Standard Contractual Clauses For Data Transfers Between The UK And USA

1. *Data Exporter:* The UK-based representative transmitting the personal data.

2. *Data Importer:* The USA-based representative receiving the personal data.

3. *Personal Data:* Any information relating to an identified or identifiable natural person.

4. *Processing:* Any operation performed on personal data, such as collection, storage, alteration, or disclosure.

5. *GDPR:* General Data Protection Regulation (EU 2016/679) and the UK GDPR following Brexit.

This agreement regulates the transfer and processing of personal data between the Data Exporter and the Data Importer for the purpose of providing services on the BIMeta platform, ensuring full compliance with UK GDPR and applicable US privacy laws.

1. The Data Exporter must ensure that any transfer of personal data is limited to what is necessary for the legitimate business purposes of BIMeta.

2. The Data Exporter guarantees that all data subjects have been informed about the transfer and that their rights under the UK GDPR have been respected.

1. The Data Importer agrees to process the data only as directed by the Data Exporter, ensuring that the data is used only for the purposes outlined in this agreement.

2. The Data Importer must implement appropriate technical and organizational security measures to protect personal data from unauthorized access, disclosure, or loss, consistent with both UK GDPR standards and US privacy regulations (e.g., CCPA).

3. The Data Importer agrees to promptly notify the Data Exporter of any data breach or security incident involving personal data.

1. The Data Importer must assist the Data Exporter in responding to any requests from data subjects exercising their rights under the UK GDPR, such as the right to access, correct, or delete their data.

2. If the Data Importer receives a direct request from a data subject, they must inform the Data Exporter and follow their instructions in response.

1. The Data Importer shall not engage any third party to process the personal data without prior written consent from the Data Exporter.

2. If third-party sub-processors are used, they must agree to the same data protection obligations set out in this agreement.

1. Both parties will implement appropriate security measures (encryption, access controls, etc.) to protect personal data.

2. Regular audits shall be conducted to ensure compliance with this agreement.

1. The Data Importer acknowledges that, under the UK GDPR, they must adopt adequate safeguards for data transferred from the UK to the US. This may include further binding corporate rules or certification schemes like the EU-US Data Privacy Framework.

2. The Data Importer agrees to maintain records of all data processing activities related to the transfer and will allow for audits by the Data Exporter or an independent auditor.

1. The Data Importer will be liable for any breach of this agreement, particularly in relation to the unauthorized or unlawful processing of personal data or its accidental loss or destruction.

2. Both parties agree to indemnify the other for any claims or damages arising from the breach of this agreement.

This agreement shall remain in force until the purpose of the data transfer has been completed, or until either party terminates the contract with written notice. In the event of termination, both parties must return or securely destroy the personal data in their possession.

This contract shall be governed by the laws of the United Kingdom, with the UK GDPR being the primary governing regulation for all personal data transferred under this agreement.