01Security of Processing
Chickpea shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by applicable Data Protection Laws.
02Sub-Processors
Chickpea shall not engage a sub-processor without the Customer’s prior written authorisation to the extent required by applicable Data Protection Laws. Where authorised, Chickpea shall ensure by written contract that the sub-processor implements equivalent data protection measures.
03Audit and Access Rights
Upon reasonable written notice, the Customer may request information reasonably necessary to demonstrate Chickpea’s compliance with applicable Data Protection Laws as a processor, where required to meet legal or regulatory obligations. On-site inspections shall only be conducted where required by law or a regulatory authority and shall be subject to Chickpea’s reasonable confidentiality and security procedures.
04Information Security Incidents
Chickpea shall notify the Customer without undue delay of any personal data breach affecting Personal Data processed on the Customer’s behalf, to the extent required by applicable Data Protection Laws, and shall reasonably cooperate with the Customer to meet its breach notification obligations.
05Data Subject Rights
Taking into account the nature of the processing, Chickpea shall assist the Customer, to the extent required by applicable Data Protection Laws, in responding to Data Subject requests relating to Personal Data processed on the Customer’s behalf.
06Return or Deletion of Data
Upon termination of the Agreement or written request by the Customer, Chickpea shall, to the extent required by applicable Data Protection Laws and unless otherwise required by law, delete or return the Personal Data and delete existing copies.
07International Transfers
Chickpea shall not transfer Personal Data outside the United Kingdom or European Economic Area unless the transfer complies with applicable Data Protection Laws.
08Limitation of Additional Obligations
Chickpea shall not be required under this Appendix or the Agreement to provide information, allow access or take action beyond the requirements of applicable Data Protection Laws as they apply to data processors.
09Approved Sub-Processors and Transfer Locations
Approved locations of transfer and/or processing outside the United Kingdom or European Economic Area:
- -United States, including Nevada and California
- -South Africa, including Johannesburg
- -Spain
- -Gibraltar