical and organisational measures to ensure the security of the data,

including protection against a breach of security leading to accidental or unlawful

destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter

“personal data breach”). In assessing the appropriate level of security, the Parties shall

take due account of the state of the art, the costs of implementation, the nature, scope,

context and purpose(s) of processing and the risks involved in the processing for the data

subjects. The Parties shall in particular consider having recourse to encryption or

pseudonymisation, including during transmission, where the purpose of processing can be

fulfilled in that manner. In case of pseudonymisation, the additional information for

attributing the personal data to a specific data subject shall, where possible, remain under

the exclusive control of the data exporter. In complying with its obligations under this

paragraph, the data importer shall at least implement the technical and organisational

measures specified in Annex II. The data importer shall carry out regular checks to ensure

that these measures continue to provide an appropriate level of security.

1. b) The data importer shall grant access to the personal data to members of its personnel only

to the extent strictly necessary for the implementation, management and monitoring of the

contract. It shall ensure that persons authorised to process the personal data have

committed themselves to confidentiality or are under an appropriate statutory obligation

of confidentiality.

1. c) In the event of a personal data breach concerning personal data processed by the data

importer under these Clauses, the data importer shall take appropriate measures to address

the breach, including measures to mitigate its adverse effects. The data importer shall also

notify the data exporter without undue delay after having become aware of the breach.

Such notification shall contain the details of a contact point where more information can

be obtained, a description of the nature of the breach (including, where possible,

categories and approximate number of data subjects and personal data records

concerned), its likely consequences and the measures taken or proposed to address the

breach including, where appropriate, measures to mitigate its possible adverse effects.

Where, and in so far as, it is not possible to provide all information at the same time, the

initial notification shall contain the information then available and further information

shall, as it becomes available, subsequently be provided without undue delay.

1. d) The data importer shall cooperate with and assist the data exporter to enable the data

exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to

notify the competent supervisory authority and the affected data subjects, taking into

account the nature of processing and the information available to the data importer.

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions,

religious or philosophical beliefs, or trade union membership, genetic data, or biometric data

for the purpose of uniquely identifying a natural person, data concerning health or a person’s

sex life or sexual orientation, or data relating to criminal convictions and offences

(hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or

additional safeguards described in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented

instructions from the data exporter. In addition, the data may only be disclosed to a third party

located outside the European Union (in the same country as the data importer or in another

third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by

these Clauses, under the appropriate Module, or if:

1. i) the onward transfer is to a country benefiting from an adequacy decision

pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward

transfer;

1. ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46

or 47 Regulation of (EU) 2016/679 with respect to the processing in question;

iii) the onward transfer is necessary for the establishment, exercise or defence of

legal claims in the context of specific administrative, regulatory or judicial

proceedings; or

1. iv) the onward transfer is necessary in order to protect the vital interests of the data

subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other

safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

1. a) The data importer shall promptly and adequately deal with enquiries from the data

exporter that relate to the processing under these Clauses.

1. b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the

data importer shall keep appropriate documentation on the processing activities carried

out on behalf of the data exporter.

1. c) The data importer shall make available to the data exporter all information necessary to

demonstrate compliance with the obligations set out in these Clauses and at the data

exporter’s request, allow for and contribute to audits of the processing activities covered

by these Clauses, at reasonable intervals or if there are indications of non-compliance. In

deciding on a review or audit, the data exporter may take into account relevant

certifications held by the data importer.

1. d) The data exporter may choose to conduct the audit by itself or mandate an independent

auditor. Audits may include inspections at the premises or physical facilities of the data

importer and shall, where appropriate, be carried out with reasonable notice.

1. e) The Parties shall make the information referred to in paragraphs (b) and (c), including the

results of any audits, available to the competent supervisory authority on request.

9) Use of sub-processors

1. a) The data importer has the data exporter’s general authorisation for the engagement of

sub- processor(s) from an agreed list. The data importer shall specifically inform the data

exporter in writing of any intended changes to that list through the addition or

replacement of sub-processors at least 24 hours in advance, thereby giving the data

exporter sufficient time to be able to object to

such changes prior to the engagement of the sub-processor(s). The data importer shall provide the

data exporter with the information necessary to enable the data exporter to exercise its

right to object.

1. b) Where the data importer engages a sub-processor to carry out specific processing

activities (on behalf of the data exporter), it shall do so by way of a written contract that

provides for, in substance, the same data protection obligations as those binding the data

importer under these Clauses, including in terms of third-party beneficiary rights for data

subjects. The Parties agree that, by complying with this Clause, the data importer fulfils

its obligations under Clause 8.8. The data importer shall ensure that the sub-processor

complies with the obligations to which the data importer is subject pursuant to these

Clauses.

1. c) The data importer shall provide, at the data exporter’s request, a copy of such a

sub-processor agreement and any subsequent amendments to the data exporter. To the

extent necessary to protect business secrets or other confidential information, including

personal data, the data importer may redact the text of the agreement prior to sharing a

copy.

1. d) The data importer shall remain fully responsible to the data exporter for the performance

of the sub- processor’s obligations under its contract with the data importer. The data

importer shall notify the data exporter of any failure by the sub-processor to fulfil its

obligations under that contract.

1. e) The data importer shall agree a third-party beneficiary clause with the sub-processor

whereby – in the event the data importer has factually disappeared, ceased to exist in law

or has become insolvent – the data exporter shall have the right to terminate the

sub-processor contract and to instruct the sub-processor to erase or return the personal

data.

10)Data subject rights

1. a) The data importer shall promptly notify the data exporter of any request it has received

from a data subject. It shall not respond to that request itself unless it has been authorised

to do so by the data exporter.

