Conditions for Creative Advertising Services

1. Interpretation

   1. Definitions:

      Advertising Standards: any present or future applicable code of practice of the Committee of Advertising Practice or Broadcast Committee of Advertising Practice, or adjudication of the Advertising Standards Authority, and includes any applicable modification, extension or replacement thereof in force from time to time, together with other UK laws, statutes and regulations which are directly applicable to the Services.

      Agency: Viv’id(a) Ltd registered in England and Wales with company number 03929225

      Agency Materials: means any artwork, copy, models, designs, photographs, commercial, feature film, character, music, voice over, sound recording, performance, book, painting, logo, or any other material protected by Intellectual Property Rights, and including any software, specifically created by the Agency for the Client as part of the Services (including any materials adapted, modified or derived from the Client Materials).

      Agency Proprietary Materials: means materials in relation to which the Intellectual Property Rights are owned by (or licensed to) the Agency and which are: (i) in existence prior to the date on which it is intended to use them in the Services; or (ii) created by or for the Agency outside of the Services and which are intended to be reused across its business.

      Authorised Client Approver: those personnel of the Client notified to the Agency or whom the Agency might reasonably assume have the authority to bind the Client in matters relating to the Contract.

      Business Day: a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.

      Client: the entity named in the SOW who purchases the Services from the Agency.

      Client Materials: any data, client equipment, computer systems, software, documents and any other materials or information owned by or licensed to the Client which are to be used by the Agency in the Services.

      Client Personal Data: means personal data:

      1. supplied to the Agency by or on behalf of the Client; and/or

      2. obtained by, or created by, the Agency on behalf of the Client in the course of delivery of Services,

         and which, in each case, is Processed by the Agency in the performance of Services.

         Conditions: these terms and conditions as amended from time to time in accordance with clause 16.5.

         Confidential Information: information received by a party relating to the other party, its clients, customers, businesses, business plans or affairs, which information is proprietary and confidential to that other party, and including any document marked “Confidential”, or any information which the recipient has been informed is confidential or which it ought reasonably to expect the other party would regard as confidential, but excludes any information which: (i) at the time of receipt by the recipient is in the public domain; (ii) subsequently comes into the public domain through no fault of the recipient, its officers, employees or agents; (iii) is lawfully received by the recipient from a third party on an unrestricted basis; and/or

         (iv) is already known to the recipient before receipt hereunder.

         Contract: the contract between the Agency and the Client for the supply of Services, comprising these Conditions (including any schedules) and the SOW.

         Control: shall be as defined in section 1124 of the Corporation Tax Act 2010, and the expression.

         Data Privacy Laws: means the following as amended, extended or re-enacted from time to time.

         1. the UK Data Protection Act 2018 and the UK GDPR

         2. EC Regulation 2016/679 (the “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

         3. EC Directive 2002/58/EC on Privacy and Electronic Communications;

         4. all local laws or regulations implementing or supplementing the EU legislation mentioned in (ii)-(iii) above (including the UK Privacy and Electronic Communications Regulations 2003); and

         5. all codes of practice and guidance issued by national supervisory authorities, regulators or EU or UK institutions relating to the laws, regulations, UK legislation and EU legislation mentioned in (i)–(iv) above.

         Data Processing Agreement (or DPA): the data processing agreement set out at Schedule 1 to this Contract.

         Deliverables: the deliverables set out in the SOW to be produced by the Agency for the Client.

         Effective Date: means the date described in clause 2.2.

         Expenses: reasonable travelling, hotel, subsistence and other expenses incurred by the Agency in connection with the supply of Services (but excluding Third Party Costs).

         Fees: the Agency fees for the Services to be provided under the Contract in accordance with its rate card or as may otherwise be specified in the SOW (excluding Third Party Costs and Expenses).

         Intellectual Property Rights: patents, rights to inventions, copyright and related rights, trade marks, business names and domain names, rights in get-up, goodwill and the right to sue for passing off, rights in designs, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how), and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.

         Losses: losses, damages, liabilities, claims, demands, actions, penalties, fines, awards, costs and expenses (including reasonable legal and other professional expenses).

         Moral Rights: means all rights described in Part I, Chapter IV of the Copyright Designs and Patents act 1988 and any similar rights of authors anywhere in the world.

