Contractual safeguards

We require our subprocessors to enter into agreements that satisfy the requirements of Article 28 of the General Data Protection Regulation, including but not limited to obligations to:

• process personal data in accordance with our documented instructions;
• ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• not engage a subprocessor without prior specific or our general written authorisation and when engaging a subprocessor, impose the same data protection obligations as are in place between itself and us;
• provide regular training in security and data protection to personnel to whom they grant access to personal data;
• implement and maintain appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data;
• promptly inform us about any actual or potential security breach; and
• cooperate with us in order to deal with requests from our clients, data subjects or data protection authorities, as applicable.