1. b) The data importer shall assist the data exporter in fulfilling its obligations to respond to

data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In

this regard, the Parties shall set out in Annex II the appropriate technical and

organisational measures, taking into account the nature of the processing, by which the

assistance shall be provided, as well as the scope and the extent of the assistance required.

1. c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply

with the instructions from the data exporter.

11)Redress

1. a) The data importer shall inform data subjects in a transparent and easily accessible format,

through individual notice or on its website, of a contact point authorised to handle

complaints. It shall deal promptly with any complaints it receives from a data subject.

1. b) In case of a dispute between a data subject and one of the Parties as regards compliance

with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a

timely fashion. The Parties shall keep each other informed about such disputes and, where

appropriate, cooperate in resolving them.

1. d) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the

data importer shall accept the decision of the data subject to:

(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual

residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii) refer the dispute to the competent courts within the meaning of Clause1 8.

1. e) The Parties accept that the data subject may be represented by a not-for-profit body,

organisation or association under the conditions set out in Article 80(1) of Regulation

(EU) 2016/679.

1. f) The data importer shall abide by a decision that is binding under the applicable EU or

Member State law.

1. g) The data importer agrees that the choice made by the data subject will not prejudice

his/her substantive and procedural rights to seek remedies in accordance with applicable

laws.

12)Liability

 

1. a) Each Party shall be liable to the other Party/ies for any damages it causes the other

Party/ies by any breach of these Clauses.

1. b) The data importer shall be liable to the data subject, and the data subject shall been titled

to receive compensation, for any material or non-material damages the data importer or

its sub-processor causes the data subject by breaching the third-party beneficiary rights

under these Clauses.

1. c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and

the data subject shall be entitled to receive compensation, for any material or non-material

damages the data exporter or the data importer (or its sub-processor) causes the data

subject by breaching the third-party beneficiary rights under these Clauses. This is

without prejudice to the liability of the data exporter and, where the data exporter is a

processor acting on behalf of a controller, to the liability of the controller under

Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.

1. d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages

caused by the data importer (or its sub-processor), it shall be entitled to claim back from

the data importer that part of the compensation corresponding to the data importer’s

responsibility for the damage.

1. e) Where more than one Party is responsible for any damage caused to the data subject as a

result of a breach of these Clauses, all responsible Parties shall be jointly and severally

liable and the data subject is entitled to bring an action in court against any of these

Parties.

1. f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to

claim back from the other Party/ies that part of the compensation corresponding to its /

their responsibility for the damage.

1. g) The data importer may not invoke the conduct of a sub-processor to avoid its own

liability.

13)Supervision

1. a) The supervisory authority with responsibility for ensuring compliance by the data

exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in

Annex I.C, shall act as competent supervisory authority.

1. b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the

competent supervisory authority in any procedures aimed at ensuring compliance with

these Clauses. In particular, the data importer agrees to respond to enquiries, submit to

audits and comply with the measures adopted by the supervisory authority, including

remedial and compensatory measures. It shall provide the supervisory authority with

written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC

AUTHORITIES

14)Local laws and practices affecting compliance with the Clauses

1. a) The Parties warrant that they have no reason to believe that the laws and practices in the

third country of destination applicable to the processing of the personal data by the data

importer, including any requirements to disclose personal data or measures authorising

access by public authorities, prevent the data importer from fulfilling its obligations under

these Clauses. This is based on the understanding that laws and practices that respect the

essence of the fundamental rights and freedoms and do not exceed what is necessary and

proportionate in a democratic society to safeguard one of the objectives listed in Article

23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

1. b) The Parties declare that in providing the warranty in paragraph(a), they have taken due

account in particular of the following elements:

(i) the specific circumstances of the transfer, including the length of the

processing chain, the number of actors involved and the transmission channels

used; intended onward transfers; the type of recipient; the purpose of

processing; the categories and format of the transferred personal data; the

economic sector in which the transfer occurs; the storage location of the data

transferred;

(ii) the laws and practices of the third country of destination – including those

requiring the disclosure of data to public authorities or authorising access by

such authorities – relevant in light of the specific circumstances of the transfer,

and the applicable limitations and safeguards;

(iii) any relevant contractual, technical or organisational safeguards put in place to

supplement the safeguards under these Clauses, including measures applied

during transmission and to the processing of the personal data in the country

of destination.

1. c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has

made its best efforts to provide the data exporter with relevant information and agrees that

it will continue to cooperate with the data exporter in ensuring compliance with these

Clauses.

1. d) The Parties agree to document the assessment under paragraph (b) and make it available

to the competent supervisory authority on request.

1. e) The data importer agrees to notify the data exporter promptly if, after having agreed to

these Clauses and for the duration of the contract, it has reason to believe that it is or has

become subject to laws or practices not in line with the requirements under paragraph (a),

including following a change in the laws of the third country or a measure (such as a

disclosure request) indicating an application of such laws in practice that is not in line

with the requirements in paragraph (a).

1. f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has

reason to believe that the data importer can no longer fulfil its obligations under these

Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or

organisational measures to ensure security and confidentiality) to be adopted by the data

exporter and/or data importer to address the situation. The data exporter shall suspend the

data transfer if it considers that no appropriate safeguards for such transfer can be

ensured, or if instructed by the competent supervisory authority to do so. In this case, the

data exporter shall be entitled to terminate the contract, in so far as it concerns the

processing of personal data under these Clauses. If the contract involves more than two

Parties, the data exporter may exercise this right to termination only with respect to the

relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated

pursuant to this Clause, Clause 16(d) and (e) shall apply.

15)Obligations of the data importer in case of access by public authorities

 

15.1 Notification

1. a) The data importer agrees to notify the data exporter and, where possible, the data subject

promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial

authorities, under the laws of the country of destination for the disclosure of

personal data transferred pursuant to these Clauses; such notification shall

include information about the personal data requested, the requesting

authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data

transferred pursuant to these Clauses in accordance with the laws of the

country of destination; such notification shall include all information available

to the importer.

