Data Recovery Service Terms and Conditions

General Terms and Conditions for ONTRACK Data Recovery Services

1. THESE TERMS

1.1 These terms and conditions ("Terms") govern the supply of Data Recovery Services to you by KLDiscovery Ontrack Limited, registered in England and Wales, Company Number 02669766 trading as “Ontrack”).  Please read these Terms carefully before you submit your Order to us. These Terms tell you who we are, how we will provide the Services to you, how you and we may change or end the Contract, what to do if there is a problem and other important information.

1.2 Our Service Description for data recovery services as well as the Data Processing Agreement (DPA), which regulates the processing of personal data within the scope of the provision of our service, is part of these Terms. For more information on the features and limitations of our data recovery service, please read our service description. The DPA governs the processing of personal data provided to Ontrack by the customer for data recovery purposes.

1.3 For information on how we, as the responsible party, collect, process and store personal data, please refer to our privacy policy.

1.4 Terms and conditions of the customer or third parties are explicitly excluded and shall not apply. These Terms and Conditions Service Description and DPA shall also apply to all future business relations, even if they are not expressly agreed again.

1.5 The services are predominantly provided in our laboratory in England. Ontrack has technical facilities and locations in Europe and the USA. If required, you hereby grant Ontrack access to data on storage devices from any Ontrack facility, including the United States of America, in order for Ontrack to provide the services. Please refer to Clause 6.3.

2. CONTACT DETAILS

2.1 How to contact us. You can contact us by telephoning our customer service team on 020 3131 6441, by writing to us at Nexus, 25 Farringdon Street, London, EC4A 4AB or ukinfo@ontrack.com.

3. INTERPRETATION

3.1 In these Terms the following definitions will apply:

(a) "Business Customer" means a customer acting for the purpose of their business, trade or profession including, without limitation, a sole trader, partnership, limited company or public authority;

(b) "Backup Media" means an Ontrack data carrier on which the recovered data is stored in encrypted form. This is usually a USB hard drive.

(c) “Confidential Information” means any information disclosed or communicated by one party to the other party in the course of the business relationship and where the receiving party had a legitimate expectation, based on a marking of the relevant information as confidential or in good faith based on the nature of the information, that the disclosing party had a particular protectable interest in keeping the relevant information confidential;

(d) “Consumer Customer” means a customer that is an individual who is not acting for the purposes of a business, trade or profession (excluding, for the avoidance of doubt, any Business Customer);

(e) “Contract” means as defined in Clause 4.4;

(f) “Customer” means both a business customer and a consumer customer.

(g) "Data" means data in electronic form of any description, including 'personal data' as defined by the General Data Protection Regulation EU 2016/679 and/or the Data Protection Act 2018;

(h) "Equipment" means your Media and, if applicable, mobile phone or tablet;

(i) "Fee" means the fee payable by you for the Services, as set out in the relevant Quotation;

(j) "Media" means storage media such as hard-drives, USB drive, SSD, memory chips, tapes or other data carriers;

(k) "Order" and "Quotation” means as defined in Clauses 4.5 and 4.1;

(l) “Service Descriptions” means the specific processes employed by Ontrack as more described at the following link https://www.ontrack.com/en-gb/legal/data-recovery-terms#descriptions, which sets out, amongst other matters, service limitations, service levels and expectations; 

(m) "Services" means the data recovery services to be provided by us to you, as described in Clauses 4 (Order Process) and 5 (Services) of these Terms as well as in the Service Description; and

(n) "Website" means our website at https://www.ontrack.com/en-gb or such other website as we use to operate our business from time to time.

4. ORDER PROCESS (Quotation and Order)

4.1 Excluding mobile phones and tablets, for standard data recovery, following an initial telephone consultation, submission of an online form via our Website or email, you will send us your Equipment for our evaluation.  We will use reasonable endeavours to: (a) examine the Equipment to determine: (i) what Data is accessible on the Equipment: (ii) the cause of any damage to the Equipment and/or the Data on the Equipment; and (iii) the amount of Data (if any) likely to be recoverable on the Equipment; ("Evaluation"); (b) report the results of our Evaluation to you.  In most cases, we will provide you with a quotation setting out the scope of Services and applicable Fee broken into two parts: (i) the optional diagnosis; and (ii) the full data recovery. For complex cases, you will be offered a paid diagnosis due to the potential complexity of the data recovery (collectively the "Quotation").  All Services will be provided according to the Service Descriptions.    

4.2 In the Quotation, where the diagnosis is listed as optional, this stage is automatically applied to the Quotation as the diagnosis will provide more detailed information on the success of the data recovery.  If the optional diagnosis is selected, following payment, you will receive a file listing specifying the Data that is likely to be recovered once the full data recovery is completed.  Subject to your cancellation rights set out in section 8 below, both optional and paid diagnosis fees are not refundable once the work has been completed, irrespective of the outcome of the diagnosis.  In some cases, the diagnosis will indicate that a full data recovery is not likely to be successful and only a partial data recovery is expected.  In addition to a Consumer Customer’s statutory cancellation rights (see section 8 below) regarding diagnosis, the optional diagnosis can be cancelled at any time within 24 hours of the Quotation acceptance. 

4.3 For mobile phones and tablets, you will be provided with a fixed price quotation following Ontrack’s receipt of details from you.  Mobiles and tablets do not require an evaluation by Ontrack’s engineers.  For mobiles and tablets, Ontrack will provide you with a free diagnosis report outlining the likely recovery of your Data.  You will then be able to choose to proceed with the data recovery process at the price specified in the Quotation.    

4.4 For other Services, such as remote data recovery (“RDR”) where you do not submit any Equipment to us, or degaussing, the Quotation shall consist of the work expected to be required by Ontrack to perform the Services.

4.5 Following receipt of our Quotation, you may at your option either: (i) accept and sign the service request or statement of work to submit an order for our Services ("Order"); (ii) submit a request for us to return your Equipment (if applicable), the delivery cost of which you agree to pay; or (iii) submit a request for us to destroy your Equipment, in which case we will be permitted to immediately destroy your Equipment.  If we do not receive an Order or request to return your Equipment within 90 (ninety) calendar days of the date of the Quotation, we will dispose of your Equipment in line with applicable law.

4.6 Our acceptance of your Order will take place when we send you an email confirmation of our acceptance, at which point a legally binding contract will come into existence between you and us, governed by these Terms ("Contract"), including the Service Description and DPA.  We will assign an order number to your Order. It will help us if you can tell us the order number whenever you contact us.

5. SENDING DAMAGED STORAGE MEDIA AND DEVICES AND RETURN OF STORAGE MEDIA AND DEVICES AND BACK-UP MEDIA

5.1 You have the following options to provide us with your devices: (i) you may drop off your Storage Media in person at our business premises during opening hours (prior notice required); (ii) you may arrange for a courier service of your choice at your own expense, and, if this option is chosen, Ontrack will provide you with packaging instructions for your Devices.  Alternatively, Ontrack offers a third-party pick-up service by selecting the "Pick-up and Delivery" option during the order process.  Ontrack will send you a shipping label for your package along with packing instructions and inform you of the location where you can drop off your media for collection by the third-party courier.

5.2 All storage media should be packed in accordance with the instructions at https://www.ontrack.com/en-gb/articles/media-shipping-instructionsas Ontrack will not be liable for any damage to your equipment during transit if the packages are incorrectly packed.

5.3 Following the diagnosis or restoration (see section 6), we will send your Backup Media to your address by means of a recognised courier service. Please contact Ontrack before completing the order if you do not want Ontrack to return your backup media by courier.  You can also use a courier service of your choice at your own expense, for example, or collect the backup media in person from our business premises during opening hours (by prior appointment).

5.4 The costs for returning your equipment are based on the information in the respective offer.  You will be informed of the exact costs during the ordering process.

6. OUR SERVICES

6.1 In return for your payment of the Fee, we will perform provide the Services with reasonable care and skill. For a detailed description of the services, please refer to our Service Description. The Service Description is part of these Terms. We will use reasonable endeavours to: (i) restore your Data and provide you with the restored Data on an encrypted Backup Media; or (ii) perform any other Services that we have agreed with you in writing to provide, such as erasing the Data from the storage media.

