SCHEDULE 3
DEFINITIONS AND INTERPRETATION
Definitions:
“Controller” (or data controller), “Processor” (or data processor), “Data Subject”, “international organisation”, “Personal Data” and “processing” all have the meanings given to those terms in DP Laws (and related terms such as “process” shall have corresponding meanings);
“Data Subject Request” means a request made by a Data Subject to exercise any rights of Data Subjects under DP Laws;
“DPIA” means a Data Protection Impact Assessment, as defined in DP Laws;
“DP Laws” means any law, enactment, regulation, regulatory policy, by law, ordinance or subordinate legislation relating to the processing, privacy, and use of Personal Data, as applicable to Enigma and/or the Introducer, including:
a) in the UK:
i. the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any laws or regulations implementing Council Directives 95/46/EC (“Data Protection Directive”) or 2002/58/EC (“ePrivacy Directive”); and/or
ii. the General Data Protection Regulation ((EU) 2016/679) (“GDPR”), and/or any corresponding or equivalent national laws or regulations; and
b) in other EU countries: the Data Protection Directive, the ePrivacy Directive and/or the GDPR, and all relevant Member State laws or regulations giving effect to these Directives or corresponding with this Regulation, and includes any judicial or administrative interpretation of them, any guidance, guidelines, codes of practice, approved codes of conduct or approved certification mechanisms issued by any relevant Supervisory Authority;
“DP Losses” means all liabilities, including:
a) costs (including legal costs), claims, demands, actions, settlements, charges, procedures, expenses, losses and damages (whether material or non-material) and
b) to the extent permitted by any applicable law or regulations:
i. administrative fines, penalties, sanctions, liabilities or other remedies imposed by a Supervisory Authority or any other relevant Regulatory Authority;
ii. compensation to a Data Subject ordered by a Supervisory Authority;
iii. the reasonable costs of compliance with investigations by a Supervisory Authority or any other relevant Regulatory Authority;
“Protected Data” means Personal Data received from or on behalf of Enigma, including via the Account Management System;
“Sub-Processor” means another Processor, including any Sub-Introducer, Associate, contractor and/or sub-contractor, engaged by the Introducer for carrying out processing activities in respect of the Protected Data on behalf of Enigma and authorised by Enigma in accordance with paragraph 1.6; and
“Supervisory Authority” means any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering DP Laws.
Interpretation
To the extent that a term of this Agreement requires the performance by a party of an obligation “in accordance with DP Laws” (or similar) this requires performance in accordance with such DP Laws as are in force and applicable at the time of performance and, if the relevant obligation is not then a requirement under applicable DP Laws, it shall not apply until such time as it is so required.
DATA PROTECTION
1.1. The parties agree that, for Protected Data, Enigma shall be the Controller and the Introducer shall be the Processor.
1.2. Each party shall comply with DP Laws and its relevant obligations under this Agreement. The Introducer shall procure that any Sub-Processor that has access to Protected Data shall comply with the Introducer’s obligations under this Agreement.
1.3. Where the Introducer processes Protected Data on behalf of Enigma, the Introducer shall:
1.3.1. (and shall procure that any person acting under its authority who has access to Protected Data) process the Protected Data only on and in accordance with Enigma's documented instructions as set out in this paragraph 1; and
1.3.2. immediately inform Enigma of any legal requirement under any applicable law or regulations that would require the Introducer to process the Protected Data otherwise than only on the Processing Instructions, or if any Enigma instruction infringes DP Laws.
1.4. The Introducer shall implement and maintain, at its cost and expense, appropriate technical and organisational measures in relation to the processing of Protected Data by the Introducer:
1.4.1. such that the processing will meet the requirements of DP Laws and ensure the protection of the rights of Data Subjects;
1.4.2. so as to ensure a level of security in respect of Protected Data processed by it is appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Protected Data transmitted, stored or otherwise processed.
1.5. Without prejudice to paragraph 1.4.2, the Introducer shall, in respect of all Protected Data processed by it under this Agreement comply with the requirements regarding security of processing set out in DP Laws, all relevant policies of Enigma and in this Agreement.