1. b)

If the data importer is prohibited from notifying the data exporter and/or the data subject

under the laws of the country of destination, the data importer agrees to use its best efforts

to obtain a waiver of the prohibition, with a view to communicating as much information

as possible, as soon as possible. The data importer agrees to document its best efforts in

order to be able to demonstrate them on request of the data exporter.

1. c)

Where permissible under the laws of the country of destination, the data importer agrees

to provide the data exporter, at regular intervals for the duration of the contract, with as

much relevant information as possible on the requests received (in particular, number of

requests, type of data requested, requesting authority/ies, whether requests have been

challenged and the outcome of such challenges, etc.).

1. d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for

the duration of the contract and make it available to the competent supervisory authority

on request.

1. e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause

14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply

with these Clauses.

15.2 Review of legality and data minimisation

1. a) The data importer agrees to review the legality of the request for disclosure, in particular

whether it remains within the powers granted to the requesting public authority, and to

challenge the request if, after careful assessment, it concludes that there are reasonable

grounds to consider that the request is unlawful under the laws of the country of

destination, applicable obligations under international law and principles of international

comity. The data importer shall, under the same conditions, pursue possibilities of appeal.

When challenging a request, the data importer shall seek interim measures with a view to

suspending the effects of the request until the competent judicial authority has decided on

its merits. It shall not disclose the personal data requested until required to do so under

the applicable procedural rules. These requirements are without prejudice to the

obligations of the data importer under Clause 14(e).

1. b) The data importer agrees to document its legal assessment and any challenge to the

request for disclosure and, to the extent permissible under the laws of the country of

destination, make the documentation available to the data exporter. It shall also make it

available to the competent supervisory authority on request.

1. c) The data importer agrees to provide the minimum amount of information permissible

when responding to a request for disclosure, based on a reasonable interpretation of the

request.

SECTION IV – FINAL PROVISIONS

16)Non-compliance with the Clauses and termination

1. a) (a) The data importer shall promptly inform the data exporter if it is unable to comply

with these Clauses, for whatever reason.

1. b) In the event that the data importer is in breach of these Clauses or unable to comply with

these Clauses, the data exporter shall suspend the transfer of personal data to the data

importer until compliance is again ensured or the contract is terminated. This is without

prejudice to Clause14(f).

1. c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the

processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant

to paragraph (b) and compliance with these Clauses is not restored within a reasonable time

and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or

supervisory authority regarding its obligations under these Clauses.

1. d) In these cases, it shall inform the competent supervisory authority of such

non-compliance. Where the contract involves more than two Parties, the data exporter

may exercise this right to termination only with respect to the relevant Party, unless the

Parties have agreed otherwise.

1. e) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data

exporter or deleted in its entirety. The same shall apply to any copies of the data. The data

importer shall certify the deletion of the data to the data exporter. Until the data is deleted

or returned, the data importer shall continue to ensure compliance with these Clauses. In

case of local laws applicable to the data importer that prohibit the return or deletion of the

transferred personal data, the data importer warrants that it will continue to ensure

compliance with these Clauses and will only process the data to the extent and for as long

as required under that local law.

 

1. f) Either Party may revoke its agreement to be bound by these Clauses where (i) the

European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU)

2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii)

Regulation (EU) 2016/679 becomes part of the legal framework of the country to which

the personal data is transferred. This is without prejudice to other obligations applying to

the processing in question under Regulation (EU) 2016/679.

17)Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such

law allows for third-party beneficiary rights. The Parties agree that this shall be the law of

Ireland.

18)Choice of forum and jurisdiction

1. a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member

State.

1. b) The Parties agree that those shall be the courts of Ireland.
2. c) A data subject may also bring legal proceedings against the data exporter and/or data

importer before the courts of the Member State in which he/she has his/her habitual

residence.

1. d) The Parties agree to submit themselves to the jurisdiction of such courts.

APPENDIX

ANNEX I

1. LIST OF PARTIES

Data exporter(s):

1. Name: Facebook Ireland Limited

Address: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2

Contact person’s name, position and contact details: Data Protection Officer, dpo@fb.com

Activities relevant to the data transferred under the Clauses: Provision of the Products by

Facebook Ireland Limited from time to time in the Territory.

Signature and date:

Data importer(s):

 

2. Name: Facebook, Inc.

Address: 1601 Willow Road, Menlo Park, CA 94025, California, United States of America

Contact person’s name, position and contact details: VP and Deputy General Counsel, legalnotices@

fb.com, or such other contact email as specified by the data importer from time to

time.

Activities relevant to the data transferred under the Clauses: Provision of services and other

activities related to the purposes of processing set out in Part 2 of this Annex.

Signature and date:

1. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Individuals who visit, access, use or otherwise interact with the Products.

