GDPR Privacy & Data Protection Addendum

1. INTRODUCTION

“Data Protection Requirements”: as applicable: (i) the Data Protection Act 2018, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) or equivalent legislation, the Privacy and Electronic Communications (EC Directive) Regulations 2003, Directive 2002/58/EC of the European Parliament (the ePrivacy Directive) and all other applicable laws (including judgments of any relevant court of law) and regulations relating to the processing of personal data, data privacy, electronic communications, marketing and data security, in each case as amended, extended or re-enacted from time to time and all orders, regulations, statutes, instruments or other subordinate legislation made thereunder in any jurisdiction from time to time; and (ii) the guidelines, recommendations, best practice, opinions, directions, decisions, codes of practice and codes of conduct issued, adopted or approved by the European Commission, the European Data Protection Board, the UK’s Information Commissioner’s Office and/or any other supervisory authority or data protection authority from time to time in relation to the processing of personal data, data privacy, electronic communications, marketing and data security.

“Cross-Border Processing” means any communication, copying or transmission of Personal Data to a Third Country.

“Personal Data” means any personal data processed or transferred by the Customers to PJE in relation to the Services  Agreement and in connection with the Services.

“Third Country” means any country that is not in the European Union or which has not been recognised by the European Commission as providing an adequate level of protection for personal data under the Data Protection Requirements.

1.1 For the purpose of this Services Agreement, including this Privacy and Data Protection Annex, personal data and the terms process, data subject, data controller, controller, data processor, processor, subprocessor, personal data breach and supervisory authority shall have the meanings given to them in the applicable Data Protection Requirements.

1.2 The Parties acknowledge that the Customer is the data controller and PJE is the data processor of Personal Data.

1.3 The Customer remains solely liable for upholding data subject’s rights in relation to the processing of such Personal Data under the Services Agreement, specifically their rights of access, right to request rectification and/or erasure and if necessary the right to object to processing, and the Customer shall promptly notify PJE of any request relating to the same received from a data subject.

1.4 Each Party warrants that it shall comply with all of its obligations under the Data Protection Requirements which arise in connection with the Services, or either party’s performance of its obligations, and that it shall not, in respect of any Personal Data processed, do any act or make any omission which puts the other party in breach of its obligations under the Data Processing Requirements.

1.5 The Customer’s instructions relating to the processing of Personal Data shall comply with the Data Protection Requirements and the Customer shall have the sole responsibility for the accuracy, quality, integrity, reliability and lawfulness of the Personal Data;

1.6 The Customer shall promptly notify PJE if it becomes aware of any breaches of or other irregularities with the Data Protection Requirements.

2. Pamoja Education Ltd (PJE) Obligations

2.1 General Obligations

2.1.1 PJE shall process Personal Data for the sole purpose of the provision of the Services to the Customer and shall act only in accordance with the commercially reasonable documented instructions of the Customer in respect of the processing of Personal Data during the term of the Services Agreement.

2.1.2 PJE shall promptly notify the Customer if, in PJE’s opinion, the Customer documented data processing instructions breach the Data Protection Requirements, and PJE shall be entitled without penalty to suspend execution of the instructions concerned, until the Customer confirms such instructions in writing. Any notification by PJE under this clause should not be regarded as legal advice and PJE shall not be required to perform a legal assessment of the Customer’s instructions. The Customer shall seek its own legal advice on applicable Data Protection Requirements. If and to the extent PJE is unable to comply with any instruction received from the Customer, it shall promptly notify the Customer accordingly.

2.1.3 The purpose of PJE’s processing Personal Data is the performance of the Services pursuant to this Privacy and Data Protection Addendum.

2.1.4 PJE shall provide reasonable assistance to the Customer in order to ensure the Customer’s compliance with the Data Protection Requirements and/or in case of inspection by a supervisory authority taking into account the nature of the processing and the information available to PJE.

2.1.5 PJE shall promptly respond to any request of the Customer concerning the processing of Personal Data carried out by PJE, and provide the Customer with all reasonable information, so that the Customer is able to: (i) inform the data subjects and respond to their requests for access, objection, rectification, restriction or deletion of Personal Data; and/or (ii) respond to any administrative formalities concerning the processing of such personal data to the supervisory authority; and/or (iii) comply with all requests of any administrative or judicial authority regarding the processing carried out under the Services

2.1.6 PJE shall promptly correct any errors or inaccuracies in the Personal Data which are notified to it either by the Customer or a data subject, or shall provide a means for the data subject to self-correct any errors or inaccuracies within such personal data, to ensure that such Personal Data is kept accurate and up to date.

2.1.7 PJE shall provide reasonable assistance to the Customer in order to ensure its compliance with its obligations to maintain a record of all categories of Personal Data processing activities. In particular, PJE shall record and make available such Personal Data for a period of eighteen (18) months from the Services Agreement expiration or termination date, and shall ensure that the Personal Data records are backed-up regularly throughout this period.

2.2 Security

2.2.1 PJE shall implement appropriate technical and organisational security measures necessary for the processing of Personal Data and Services to be performed under thisServices Agreement to ensure the confidentiality and security of Personal Data and, in particular, to prevent such Personal Data from being distorted, damaged or communicated to unauthorized third-parties, and to protect the Personal Data against any accidental or unlawful destruction, accidental loss, alteration, dissemination and/or unauthorized access, as well as against all unlawful forms of processing provided that, such measures shall ensure a level of security appropriate to the risks inherent in the processing and the nature of the Personal Data to be protected.

2.2.2 In case of a personal data breach involving Personal Data, PJE shall:

(I) notify the Customer without delay after becoming aware of an actual personal data breach involving Personal Data, and:

(II) take steps to remedy such personal data breach involving Personal Data as soon as possible so as to minimize the impact of any personal data breach to all relevant data subjects.