6.2 When examining the Devices, we will take reasonable precautions to determine: (i) what data on the Devices is accessible and recoverable; (ii) what damage to the Devices and/or data structures may be identified; (iii) how much data (if any) on the Devices is likely to be recoverable; and (iv) to advise you of the expected results of recovering data from the Devices. Our data recovery services may include data recovery of data in the laboratory, through the provision of software solutions and, for business customers, by means of remote data recovery. 

6.3 We provide most of our services at the premises of KLDiscovery Ontrack Limited at Nexus, 25 Farringdon Street, London, EC4A 4AB, England, United Kingdom of Great Britain and Ireland. However, we may also send your device to a sister company located in the European Economic Area. In line with Clause 1.5 we may also be required to access your data remotely from outside the United Kingdom or European Economic Area to provide the Services.

6.4 Mobile Phone Repair.  The primary service we offer will be the recovery of the Data from the mobile phone and we do not offer a standalone mobile phone repair.  In some cases, the work required for a data recovery may result in the partial or temporary repair of the mobile phone.  In such cases, this may result in the restoration of functionality to the mobile phone so that you are able to use it in normal usage conditions but Ontrack does not offer any guarantee or warranty with respect to such repairs.

6.5. Degaussing.  Ontrack will place your Equipment into a degaussing unit which is a machine which effectively and securely scrambles the magnetic data held on the Equipment.  Following the degaussing process, the Data is no longer readable and will have been securely destroyed.

6.6 Remote Data Recovery – applicable only to business customers. With Remote Data Recovery (RDR), the above Terms will apply. Ontrack will require the customer to connect to the customer's internal network. No devices will be submitted to Ontrack’s lab, unless requested. For remote data recovery, you must download and install the Ontrack RDR customer software from the link provided by Ontrack. Once installed, the RDR customer allows the user to connect to Ontrack via an encrypted internet connection. The RDR connection is used by Ontrack solely to run the Ontrack recovery tools directly on the customer's computer. Ontrack uses the RDR connection to store the Ontrack Recovery Tools on the customer's computer in a protected folder.  Your data will not be transmitted to Ontrack during this process. Once the RDR is complete, the Ontrack Recovery Tools are deleted from the customer's computer. Ontrack warrants that the RDR Customer Software, (a) is free of program code or program instructions intentionally designed to interrupt, disable, damage, interfere with or otherwise adversely affect computer programs, files or operations; and (b) does not contain other malicious or harmful code typically referred to as viruses or described by similar terms including Trojan horse, worm or backdoor.

6.7 At the time of entering the Contract, we can only estimate the time when your data recovery is likely to be completed. It is not possible to provide a specific date for a completed Data Recovery due to the nature of the Services. However, you will be informed of the estimated completion date during the provision of the service. When you receive your backup media containing your recovered data from Ontrack, we ask that you immediately check the backup media (USB hard drive or other storage device) for technical functionality. Ontrack can only reproduce your recovered data in the event of a failure of the backup media within our data retention period for your recovered personal data as set out in Ontrack's Data Processing Agreement. The costs of returning the Equipment will be as set out on the relevant Quotation. 

6.8 For some Services, we may need certain information from you such as user names, passwords and/or access codes.   If you do not provide this information within a reasonable time of our request, or if you provide incomplete or incorrect information, we may make an additional charge of a reasonable sum to compensate us for any extra work that is required as a result. We will not be responsible for supplying the Services late or not supplying any part of them if this is caused by you not giving us the information we need.

 6.9 We may have to suspend the supply of Services to: (i) deal with technical problems or make technical changes; (ii) update the Services to reflect changes in relevant laws and regulatory requirements; (iii) make changes to the Services as requested by you.  We may also suspend supply of the Services if you do not pay after giving you notice.

6.10 While we use approved original equipment manufacturer repairs, we offer no guarantee that the Services will be consistent with any warranty offered by the original equipment manufacturer.  Our performance of the Services should, under no circumstances, be taken as a guarantee that the Services will be successful, that all or any of your Data is recoverable or will be useable, that the Mobile Phone will be capable of being used or that we will achieve any other particular result. No success is owed within the scope of our service provision.

6.11 Please note that we may not accept all Apple products for data recovery. Our data recovery services do not usually include data recovery from iPhones/iPads after a factory reset. In cases where data is lost from an iMac, in most cases we will require the storage device to be removed from the iMac prior to sending in to our Ontrack facility. Please contact our customer service team before sending in Apple products as an Ontrack representative will be able to provide you instructions or recommendations for your case.

7. INTELLECTUAL PROPERTY RIGHTS

7.1 Your Equipment and Data shall at all times remain your property, and we shall have no right, title or interest in or to them (except the right to possession and use of your Equipment and Data to perform the Services).  You retain all intellectual property rights you have in your data.

7.2 All intellectual property rights related to the provision of the Services shall remain with Ontrack, including the development, creation and provision of the Services, inventions, copyrighted works, methods, processes and know-how used to develop or comprise the Services, together with any hardware, firmware, platforms, software and any modifications, enhancements, new features or functionality created or used by Ontrack as part of the Services ("KLD-IP").

8. RIGHTS TO END CONTRACT (CONSUMER CUSTOMERS)

8.1 This Clause 8 applies solely to our Contracts with Consumer Customers.  Following an Order, you have a legal right to change your mind.  These rights, under The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, are explained in more detail below.

8.2 During the Free Evaluation, you can cancel at any time.  If you place an Order including any diagnosis, you can cancel within 14 (fourteen) days after the day we email you to confirm we accept your Order. However, once we have completed the Services, you cannot change your mind, even if the period is still running. By placing an Order, you expressly authorise us to commence the Services immediately.  If you cancel after we have started the Services, you must pay us for the Services provided up until the time you tell us that you have changed your mind.  We will tell you what this Fee will be following the cancellation request.

8.3 To cancel the Order, you can do so through one of the following methods of communication by providing your Order number, name, address and cancellation request:

(a) Phone or email. Call customer services on 020 3131 6441 or email us at ukinfo@ontrack.com;

(b) By post. write to us at Nexus, 25 Farringdon Street, London, EC4A 4AB ; or

(c) By Cancellation Form: complete and send to us a cancellation form in the format of the Model Cancellation Form included as a Schedule to these Terms.

8.4 The optional diagnosis can be cancelled within 24 hours of the Quotation using the same cancellation methods set out above. 

9. RIGHTS TO END THE CONTRACT (BUSINESS CUSTOMERS)

9.1 This Clause 9 applies solely to our Contracts with Business Customers. Following an Order, you shall not be able to terminate the Services unless set out in clause 10 below.

10. MUTUAL TERMINATION RIGHTS

10.1 Without affecting any other right or remedy available to either Party, each Party may terminate the Contract with immediate effect by giving written notice if:

(a) Either Party commits a material breach of any term of the Contract which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 7 (seven) days after being notified in writing to do so or repeatedly breach these Terms.  A failure to pay the Fee shall constitute a material breach; or

(b) either Party ceases (or threatens to cease) to trade all or part of its business, has a liquidator, receiver or administrative receiver appointed to it or over any part of its undertaking or assets or passes a resolution for its winding up (otherwise than for the purpose of a bona fide scheme of solvent amalgamation or reconstruction where the resulting entity shall assume all of the liabilities of it) or a court of competent jurisdiction makes an administration order or liquidation order or similar order, or enters into any voluntary arrangement with its creditors, or is unable to pay its debts as they fall due, or, if an individual, becomes bankrupt; and/or

(c) (Ontrack's right of termination): the Customer fails to pay the remuneration for the Data Recovery Services when due.

10.2 We may terminate the Contract if, by performing the Contract, we may breach applicable export and sanctions laws relating to dealings with certain companies and individuals set by the European Commission or other national authorities, including the United States.  You agree to provide, upon our request, proof of identity for the purpose of verifying the applicability of applicable export and sanctions law You agree to provide, upon our request, proof of identity for the purpose of verifying the applicability of applicable export and sanctions laws.          

10.3 If the termination is for a reason for which Ontrack is not responsible, the Customer is obliged to pay the agreed remuneration for all data recovery services provided by Ontrack until the termination takes effect. 