         Services: the advertising services, including the Deliverables, to be supplied by the Agency to the Client as set out in the SOW.

         SOW: the scope of work prepared by the Agency containing the description or specification of the Services and agreed by the parties in writing.

         Term: the duration of the Contract as set out in the SOW and subject to clause 12 of these Conditions.

         Territory: means the United Kingdom, unless expressly specified otherwise in the SOW, and publication and marketing on globally accessible media such as the internet shall not mean that the Territory is deemed to be world-wide.

         Third Party Costs: all third party costs incurred by the Agency on behalf of the Client in performing the Services, including production work such as illustrations, film production, artwork and photography, the services of models and other performers, recordings, animation, print and post production work and all costs incurred in taking legal or other advice, searches and enquiries.

         Third Party Materials: means those materials which are either commissioned by the Agency from third parties and incorporated into the Deliverables, or which have been created by a third party and which are in existence at the time it is desired to make use of them for inclusion in the Deliverables.

         UK GDPR: has the meaning given in the Data Protection Act 2018.

   2. Interpretation:

      1. A reference to a statute or statutory provision is a reference to it as amended or re-enacted. A reference to a statute or statutory provision includes any subordinate legislation made under that statute or statutory provision, as amended or re-enacted.

      2. Any phrase introduced by the terms including, include, in particular or any similar expression, shall be construed as illustrative and shall not limit the sense of the words preceding those terms.

      3. A reference to writing orwritten includes email unless otherwise stated.

2. Basis of contract

   1. The Client agrees to engage the Agency, and the Agency agrees to accept such engagement to provide the Services as set out in the SOW, under and subject to these Conditions.

   2. The Contract shall come into existence when the SOW is signed by both parties (“Effective Date”) and shall continue for the Term.

   3. These Conditions shall apply to the exclusion of any other terms that the Client may seek to impose or incorporate.

3. Supply of Services

   1. The Agency shall:

      1. supply the Services to the Client in the Territory, materially in accordance with the SOW;

      2. use reasonable endeavours to meet any performance dates specified in the SOW; and

      3. have the right to make any changes to the Services which are necessary to comply with any applicable law or safety requirement, or which do not materially affect the nature or quality of the Services.

   2. The Agency warrants to the Client that the Services will be provided using reasonable care and skill.

   3. The Agency acts in all its contracts with third parties in respect of the provision of Services as a principal at law.

   4. The Agency will not be obliged to perform any work on behalf of the Client until a SOW has been signed by both parties.

4. Client's obligations

   1. The Client shall:

      1. ensure that any information it provides for incorporation in the SOW is complete and accurate;

      2. co-operate with, and ensure that its other suppliers and agencies co-operate with, the Agency in all matters relating to the Services;

      3. promptly provide the Agency with such information and Client Materials as the Agency may reasonably require in order to supply the Services, ensure that such materials and information are accurate in all material respects and that it has all rights and licences in place to enable their use by the Agency; and

      4. not issue any instruction to the Agency or otherwise require the Agency to carry out or participate in any act that might reasonably be considered by the Agency to be unlawful.

   2. If the Client does not fulfil its obligations under or in connection with the Contract (including its payment obligations), then to the extent that such failure prevents the Agency from performing any Services and/or providing any Deliverables in accordance with the Contract, the Agency will be relieved of its obligations to the Client and shall not be liable for any Losses incurred by the Client as a result of any such failure.

5. Approvals

   1. Where a party is asked to give approval under or in connection with the Contract, such approval shall not be unreasonably withheld or delayed.

   2. The Client’s approval of costs estimates and creative treatments will be the Agency’s authority to enter into contracts with relevant third parties and to prepare Deliverables.

   3. In the event of any delay or failure of an Authorised Client Approver giving approvals requested under or in connection with the Contract, the Agency will not be liable for any resulting delays or adverse impact caused to the delivery of the Services.

6. Amendments & Cancellations

   1. In the event that either party wishes to make any material amendment to the SOW, any such amendment shall be subject to the agreement of both parties in writing.

   2. The Client may request the Agency to cancel any Services, including any plans, schedules or work in progress, and the Agency will take reasonable steps to comply with any such request provided that it is able to do so within its contractual obligations to suppliers.

