A. List of Parties
Data exporter: Customer is the data exporter. The data exporter is a user of the Services.
The data exporter’s data protection contact (and EU/UK representative if applicable) is as detailed in the Engagement Letter or as otherwise provided to the data importer.
Data importer: The data importer is the Azets entity identified in the Engagement Letter. The data importer provides the Services.
The data importer’s data protection contact details are as specified in the DPA.
B. Description of Transfer
Data Subjects: The categories of Data Subjects whose Personal Data may be Processed in connection with the Services are determined and controlled by data exporter in its sole discretion and may include but are not limited to: data exporter’s representatives and end users, such as employees, contractors, collaborators, and customers, customers and prospects of data exporter, and employees or contractors of data exporter’s prospects and customers.
Categories of data: The categories of Personal Data are determined by data exporter in its sole discretion and may include but are not limited to: first and last name, employer, role, professional title, and contact information (e.g., email, phone, physical address).
Special categories of data: Special categories of Personal Data, if any, are determined by data exporter in its sole discretion and may include, but are not limited to, information revealing racial or ethnic origin, political, religious, or philosophical beliefs, trade union membership or health data. Any such special category Personal Data is subject to strict purpose limitation controls, access restrictions (including access only for staff having followed specialised training) and security measures.
Frequency, duration, and retention: The Personal Data is transferred on a continuous basis determined by the data exporter. The data importer shall Process the Personal Data for the duration of the Engagement Letter and shall retain the Personal Data in accordance with clause 9.1 of the DPA.
Nature and purpose of the Processing: Azets shall Process Personal Data only as described and subject to the limitations herein (a) to provide Customer the Services in accordance with the Documented Instructions, and
(b) for business operations incident to providing the Services to Customer, which may include (i) delivering functional capabilities as licenced, configured and used by Customer and its Authorised Users, and (ii) preventing, detecting and repairing problems, including Security Incidents, and (iii) providing support, advice and guidance.
Sub-Processors: Any Sub-Processor appointed by the data importer shall Process the Personal Data to assist the data importer in providing the Services as described above for the duration of the Engagement Letter.
C. Competent Supervisory Authority:
The competent Supervisory Authority shall be detailed in the Engagement Letter or otherwise determined in accordance with Clause 13, Section II of Module Two and Module Three of the EU SCCs. In respect of the UK Addendum, the competent supervisory authority shall be read as the Commissioner.
Effective 23 January 2023