11. CUSTOMER ACKNOWLEDGEMENTS

11.1 You hereby acknowledge and warrant to us that: (i) you are legally capable of entering into binding contracts; (ii) you have full authority, power and capacity to agree to these Terms and if you are a Business Customer have the appropriate legal authority to conclude the Contract; (iii) all the information that you provide to us in connection with your Order is true, accurate, complete and not misleading; (iv) you are the owner of the Equipment and/or have the permission from the owner of the Equipment for us to perform the Services;  (v) your supply of your Equipment and/or Data to us will not breach any obligations or rights of any third parties; (vi) your supply of your Equipment and/or Data to us will not breach any applicable law; (vii) you are legally permitted to grant access to the Data; (viii) your Equipment does not contain any material (including without limitation any Data) which may infringe the Intellectual Property Rights of any third party; and (ix) your Equipment does not contain any material which will breach applicable law. 

11.2 We reserve the right (and you hereby acknowledge that we have the right) to request documentary evidence of your ownership, permission or legal right to authorise the Services and to suspend or not commence the Services without receipt of such evidence. You agree to provide us with documentary evidence of identity upon request to enable us to verify the applicability of any applicable export and sanctions regulations in accordance with Clause 11.2.

11.3 You hereby acknowledge that your Equipment and/or Data may already be damaged prior to our receipt of them, and that our efforts to complete the Services may result in the destruction of, or any further damage to, your Equipment and/or Data. We will take reasonable care in performing the Services, but will not, save as specified in section 13 of these Terms, bear any responsibility for existing or additional damage that may occur to your Equipment and/or Data during our performance of the Services. This does not affect the provisions of clause 14.

12. PRICE AND PAYMENT

12.1 The price of the Services will be the fee as set out in the relevant Quotation. VAT shall be added at the statutory rate and, if applicable, is payable by the Customer. Payment may be made by cash, bank transfer or credit card, or for business customers also by order on account (order number).

12.2 In the case of cash payments, advance bank transfer, or credit card payment, the fee is generally payable prior to the commencement of the Services (prepayment) or, if applicable, at the time specified in the payment agreement made separately with Ontrack. If you fail to pay any amount due to us under the Agreement, we may retain the Equipment and Data until payment is made in full. In the event of a cancelled, late or non-payment, you will receive a first reminder (text form) after payment is due. If payment is not received after the first reminder, you will receive another reminder before we reserve the right to hand the claim over to our collection agency. We further reserve the right to claim default interest or issue further claims.

12.3 If you pay by credit/debit card, Ontrack will send you a payment link to a secure 3rd party payment platform to to authorise the payment and complete the payment process once the work is completed but before the backup media is sent to you.

12.4 Business customers will receive an invoice. If you do not pay the invoice in full within the agreed payment period, we will send you a reminder (text form). If payment is not received after the first reminder, you will receive another reminder before we hand the claim over to our collection agency. We will charge interest on arrears at the legally permissible rate in the event of late payment. We reserve the right to assert further claims (e.g., for damages caused by default).

12.5 No Data will be provided by Ontrack until payment has been made in full for the applicable Order. If you fail to pay to us any amount due under these Terms we may retain the Equipment and Data until you make full payment.  If you do not make full payment within 90 (ninety) calendar days of the due date we may, without liability or consulting you further, dispose of your Equipment and/or Data in line with applicable law.  We will also charge interest to you on the overdue amount at the rate of 4% a year above the base lending rate of Barclays Bank plc from time to time. This interest will accrue on a daily basis from the due date until the date of actual payment of the overdue amount, whether before or after judgment.

13. OUR RESPONSIBILITY FOR LOSS OR DAMAGE SUFFERED BY YOU

13.1 We do not accept responsibility for any corruption of, or physical or other damage to, or destruction of your Equipment, your Data, or any other equipment that may occur, or invalidation of any warranties in respect of your Equipment or other equipment, either: prior to our receiving your Equipment, your Data, or other equipment; or in the course of our providing the Services where such damage, destruction, corruption or invalidation arises from our performing the Services in accordance these Terms.

13.2 Whilst we will use reasonable endeavours to take care of your Equipment or Data whilst in our possession, we will not be responsible to you if any of your Equipment or Data is lost, destroyed, corrupted or otherwise damaged through fair wear and tear.

13.3 We do not exclude or limit in any way our liability to you where it would be unlawful to do so. This includes our liability for death or personal injury caused by our negligence or the negligence of our employees, agents or subcontractors; for fraud or fraudulent misrepresentation; and for Consumer Customers, for breach of your legal rights in relation to the Services and for defective Services under the Consumer Protection Act 1987.

13.4 Subject to the provisions of this clause 12, our total liability to you, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with a Contract shall be limited to (i) in cases of breach of confidentiality, data protection or intellectual property, the greater of £10,000 or the value of the Fee payable under the applicable Contract; or (ii) in any other case, the value of the Fee payable under the Contract.

13.5 Neither Party shall be liable to the other, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with these Terms or any Contract for any indirect or consequential loss, loss of profits or loss of sales or business.

13.6 Use of Couriers.  Consistent with the provisions of section 5, In collecting your Equipment prior to the commencement of the Services, or in delivering the recovered Data and/or original Equipment, we outsource such service to nationally recognised courier companies.  By agreeing to us using them for the Services, you agree that any loss or damage to the Equipment or Data shall be expressly subject to the terms and conditions provided by the applicable courier company, including limitations of liability and compensation limits.  You hereby waive all right to bring any claim against Ontrack for any loss or damage to Data or Equipment arising from negligence and/or breach of contract by the courier company beyond any compensation scheme set out by them.  

14. INDEMNITY

14.1 You shall indemnify us in full against and hold us harmless from all claims, costs, damages, liabilities, expenses (including without limitation legal expenses) demands and judgments awarded against or incurred or paid by us as a result of or in connection with any and all of your acts, inactions and/or omissions connected with the Contract and these Terms.

15. DATA PROTECTION

15.1 Information on how we collect, process and retain your personal data, please see our Privacy Policy at the following link on our website: https://www.ontrack.com/en-gb/legal/privacy-policy

16. HOW WE PROCESS PERSONAL DATA (RECOVERED DATA)

16.1 To the extent that Ontrack processes personal data for you as a customer in the course of data recovery, our Data Processing Agreement applies, which is available at https://www.ontrack.com/en-gb/legal/service-terms-and-conditions#data-processing-agreement

17. CONFIDENTIAL INFORMATION

17.1 Each party agrees to not disclose any Confidential Information of the other party to any third party without the prior written authorisation of the party disclosing the Confidential Information and to:  (i) use such Confidential Information only for the purposes of carrying out its obligations pursuant to these Terms; (ii) use the same methods and degree of care to prevent disclosure of such Confidential Information as it uses to prevent disclosure of its own proprietary and Confidential Information but in no event less than reasonable care; and (iii) disclose Confidential Information to its employees and approved third parties, only on a need-to-know basis provided that all such persons are bound by duties of confidentiality no less onerous than are set out in these Terms.

17.2 Confidentiality obligations shall not apply to any Confidential Information: (i) which enters the public domain through no fault of the recipient party; (ii) which was known to the recipient party prior to receipt from the other party; (iii) which is disclosed to the recipient party by a third party (other than employees or agents of either party) in circumstances that such disclosure is not in violation of any confidentiality obligation to the party disclosing the Confidential Information; or (iv) which is independently developed by the recipient party without recourse to Confidential Information.

18. OTHER IMPORTANT TERMS

18.1 This Contract is between you and us. No other person shall have any rights to enforce any of its terms.  Each of the paragraphs of these Terms operates separately. If any court or relevant authority decides that any of them are unlawful and/or unenforceable, the remaining paragraphs will remain in full force and effect.  If we delay in taking steps against you in respect of your breaking this contract, this will not prevent us taking steps against you at a later date.

18.2 We may change the Services to reflect changes in relevant laws and regulatory requirements and to implement minor technical adjustments and improvements, for example to address a security threat. These changes will not affect your use of the Services. In addition, we may make more material changes to these Terms or the Services, but if we do so we will notify you and you may then contact us to end the Contract before the changes take effect and receive a refund for any Services paid for but not received.

18.3 As well as any other rights you have under law or regulation, if you are resident in the European Union, you may have the option to submit complaints on the European Union’s Online Dispute Resolution platform (the “Platform”) which facilitates the settlement of disputes online.  For more information, please visit the Platform on https://ec.europa.eu/consumers/odr/main/index.cfm?event=main.home.chooseLanguage/. [Ontrack does not intend to use the Platform to settle disputes and you accept that Ontrack is under no obligation to use the Platform to settle any disputes.