   3. In the event of any cancellation pursuant to clause 6.2, the Client will reimburse the Agency for all Fees as would have been payable had the Services not been cancelled, together with any Third Party Costs and Expenses incurred by the Agency or to which the Agency is committed as well as any charges or other expenses or costs imposed on the Agency by third parties arising from the cancellation, including all sums agreed to be paid by the Agency to a production company.

7. Charges & Payment

   1. The Agency shall invoice the Client for, and the Client shall pay, all Fees, Expenses and Third Party Costs.

   2. The Fees do not cover the performance of services which are outside of a SOW nor do they cover the performance of Services outside the Territory. If any such services are required, they shall be subject to the written agreement of the Agency and payable on the basis set out in clause 7.4.

   3. The Agency reserves the right to increase its standard daily fee rates provided that such rates cannot be increased more than once in any 12-month period. The Agency will give the Client written notice of any such increase 3 months before the proposed date of the increase.

   4. The Fees, Expenses and Third Party Costs will be invoiced in accordance with the payment terms set out in the SOW and shall be payable within 30 days of the date of the relevant invoice, provided that in the event that any Third Party Costs require payment in advance or sooner than within 30 days of the date of invoice, the Client shall pay such costs within the period set out in the relevant invoice.

   5. All sums stated in the Contract or in any SOW, quotation or estimate exclude VAT and any other applicable sales tax (unless otherwise stated) which shall also be payable by the Client at the rate prevailing from time to time.

   6. If the Client fails to make any payment due to the Agency under the Contract by the due date for payment, then debts will be subject to the Late Payment of Commercial Debts (interest) Act 1998.

   7. If the Client is overdue with any payment hereunder, then without prejudice to the Agency’s other rights or remedies:

      1. the Agency shall have the right to suspend performance of the Services until it has received payment of the overdue amount and any accrued interest; and/or

      2. the Agency shall have the right to terminate the applicable SOW immediately upon written notice to the Client.

   8. Where a surcharge is levied by a supplier against the Agency due to late payment and this results from late payment by the Client, the Client shall immediately reimburse to the Agency the amount of such surcharge, together with any accrued interest or other sum charged by the supplier in respect of the overdue amount.

   9. Where a late copy charge is levied by a media owner against the Agency due to copy being delivered late and this does not result from the Agency’s negligent or wilful act or omission, then the Client shall immediately reimburse the amount of such late copy charge to the Agency.

   10. The Client shall pay all amounts due under the Contract in full without any set-off, counterclaim, deduction or withholding (except for any deduction or withholding required by law).

8. Intellectual property rights

   1. Subject to the remaining provisions of this clause 8 and subject to the Agency receiving payment of all Fees attributable to the Agency Materials the Agency hereby assigns to the Client (and in the case of copyright, by way of a present assignment of future copyright) all Intellectual Property Rights in the Agency Materials which are capable of being assigned together with the right to sue for past infringement of the Intellectual Property Rights in the Agency Materials. If the Client wishes to use any Deliverables outside of the Territory, then such use shall be subject to agreement of further fees.

   2. All Intellectual Property Rights in the Agency Proprietary Materials shall be owned by and remain the property of and vested in the Agency. Subject to the Agency receiving payment of all Fees attributable to the Agency Proprietary Materials licensed under this clause, the Agency hereby grants to the Client a licence to use such Agency Proprietary Materials as are included in the Deliverables, in the Territory, for the period of time and for the purposes set out in the relevant SOW.

   3. The Agency shall obtain licences or consents in respect of Third Party Materials in order that the Client can use Third Party Materials for the purposes set out in the SOW. The Agency shall notify the Client of any restrictions on usage in respect of such Third

      Party Materials, and the Client shall comply with any such restrictions and shall indemnify the Agency against any Losses suffered by the Agency as a result of the Client breaching any such restrictions.

   4. The Agency shall use reasonable endeavours to ensure that all Moral Rights in the Agency Materials and Third Party Materials included in the Deliverables are waived (or where not lawfully possible to waive Moral Rights, that Moral Rights are not asserted) and if the Agency cannot obtain such waiver of (or agreement not to assert), the Agency will notify the Client and shall obtain the Client’s approval prior to incorporating such materials into the Deliverables.