1.6. The Introducer shall not engage another Processor to perform specific processing activities in respect of the Protected Data on behalf of Enigma without Enigma's prior written consent and, if Enigma gives its consent, the Introducer shall appoint the Sub-Processor under a binding written contract (“Processor Contract”) which imposes the same data protection obligations as are contained in this Agreement on the Sub-Processor, in particular under paragraph 1.41.4 and the conditions in this paragraph 1.6 for engaging another Processor.
1.7. The Introducer shall:
i. ensure that any persons it authorises to process the Protected Data have signed agreements requiring them to keep Protected Data confidential.
ii. take all reasonable steps to ensure the reliability of any such persons processing Protected Data; and
iii. ensure that such persons receive adequate training on compliance with this Schedule and the DP Laws applicable to the processing.
1.8. The Introducer shall implement and maintain, at its cost and expense, appropriate technical and organisational measures to assist Enigma in the fulfilment of Enigma's obligations to respond to Data Subject Requests relating to Protected Data, including to ensure that all Data Subject Requests it receives are recorded and then referred to Enigma within three days of receipt of the request.
1.9. The Introducer shall provide reasonable assistance, information and cooperation to Enigma to ensure compliance with Enigma's obligations under DP Laws.
1.10. The Introducer shall not transfer any Protected Data to any country outside the European Economic Area (“EEA”) or to any international organisation (an “International Recipient”) without Enigma's prior written consent and, if Enigma consents to the transfer of Protected Data to an International Recipient, the Introducer shall ensure that such transfer (and any onward transfer):
i. is pursuant to a written contract including provisions relating to security and confidentiality of the Protected Data;
ii. is effected by way of a legally enforceable mechanism for transfers of Personal Data as may be permitted under DP Laws from time to time (the form and content of which shall be subject to Enigma's written approval);
iii. complies with paragraph 1.3.1; and (iv) otherwise complies with DP Laws.
1.11. The Introducer shall maintain complete, accurate and up to date written records of all categories of processing activities carried out on behalf of Enigma containing such information as required under DP Laws and any other information Enigma reasonably requires (“Processing Records”), and shall make available to Enigma on request in a timely manner such information (including the Processing Records) as is reasonably required by Enigma to demonstrate compliance by the Introducer with its obligations under DP Laws and this Agreement, which Enigma may disclose to its Associates or to the Supervisory Authority or any other relevant Regulatory Authority.
1.12. The Introducer shall allow for and contribute to audits, including inspections, conducted by Enigma, the Supervisory Authority and any other Regulatory Authority, or another auditor mandated by Enigma for the purpose of demonstrating the Introducer’s compliance with its obligations under DP Laws and this Agreement, subject to Enigma giving the Introducer reasonable prior notice of such audit and/or inspection (or such notice as is provided by the Supervisory Authority or other Regulatory Authority), and ensuring that any auditor is subject to binding obligations of confidentiality and that such audit or inspection is undertaken so as to cause minimal disruption to the Introducer’s business and other customers.
1.13. In respect of any personal data breach (actual or suspected) related to this Agreement, the Introducer shall notify Enigma of the breach without undue delay (but in no event later than twelve (12) hours after becoming aware of the personal data breach) and provide Enigma without undue delay (wherever possible, within twenty four (24) hours of becoming aware of the breach) with such details relating to the breach as Enigma reasonably requires.
1.14. The Introducer shall without delay, at Enigma's written request, either securely delete or return all the Protected Data to Enigma in a format and on media as reasonably requested by Enigma on expiry or termination of this Agreement or, if earlier, as soon as processing by the Introducer of any Protected Data is no longer required for the Introducer’s performance of its obligations under this Agreement, and securely delete existing copies (unless storage of any data is required by any applicable law or regulation, and if so the Introducer shall notify Enigma of this).
The Introducer shall indemnify and keep indemnified Enigma in respect of all DP Losses suffered or incurred by, awarded against or agreed to be paid by Enigma, arising from or in connection with the Introducer acting outside or contrary to Enigma's lawful instructions or any breach by the Introducer of its data protection obligations under this Schedule.