18.4 These terms are governed by English law and each Party may bring legal proceedings in the courts of England and Wales.

Effective: 1 July 2023

Schedule –

Model cancellation form

(Complete and return this form only if you wish to withdraw from the contract)

To          

[TRADER'S NAME, ADDRESS, TELEPHONE NUMBER AND, WHERE AVAILABLE, FAX NUMBER AND E-MAIL ADDRESS TO BE INSERTED BY THE TRADER]

Subject: Revocation of the service contract

I/We* hereby give notice that I/We* cancel my/our* contract for the supply of the following service*,

Ordered on*/received on*,        

Name of consumer(s),  

Address of consumer(s),              

Ontrack customer number,

Signature of consumer(s) (only if this form is notified on paper),

Date

Sign: __________________

*Delete as appropriate

Service description for Ontrack data recovery services

1. The data recovery process, Ontrack's service and limitations

a) Data recovery services are carried out in several steps:

• The Evaluation - see section 2 below -; or/and
• The Diagnosis - see section 4 below -; and
• Data Recovery after Evaluation or Diagnosis - see section 5 below -, or RDR Remote data recovery service for business customers - see section 6 below.
• Quotation for smartphones and tablets – see section 3 below;

b) Ontrack will recover as much data as possible from one or more damaged media by taking the appropriate measures. Ontrack does not test usability or compatibility on any application software.

c) It is possible that deleted and/or corrupted data cannot be read even when using Ontrack's tools and technologies. Therefore, Ontrack cannot guarantee that data on damaged media can be recovered, repaired or read.

d) Ontrack will examine media to determine what damage needs to be overcome in order to recover data and data structures to the point where they are likely to be read and used again in their respective applications. To do this, Ontrack applies the highest technical standards and proprietary processes, as well as software and hardware tools. Due to the nature of Ontrack's work with damaged data or media, there is a general risk that any remaining data on the damaged media may be partially or completely lost or destroyed. 

e) The customer acknowledges that there remains a risk that:

• once existing data can no longer be recovered, additional data may be lost;
• recovered data can no longer be used by the customer;
• the information content embodied in the storage media is destroyed in whole or in part; and
• the data carriers, software and other items provided may be damaged, unusable or destroyed.

2. Evaluation 

a) The Evaluation is an initial assessment by an experienced data recovery engineer that determines what damage can be seen on the media to give an estimate of the amount of data that can be expected to be recovered. The Evaluation can be used for HDDs, SDDs and RAID/NAS systems. Excluded from the Evaluation service are, among others, mobile phones, tablets and flash media, as well as media with deleted data, water and fire damage, and storage media that have already been opened. During the evaluation, the client's data  carrier  is connected to our own  proprietary systems and opened if necessary. In the Evaluation, no data is copied/backed up (imaged) or further analysed. No listing of recoverable data sets or indication of which files can be recovered is produced. Ontrack does not provide a standalone damage report.

b) Ontrack will inform the Customer after the Evaluation whether (i) a data recovery is eligible, (ii) a further chargeable diagnostic is required to determine the data recovery options including the amount of data likely to be recoverable (see Section 3); (iii) or a data recovery cannot be performed by Ontrack in the circumstances.

c) An assessment of the likely success of a data recovery after the Evaluation is made on the basis of the following classifications:

• Excellent - We expect 95-100% of your data to be successfully recovered.
• Good. We expect 75-100% of your data to be successfully recovered.
• Partially recoverable- We estimate that a small portion of your raw data can be recovered in the range of up to 50%.
• Complex Due to the complexity of the failure, we cannot yet give an exact percentage for the recoverability of your data. Therefore, we recommend an extended diagnosis in this case.
• Not recoverable - We cannot access the data on your data carrier.

d) The assessment of the chances of success of a data recovery based on the above classification is no guarantee that the percentages listed in section 2 letter c) will be met, as neither physical nor data structural damage is repaired in an Evaluation.

e) If requested by the Customer, Ontrack may, after the Evaluation, carry out a diagnosis, subject to a fee, which includes, where possible the creation of a Verifile File List, which can more accurately determine the amount of data to be recovered (see section 3 below).  Please note, it is not always possible to provide a File Listing in the eventuality that no data is recoverable.

f) If the Customer places an order for diagnosis or data recovery based on the results of the  Evaluation (see section 4 below), Ontrack will perform the applicable service, either diagnosis (see section 4) or data recovery (see section 5).

g) The Customer may decide not to perform the data recovery or diagnosis after the Evaluation in which case the order is complete.  If the Client so wishes, the media will be returned to the Client for the fee specified in the quotation form. Otherwise, the media will be securely disposed of.

h) Please note that processing during the evaluation may damage the customer's equipment. 

3. Quotation for smartphones and tablets (charged diagnosis)

a) Mobiles and Tablets do not require an evaluation. The first step is to provide Ontrack with information for Ontrack to determine the device type and whether the damage is logical and/or physical.

b) The customer is then provided with a fixed price quotation for data recovery. Upon receiving the device, Ontrack will perform a Diagnosis and provide a report to the customer specifying the amount of data Ontrack expects to recover.  Ontrack requires the customer to supply the passcode for the smartphone or tablet.  The customer may decide not to perform the data recovery after receiving the diagnosis report, in which case the process is complete.

c) If the customer decides to proceed with a data recovery, Ontrack will begin the data recovery as described in section 5.

4. Diagnosis

a) For the recovery of data on smartphones, tablets or flash media or in the case of specific data damage, Ontrack offers a chargeable diagnosis (and not an Evaluation – see section 3 above). In all other cases, Ontrack may also recommend a diagnosis after the Evaluation has been carried out, especially in the case of complex damage. A Diagnosis may also be requested without the Evaluation. In certain cases, the diagnosis will be listed as optional, and can be removed at the customer’s discretion. In such cases, please refer to the specific terms of the quotation provided, as well as Ontrack’s Terms and Conditions for Data Recovery.    

b) The diagnosis will determine the type and extent of the data damage, the exact determination of the possibilities of data recovery on the data carriers provided by the customer and the amount of files/data that can probably be recovered. Ontrack will provide the Customer with access to a proprietary platform that will allow the Client to track the status as well as provide the Client with a final file list (Verifile) if data recovery is possible. In some cases, Ontrack may not be able to access the data and therefore not be able to provide a file list (Verifile).

c) The file list (Verifile) contains an indication of the quality of the data in terms of its usability in the traffic light system:

• Green - the data will most likely work or open in the respective application.
• Yellow - the data or files are partially damaged - this may mean that the files cannot be opened and edited in the respective application. It is possible that the damaged files can be repaired.  Ontrack may be able to provide this service in some situations and, in such a case, will contact the customer directly.
• Red - the data or files are corrupted - this probably means that the files cannot be opened and edited in the respective application.

d) It is not possible for Ontrack to guarantee the usability of the data with the customers respective applications as part of the diagnosis. Ontrack Engineers will provide guidance to the overall status of the recovered data, however these predictions cannot be guaranteed due to other causes of damage that cannot be identified. This applies in the special case to database files of all kinds. The import of the data sets, the effort for cleaning the data sets according to the state of the art of the respective database software and application and the consultation of further experts is the sole responsibility of the customer.  Ontrack will support the customer and commissioned contractors as far as possible.

e) There are special data loss scenarios in which the coloured statements in the file list (Verifile) have no meaning. In the case of such severe structural damage, Ontrack does not guarantee the functionality of the files.   If such a case exists, this is indicated in the diagnosis result.

f) Diagnosis is carried out in Ontrack's laboratory.

g) Depending on the type of media, the diagnosis may result in the transfer of data to another storage medium and the destruction of the original customer device.

h) If the Customer places an order for data recovery based on the results of the diagnosis (see section 4 below), Ontrack will perform the data recovery.

 g) The Customer may decide not to perform the data recovery after the diagnosis. At the request of the Customer, the Customer's media will then be returned to the Customer for the fee specified in the Quotation Form. Otherwise, the media will be securely disposed of.

5. Data recovery after Diagnosis or Evaluation

a) Offer for data recovery after Evaluation

The result of the Evaluation is sent together with an offer for data recovery. Only the expected success rating Excellent/Good/Partial/Complex is transmitted.