   5. The Agency shall be entitled during and after the Term to use any Deliverables which have been broadcast, published, distributed or otherwise made available to the public, and the Client’s name and logo, for the purposes of promoting its work and its business including on the Agency’s website, in credentials pitches, in its showreel and for entering awards and industry competitions.

9. Agency Warranties

   1. The Agency warrants that:

      1. it has full power and authority to enter into the Contract;

      2. subject to clause 9.3 the use of the Deliverables by the Client in accordance with the Contract and for the purposes set out in the SOW will not infringe the copyright of any third party;

      3. to the best of its knowledge and belief and subject to clause 9.3, as at the date of their delivery the use of the Deliverables in accordance with this Contract for the purposes set out in the SOW will comply with all Advertising Standards in the UK, save that where the Client’s business involves any industry sector which is subject to its own industry specific standards or other code, regulation, statute or law (collectively “Specialist Advertising Regulations”) the Client shall be responsible for ensuring that the Deliverables are compliant with such Specialist Advertising Regulations.

   2. All warranties, conditions, terms, undertakings and obligations implied by statute, common law, custom, trade usage, course of dealing or otherwise are hereby excluded to the fullest extent permitted by law, including any condition of satisfactory quality or fitness for a particular purpose.

   3. The Client releases the Agency from any liability under or in connection with the Contract and hereby indemnifies the Agency against any Losses incurred by the Agency to

      the extent that such Losses arise as a result of:

      1. the Deliverables infringing third party Intellectual Property Rights, breaching Advertising Standards, Specialist Advertising Regulations, or other laws and regulations, where the Agency had previously notified the Client of a specific risk that the Deliverables infringed third party Intellectual Property Rights or breached Advertising Standards, Specialist Advertising Regulations, or other laws and regulations; and/or

      2. the incorporation of Client Materials into the Deliverables.

10. Client Warranties

    1. The Client warrants that:

       1. it has full power and authority to enter into the Contract;

       2. the Client Materials will not, when used in accordance with this Contract and any written instructions given by the Client, infringe third party copyright;

       3. to the best of its knowledge and belief, the Client Materials will comply with all applicable laws and regulations including all Advertising Standards; and

       4. the Client Materials are accurate and complete in all material respects.

11. Limitation of liability:

    1. Nothing in the Contract shall exclude or in any way limit either party’s liability for fraud, death or personal injury caused by its negligence or any other liability to the extent such liability may not be excluded or limited as a matter of law.

    2. Subject to clause 11.1, the Agency shall not be liable to the Client, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with the Contract for:

       1. loss of profits;

       2. loss of sales or business;

       3. loss of agreements or contracts;

       4. loss of anticipated savings;

       5. loss of use or corruption of software, data or information;

       6. loss of damage to goodwill; and

       7. any indirect or consequential loss.

    3. Subject to clause 11.1, the Agency's total liability to the Client, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with the Contract shall in no event exceed 125% of the total Fees paid under the Contract.

    4. This clause 11 shall survive termination of the Contract.

12. Termination

    1. Without limiting its other rights or remedies, either party may terminate the Contract with immediate effect by giving written notice to the other party if:

       1. the other party commits a material breach of any term of the Contract and (if such a breach is remediable) fails to remedy that breach within 30 days of that party being notified in writing to do so;

       2. the other party takes any step or action in connection with its entering administration, provisional liquidation or any composition or arrangement with its creditors (other than in relation to a solvent restructuring), being wound up (whether voluntarily or by order of the court, unless for the purpose of a solvent restructuring), having a receiver appointed to any of its assets or ceasing to carry on business or, if the step or action is taken in another jurisdiction, in connection with any analogous procedure in the relevant jurisdiction;

       3. the other party suspends, or threatens to suspend, or ceases or threatens to cease to carry on all or a substantial part of its business; or

       4. the other party's financial position deteriorates to such an extent that in the terminating party's opinion the other party's capability to adequately fulfil its obligations under the Contract has been placed in jeopardy.

    2. Without limiting its other rights or remedies, the Agency may terminate the Contract with immediate effect by giving written notice to the Client if:

       1. the Client fails to pay any amount due under the Contract on the due date for payment and remains in default not less than 14 days after being notified in writing to make such payment; or

       2. there is a change of Control of the Client.

