CONFIDENTIAL — COMMERCIALLY SENSITIVE
DATA PROCESSING AGREEMENT
Between
AURELIUS GLOBAL MEDIA GROUP PLC
and
PENDLETON ADTECH SOLUTIONS LTD
Executed on 5 April 2024
Calderwood & Harkness LLP Matter No. 1017-00008
Right-click to update Table of Contents
PREAMBLE
THIS DATA PROCESSING AGREEMENT (the "DPA" or "Agreement") is entered into as of 5 April 2024 (the "Effective Date")
BETWEEN:
(1) AURELIUS GLOBAL MEDIA GROUP PLC, a public limited company incorporated in England and Wales under Companies House registration number 08741562, whose registered office is at 140 Threadneedle Row, London EC2R 8AH, United Kingdom (hereinafter referred to as "AGMG" or the "Controller"); and
(2) PENDLETON ADTECH SOLUTIONS LTD, a private limited company incorporated in Ireland under Companies Registration Office number 614823, whose registered office is at 22 Grand Canal Dock, Block 4, Dublin D02 HW94, Ireland (hereinafter referred to as "Pendleton" or the "Processor"),
each a "Party" and together the "Parties".
RECITALS
(A) AGMG is a digital media, entertainment streaming, and e-commerce conglomerate operating fourteen (14) European-facing websites and three (3) mobile applications serving audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy, with approximately eighty-seven million (87,000,000) monthly active users across its EU/EEA properties.
(B) Pendleton operates a demand-side platform ("DSP") and real-time bidding ("RTB") intermediary and serves as AGMG's primary programmatic advertising partner across all European digital properties.
(C) The Parties entered into a Master Services Agreement dated 15 June 2021 (the "MSA") pursuant to which Pendleton provides programmatic advertising services to AGMG, involving the processing of approximately 4.2 billion ad bid requests per month involving AGMG user data.
(D) The annual fees paid by AGMG to Pendleton under the MSA are approximately €2.8 million, with revenue-share arrangements generating approximately €18.4 million per year for AGMG.
(E) Following a complaint filed by Digitale Rechte Europa e.V. with the Commission nationale de l'informatique et des libertés ("CNIL") (complaint reference PLT-2023-FR-04821, dated 8 November 2023) and a formal notice issued by the CNIL (reference MED-2023-097, dated 14 December 2023), and an informal inquiry from the UK Information Commissioner's Office ("ICO") (reference ICO/ENF/2023/LTR-11084, dated 22 December 2023), AGMG has undertaken a comprehensive remediation of its cookie-consent mechanisms and advertising-technology data flows to ensure full compliance with the General Data Protection Regulation and the ePrivacy Directive.
(F) The Parties wish to enter into this Data Processing Agreement to ensure that the processing of personal data by Pendleton on behalf of AGMG complies with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), in particular Article 28 thereof, and applicable national implementing legislation in each relevant jurisdiction.
(G) This DPA supplements and is incorporated into the MSA. In the event of any conflict between the terms of this DPA and the terms of the MSA, the terms of this DPA shall prevail to the extent of the conflict, and solely with respect to matters relating to the processing and protection of personal data.
(H) This DPA has been negotiated by Calderwood & Harkness LLP (One Finsbury Square, London EC2A 1AE, United Kingdom) on behalf of AGMG and by Dalrymple Kearney & Co. (15 Fitzwilliam Place, Dublin D02 YX28, Ireland) on behalf of Pendleton.
NOW, THEREFORE, in consideration of the mutual obligations set out herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
SECTION 1: DEFINITIONS AND INTERPRETATION
1.1 Definitions. In this DPA, unless the context otherwise requires, the following terms shall have the meanings ascribed to them below:
"Applicable Data Protection Law" means, collectively and as applicable to the relevant processing activity: (a) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, or "GDPR"); (b) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the "ePrivacy Directive"), as amended by Directive 2009/136/EC; (c) the UK GDPR (as defined below); (d) the UK Data Protection Act 2018; (e) the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), as amended; (f) the French Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (Loi Informatique et Libertés), as amended; and (g) any other applicable data protection, privacy, or electronic communications legislation enacted by an EU/EEA Member State or the United Kingdom, in each case as may be amended, supplemented, or replaced from time to time.
"Approved Sub-processor" means a Sub-processor listed in Annex III to this DPA as at the Effective Date, or subsequently approved in accordance with the procedures set out in Section 7.