The data recovery quotation contains the data recovery price in relation to the service levels (see paragraph c.), which show the processing time for the respective data recovery process and is sent to the customer as described in our Terms.

b) Offer for data recovery after diagnosis

After the diagnosis, Ontrack will send the Verifle list to the client where possible, inform the Client how long the data recovery process will take and what the costs for the data recovery will be. The Client will receive a data recovery quote as described in our Terms and Conditions, which will include the data recovery price in relation to the Service Levels (see paragraph c.) that indicate the processing time for the respective data recovery process.

c) Service levels

For the data recovery order, the customer can choose between the following service levels depending on the urgency:

• Emergency service
  Processing takes place immediately after receipt of order around the clock.
• Priority service
  Processing takes place immediately after receipt of the order from Monday to Friday from 8:00 to 18:00. The duration of the data recovery process is usually 3-5 working days.
• Standard service
  The data medium is processed after receipt of the order from Monday to Friday between 9:00 and 17:00. The duration of the data recovery process is usually 7-10 working days.
• Economy Service
  The data carrier is processed after receipt of the order from Monday to Friday between 9:00 am and 5:00 pm. The duration of the data recovery process is usually  30 working days.

d) Acceptance of the data recovery

The customer accepts the data recovery offer as described in our Terms.

If the customer decides not to carry out the data recovery on the basis of the Evaluation results or file list (verifile), the order is deemed to be cancelled. At the customer's request, the data media will be returned to the customer for the fee specified in the offer form. Otherwise, the media will be securely disposed of.

e) Carrying out the data recovery

If the customer places an order for data recovery based on the data recovery quote after reviewing the results of the Evaluation and/or the diagnostic results, Ontrack will perform the data recovery.
The customer receives the data that was recoverable by Ontrack. After a diagnosis, this is usually the data shown in the file list (Verifile).

The data recovered by Ontrack is stored on a portable storage device and sent to the client. In addition to the separate media containing the recovered data, Ontrack may return the damaged media if requested by the Client at the time of placing the data recovery order, subject to payment of the return shipping fee specified therein.
At the Client's request, Ontrack may erase the data on the Data Carrier and/or dispose of the Data Carrier in accordance with applicable regulations.

f) Deviations in the data recovery result

In the event that the amount of recovered data is significantly less than the amount of recoverable data estimated in the evaluation, where no file listing has previously been ordered, one will be provided to the client at no additional charge to assist with the decision to proceed with the recovery stage. If a file listing has previously been ordered and provided, a Customer Representative will be in contact with the customer to discuss the results and the customers options for the Data Recovery. 

g) Data Recovery for smartphones and tablets

If the customer places an order for data recovery based on the diagnosis report and data recovery offer, Ontrack will carry out the data recovery. Upon payment as described in our Terms, Ontrack will return the recovered data along with the damaged smartphone/tablet. At the customer's request, Ontrack may delete and/or dispose of the smartphone/tablet in accordance with data protection regulations at no charge.

In abbreviation to the report, if only a partial data recovery is possible, the order will be deemed unsuccessful, and the customer will not be charged for the data recovery. The smartphone/tablet can be returned to the customer for the fee shown in the quotation. Otherwise, the smartphone/tablet will be destroyed. 

If the customer wishes to receive the partial data, the full fee is payable prior to Ontrack sending the data.  The data is retained for thirty (30) days before it will be deleted.

6. RDR Remote Data Recovery Service

a) RDR^® stands for Remote Data Recovery™ ("RDR"). RDR is a patented technology that allows Ontrack engineers to perform a lab-quality data recovery directly on the client's server, desktop or laptop via an internet connection. The only requirement is that the disk is operational. Ontrack's RDR consists of three main components:

- Communication client: the client initiates a connection to an Ontrack RDR server using the specially developed RDR client software. The RDR client works with common operating systems. The drives to be recovered do not have to be from a particular operating system.
- RDR Server: Ontrack has several server locations around the world.
- RDR workstation: It is used by Ontrack engineers to remotely control the tools on the client's machine and recover the client's data.

 b) First, the client downloads the appropriate RDR client version and installs it on the server, desktop or laptop that will be used for recovery.  Next, the Ontrack Client software connects as an outbound TCP/IP connection from the Client's location to the Ontrack server, creating a tunnel or point-to-point connection across the Internet. As the connection is likely to use a web connection, it can pass through most firewalls without any additional configuration requirements. Data security is paramount due to Ontrack's proprietary communication protocol, encrypted packets and secure Ontrack facilities.

RDR protects customer data via an RDR connection in four ways:

1. direct connection to the RDR server: The client software uses a direct TCP connection from the client's computer to the Ontrack RDR server. RDR does not use a third-party hosting product.
2. encryption: the communication link uses 256 bit encryption on all packets.
3. Proprietary Protocol: RDR communications use a proprietary protocol, but not HTTP or any other common protocol that others would understand.
4. no customer data is transmitted over the connection: the RDR connection is only used by the Ontrack engineer to remotely control Ontrack utilities directly on the customer's machine. Screen updates and keyboard packets are sent over the connection, but not actual customer data files. Instead, the Ontrack engineer controls file system structure repair tools to make the data accessible to the customer.

c) As soon as the connection is established, either the diagnosis begins, or the recovery process starts if a data recovery order is placed.

Status: May 2023

Data Processing Agreement

This Data Processing Agreement is part of the General Terms and Conditions for Ontrack Data Recovery Services and applies to: (i) KLDiscovery Ontrack Limited (company number 02669766) having its registered office address at Ontrack, Nexus, 25 Farringdon Street, London, EC4A 4AB (“Ontrack”); and (ii) the applicable Customer placing an order for Ontrack’s data recovery services pursuant to the applicable service terms of business (“Terms”).

The Parties have agreed that the terms of this Data Processing Agreement shall apply to the Processing of Personal Data (as defined below) that is required to enable Ontrack to provide the services to the applicable Customer.   

Definitions

In this Data Processing Agreement:

Data Processing provisions

1  Data Processor and Data Controller

1.1 The Parties agree that, in respect of Personal Data, the Customer shall be the Data Controller and Ontrack shall be the Data Processor.  It is acknowledged that the Customer shall have sole responsibility for the accuracy, quality, integrity and reliability of any Personal Data and of the means by which it acquired such Personal Data.

1.2 The Customer warrants, represents and undertakes, that: (i) all Personal Data used in connection with the services pursuant to the Terms shall comply in all respects with Data Protection Laws; (ii) all instructions given by it to Ontrack in respect of Personal Data shall at all times be in accordance with Data Protection Laws; (iii) it has obtained all necessary consents from any Data Subject whose Personal Data is included within the Personal Data or otherwise has the appropriate legal permission to provide the Personal Data to Ontrack; and (iv) it will comply with the terms of this Data Processing Agreement.

1.3 Ontrack warrants, represents and undertakes, that it shall: (i) process the Personal Data only to the extent necessary in connection with the Terms; and (ii) process the Personal Data in accordance with the Customer’s documented instructions and the requirements of Data Protection Laws; (iii) promptly inform the Customer if Ontrack considers that the Customer’s instructions infringe Data Protection Laws, or if Ontrack becomes unable to comply with Customer's instructions regarding the Processing of Personal Data  (whether as a result of a change in applicable law, or a change in Customer’s instructions); and (iv) comply with the terms of this Data Processing Agreement.

1.4 Within the scope of the commissioned processing, all data handed over by the customer shall be processed. The categories of personal data and the categories of data subjects are known to the customer and are specified for the processor if this is necessary in the context of the order. In the case of data recovery, knowledge of the content of the client data is usually not relevant for the processor.

2 Instructions and details of Processing

2.1 The Processing of Personal Data to be carried out by Ontrack under this Data Processing Agreement shall comprise the Processing as required for Ontrack to provide the Data Recovery services.

3 Technical and organisational measures

3.1 Ontrack shall implement and maintain, at its cost and expense, appropriate technical and organisational measures in relation to the Processing and security of Personal Data in accordance with Data Protection Laws and in accordance with Articles 32-34 of the GDPR in particular.  Ontrack shall ensure that such technical and organisational measures are appropriate to the particular risks that are presented by its Processing activities, in particular to protect Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access.

3.2 Ontrack’s technical and organizational measures at the date of this Data Processing Agreement are set out at Annex 2.