13. Consequences of termination

    On termination of the Contract for any reason:

    1. the Client shall immediately pay to the Agency all of the Agency's outstanding unpaid invoices and interest and, in respect of Services supplied but for which no invoice has been submitted (including Third Party Costs and Expenses), the Agency shall submit an invoice, which shall be payable by the Client immediately on receipt;

    2. the Client shall return all of the Agency Materials and any Deliverables which have not been fully paid for;

    3. the accrued rights, remedies, obligations and liabilities of the parties as at expiry or termination shall be unaffected, including the right to claim damages in respect of any breach of the Contract which existed at or before the date of termination or expiry; and

    4. clauses which expressly or by implication survive termination shall continue in full force and effect.

14. Data Protection

    1. Each party shall comply with the obligations applicable to it under the Data Privacy Laws.

    2. The parties do not anticipate that the Agency shall process any Client Personal Data in connection with the performance of Services. If, for any reason, the Agency does process Client Personal Data for and on behalf of the Client in connection with the performance of Services, the parties will, acting reasonably, agree and enter into a separate data processing addendum that complies with the requirements of Data Privacy Laws and affords appropriate protection in respect of the Client Personal Data before the Agency processes such Client Personal Data.

       In the event where the Agency is processing Client Personal Data the parties will complete the Data Processing Agreement as a schedule attached to this Contract.

       Without prejudice to the generality of clause 14.1, in respect of the Agency’s processing of Client Personal Data, the parties shall each comply with their respective obligations set out in the Data Processing Agreement.

15. Advertising Standards

    1. Both parties acknowledge that they have a responsibility to comply with all Advertising Standards.

    2. The parties will co-operate with each other in ensuring that suitable objective factual product and other information is available as required to satisfy the requirements of any applicable Advertising Standards.

16. General

    1. Force majeure. Neither party shall be in breach of the Contract nor liable for delay in performing, or failure to perform, any of its obligations under the Contract if such delay or failure result from events, circumstances or causes beyond its reasonable control.

    2. Assignment and other dealings.

       1. The Agency may at any time assign, transfer, mortgage, charge, subcontract or deal in any other manner with all or any of its rights under the Contract and may subcontract or delegate in any manner any or all of its obligations under the Contract to any third party or agent.

       2. The Client shall not, without the prior written consent of the Agency, assign, transfer, mortgage, charge, subcontract, declare a trust over or deal in any other manner with any or all of its rights or obligations under the Contract.

    3. Confidentiality.

       1. Each of the parties undertakes to maintain the confidentiality of the other party’s Confidential Information at all times and to use no less adequate measures than it uses in respect of its own confidential information to keep the other party’s Confidential Information reasonably secure.

       2. Neither party shall at any time, whether during the Term or at any time thereafter, without the prior written approval of the other party, unless otherwise required by law use, disclose, exploit, copy or modify any of the other party’s Confidential Information, or authorise or permit any third party to do the same, other than for the sole purpose of the exercise of its rights and/or the performance of its obligations in connection with the Contract.

       3. Each party may disclose the other party's Confidential Information to its employees, officers, representatives, subcontractors or advisers who need to know such information for the purposes of carrying out the party's obligations under the Contract. Each party shall ensure that its employees, officers, representatives, subcontractors or advisers to whom it discloses the other party's confidential information comply with this clause 16.3.

       4. The Client acknowledges and agrees that any identifiable and original idea or concept presented by the Agency in relation to any promotion or advertising campaign developed by the Agency shall be acknowledged as being available only for such promotion or campaign and shall not be used for any other purposes whatsoever without the Agency’s express prior written approval. All ideas and concepts presented to the Client shall remain strictly confidential and shall not be used in any way, including communication to any third party, without the Agency’s prior written approval.

    4. Entire agreement.

       1. The Contract constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

       2. Each party agrees that it shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in the Contract. Each party agrees that it shall have no claim for innocent or negligent misrepresentation based on any statement in the Contract.

    5. Variation. No variation of the Contract shall be effective unless it is in writing and signed by the parties (or their authorised representatives).

    6. Waiver. A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent breach or default. A delay or failure to exercise, or the single or partial exercise of, any right or remedy shall not:

       1. waive that or any other right or remedy; or

       2. prevent or restrict the further exercise of that or any other right or remedy.