Categories of personal data transferred

The personal data transferred is the personal data generated, shared and uploaded by or about

individuals who visit, access, use or otherwise interact with the Products, including:

• information related to the things users do and the information users provide when
  using the Products (such as profile information, posted photos and videos, shared
  location information, communications between users, and related information about
  use of the Products);
• information related to the data subjects that other users of the Products provide (such
  as a user’s imported contacts or photos);
• information related to users’ networks and connections (such as a user’s connections
  to groups, pages, and other users);
• information related to payments (such as information related to purchases or financial
  transactions);
• information about devices (such as information from or about the computers, phones
  or other devices where users install software provided by, or that access the Products);
• information from websites and apps that use the Products (such as information about
  visits to third- party websites or apps that use a “like” or “comment” button or other
  service integrations); and
• information from third-party partners (such as information related to jointly offered
  services or use of third party services); and
• information from affiliates of Facebook and companies in the Facebook family of
  companies.
  Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take
  into consideration the nature of the data and the risks involved, such as for instance strict
  purpose limitation, access restrictions (including access only for staff having followed
  specialised training), keeping a record of access to the data, restrictions for onward transfers
  or additional security measures.
  Such data may include:
• personal data revealing racial or ethnic origin, political opinions, religious or
  philosophical beliefs, or trade union membership, data concerning health or data
  concerning a natural person's sex life or sexual orientation; and
• genetic data and biometric data (as those terms are defined in the GDPR) for the
  purpose of uniquely identifying a natural person.
  The applied restrictions or safeguards are specified in Annex II. Additional restrictions or
  safeguards for special categories of data listed in this section may be notified by the data
  exporter to the data importer from time to time, including as set out in the data exporter’s
  relevant policies.
  The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous
  basis).
  Continuous
  Nature of the processing The nature of the processing is the performance of such operations as may be necessary in
  order to carry out the data exporter’s instructions in connection with the intra-group services
  and support provided by the data importer, to the extent relevant to the Products. Such
  processing operations will include collection, recording, organisation, structuring, storage,
  adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination
  or otherwise making available, alignment or combination, restriction, erasure and / or
  destruction.

 

Purpose(s) of the data transfer and further processing

Depending on the Products visited, accessed, or used by the data subject, and subject to any

relevant permissions, controls and other internal instructions, the purposes of processing

include:

• providing infrastructure services by providing data networking, peering, hosting,
  processing and related services, including data routing and temporary data caching
  services to deliver, facilitate, and optimise fast and reliable network connections
  between the Parties, their Affiliates, and users of the data exporter’s Products;
• providing general and administrative services generally required for the operation and
  support of the data exporter’s business including human resources, recruiting, finance,
  accounting, communications and policy, management services, and other business or
  administrative services as may be requested by the data exporter from time to time;
• providing sales and marketing services by (for example):
  
  
• carrying out external communications and conducting market growth and
  analytics assessments;
• developing and supporting relationships with external partners to help them
  leverage the Products in their businesses;
• supporting the data exporter’s advertisers, including identifying potential
  target advertisers;
• facilitating communications with users via mobile network services, including
  sending messages for registration and account security purposes, for providing
  platform updates and other engagement messages, or to respond to user
  requests;
• activities in connection with the provision of marketing and sales support,
  including generating reports about the effectiveness of such advertising,
  identifying issues arising from the delivery and implementation of such
  advertising; and
• howing and measuring ads and services (such as displaying relevant ads and
  measuring the effectiveness of ads), reviewing ad content and ensuring
  compliance with advertising policies;
• providing, testing, improving, fixing, and customising the Products to improve and
  support users’ experience, personalise content, enable communications between users,
  make suggestions, conduct surveys and research, and customise services based on
  location, and trouble-shoot issues;
• providing user and customer support services and communicating with users,
  responding to queries as well as explaining terms and policies and providing updates
  about the Products
• promoting safety and security on the Products (such as developing and operating an
  incident management process, using information to verify accounts, investigate
  suspicious activity or possible violations of terms or policies) and operating an
  integrity program for investigating and proactively responding to legal process and
  governmental requests (including from law enforcement agencies);
• developing new and existing Products by identifying and testing new features and
  providing technical engineering support, conducting trouble-shooting activities, as
  well as general information technology and communication services, help desk
  support activities and all related services;
• acting as a tax agent in respect of potential US and international tax obligations of the
  data exporter;
• performing research and development services and all activities in connection with
  conducting and supporting research and innovation and the development, testing and
  improvement of the Products; and
• assisting with user and non-user queries and complaints (for example for regulatory
  compliance purposes) by communicating with users and non-users (including
  receiving, reading, sending, sharing, responding to queries and complaints);
• providing legal advisory, legal support and other legal related services (such as
  developing and maintaining records of processing activities, and operating a process
  for reactive disclosures to law enforcement agencies); and
• providing contract administration, project management, planning and related services
  (such as developing and operating a contract management system, and developing and
  operating a third party oversight and management program).
  The period for which the personal data will be retained, or, if that is not possible, the criteria
  used to determine that period
  The data importer shall retain personal data transferred pursuant to this Agreement for the
  duration of this Agreement, unless obliged to delete, return or retain such personal data in
  accordance with this Agreement or in accordance with any applicable Facebook group
  retention policy or applicable law.
  For transfers to (sub-) processors, also specify subject matter, nature and duration of the
  processing
  Not applicable.

1. COMPETENT SUPERVISORYAUTHORITY

Identify the competent supervisory authority in accordance with Clause 13

Data Protection Commission, Ireland

ANNEX II

TECHNICALAND ORGANISATIONAL MEASURES INCLUDING TECHNICALAND

ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s)

(including any relevant certifications) to ensure an appropriate level of security, taking into

account the nature, scope, context and purpose of the processing, and the risks for the rights

and freedoms of natural persons.

The data importer shall implement the security objectives described below to protect its

systems, including the physical, technical, and administrative controls that govern access to

and use of the data importer's systems. Properly implemented, the measures below represent a

description of the technical and organisational security measures that the data exporter

considers appropriate to ensure the security of the data, taking into account the nature, scope,

context and purposes of the processing activity as well as the potential risk to the rights and

freedoms of natural persons.

To enable oversight of the data importer’s implementation of the measures, the data importer

shall have in place a dedicated security team to oversee the development, implementation,

effectiveness testing and ongoing maintenance of a security program, in order to realise these

security requirements.

The data importer shall also, at the request of the data exporter, be able to describe the means

by which it is achieving these security requirements and shall maintain appropriate records

and other evidence to enable the data exporter to perform oversight of the implemented

security measures.

