DATA PROCESSING CONDITIONS FOR COUNTY ASSOCIATIONS

Last update: May 2018

DEFINITIONS

Conditions: shall mean these Data Processing Conditions.

Data Controller, Data Processor, Processing and Process: have the meanings given to them in the Data Protection Laws.

Data Protection Laws: means any applicable law which relates to the protection of individuals with regards to the Processing of Personal Data, including the General Data Protection Regulation (EU) 2016/679.

Data Subject: an individual who is the subject of Personal Data.

England Squash: means England Squash Limited (company number 02411107).

Party/Parties: means You and/or England Squash as the context requires.

Personal Data: has the meaning set out in the Data Protection Laws and relates only to personal data, or any part of such personal data, of which England Squash is the Data Controller.

You/Your: means the County Association

CLAUSES

1. Processing of Personal Data

1.1 In consideration of the disclosure of Personal Data by England Squash to You, You agree to comply with these Conditions.

2. Your Obligations

2.1 England Squash and You acknowledge that for the purposes of the Data Protection Laws, England Squash is the Data Controller and You are the Data Processor of any Personal Data.

2.2 You shall Process the Personal Data only to the extent, and in such a manner, as is necessary for the purposes England Squash may specify in writing from time to time (which shall include, without limitation, Processing such data as may be reasonably necessary for the purposes of administering squash and squash 57 within Your county) and in accordance with England Squash’s written instructions from time to time and You shall not Process the Personal Data for any other purpose.

2.3 You shall promptly comply with any request from England Squash requiring You to amend, transfer or delete the Personal Data, in any event, no later than 14 days following such request.

2.4 You shall not modify or alter the form of any Personal Data in any way without the prior written consent of England Squash. If You receive any complaint, notice or communication which relates directly or indirectly to the Processing of the Personal Data or to either party's compliance with the Data Protection Laws and the data protection principles set out therein, You shall immediately notify England Squash and You shall provide England Squash with full co-operation and assistance in relation to any such complaint, notice or communication.

2.5 You shall not transfer the Personal Data outside the European Economic Area without the prior written consent of England Squash.

2.6 You shall immediately inform England Squash if You become aware of any unauthorised or unlawful Processing of Personal Data or if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable.

2.7 You shall provide all reasonable assistance to England Squash to ensure compliance with the obligations set out in Articles 32-36 of the General Data Protection Regulation ((EU) 2016/679), relating to security of processing, notification of personal data breaches to the Information Commissioner’s Office, communication of personal data breaches to the data subject, data protection impact assessments and consultations with the Information Commissioners Office and regulators (in each case, taking into account the nature of the processing and the information available to You);

2.8 You shall immediately cease processing, and delete from Your systems (and return, if England Squash requires), any personal data in respect of which the underlying data subject has withdrawn their consent to the processing of such personal data or processing is otherwise unlawful (as notified to it by the other party) or in any event, on termination of this Agreement (as relevant to the particular processing activities), unless retention of such personal data is required pursuant to a legal obligation to which You are subject.

3. Access to Personal Data

3.1 You shall ensure that access to the Personal Data is limited to:

(a) those persons who need access to the Personal Data to meet Your obligations under these Conditions and any agreement with England Squash; and

(b) in the case of any access by any employee, such part or parts of the Personal Data as is strictly necessary for performance of that employee's duties.

3.2 You shall ensure that all such persons or employees:

(a) are informed of the confidential nature of the Personal Data and are under suitable obligations of confidentiality; and

(b) are aware both of Your duties and their personal duties and obligations under such laws and these Conditions and any other agreement with England Squash.

3.3 You shall take reasonable steps to ensure the reliability of any of those persons and/or employees who have access to the Personal Data.

4. Rights of the Data Subject

4.1 You shall notify England Squash within two working days if You receive a request from a Data Subject for access to that Data Subject's Personal Data or where such Data Subject wishes to exercise any of the other rights afforded to them in the Data Protection Laws.

4.2 You shall provide England Squash with full co-operation and assistance in relation to any request made by a Data Subject pursuant to clause 4.1.

4.3 You shall not disclose the Personal Data to any Data Subject or to a third party other than at the request of England Squash or as provided for in writing in any agreement with England Squash.

5. Rights of England Squash

5.1 You must provide England Squash with any information that England Squash reasonably requires in order to prove Your compliance with these Conditions. You will provide all necessary co-operation and assistance (including complying with any audits and inspections conducted by England Squash) to England Squash in proving Your compliance with these Conditions and enabling England Squash to meet its requirements in relation to Personal Data under the Data Protection Laws.

6. Warranties and Indemnity

6.1 You warrant that:

(a) You will Process the Personal Data in compliance with all applicable laws and regulations including the Data Protection Laws;

(b) You will take all appropriate security measures with regards to Personal Data as specified under the Data Protection Laws;

(c) You will take appropriate technical and organisational measures against the unauthorised or unlawful Processing of Personal Data and against the accidental loss or destruction of, or damage to, Personal Data, including, but not limited to, the security measures set out in any guidance England Squash may publish from time to time; and

(d) You will ensure that when necessary, any Personal Data is securely encrypted to a standard appropriate for such Personal Data.

7. Appointment of subcontractors

7.1 You may not authorise any third party or sub-contractor to Process the Personal Data except with the prior written consent of England Squash, and subject to any terms and conditions prescribed by England Squash (as it sees fit). If You sub-contract your Processing obligations under these Conditions You will in any event remain liable to England Squash for any acts or omissions of the sub-processor as if they were Your own.

8. Confidentiality

8.1.The parties acknowledge that for the purpose of these Conditions Personal Data shall constitute confidential information. Each party undertakes that it shall not:

8.1.1 use the other party's confidential information for any purpose other than to exercise its rights and perform its obligations under or in connection with these Conditions; and

8.1.2 at any time disclose to any person the party’s confidential information except that each party may disclose the other party’s confidential information to its employees, officers or representatives who need to know such information for the purposes of exercising that party's rights or carrying out its obligations under or in connection with these Conditions (provided such disclosure takes place in accordance with clause 3 above) or as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

9. Governing Law and Jurisdiction

9.1. These Conditions and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them or their subject matter or formation shall be governed by and construed in accordance with the law of England and Wales. Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with these Conditions or their subject matter or formation.