    7. Severance. If any provision or part-provision of the Contract is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of the Contract.

    8. Notices.

       1. Any notice or other communication given to a party under or in connection with the

          Contract shall be in writing, addressed to that party at its registered office or such other address as that party may have specified to the other party in writing in accordance with this clause, and shall be delivered personally, or sent by pre-paid first class post or other next working day delivery service, commercial courier or email.

       2. A notice or other communication shall be deemed to have been received: if delivered personally, when left at the address referred to in clause 16.8(a); if sent by pre-paid first class post or other next working day delivery service, at 9.00 am on the second Business Day after posting; if delivered by commercial courier, on the date and at the time that the courier's delivery receipt is signed; or, if sent by email, one Business Day after transmission.

       3. The provisions of this clause shall not apply to the service of any proceedings or other documents in any legal action.

    9. Third parties. No one other than a party to the Contract shall have any right to enforce any of its terms.

    10. Governing law and Jurisdiction. This Contract, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, shall be governed by the law of England and Wales, and each party submits to the exclusive jurisdiction of the courts of England and Wales.

[SCHEDULE 1 – Data Processing Agreement]

BACKGROUND:

1. In order to supply all or part of the Services, Agency will be required to process certain personal data on behalf of Client;

2. The parties are entering into this Data Processing Agreement to comply with data privacy laws and to set out their respective rights and obligations in respect of such processing.

   1. Definitions and Interpretation

      1. Unless otherwise defined in this Data Processing Agreement (DPA), words and expressions used in this DPA shall have the meanings given in the Contract. In this DPA, the following words shall have the following meanings:

         EEA: means the European Economic Area;

         European Law: means any law in force in the EEA or the United Kingdom, including the Data Privacy Laws;

         International Transfer Requirements: means the requirements of Chapter V of the GDPR (Transfers of Personal Data to third countries or international organisations);

         Restricted Country: means a country, territory or jurisdiction which is not considered by the EU Commission (or in respect of personal data transfers caught by the requirements of UK Data Privacy Laws, the relevant UK governmental or regulatory body as applicable) to offer an adequate level of protection in respect of the processing of personal data pursuant to Article 45(1) of the GDPR;

         Restricted Transfer: means a transfer of personal data from an entity whose processing of personal data under the Contract is caught by the requirements of the GDPR and/or UK Data Privacy Laws (as applicable), to an entity that processes the relevant personal data in a Restricted Country;

         Sub-processors: has the meaning given in paragraph 3.9;

         UK: means the United Kingdom; and

      2. References to “processor”, “controller”, “personal data”, “process”, “processing”, “personal data breach”, “data subject” or “supervisory authority” shall have the same meanings as defined in the GDPR.

      3. In this DPA:

         1. a reference to the GDPR and/or an Article or Chapter of the GDPR shall, where the context so requires and insofar as the Data Privacy Law(s) is that of the UK, be construed as a

            reference to the equivalent Data Privacy Law(s) of the UK and/or the corresponding provision of such Data Privacy Law(s); and

         2. a reference to a paragraph or an Appendix is a reference to a paragraph of, or Appendix to, this DPA.

      4. In the event of any conflict or inconsistency between the terms of this DPA and any other part of the Contract, this DPA will take precedence.

   2. 1. The parties acknowledge and agree that, to the extent that the Agency processes Client Personal Data on behalf of the Client in connection with the provision of Services, the Agency shall be the processor and the Client shall be the controller with respect to such processing.

      2. Each of the parties acknowledges and agrees that the subject-matter and duration of the processing carried out by the Agency on behalf of the Client, the nature and purpose of the processing, the type of personal data and categories of data subjects are accurately documented in Appendix 1 (which may from time to time be updated by the written agreement of the parties).

      3. If at any time either party considers that the relationship between the parties and/or the scope of processing carried out by the Agency no longer corresponds to the intention of the parties stated in paragraph 2.1 or 2.2, that party shall promptly notify the other and the parties shall discuss and agree in good faith such steps that may be required to reflect the true status and/or scope of processing undertaken by the Agency.

