3.1. Instructions. The Provider processes personal data only on documented instructions from the Client, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in such a case the Provider informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
3.2. Notification of unlawful instructions. If, in the Provider's opinion, an instruction infringes the GDPR or other data protection provisions, the Provider immediately informs the Client and may suspend execution of the instruction until the matter is resolved.
3.3. Confidentiality. The Provider ensures that persons authorised to process the personal data have committed themselves to confidentiality in writing and that this obligation survives the end of their employment or other relationship.
3.4. Security. The Provider implements the technical and organisational measures required by Article 32 GDPR, as described in Annex III.
3.5. Sub-processors. The Client gives the Provider a general written authorisation to engage sub-processors. The list of approved sub-processors is set out in Annex II. The Provider informs the Client of any intended addition or replacement of a sub-processor at least 30 calendar days in advance; within that period the Client may object on reasoned grounds. If the parties cannot find a solution, the Client may terminate the affected service without penalty.
3.6. Sub-processor obligations. The Provider imposes on each sub-processor the same data protection obligations as set out in this Agreement and remains fully liable to the Client for the performance of the sub-processor's obligations.
3.7. Assistance with data subject rights. Taking into account the nature of the processing, the Provider assists the Client by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Client's obligation to respond to requests to exercise the rights laid down in Chapter III GDPR. If the Provider receives a request directly from a data subject, it does not act on it independently but forwards it to the Client within 3 working days.
3.8. Assistance with Articles 32–36. The Provider assists the Client in ensuring compliance with the obligations laid down in Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Provider.
3.9. Personal data breaches. Upon becoming aware of a personal data breach, the Provider notifies the Client without undue delay and in any event within 24 hours, providing the available information: the nature of the breach, the approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. This period is deliberately shorter than the 72 hours allowed to the Client under Article 33(1) GDPR so that the Client can notify the supervisory authority in time.
3.10. Data after the end of the services. Upon the end of the provision of services, the Provider, at the Client's choice, deletes or returns all personal data to the Client and deletes existing copies, unless Union or Member State law requires storage. The Client states its choice within 30 calendar days of the end of the services; failing that, the data are deleted. The Provider confirms deletion in writing upon request.
3.11. Information and audits. The Provider makes available to the Client all information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Client or an auditor mandated by the Client. Audits are carried out no more than once per calendar year (except where ordered by a supervisory authority or following a security breach), on at least 14 calendar days' notice and with the Client bearing the Provider's reasonable costs.