 

1. Application Security

The data importer shall implement appropriate security measures to prevent, detect and

mitigate threats/flaws in its products and services throughout the development lifecycle.

These measures include:

1. Implementation and maintenance of secure application frameworks as part of the

software development lifecycle.

1. Controls to identify bugs and triage, monitor and mitigate them through the use of

static and dynamic analysis tools, a bug bounty program, and mutual code reviews.

2. Asset Management

The data importer shall actively manage (inventory, track, and correct) devices on its

network, so that only authorised devices are given access. Such measures must include

requirements for user identification and authorisation.

These measures include:

1. Asset acquisition, including intake request and purchase approval, must occur in

accordance with relevant policies (as updated from time to time) through defined processes

and approved channels.

1. Maintenance of an asset inventory, tracking all assets throughout their lifecycle.
2. End of life asset management procedures in accordance with relevant policies (as

updated from time to time) to ensure sanitization and destruction of all decommissioned

production and non-volatile memory media including certification of sanitisation/destruction

where appropriate.

1. Mobile devices come with a pre-installed mobile device management (“MDM”)

solution that allows controlled access to networks and has the ability to remotely wipe lost or

stolen mobile devices.

1. Devices are quarantined if they do not connect with the MDM solution regularly.
2. Business Continuity and Disaster Recovery

The data importer shall protect critical business processes from the effects of major failures

of information systems or disasters and ensure their timely resumption in the event of an

incident. These measures must include requirements for ensuring ongoing availability and

resilience of processing systems and services and for the ability to restore availability and

access to personal data in a timely manner in the event of an incident.

These measures include:

1. Implementation of a disaster recovery program that focuses on making information

systems resilient against failures and disasters with designated personnel with responsibility

for developing and improving disaster recovery capabilities.

1. Perform data backups to enable resumption of system operations in an event of

failure.

1. Replication of data across multiple data center regions across the globe and

automatically route and load-balance network traffic based on latency and network health

checks.

1. Regular disaster recovery tests and, based on the learning from these tests, works to

update and improve its disaster recovery processes and automated technologies.

4. Security Compliance, Policy and Risk

The data importer shall align security objectives with business goals, applicable laws and

regulations through the creation and maintenance of appropriate documentation, while

effectively managing risk and meeting compliance requirements

These measures include:

1. An established security leadership team including key stakeholders to operate,

maintain and continually develop a comprehensive information security program through an

integrated system of policies, standards, guidelines and controls.

1. Maintenance of a suite of information security policies based on a standard policy

framework.

(a)

Provide risk-based security requirements and measurable security recommendations

in policy form;

(b)

Provide guidance on the adoption of requirements and recommendations;

(c)

Procedures regarding the policy development lifecycle (development,

implementation, maintenance, and exception management).

1.  

Regular assessments of compliance with security policies, frameworks, and regulatory

requirements.

1.  

Maintenance of a risk program which includes risk assessment and risk management

procedures.

1.  

Inputs from activities such as vulnerability scanning, penetration testing, and product

security reviews are used to determine risks.

5.  

Configuration Management

The data importer shall have in place measures to configure systems and applications in a

consistent and secure manner.

These measures include:

 

1. Configuration settings, including secure baselines are maintained through a system

management tool for production servers, mobile devices and network devices:

(a) Baseline configurations are stored in a central repository and define the services

available on each system and how those services should be configured;

(b) Standard configurations are established for network devices.

1. Automated tools verify that standard device configurations are being used and detect

changes to configurations.

1. Security configurations are managed through configuration management and change

control processes.

6. Change Management

The data importer shall have in place measures to ensure changes to critical systems follow

approved procedures and are tracked through version control tools.

These measures include:

1. Formal process and internal tracking system to initiate and log changes, review, and

test code changes ensuring integrity and accountability for code changes.

1. Formal process and internal tracking system to initiate, log, review and test

configurations changes ensuring integrity and accountability for configuration changes.

1. Monitoring changes for a period of time before full deployment to all production

systems.

7. Data Security

The data importer shall have in place security measures to protect data confidentiality,

integrity and availability throughout the data lifecycle, from creation until deletion.

Such measures must ensure ongoing confidentiality and integrity of processing systems and

services and include requirements for the protection of data during transmission and storage.

These measures include:

1. Implementation of policies and standards such as data classification standards that

require that appropriate security and access controls be implemented, taking into account data

type, business need, the nature and purpose of processing, legal requirements, and roles and

responsibilities of accessing parties:

(a) Specific Facebook policies apply to access to and use of Facebook user data;

(b) Noncompliance with such policies may result in a formal disciplinary process.

1. Facebook policies define permitted and prohibited data sharing, based on data

classification.

1. Data is not shared externally without first obtaining approval from appropriate

stakeholders including Legal, and, where appropriate or required, implementation of a

non-disclosure agreement.

1. Internal sharing of confidential / private data is subject to Facebook’s principle of

least privilege requirements (which requires that personnel have only the minimum level of

access necessary to perform their roles and job responsibilities).

1. Critical data elements such as passwords, biometric templates and payment card

information are encrypted at rest;

1. Full disc or file based encryption is implemented on all managed laptops and mobile

devices.

1. Encryption of data in transit across public networks using strong industry protocols.
2. Identity and Access Management

The data importer shall implement technical and organisational measures to provide security

throughout the identity and access management lifecycle by ensuring access to data and

systems are provisioned to the authorised people through correct channels

These measures include:

 

1. User identity is tied to a unique account and access is limited based on role, elevated

access such as administrative or super-user access that allows for the full control of critical

identity and access management systems is restricted to authorized personnel.

1. Review of accounts with elevated access to ensure appropriate assignment of those

privileges.