   3. 1. The Agency shall only process the Client Personal Data in accordance with the documented instructions of the Client (including those documented in accordance with Appendix 1, as updated from time to time), unless required to do so by European Law to which the Agency is subject, in which event the Agency shall inform the Client of such legal requirement unless prohibited from doing so by European Law on important grounds of public interest.

      2. The Agency shall inform the Client if, in the Agency’s opinion, an instruction given by the Client to the Agency under paragraph 3.1 infringes the Data Privacy Laws.

      3. The Agency shall ensure that any persons authorised by it to process the Client Personal Data are subject to an obligation of confidentiality.

      4. The Agency shall implement appropriate technical and organisational measures to ensure that the Client Personal Data is subject to a level of security appropriate to the risks arising from its processing by the Agency, taking into account the factors and measures referred to in Article 32 of the GDPR. Such security measures may include:

         1. the pseudonymisation and encryption of personal data;

         2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

         3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and

         4. a process for regularly testing, assessing, and evaluating the effectiveness of the security measures.

      5. Taking into account the nature of the processing and the information available to the Agency, the Agency shall assist the Client with regard to the Client’s compliance with its obligations under the following Articles of the GDPR:

         1. Article 32 (Security of processing);

         2. Articles 33 and 34 (Notification and communication of a personal data breach);

         3. Article 35 (Data protection impact assessment); and

         4. Article 36 (Prior consultation by the Client with the supervisory authority).

      6. Without prejudice to the generality of paragraph 3.5, the Agency shall notify the Client without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach. The Agency shall provide such co-operation, assistance and information as the Client may reasonably require in respect of any personal data breach. Without prejudice to the generality of this requirement, the Agency shall provide the Client with the following information in respect of any personal data breach (insofar as it is possible, at the time of notifying the Client of the relevant personal data breach, or where such information is not available at the point of notification as soon as such information is available):

         1. the nature of the Client Personal Data, including where possible the categories and approximate number of data subjects concerned and the categories and number of personal data records concerned;

         2. the likely consequences of the personal data breach;

         3. the measures taken or proposed to be taken by the Agency to address the personal data breach, including where appropriate measures to mitigate the possible adverse effects; and

         4. the details of a contact point where more information concerning the personal data breach can be obtained.

      7. Without prejudice to the generality of paragraph 3.5, the Agency will notify the Client without undue delay (and in any event within 48 hours) of any rights request it receives from a data subject pursuant to Chapter III of the GDPR. Unless otherwise agreed between the parties, the Agency shall not respond to or fulfil such requests itself. Taking into account the nature of the processing, the Agency shall assist the Client by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Client’s obligation to respond to such requests for exercising a data subject's rights under the GDPR.

      8. Upon the earlier of:

         1. termination or expiry of the Contract; or

         2. the date on which the Client Personal Data is no longer relevant to, or necessary for, the purposes of providing the relevant Services;

            the Agency shall deliver up or destroy (as elected by the Client) such Client Personal Data which is in the possession of, or under the control of, the Agency unless European Law requires the Agency to store such Client Personal Data.

      9. Notwithstanding any other provision of the Contract, the Agency shall be entitled to appoint further processors to process the Client Personal Data (“Sub-processors”). The following shall apply in respect of the appointment of Sub-processors:

         1. the Client shall be deemed to have approved the appointment of the Sub-processors documented in accordance with Appendix 1;

         2. the Agency shall notify the Client in writing of its intention to engage any additional Sub-processor. Such notice shall give details of the identity of such Sub-processor and the services to be supplied by it;

         3. the Agency shall only use a Sub-processor that has provided sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Data Privacy Laws and ensures the protection of the rights of data subjects;

         4. the Agency shall impose, through a legally binding contract between the Agency and the Sub-processor, data protection obligations on the Sub- processor that are in all material respects equivalent to those set out in this DPA (including, to the extent applicable, the requirements of paragraph 5) and which in any event meet the requirements set out in the Data Privacy Laws;

         5. the Client shall be entitled to object to the proposed appointment of the Sub-processor where it reasonably considers that such appointment will not comply with the requirements of this paragraph 3.9. The Client shall be deemed to have approved the engagement of the Sub-processor if it has not served a notice in writing on the Agency objecting to such an appointment within 14 days of the date that the notice is deemed to be received by the Client in accordance with paragraph 3.9(b);

         6. where the Client objects to the proposed appointment, the Agency will use commercially reasonable efforts to continue to provide the Services without the use of the relevant Sub-processor. Where the Agency is unable to continue to provide the Services despite having used such commercially reasonable efforts, the Agency shall have no liability for any failure to provide the Services in accordance with the Contract; and

         7. the Agency shall remain fully liable for all acts or omissions of the Sub- processors as if they were acts or omissions of the Agency.

