GDPR amendment to standard Customer Terms & Conditions

Dear Sirs,

Variation to our General Conditions for Business Customers

You may be aware that the General Data Protection Regulation (GDPR) comes into effect in the UK, and wider European Union, on 25 May 2018.

In preparation for the GDPR, we have recently reviewed our General Conditions for Business Customers for the provision of telecommunication network services. In providing the Services to you, we recognise that personal data relating to your staff passes to us. We further recognise that personal data (for administrative purposes) passes between us, and the GDPR may apply to this data.

To allow us both to comply with our enhanced legal and regulatory obligations, it is important for both of us to ensure that our terms of business reflect the changes introduced by the GDPR. To do this, we have prepared a short variation to our terms, to be inserted as an addendum. This is in accordance with our rights to vary our standard terms, from time to time, under clause 12.1. Whilst these changes will take effect, procedurally, 28 days from the date of this letter, a number of changes or enhancements into how we process your personal data have already been implemented ahead of GDPR.

A copy of our proposed wording is annexed to this letter. The changes are not drafted to improve our position under our contract with you. If you have any questions relating to this letter or its subject matter, please email them to yourdata@nsn.co

We look forward to continually working with you. Yours faithfully

Mark Shraga
Chief Executive Officer
For and on behalf of New Star Networks Limited

Schedule 1

Data Protection

  1. APPLICATION
    1. The Company has amended its General Conditions for Business Customers (General Conditions) on the terms of this Schedule 1, in accordance with clause 12.1 of the General Conditions.
    2. Where there is any conflict between the provisions of this Schedule and those in the General Conditions (particularly clause 23), the terms of this Schedule shall prevail.
    3. The following definitions and rules of interpretation shall apply in this Schedule, in addition to those contained in clause 1 of the General Conditions:

      “Act” refers to the UK Data Protection Act 1998;

      “Customer Data” means all necessary personal data relating to any Customer (including name and contact details and any other data listed in Schedule 1) and any data subject employed or engaged by any Customer that is provided to NSN under the Agreement;

      “Data Protection Laws” refers to:

      (i) the Regulation (unless and until it is no longer directly applicable in the UK);

      (ii) any UK implementing laws, regulations and secondary legislation under the Regulation (as amended or updated from time to time);

      (iii) any successor legislation to the Regulation; and

      (iv) the Act; and

      “Privacy Policy” refers to the Company’s privacy policy located on its website at https://www.scgtogether.com/nsn-privacy-policy/; and

      “Regulation” refers to the EU General data Protection Regulation (2016/679)

    4. These Schedules are in addition to the Company’s and the Customer’s obligations under the Data Protection Laws and the General Conditions.
    5. Terms used in these Schedules relating to data privacy/protection (but not otherwise defined), such as personal data, data processor and data subject, shall have the meaning(s) given to them in the Act or the Regulation (as applicable).
    6. The terms and provisions of this Schedule shall survive the termination or expiry of the General Conditions (for any reason).
  2. DATA PROTECTION
    1. Where the Company processes any Customer Data, the Company will comply with all requirements and obligations under the Data Protection Laws.
    2. The Customer shall notify all Users of the:
      1. nature and identity of the Company as a data processor;
      2. categories of personal data transferred; and
      3. Privacy Policy.
    3. The Company shall:
      1. update the Privacy Policy (where necessary to remain compliant with the Data Protection Laws); and
      2. maintain a valid and subsisting registration with the Information Commissioner’s Office to process the Customer Data (where required to do so).
    4. The Company shall only process the Customer Data it reasonably requires to provide the Services. All Customer Data processed by the Company shall be in accordance with the Privacy Policy (to the extent it complies with the Data Protection Laws) and the Customer’s written instructions.
    5. The Company shall:
      1. ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of, and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected (having regard to the state of technological development and the cost of implementing any measures);
      2. ensure that all personnel, contractors, agents or representatives who have access to and/or process personal data at any time are:
        (a) limited only to those natural persons who need access to the personal data for the Company to meet its obligations under these General Conditions;
        (b) informed of the confidential and sensitive nature of personal data; and
        (c) are aware of their obligations, and data subjects’ rights, under the Data Protection Laws;
      3. assist the Customer (at the Customer’s cost) within a reasonable period in responding to any request from a data subject in connection with any exercise of any of its rights under the Data Protection Laws and to provide assistance with respect to security, breach notifications, impact assessments and consultations, where requested;
      4. provide, on request, a copy of all personal data held by the Company in the format and on the media reasonably specified by the Customer (at the Customer’s cost);
      5. notify the Customer as soon as reasonably practicable on becoming aware of a personal data breach, including if any personal data is lost, destroyed or becomes damaged, corrupted or unusable, and where requested or required to assist, to notify the data subject of such breach;
      6. keep and maintain complete and accurate records and information of any processing of personal data it carries out on behalf of the Customer, and permit (on reasonable notice), the Customer (or the Customer’s representative) to inspect all such records relating to the processing of personal data by the Company to demonstrate its compliance with this clause 23; and
      7. notify the Customer (as soon as reasonably practicable), if it has been given an instruction which doesn’t comply with the Data Protection Laws.
    6. The Customer acknowledges that the Customer Data will be processed by the Company through:
      1. hosting on third party systems; or
      2. processed by staff in offices located;
        outside of the EEA or a territory deemed to ensure adequate protection of personal data by the European Commission. Detailed information about the Customer Data affected, and relevant third parties, is available in the Privacy Policy.
    7. By signing this Agreement, the Company:
      1. expressly consents to the transfers of Customer Data contemplated by Part 2.6 of this Schedule 1; and
      2. warrants that it has the relevant consent of all affected data subjects to the transfer (as required by the Regulation.
  3. OTHER CUSTOMER OBLIGATIONS
    The definition of automated personal data (as referred to in sub-clause 9.1(l) of the General Conditions) shall have the updated meaning given to it in the Regulation, not the Act.
  4. CONSEQUENCES OF TERMINATION
    In addition to any other consequences of termination listed in sub-clause 14.11 of the General Conditions, each party will (at the disclosing party’s request) promptly return to the other all Confidential Information and any other property (including any personal data and Customer Data) which is in its custody or control, or will destroy the same and certify such destruction.
  5. CREDIT CHECKS AND FRAUD PREVENTION
    Where the Company, or any other organisation, uses Customer Data for fraud prevention (or other purposes for which the Customer or any User gives its specific permission), such data will only be used where permitted under the terms of the Regulation. For more information about how data may be used, please check the Privacy Policy.