1. Identity management systems (or directory services) are used for managing:

(a) Account access credentials providing access to information systems, e.g. the corporate

or production network; and

(b) elevated access credentials.

1. Access credentials may not be shared with unauthorized individuals, stored on

unauthorized devices, or retained in an insecure manner.

1. Changes to access levels are logged for analysis and investigative purposes.
2. Automatically disable account access credentials, providing access to information

systems, e.g. the corporate or production network, assigned to employees including

contractors and contingent workers after their termination date.

1. Passwords must meet password complexity requirements as defined in the password

and passcode complexity standard.

1. Multi-factor authentication is enabled, where possible, for all information systems.
2. Cryptographically protect or otherwise secure user passwords when stored and when

in transit over the Internet or other similar transmission channels.

9. Logging and Monitoring

 

The data importer shall ensure that security logs are effectively generated, protected and

reviewed to support the detection and investigation of suspicious events in production and

corporate systems.

These measures include:

 

1. Logging and monitoring systems are designed to generate logs of event types that

enable security related activities be detected.

1. Logs are sent to remote log aggregator systems.
2. Clocks are synchronised to a single referenced time source.
3. Logs are protected in transit where appropriate.
4. Logs are protected against unauthorized changes or access.
5. Logs are backed up according to defined schedules and retention policies.
6. Procedures are in place to ensure that alerts triggered by monitoring and detection

tools are routed to dedicated security Personnel, reviewed and triaged based on the type of

alert, and escalated where appropriate.

1. Endpoint-monitoring software is in place to log and monitor activity on managed IT

assets.

10. Network Security

The data importer shall have in place measures to securely design, protect and manage the

supporting network infrastructure (including firewalls, routers, switches, and related

infrastructure) and to protect information flowing in its networks from unauthorised access.

These measures include:

 

1. Protecting data and information systems against unauthorized access based on the

risks associated with each network, including guest networks, and the internet by using:

network segmentation, security zones, access contro lists, traffic monitoring, firewalls and

demilitarised zones (i.e. subnetworks that are physically or logically separated from each

other and internal networks).

1. Centralized authentication and authorization services used to access and manage

network assets.

1. The use of secure protocols for remote access to critical systems such as an approved

VPN client and 2-factor authentication.

1. The use of firewalls, host-based filtering, anti-spoofing technologies on perimeter and

edge information systems.

1. Regular review of firewall and router configurations including automated port scans

for service discovery to ensure that the configuration rules comply with applicable security

requirements.

1. DDoS detection and mitigation mechanisms in place to protect the network from

denial of service attacks.

11. People Security

The data importer shall have in place processes which establish security expectations and

responsibilities for its personnel before, during and after termination of employment.

These measures include:

1. Background checks are completed on employees and agency workers prior to

commencing employment.

1. Employees and agency workers must sign confidentiality agreements prior to

commencing employment.

1. Providing training to new hires on information security policies and procedures with

further training related to job roles as appropriate.

1. Continuing security awareness training is provided to personnel throughout their

employment.

1. Assets are returned upon termination of employment or contract.
2. Physical Security

The data importer shall have in place measures to prevent unauthorised physical access to

organisational assets and systems, to protect them from damage, misuse, destruction of theft.

These measures include requirements for physical security of locations at which personal data

are processed.

These measures include:

1. Visitor management processes to ensure visitors register at reception, present a valid

ID, and sign a non-disclosure agreement, or otherwise obtain an approved exception.

1. Visitors are escorted by employees while on premises at all times.
2. On-premises guard staff are responsible for monitoring facilities and responding to

physical security alerts through a Security Operations Center that is continually operational

(24x7).

1. Access is controlled through access badges issued to personnel (including employees,

interns, contingent workers, and vendors).

1. Access to higher risk areas is monitored through enhanced physical and electronic

means with badge access privileges limited to personnel on a need to access basis. Data

centres may use additional security measures including biometric devices.

1. Pre-approval is required to access data centres and access to data centres is reviewed

regularly.

1. Protect data centre equipment from damage, destruction and/or interruption due to

environmental factors, these measures include:

1. Temperature and humidity level controls to monitor and maintain appropriate

environmental conditions;

(a) Fire detection and suppression equipment is in place at all data centres;

(b) Redundant secondary power (UPS/CPS), backup generator units, and backup

telecommunications to support critical systems in the event of a utility outage.

13. Security Incident Response

The data importer shall have in place measures to prepare for, respond to and learn from

security incidents in an effective manner.

These measures include:

1. A security incident response policy which provides instruction on which security

teams should be included in assisting in incident response efforts.

1. Dedicated teams for handling a variety of security incidents including, but not limited

to, incidents involving external threat actors, internal threat actors, lost or stolen devices,

service disruptions, incidents involving regulated data, and incidents requiring coordination

with law enforcement.

14. Third Party Security

The data importer shall have in place measures to protect the security of data that is accessed,

processed, transferred to, shared with, or managed by external parties and vendors.

 

These measures include:

 

1. Processes in place for conducting due diligence on service providers who may receive

or be granted access to data in order to evaluate whether their data security standards are

appropriate in order to protect data.

1. Vendor security assessments are conducted by security personnel and are based on a

range of factors.

1. The level of assessment conducted for each vendor is determined according to the

type of data the vendor may process and the nature of anticipated connectivity.

1. Critical issues identified during the assessment process must be remediated before a

vendor is onboarded.

1. Depending on the sensitivity of data shared with the service provider and other

factors, the service provider may be required to undergo a periodic or random security

assessment.

15. Vulnerability Management

The data importer shall have in place measures to prevent, detect, and remediate software

vulnerabilities in its corporate and production infrastructure. The measures include processes

for regularly testing, assessing and evaluating vulnerabilities to ensure security of processing.