2.2.3 Such notification must contain:

1. i)   A description of the nature of the personal data breach including:
2. a) Categories of Personal Data concerned;
3. b) Approximate number of data subjects concerned;
4. c) Categories of Personal Data records concerned;
5. d) Approximate number of Personal Data records concerned, and;
6. ii)   A description of the likely consequences of the personal data breach involving Personal Data and;

iii)   A description of the measures taken or proposed to be taken by PJE to address such personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

2.2.4 PJE shall document any personal data breach involving Personal Data, comprising the facts relating to it, its effects and the remedial action taken.

2.3 Access to Personal Data

2.3.1 In accordance with confidentiality obligations as defined in the Services Agreement, PJE shall not transfer, communicate or disclose in any manner any personal data to any third parties, except to those subcontractors and personnel required to provide the Services to the Customer (hereinafter the “Authorised Recipients”) for the sole purpose of such Authorised Recipients of performing the Services under the Services Agreement. Where a subcontractor is engaged by PJE shall ensure that they are appointed in accordance with clause 2.4 below.

2.3.2 PJE shall ensure that the Authorised Recipients in charge of the performance Services process the Personal Data only on a need-to-know basis and are subject to appropriate obligations of confidentiality and security, and bound by a non-disclosure agreement that is least as stringent as the one in force between the parties.

2.3.3 In case of any investigation or seizure of Personal Data by government officials, a supervisory authority or any law enforcement authority, PJE shall take reasonable steps at its disposal to protect the confidentiality of Personal Data.

2.3.4 If a Party is compelled to disclose Personal Data by law, such Party shall promptly notify the other Party of the disclosure order (if and to the extent permitted by laws and/or regulations).

2.4 Personal Data Transfers

2.4.1 As part of the Services, the Customer acknowledges that PJE transfers Personal Data all over the world as part of its business operations to facilitate the provision of the Services to the Customer. Where PJE transfers personal data to another Third Country, it shall take steps to ensure that it has appropriate safeguards in place to protect the Personal Data in accordance with UK and EU Data Protection Requirements. Further information about the transfers and the basis on which those transfers are made is set out in this paragraph 2.4.

2.4.2 The Customer provides its prior consent to PJE transferring Personal Data between its group companies in UK, USA, Taiwan and Hong Kong, and data centres in Canada, USA Hong Kong, Singapore, Ireland and UK. Where required by Data Protection Requirements, appropriate safeguards shall be in place to cover such transfers, where personal data is transferred outside of the European Union, PJE has entered into standard contractual clauses issued by the European Commission as required under the Data Protection Requirements.

2.4.3 The Customer provides its general authorisation to PJE’s use third party suppliers, as listed and updated on PJE’s website viahttps://www.managebac.com/terms/privacy-policy/subprocessors, https://www.openapply.com/terms/privacy-policy/subprocessors, https://www.onatlas.com/terms/privacy-policy/subprocessors, https://www.schoolsbuddy.com/terms/privacy-policy/subprocessors, and https//www.PJEeducation.com/terms/privacy-policy/subprocessors which may process Personal Data on behalf of PJE (“Subprocessors”) in order for PJE to provide the Services to the Customer.

2.4.4 PJE shall provide updates to the list of Subprocessors and proposed Subprocessers via https://www.managebac.com/terms/privacy-policy/subprocessors, https://www.openapply.com/terms/privacy-policy/subprocessors, https://www.onatlas.com/terms/privacy-policy/subprocessors, https://www.schoolsbuddy.com/terms/privacy-policy/subprocessors and https//www.PJEeducation.com/terms/privacy-policy/subprocessors, the Customer may object in writing to the processing of its Personal Data by a new sub-processor within thirty (30) days following the update of the list of Subprocessors and such objection shall describe the Customer ‘s legitimate reason(s) for objection. If a Customer does not object during such time period the new Subprocessor(s) shall be deemed accepted.

2.4.5 PJE shall include in any contract with its Sub Processors which will process Personal Data obligations on such Sub Processors which are equivalent to those obligations imposed upon PJE in this Privacy and Data Protection Addendum. PJE shall be liable for the acts and omissions of its Sub Processors to the same extent PJE would be liable if performing the services of each Subprocessor directly under the terms of this Privacy and Data Protection Addendum.

2.4.6 Where Sub Processors are located in a Third Country, PJE shall put in place appropriate safeguards to protect the Personal Data and ensure that such transfers of Personal Data are at all times in accordance with the Data Protection Requirements. This shall include, entering into and maintaining accurate standard contractual clauses adopted by the European Commission, or, where a Subprocessor is located in the USA, PJE may rely upon a Subprocessor’s DPF certification, to the extent that these data transfer mechanisms are considered to be lawful under the Data Protection Requirements (where applicable).

2.5 Information Requests & Review

The Customer shall be entitled to request information and review Faria Education Group’s ISO 27001 certification and related documents, processes and workflows relating to its internal Data Protection and Compliance standards and its obligations set out in this Privacy and Data Protection Addendum. Any information and review requests can be directed to PJE’s Data Protection Officer at [email protected]

3. PERSONAL DATA PROCESSING CONDITIONS

3.1 PJE’s Server locations

3.1.1 PJE informs the Customer that the Personal Data will be hosted in servers located in the following countries: Canada, USA, Hong Kong, Singapore, Ireland, EU and UK.

3.1.2 Any change of the server(s) location by PJE shall be promptly notified to the Customer and shall be included in the form of a written amendment pursuant to the conditions of this Services Agreement.

 3.2 PJE’s Information Security Certification

3.2.1 Faria Education Group is ISO/IEC 27001:2022 certified by BSI under certificate number IS 664562. Implementing ISO 27001 demonstrates a commitment to information security at every level of our organization.