1.
In this clause “Data Controller”, “Data Processor”, “Data Subject”, and “processing” will have the same meaning as in the General Data Protection Regulation.
2.
We request that all personal information that you provide is accurate, current and complete.
3.
Any information which is collected using the Service for which we are the Data Controller (for instance log in information or contact information for our customers or subscribers) will be held by us in accordance with our Privacy Policy Notice.
4.
It is agreed that that for the purposes of the GDPR you are the Data Controller and we are the Data Processor with regards to any data Wetu is processing on your behalf (such as inclusions in Itineraries and which relate to the recipient which the Itinerary is intended for).
5.
Our Privacy and Data Protection Notice includes details of the scope, nature and purpose of the processing of data where we are the Data Processor, the duration of the processing, the types of personal data processed and the data subjects involved as required by Article 28(3) of the General Data Protection Regulation (GDPR).
6.
You agree to comply with applicable requirements of any laws and regulations relating to data protection in relation to your processing of Subscriber Personal Data. We agree to comply with the provisions of the GDPR and these Terms.
7.
We agree that we will not process Subscriber Personal Data other than as required in order for us to deliver the Service, as set out in these Terms, as specified in our Privacy Policy Notice or in accordance with your written instructions unless required by law in which case we will (to the extent permitted by law) inform you of that legal requirement before the processing.
8.
We agree that all staff who have access to and/or process Subscriber Personal Data are obliged to keep the Subscriber Personal Data confidential.
9.
We will ensure that we have in place appropriate technical and organisational measures to ensure that Subscriber Personal Data is subject to an appropriate level of security, including to the extent required the measures referred to in Article 32(1) of the GDPR. In reaching our judgement as to the appropriate level of security we will take into account current technology, costs of implementation and the nature, scope, context and purposes of the processing we undertake as well as the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage of the Subscriber Personal Data.
10.
If you are based inside the European Economic Area we will not transfer any Subscriber Personal Data outside the European Economic Area unless there are appropriate safeguards in relation to the transfer and we are providing an adequate level of protection to any Subscriber Personal Data that is transferred.
11.
We will notify you without undue delay upon becoming aware of any data breach affecting Subscriber Personal Data and we will assist you in responding to any request from a Data Subject and in ensuring compliance with your obligations under Data Legislation.
12.
with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators.
13.
We will maintain complete and accurate records and information to demonstrate our compliance with these Terms and Data Legislation and we will cooperate with and allow for audits by you or your designated auditor in relation to the Processing of Subscriber Personal Data by us.
14.
You agree that we may use third party processors as described in our Privacy Policy Notice or agreed with you. If you notify us in writing of any objections (on reasonable grounds) to a said third party processor, we will not appoint the third-party processor until reasonable steps have been taken to address the objections raised by you and you have been provided with a reasonable written explanation of the steps taken.
15.
With respect to each third-party processor, we will take steps to ensure that the applicable terms with that processor will offer at least the same level of protection for Subscriber Personal Data as those set out in this agreement and which meet the requirements of article 28(3) of the GDPR. As between you and us, we will remain fully liable for all acts or omissions of any third-party processor appointed by us.
16.
We will delete Subscriber Personal Data following termination of your subscription if requested in writing by you. We may retain Subscriber Personal Data if required by law only to the extent and for such period as required by those laws.
17.
All notices sent to you will be sent to the email address provided with your registration details (as updated by you). By accepting these terms you give your consent to receive communications from us by email. You also hereby agree that all agreements, notices, disclosures and any other form of communication that we provide to you satisfy any legal requirement that such communications be in writing.