These measures include:

 

1. Maintenance of an inventory of infrastructure assets in order to provide the basis for

review and analysis for vulnerabilities.

1. Performing regular vulnerability scans/detection on both internal and external systems

to identify and evaluate the risks posed by vulnerabilities.

1. Testing the codebase for vulnerabilities (and incorporating new threat information into

the testing).

1. Coordinate with owners of affected products or systems to resolve the vulnerabilities

according to severity level and defined service levels.

1. Conduct annual penetration tests to evaluate critical systems and processes for

vulnerabilities.

16. Data Protection Principles and Data Subject Rights

In accordance with the data exporter’s instructions, the data importer shall have in place

measures to ensure that personal data is:

 

1. adequate, relevant and limited to what is necessary in relation to the purposes for

which it was processed; and

1. accurate and, where necessary, kept up to date (every reasonable step must be taken to

ensure that personal data which is inaccurate, having regard to the purposes for which it is

processed, is erased or rectified without delay).

The data importer shall be responsible for its own compliance with obligations under the

Clauses and this Annex II, and shall be able to demonstrate such compliance upon request.

The data importer shall have appropriate measures in place to retain and delete personal data

in accordance with the relevant retention policies (as updated from time to time), and subject

to requirements under applicable law.

The data importer shall have appropriate measures in place to assist the data exporter in

complying with its obligations in respect of data subject rights, including rights of access,

rights to rectification, right to restriction of processing, right to data portability (including by

utilising commonly-used file formats), and at the direction of the data exporter shall utilise

automated tools to enable users to exercise their rights of access and portability directly. The

data importer shall have appropriate measures in place to comply with the data exporter’s

relevant data subject rights policies.

 

 

1. A notice, request or investigation by a Supervisory Authority concerning Customer Personal Data; or
2. Complaints or requests received directly from Customer's data subjects, particularly requests for access, correction, erasure, restriction, portability, blocking or deletion of Customer Personal Data. LinkedIn will not provide a substantive response without Customer's prior written consent.

5.3 Assistance to Customer. LinkedIn will provide reasonable assistance to Customer:

1. With data subject requests concerning access to, correction, erasure, restriction, portability, blocking or deletion of Customer Personal Data processed by LinkedIn for Customer. If a data subject submits such a request directly to LinkedIn, LinkedIn will promptly forward it to Customer;
2. With investigating Personal Data Breaches and notifying the Supervisory Authority and Customer's data subjects of them; and
3. Where applicable, with preparing data protection impact assessments and, where necessary, consulting a Supervisory Authority.

5.4 Required processing. If Data Protection Requirements oblige LinkedIn to process Customer Personal Data for a reason other than providing the services described in the Agreement, LinkedIn will inform Customer before processing, unless prohibited by law, for example by confidentiality rules under applicable EU Member State law.

5.5 Security. LinkedIn will:

1. Maintain appropriate organisational and technical security measures to protect Customer Personal Data against unauthorised or accidental access, loss, alteration, disclosure or destruction. Measures concerning personnel, premises, hardware, software, storage and networks include access controls, monitoring and logging, vulnerability and security breach detection, incident response, and encryption in transit and at rest. They include the measures described in Annex D to this DPA, which applies as Annex II to the Standard Contractual Clauses;
2. Take responsibility for adequate security, privacy and confidentiality arrangements for all LinkedIn employees handling Customer Personal Data, and liability for their failure to comply with this DPA;
3. Take reasonable steps to ensure all LinkedIn employees protect the security, privacy and confidentiality of Customer Personal Data in accordance with this DPA, which applies as Annex II to the Standard Contractual Clauses; and
4. Inform Customer of any Personal Data Breach by LinkedIn, its subprocessors or other third parties acting on its behalf without undue delay and, in any event, within 48 hours of becoming aware of it.
5. Where a Personal Data Breach results from (i) negligent or intentional misconduct by LinkedIn or a LinkedIn subprocessor under Section 5.1(f), or (ii) LinkedIn's material non-compliance with this DPA, LinkedIn will bear all investigation and remediation costs. LinkedIn will reasonably reimburse Customer for costs associated with legally required notifications to data subjects, credit monitoring or other appropriate remedial measures, provided LinkedIn, as processor, fulfils its obligations under Section 5.3(b) of this DPA.

 

6. AUDIT AND CERTIFICATION

6.1 Supervisory Authority audit of Customer. If a Supervisory Authority requires an audit of the data processing facilities where LinkedIn processes Customer Personal Data to verify or monitor Customer's compliance with Data Protection Requirements, LinkedIn will cooperate. Customer bears all associated costs and fees, including reasonable costs and fees for LinkedIn's time and rates for services provided.

6.2 Audits. On request, LinkedIn will provide Customer annually with an opinion or report on the service organisation's controls issued by an accredited independent auditor under Statement on Standards for Attestation Engagements No. 18 (“SSAE 18”) or International Standard on Assurance Engagements 3402 (“ISAE 3402”), applicable to the services under the Agreement. Each is a “Report”. If, in Customer's reasonable judgement, a Report does not provide sufficient information to confirm compliance with this DPA, Customer or a recognised independent auditor agreed by Customer and LinkedIn may audit compliance during normal business hours, with reasonable notice and appropriate confidentiality procedures. Customer bears all associated costs and fees, including reasonable costs and fees for LinkedIn's time and rates for services provided. Before an audit, Customer and LinkedIn will agree its scope, timing and duration. Customer will promptly inform LinkedIn of any non-compliance found. Customer may audit LinkedIn only once a year.