      10. The Agency shall keep at its normal place of business a written record of its processing of Client Personal Data and of its compliance with its obligations set out in this DPA (“Records”). The Agency shall permit the Client, its third party representatives or a supervisory authority or its third party representatives access to inspect, and take copies of, the Records and any other relevant

      information held at any premises or on systems used in connection with the processing of the Client Personal Data, for the purpose of auditing compliance with the Agency’s obligations under this paragraph 3. The Agency shall give any and all necessary assistance in respect of the conduct of such audits.

   4. 1. The Client shall ensure that:

         1. the supply to the Agency of Client Personal Data by or on behalf of the Client for the purposes of processing undertaken by the Agency and its permitted Sub-processors shall comply with the Data Privacy Laws;

         2. there is a lawful basis in respect of the Agency’s (and any permitted Sub- processor’s) processing of the Client Personal Data and data subjects have been provided with a privacy policy or notice that complies with the requirements of Article 13 and/or 14 of the GDPR in respect of such processing; and

         3. the instructions given by the Client to the Agency by operation of paragraph 3.1 shall comply with the Data Privacy Laws.

      Between the parties

   5. 1. The parties acknowledge and agree that the transfer from the Client to the Agency of Client Personal Data does not constitute a Restricted Transfer. If and to the extent that such a transfer or processing of Client Personal Data becomes a Restricted Transfer, the parties shall enter into a separate addendum to implement a transfer mechanism to ensure that the Restricted Transfer complies with the International Transfer Requirements.

         By the Agency

      2. The Client acknowledges and agrees that Client Personal Data may be transferred by the Agency to Sub-processors located in a Restricted Country, which may be considered a Restricted Transfer. In the event of the transfer being considered a Restricted Transfer, the Agency shall enter into a transfer mechanism to ensure that the Restricted Transfer meets the International Transfer Requirements, and the Agency shall provide details of the relevant transfer mechanism on request.

         Failure of transfer mechanism

      3. The parties acknowledge and agree that to the extent either party considers (acting reasonably) that the use of the relevant lawful transfer mechanism relied on in respect of a restricted Transfer under paragraph 5.1 is no longer an appropriate lawful transfer mechanism to legitimise the relevant Restricted Transfer pursuant to the International Transfer Requirements, the Restricted Transfer shall be suspended and the parties shall work together in good faith to agree and put in place an alternative lawful transfer mechanism or such other supplementary measures to enable the Restricted Transfer to continue.

      4. In addition to paragraph 5.2, the parties will each use commercially reasonable efforts to ensure that the Services can continue to be provided in all material respects in accordance with the Contract despite the suspension of the Restricted Transfer.

      5. Without prejudice to Agency’s obligations under paragraphs 5.2 and 5.3, the Agency shall have no liability under the Contract for any inability to provide the relevant Services in accordance with the Contract as a result of the suspension of a Restricted Transfer pursuant to paragraph 5.2.

The Client acknowledges and agrees that the remuneration in respect of the Services does not take into account costs that may be incurred by the Agency in complying with its obligations under this DPA. Accordingly, the Client will pay the Agency in respect of any costs that are (or are to be) reasonably incurred by the Agency outside the ordinary course of the Agency’s business in respect of the performance by the Agency of its obligations in this DPA, except where such performance is required as a result of a breach by the Agency of its obligations under this DPA. Where practicable to do so, the Agency will seek the Client’s written approval prior to incurring such costs.

Where, in accordance with the provisions under Article 82(3) of the GDPR, both parties are responsible for the act, or omission to act, resulting in the payment of Losses by a party or both parties then a party shall only be liable for that part of such Losses which is in proportion to its respective responsibility.

Appendix 1 to the DPA

Details of processing

Permitted Sub-processors and location of processing