4 Using Personnel and Sub-Processors

4.1 Save as set out in clause 4.2, Ontrack shall not engage any sub-processor for carrying out any processing activities in respect of the Client Data without the Client’s prior written authorisation.  In the event that authorisation is provided, prior to making any disclosure to any approved sub-processor, Ontrack shall put in place written terms with the sub-processor which are equivalent to those set out in this Data Processing Agreement.  It is acknowledged and accepted that, notwithstanding anything to the contrary in this Agreement, Ontrack shall remain fully liable to the Client for the performance of each sub-processor’s obligations.  Ontrack shall inform the Client of any intended changes concerning the addition or replacement of such sub-processors and allow Client a reasonable opportunity to object, on reasonable grounds, to any such changes or replacements. 

4.2 Approved sub-processors at the date of this Data Processing Agreement are set out at Annex 1.

4.3 Ontrack shall ensure the reliability of its Personnel who have access to Personal Data and ensure that they process it only where strictly necessary for the services, ensure that they are fully aware of the measures to be put in place and the steps to be taken when Processing the Personal Data  having regard to Data Protection Laws, and ensure that they have committed themselves to protect the confidentiality of the Personal Data  including by way of an appropriate obligation of confidentiality (whether by written contract or otherwise) in respect of the Personal Data .

5 Assistance with the Customer’s compliance and Data Subject rights

5.1 Ontrack shall promptly refer all Data Subject Requests it receives to the Customer.  Ontrack shall provide such reasonable assistance as the Customer reasonably requires (taking into account the nature of Processing and the information available to Ontrack) to the Customer in ensuring compliance with the Customer’s obligations under Data Protection Laws with respect to: (i) the security of Processing; (ii) data protection impact assessments (as such term is defined in Data Protection Laws); (iii) prior consultation with a Supervisory Authority regarding high risk Processing; and (iv) notifications to the Supervisory Authority and/or communications to Data Subjects by the Customer in response to any Personal Data Breach, provided that, in the event that such assistance is disproportionate in time and resources to Ontrack, Customer shall pay Ontrack’s fees for providing such assistance. 

6  International data transfers

6.1 The Customer acknowledges that, as at the date of this Data Processing Agreement, Ontrack may process personal data in the United Kingdom, Europe, and the United States of America during the term of this Agreement.

6.2 The Customer acknowledges that in respect of Personal Data subject to the Data Protection Act 2018 (UK), Ontrack shall be permitted to process all or any part of the Personal Data within the European Economic Area (“EEA”) pursuant to paragraph 5(1)(a) of Sch.21 to the Data Protection Act 2018. Additionally, the United Kingdom has received an Adequacy Decision dated June 28, 2021, from the European Commission pursuant to Article 45(3) of the GDPR which confirms that transfers may take place without the need to obtain any further authorisation (“Adequacy Decision”). In the event that the Adequacy Decision expires or is otherwise declared invalid, the Parties shall enter the EU Controller to Processor Standard Contractual Clauses in force at the applicable time to ensure compliant Processing of Personal Data by Ontrack in the United Kingdom.

6.3 In respect of Personal Data transfers to the United States of America, the parties agree that the 2021 Controller to Processor Standard Contractual Clauses (Module 2) approved by the European Commission, with the applicable amendments mandated by S119A(1) of the Data Protection Act 2018, and in accordance with the requirements of the Swiss Federal Act on Data Protection of 19 June 1992 ("FADP") and, after entry into force, in accordance with Art. 16(2)(d) of the future revised Federal Act on Data Protection of 25 September 2020 ("revDSG"), (“Standard Contractual Clauses”) are incorporated by reference into this Data Processing Agreement and that all transfers shall be subject to the terms of the Standard Contractual Clauses. If the Standard Contractual Clauses are amended, repealed or replaced by the European Commission or pursuant to applicable Data Protection Laws, the Parties shall work together in good faith to enter into an updated version of the data transfer mechanism, or to negotiate an alternative solution to enable compliant transfers of Personal Data to the United States of America.

6.4 Upon the terms set out in this clause 6 “International Data Transfers”, the Customer authorises the transfer of Personal Data to the United States of America.  The Customer’s consent to the transfer of Personal Data to the United States of America may be withdrawn at any time but, in such an event, the Customer acknowledges that Ontrack may not be able to complete the Order and/or perform the Services if the Customer withdraws consent to the Personal Data transfer.   

7 Records, information and audit

7.1 Ontrack shall: (i) create; (ii) keep up-to-date; and (ii) maintain full and accurate records relating to all Processing of Personal Data.

7.2 Ontrack shall grant to Customer the right of audit, no more than once per calendar year and on a minimum of 30 (thirty) days written notice, during normal business hours and subject to reasonable confidentiality undertakings being given, to access and take copies of such records relating to Processing of Personal Data and shall provide all reasonable assistance to Customer in exercising its audit rights.  This audit right shall not extend to any third-party data centre or other third-party facility housing any server equipment where only visual and accompanied inspection is permitted.

7.3 Ontrack shall at Customer’s request and expense promptly provide Customer with all information necessary to enable Customer to demonstrate compliance with its obligations under the GDPR, to the extent that Ontrack is able to provide such information.

8 Breach notification

8.1 In respect of any Personal Data Breach involving Personal Data, Ontrack shall, without undue delay: (i) notify the Customer of the Personal Data Breach; and (ii) provide the Customer with details of the Personal Data Breach.

9  Deletion or return of Personal Data and copies

9.1 Ontrack shall, at the Customer’s written request or upon expiry of internal retention periods, either delete or return all the Personal Data  to the Customer in such form as the Customer reasonably requests within a reasonable time after the earlier of: (i) the end of the provision of the relevant data recovery services pursuant to the Terms related to Processing; or (ii) once Processing by Ontrack of any Personal Data  is no longer required for the purpose of Ontrack’s performance of its relevant obligations under this Data Processing Agreement, and delete existing copies (unless storage of any Personal Data  is required by applicable law and, if so, Ontrack shall inform the Customer of any such requirement).  Ontrack shall procure that its Sub-Processors shall undertake the same actions with regard to Personal Data. 

9.2 In the event that Personal Data remains within Ontrack’s possession or control for any period longer than 12 (twelve) months without any active instructions from the Customer, Ontrack shall delete such Personal Data.  

10 Indemnity

10.1 Each Party (the “Indemnifying Party”) shall indemnify and keep indemnified the other Party (the “Indemnified Party”) in respect of all claims, demands, actions, settlements, interest, charges, procedures, expenses, losses and damages suffered or incurred by, awarded against or agreed to be paid by, the Indemnified Party arising from or in connection with the Indemnifying Party’s non-compliance with this Data Processing Agreement and/or breach of Data Protection Laws.

11 Liability

11.1 The total liabilities of either Party under this Data Processing Agreement shall in no event exceed the contractual limits set out and agreed in the Terms.

12 Term and Termination

12.1 Unless terminated by agreement of the Parties, this Data Processing Agreement shall commence on the date an order is placed for services pursuant to the Terms and continue in force for so long as Ontrack continues to process Personal Data.

13 Choice of Law

13.1 This Data Processing Agreement shall be subject to the terms of the choice of law provision set out in the Terms.

Date: 1 July 2023

Annex 1 – Sub-Processors and Transfers

Status: June 2023

Annex 2: Technical-Organisational Measures

Note on the document:
The general technical and organizational measures of KLDiscovery Ontrack are described here. The existing measures are listed generically in this document. These measures are implemented wherever necessary and possible.