7. DATA TRANSFERS

7.1 For transfers of EU Personal Data to LinkedIn for processing outside the EU, EEA or a country recognised by the European Commission as providing adequate protection, each party agrees to use Module 2 of the Standard Contractual Clauses for controller-to-processor transfers, incorporated by reference. The parties agree that: (i) Ireland's Data Protection Commission is the competent Supervisory Authority under Clause 13; (ii) data subjects whose EU Personal Data is processed by a LinkedIn entity are third-party beneficiaries under the applicable clauses; (iii) the clauses are governed by Irish law, which permits third-party beneficiary rights under Clause 17; and (iv) disputes arising from the clauses are determined by the Irish courts under Clause 18. Annex A to this DPA constitutes Annex I to the clauses, and Annex D constitutes Annex II.

 

 

7.2 If LinkedIn is or becomes unable to meet these requirements, EU Personal Data will be processed and used solely within an EU Member State, and any transfer to a third country requires Customer's prior written consent. LinkedIn will promptly inform Customer of any inability to comply with this Section 7. Notwithstanding this, where transfers under this section involve UK Personal Data sent to LinkedIn for processing outside the UK or a country recognised as adequate by the UK Information Commissioner's Office: (1) each party agrees to use the 2010 SCCs for UK Personal Data processing for as long as they remain legally permissible for these transfers; and (2) Annexes A and D constitute Annexes I and II respectively. If the Information Commissioner's Office confirms that a UK addendum to the EU SCCs is required to rely lawfully on them for UK Personal Data transfers: (a) the SCCs used for EU Personal Data also apply to UK Personal Data transfers; (b) the UK addendum is deemed executed by Customer and LinkedIn; and (c) the parties' SCCs are deemed amended as specified in that addendum. The UK Information Commissioner is the sole Supervisory Authority for UK Personal Data transfers under this Agreement.

8. RETURN AND DELETION OF DATA

The parties agree that, when data processing services end or on Customer's reasonable request, LinkedIn will, at Customer's choice, return or securely destroy all Customer Personal Data and copies, demonstrate to Customer's satisfaction that it has done so, and instruct its subprocessors to do the same, unless Data Protection Requirements prevent return or destruction of some or all of the disclosed data. In that case, LinkedIn will maintain confidentiality and process retained data actively only to comply with applicable laws. For clarity, LinkedIn may continue to process data aggregated so that it does not identify individuals or customers to improve its systems and services.

9. CONTROLLER-TO-CONTROLLER SCENARIOS

Some services may provide an integrated view and export of LinkedIn members' personal data that Customer can already access on LinkedIn.com in accordance with members' privacy settings. For GDPR purposes, where a member controls an export or Customer already has access, Customer and LinkedIn are independent controllers of personal data originally obtained through LinkedIn services. Each acts as controller of its own copy. When each party acts as controller under applicable Data Protection Requirements, it will reasonably cooperate with the other to enable the exercise of rights under the GDPR and other applicable requirements. Where both parties are controllers and a transfer between them involves EU Personal Data sent outside the EU, EEA or a country recognised by the European Commission as adequate, each party agrees to use Module 1 of the Standard Contractual Clauses, incorporated by reference. The parties agree that: (i) Ireland's Data Protection Commission is the competent authority under Clause 13; (ii) data subjects whose EU Personal Data a LinkedIn entity processes are third-party beneficiaries; (iii) Irish law, which permits third-party beneficiary rights under Clause 17, governs the clauses; and (iv) disputes are determined by Irish courts under Clause 18. Notwithstanding this, where transfers under this Section 9 involve UK Personal Data sent to LinkedIn for processing outside the UK or a country recognised as adequate by the Information Commissioner's Office: (1) each party agrees to use the 2004 controller-to-controller SCCs, incorporated by reference, for as long as legally permissible; (2) Annexes A and D constitute Annexes I and II respectively; and (3) for Section II(h), the importer processes UK Personal Data at its discretion in accordance with the data processing principles in Annex A to the SCCs. If the Information Commissioner's Office confirms that a UK addendum is required to rely lawfully on those clauses: (a) the SCCs used for EU Personal Data under Section 9 also apply to UK Personal Data; (b) the UK addendum is deemed executed by Customer and LinkedIn; and (c) their SCCs are deemed amended as specified in the addendum.

The parties acknowledge and agree that each acts independently as controller and that they are not joint controllers within the meaning of the GDPR.

10. EXTERNAL PROCESSORS

Customer acknowledges that, when providing certain services, such as applicant tracking, learning management and CRM systems, LinkedIn may transfer Customer Personal Data to external processors and otherwise interact with them upon Customer's instructions. Where such transfers occur, Customer is responsible for entering into separate contracts requiring those external processors to comply with Data Protection Requirements. For clarity, these external processors are not subprocessors.

11. TERM

This DPA remains in force while LinkedIn processes personal data on Customer's behalf, or until the LinkedIn Agreement ends and all personal data has been returned or deleted under Section 8 above.

12. GOVERNING LAW AND JURISDICTION

Notwithstanding any other provision of the Agreement, this DPA is governed by Irish law, and any action or proceedings relating to it, including non-contractual disputes or claims, will be brought in Dublin, Ireland. However, a dispute concerning the processing of UK Personal Data under this GDPR provision is governed by the law of England and Wales.

ANNEX / APPENDIX 1: DESCRIPTION OF THE TRANSFER

Categories of data subjects whose personal data is transferred:

Module 1 (controller to controller): registered LinkedIn.com users (“LinkedIn Members”)

Module 2 (controller to processor):

Services Where applicable	Categories of data subjects whose personal data is transferred:
Talent/recruitment	- Employees, contractors, partners and/or customers of the data exporter - Prospective and actual candidates of the data exporter - Third parties in the data exporter's applicant tracking system, generally parties with an actual or potential relationship to it, such as prospective or actual candidates or employees
LinkedIn Learning	- Employees, contractors, students, non-standard users individually approved by LinkedIn, and/or library users of the data exporter
Glint/Engage	- Employees of the data exporter