1. Confidentiality (Art. 32 para. 1 b GDPR)

Access Control
No unauthorised access to data processing equipment;
√  Building security via Nexus Security on site (24/7)
√  Manned reception during working hours
√  Access fob for rooms
√  Different security zones with different access authorizations
√  Door security (Magnetic door closer, Key Fob)
√  Master key
√  Key/Chip regulation
√  Rules for dealing with visitors and external personnel
√  Visitors list
√  Visitors may only be in server rooms when accompanied
√  Only personnel responsible for computer forensics have access to the clean room and engineering lab
√  Video system monitored by the US

System Access Control
No unauthorized access to data processing systems;
√  authorization concepts and needs-based access rights
√  central user administration
√  secure password procedures / password policy
√  encrypted user authentication
√  automatic blocking mechanisms after unsuccessful access attempts
√  Two-Factor Authentication
√  Encryption for files and data carriers
√  Use of firewalls and virus protection
√  Use of Virtual Private Network (VPN)
√  Logging of accesses and access attempts (room access, VPN, etc)

Data Access Control
No unauthorized reading, copying, modification or removal within the system;
√  authorization concepts and needs-based access rights for programs and data 
√  central user administration
√  Automatic logout in case of inactivity after a certain period of time
√  Use of rotating archiving systems and controlled access to backup tapes
√  Encryption for files and data carriers
√  Logging of accesses and incorrect access attempts

Separation Control
Separate processing of data collected for different purposes;

√  Multi-client capability
√  Separation according to different purposes is ensured by different systems/databases
√  Separation of functions for production / test
√  Different encryption of data records to ensure separation for different processing purposes
√  implementation of defined functions in the information systems: Administrator, auditor, user.
√  authorization concepts and needs-based access rights for programs and data 
√  Use of secure processes such as Challenge Response Procedures to ensure an authorised application

Pseudonymisation (Art. 32 para. 1 a GDPR; Art. 25 para. 1 GDPR)
The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without additional information, provided that this additional information is kept separately and is subject to appropriate technical and organisational measures;

Any pseudonymisation is agreed between the parties in the respective order or contract.

2. Integrity (Art. 32 para. 1 b GDPR)

Transfer Control
No unauthorized reading, copying, modification or removal during electronic transmission or transport;
√  Encryption concepts (encryption of data carriers, encryption of files).
√  Use of digital signatures
√  Virtual Private Networks (VPN)
√  Agreements on order processing with contractors
√  Disk management and inventory control via Business System
√  Regulated use of external data carriers such as USB sticks, external hard drives.
√  Issue of data carriers only to authorized recipients (e.g. order receipt, accompanying document)
√  Definition of authorized users for media access
√  Packaging and shipping instructions (type of shipping e.g. in closed containers)
√  Direct collection, courier service, transport escort
√  Separate sealing of confidential data carriers
√  Arrangement for making copies of data
√  Documentation of the retrieval and transmission programs
√  Secure document destruction and data deletion
√  Secure deletion of data before data medium exchange and reuse
√  Data carrier disposal via degaussing according to CESG Claims Tested Mark then sent to Stone Group Ltd for recycling.
√  Secured building access entry for delivery and return

Input Control
Determining whether and by whom personal data have been entered, modified or removed in data processing systems;
 
√  Organizational defined responsibilities for data entries
√  Role-based authorization concept
√  Logging of inputs (Changed data, users who changed data) in Business System.
√  Securing the protocols against unauthorized access
√  Processing of Computer Forensics media only takes place on working copies, original media are stored in an evidence bag
√  Protocol evaluation systems
√  Dual control principle for particularly sensitive data (Standard process and Chain of Custody)

3. Availability and resilience (Art. 32 para. 1 b GDPR)

Availability Control
Protection against accidental or deliberate destruction or loss;
√  Fire and smoke detection systems
√  Fire extinguisher for server room
√  Air conditioning of the server room
√  Server room temperature monitoring
√  Use of RAID systems
√  Backup concepts & recovery concepts
√  Regular data recovery tests
√  uninterruptible power supply (UPS)
√  Virus protection
√  Firewall)
√  Protection against malicious code
√  defined reporting channels (also with the service provider)
√  Emergency plans

Rapid recoverability (Art. 32 para. 1 c GDPR);
√  Backup concepts & recovery concepts
√  Ensuring fast procurement of hardware by purchasing/partners

4. Procedures for regular review, assessment and evaluation (Art. 32 para. 1 d GDPR; Art. 25 para. 1 GDPR)

Data-Privacy-Management / Data Protection Management
√  Data Protection Management System
√  Employee commitment to confidentiality
√  Guidelines and concepts on data security and data protection (including Information Security Policy, HR Policy, Data Protection Management Concept, Information Security Summary)

Incident-Response-Management (emergency plans)
√  Risk assessment
√  Emergency plans

Data Protection by Design and Default (Art. 25 para. 2 GDPR)
√  Authorization concepts
√  Need-To-Know-Policy

Order Control
No commissioned data processing within the meaning of Art. 28 DS-GVO without corresponding instructions from the client;
√  Contracts for order processing (Art 28 GDPR)
√  Clear contract design with partner companies
√  Formalized order management
√  Strict selection of service providers
√  Secure data medium transport through appropriate service providers
√  Obligation of prior conviction
√  Follow-up checks via Business System.
√  Secure data deletion after the job has been completed/after 30 days or under conditions of the contract, or new instruction to delete by the customer.
√  Standardized processes for processing of order data
√  Standard Change Management Process (according to ITIL)
Monitoring of the processes

5. Further remarks / references / documents
√  In addition, the technical-organizational measures of the subcontracted data processors apply
√  Certification of KLDiscovery Ontrack according to ISO 27001
√  Certification of Third Parties (according to ISO 27001)

Data Processing Agreement 6.3
Standard Contractual Clauses

 (Controller to Processor (Module Two)

SECTION I

Clause 1

Purpose and scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.

(b) The Parties:

(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and

(ii)   the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)

have agreed to these standard contractual clauses (hereinafter: “Clauses”).

(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2

Effect and invariability of the Clauses

(a)  These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3

Third-party beneficiaries

(a)   Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);

(iii) Clause 9(a), (c), (d) and (e);

(iv) Clause 12(a), (d) and (f);

(v) Clause 13;

(vi) Clause 15.1(c), (d) and (e);

(vii) Clause 16(e);

(viii) Clause 18(a) and (b).

(b)   Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4

Interpretation

(a)   Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c)   These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7

Docking clause

(a)   An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c)   The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Instructions

(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.

(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter “personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by these Clauses, or if:

(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii)   the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;

(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

(a)   The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.

(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.

(c)   The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non- compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.

(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.

(e)   The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

Clause 9

Use of sub-processors

(a) GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub- processors at least fourteen (14) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub- processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub- processor to fulfil its obligations under that contract.

(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Clause 10

Data subject rights

(a)   The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.

(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

(c)   In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.

Clause 11

Redress

(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii)   refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12

Liability

(a)   Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.

(c)   Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.

(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.

(e)   Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13

Supervision

(a) [This section applies where the data exporter listed in Annex 1.A. is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

[This section applies where the data exporter listed in Annex 1.A. is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

[This section applies, where the data exporter listed in Annex 1.A. is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries,

submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

(where the EU processor combines the personal data received from the third country-controller with personal data collected by the processor in the EU)

(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii)   the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards;

(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15

Obligations of the data importer in case of access by public authorities

(where the EU processor combines the personal data received from the third country-controller with personal data collected by the processor in the EU)

15.1 Notification

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation

(a)   The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c)   The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

(a)   The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c)   The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e)   Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17

Governing law

These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.

Clause 18

Choice of forum and jurisdiction

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b) The Parties agree that those shall be the courts of Ireland.

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d) The Parties agree to submit themselves to the jurisdiction of such courts.

APPENDIX

EXPLANATORY NOTE:

It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does not necessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual relationship, where this transparency can achieved through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should be used.

ANNEX I 

LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

1. Name: The customer that is stated in the Order is data exporter for the purpose of these SCC.

Address: Customer’s address stated in the Order

Contact person’s name, position and contact details: The customer that authorized the Order

Activities relevant to the data transferred under these Clauses: Processing and hosting of data for data recovery and related services as stated in the order…

Signature and date: as stated in the Order

Role (controller/processor): Controller

Data importer(s):

2. Name: KLDiscovery Ontrack, LLC

Address:  9023 Columbine Road, Eden Prairie, MN 55347, USA. 

Contact person’s name, position and contact details: Shannon Gaughan (Commercial Counsel) / Gideon Kaplan (Associate General Counsel): Shannon.guaghan@kldiscovery.com / Gideon.kaplan@kldiscovery.com

Activities relevant to the data transferred under these Clauses: Hosting and processing of Personal Data . 

Signature and date:  Data importer’s contact person stated above

Role (controller/processor): Processor

2. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Natural persons, such as Customers, Employees, Suppliers of Data Exporter or other data delivered by Data Exporter.

Categories of personal data transferred

Information relating to identified or identifiable natural persons, including pictures and photographs, contractual relationships and/or customer history, billing and payment data or other categories of data delivered by Data Exporter.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

If sensitive data should be transferred, it will be processed using the same processing methods as set out in these standard contractual clauses, using appropriate safeguards.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

One off, or as often as instructed by the data exporter.

Nature of the processing

The applicable Order content, mainly data recovery and connected services.

Purpose(s) of the data transfer and further processing

The purpose of the data transfer and processing results from the Service Terms and Service Description to the applicable Order, usually in connection with Data Recovery or related Services

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

The term required to complete the Order and, if applicable, after termination of the Order, provided, that any such processing is carried out in connection with the services provided under the Order.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

./.

COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

Supervisory Offices, depending on Data Exporter as defined in Clause 13:

https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

EXPLANATORY NOTE:

The technical and organisational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers.

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.

The technical and organizational measures at Data Importer’s location will be shared upon request of the Data Exporter.

ANNEX III – LIST OF SUB-PROCESSORS

EXPLANATORY NOTE:

This Annex must be completed, in case of the specific authorisation of sub-processors (Clause 9(a), Option 1).

The controller has authorised the use of the following sub-processors:

1. Name:  None

Address: Not applicable.

Contact person’s name, position and contact details:  Not applicable

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorized):  Not applicable. 

ANNEX IV TO THE STANDARD CONTRACTUAL CLAUSES – SUPPLEMENTARY PROTECTIONS

In addition to the provisions of the Controller-to-Processor Standard Contractual Clauses, the following supplementary protections shall apply:

Definitions

For the purposes of this Annex IV, the following definitions apply:

(i) “Back Door” means any technical or organisational measures or mechanisms designed to enable any public authorities, or other third parties, to gain access to any of the data importer’s systems, or to any Relevant Personal Data, including by circumventing the data importer’s security measures;

(ii) “Disclosure Order” means any legally binding demand for access to, or disclosure of, any Relevant Personal Data, made by any public authority, in any jurisdiction, to the data importer;

(iii) “Group” means any legal entity under common control with, controlled by, or control the data importer;

(iv) “Relevant Authority” means a public authority that makes a Disclosure Order; and

(v) “Relevant Personal Data” means any personal data (as defined in these Controller-to-Processor Standard Contractual Clauses) received by the data importer, or any of its sub-processors, under these Clauses.

Supplementary Protections

1. No back doors

The data importer hereby confirms that:

(i) it has not created any Back Doors in any infrastructure, technical environment, review platforms or other system used to host and/or process Personal Data of the data exporter;

(ii) it has not intentionally created or changed its business processes in a manner that facilitates access to its infrastructure, technical environment, review platforms or others systems or to any Relevant Personal Data; and

(iii) to the best of the data importer’s knowledge, applicable laws and government policies applicable to the data importer:

(A) do not require the data importer to create or maintain any Back Doors; and

(B) do not require the importer to be in possession of, or to disclose or provide, any encryption keys in relation to any Relevant Personal Data.

2. Enhanced audit rights

In addition to, and without prejudice to, the audit rights afforded to the data exporter under the auditing provisions of the Data Processing Agreement, and Clause 8.9(c) these Controller-to-Processor Contractual Clauses, to the extent permitted by applicable law, the data exporter, or its appointed representatives, shall be permitted, on no less than 48 hours’ written notice, to conduct an audit of the data importer’s relevant systems (and the systems of any sub-processors where such sub-processors within the data importer’s Group), whether in person or, to the extent practicable, by remote means, for the sole purpose of determining whether any Relevant Personal Data have been disclosed in response to any Disclosure Order. This additional right to audit shall be at the sole cost and expense of the data exporter who shall determine whether and if such audit shall take place.  The data importer shall, where requested by the data exporter, take reasonable steps to assist the data exporter in conducting such audits including the provision of technical personnel to assist the data exporter in conducting the audit, supervised and controlled access to data importer’s infrastructure, technical environment, review platforms or other systems (provided such access does not impact any other client of the data importer or require the disclosure of confidential information relating to such clients) and copies of relevant documents that may assist the data exporter in conducting and assessing the findings of such audit.

3. Notification and Transparency

To the extent permitted by applicable law, the data importer shall regularly (and at least once every 24 hours) publish a message via a secure URL, accessible at https://www.kldiscovery.com/legal/transparency-report (“Transparency Page”) informing the data exporter that, as at the time of the published message, it has not received a Disclosure Order.  The data importer shall, for the term of processing of Relevant Personal Data under these Controller-to-Processor Contractual Clauses, continue to publish such information on the Transparency Page. 

4. Obligation to Challenge

In the event that the data importer receives a Disclosure Order, the data importer shall promptly review the validity and enforceability of such Disclosure Order under applicable law and if, after a careful assessment, the data importer concludes that there are plausible grounds for challenging the Disclosure Order, and that such a challenge has a reasonable likelihood of succeeding, the data importer shall use reasonable efforts to bring such a challenge (including, where appropriate, through interim proceedings). To the extent that, notwithstanding any challenge, the data importer is obliged to disclose any Relevant Personal Data to the Relevant Authority, the data importer shall take all reasonable measures to ensure that it discloses the minimum amount of Relevant Personal Data required by applicable law.

5. Obligation to Notify

In the event that the data importer receives a Disclosure Order, the data importer shall:

(i) to the extent that the Disclosure Order contradicts the requirements of these Controller-to-Processor Contractual Clauses, inform the Relevant Authority that the Disclosure Order is incompatible with its obligations under these Controller-to-Processor Contractual Clauses, and that the Disclosure Order therefore exposes the data importer to conflicting legal obligations;

(ii)   to the extent permitted by applicable law, notify the data exporter of the Disclosure Order; and

(iii) where the data importer is legally able to inform the data exporter of the Disclosure Order, provide all reasonable assistance to the data exporter to defend, challenge and/or limit the scope of the Disclosure Order and shall take all reasonable instructions from the data exporter regarding the Disclosure Order including choice of counsel by the data exporter.  Where the data importer is permitted to notify, and therefore take instructions from the data exporter regarding the Disclosure Order, the data exporter shall be responsible for any reasonable costs and expenses incurred by the data importer in carrying out the data exporter’s instructions.

6. Policies and procedures

The data importer shall implement and maintain adequate internal policies with clear allocation of responsibilities for data transfers, reporting channels and standard operating procedures for handling Disclosure Orders.

7. Disclosure of Records

The data importer shall create and maintain a written record of:

(i) each Disclosure Order; and

(ii) the response to each Disclosure Order, together with details of the analysis of the Disclosure Order, the reasons for any response to the Disclosure Order,

and shall make such records available to the data exporter on request, to the extent permitted by applicable law, subject to appropriate redactions.

8. Standards

The data importer shall adopt the security standards set out in Annex II, including but not limited to the ISO 27001 standard, and shall implement all appropriate security measures with due regard to the state of the art, in accordance with the levels of risk associated with the categories of Relevant Personal Data processed and the likelihood of Disclosure Orders in relation to such Relevant Personal Data.

9. Policy Review

The data importer shall implement a regular review of the measures it has taken to protect Relevant Personal Data, including its applicable policies and procedures, to assess the suitability of those measures, and identify and implement additional or alternative measures when reasonably necessary. 

10. Onward Transfers

Where the data exporter provides instructions to data importer for the onward transfer of Relevant Personal Data to a sub-processor, the data importer shall use commercially reasonable efforts to obtain, from that sub-processor, an agreement that provides an equivalent level of protection for Relevant Personal Data, as is set out in this Annex IV, prior to the onward transfer of Relevant Personal Data to that sub-processor.  Where the data importer is unable to obtain equivalent measures as those set out in this Annex IV, the data importer shall not transfer any Relevant Personal Data to the sub-processor without the prior written authorization of the data exporter.  It is acknowledged at all times that, where the data importer is unable to obtain equivalent measures as those set out in this Annex IV, any authorization by the data exporter shall be solely at the data exporter’s legal risk.

11. Compensation or other legal remedies

It is acknowledged and accepted by the data exporter and data importer that the decision to transfer any Relevant Personal Data shall be solely taken by the data exporter, or the data exporter’s end client, as the case may be, and nothing in this Annex IV or more generally following a data exporter decision to transfer Relevant Personal Data shall impose, or create, any liability on the data importer to any Data Subject or the data exporter arising from such a decision.

Provisions applicable in relation to transfers of Personal Data governed by the Data Protection Act 2018 (UK)

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

VERSION B1.0, in force 21 March 2022

ThisAddendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1: Parties