"Controller" means AGMG, as the entity which determines the purposes and means of the processing of Personal Data, within the meaning of Article 4(7) of the GDPR.
"Data Subject" means an identified or identifiable natural person whose Personal Data is processed under or in connection with this DPA.
"DPA" means this Data Processing Agreement, including all Annexes attached hereto and incorporated herein by reference.
"EEA" means the European Economic Area, comprising the Member States of the European Union together with Iceland, Liechtenstein, and Norway.
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
"MSA" means the Master Services Agreement dated 15 June 2021, entered into between AGMG and Pendleton, as amended from time to time.
"Personal Data" means any information relating to a Data Subject that is processed by the Processor on behalf of the Controller under or in connection with this DPA, as further described in Annex I, Section B.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed, within the meaning of Article 4(12) of the GDPR.
"Processing" and "Process" mean any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, as defined in Article 4(2) of the GDPR, and "Processed" shall be construed accordingly.
"Processor" means Pendleton, as the entity which processes Personal Data on behalf of the Controller, within the meaning of Article 4(8) of the GDPR.
"SCCs" means the standard contractual clauses for the transfer of personal data to third countries annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, supplemented, or replaced from time to time.
"Sub-processor" means any third party (including any affiliate of the Processor, but excluding the Processor's own employees) engaged by the Processor to carry out specific processing activities in respect of Personal Data on behalf of the Controller.
"Supervisory Authority" means an independent public authority established by an EU/EEA Member State or the United Kingdom with responsibility for monitoring the application of data protection law, within the meaning of Article 4(21) of the GDPR. For the purposes of this DPA, relevant Supervisory Authorities include, without limitation, the Commission nationale de l'informatique et des libertés (CNIL), the UK Information Commissioner's Office (ICO), and the Irish Data Protection Commission (DPC).
"Technical and Organisational Measures" or "TOMs" means the technical and organisational security measures described in Annex II to this DPA, as updated from time to time in accordance with Section 5.4 of this DPA.
"Transfer Impact Assessment" or "TIA" means the assessment of the legal framework of the destination country conducted for the purpose of evaluating whether an essentially equivalent level of protection for Personal Data can be ensured in connection with international data transfers, as appended in Annex IV, Part 2 to this DPA.
"UK GDPR" means the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and any subsequent amendments.
1.2 Interpretation. In this DPA, unless the context otherwise requires:
(a) references to "Articles" are references to Articles of the GDPR, unless otherwise expressly stated;
(b) headings and sub-headings are included for convenience of reference only and shall not affect the interpretation or construction of this DPA;
(c) words importing the singular shall include the plural and vice versa, and words importing a gender shall include all genders;
(d) references to "Sections" are to sections of this DPA, and references to "Annexes" are to the Annexes attached to this DPA;
(e) references to any statute, statutory provision, regulation, or directive shall include any amendment, extension, re-enactment, or replacement thereof in force from time to time;
(f) references to "writing" or "written" include communication by electronic mail, provided that such communication is capable of being stored and reproduced in tangible form;
(g) the words "include", "including", and "in particular" shall be construed as being by way of illustration or emphasis only and shall not limit the generality of the preceding words; and
(h) references to "days" mean calendar days unless "business days" is expressly specified, in which case "business days" means any day other than a Saturday, Sunday, or public holiday in England and Wales or Ireland, as applicable.
SECTION 2: SCOPE AND PURPOSE OF PROCESSING
2.1 Subject Matter and Duration
The subject matter of the processing under this DPA is the provision by Pendleton of programmatic advertising services to AGMG, including demand-side platform operations, real-time bidding, and related data analytics, as more fully described in the MSA and in Annex I to this DPA.
The duration of the processing shall be co-terminous with the term of the MSA, commencing on the Effective Date and continuing until the MSA is terminated or expires in accordance with its terms, unless this DPA is earlier terminated in accordance with Section 15.
2.2 Nature and Purpose of Processing
The nature and purpose of the processing carried out by Pendleton on behalf of AGMG under this DPA comprises the following activities:
(a) Real-time bidding and programmatic ad serving: Pendleton receives bid requests containing Personal Data from AGMG's fourteen (14) European websites and three (3) mobile applications, evaluates those bid requests through its demand-side platform, and facilitates the real-time auction process for the placement of programmatic advertisements on AGMG's digital properties.
(b) Volume of processing: Pendleton processes approximately 4.2 billion ad bid requests per month involving Personal Data of AGMG's users.
(c) Ad targeting, frequency capping, and campaign optimisation: Pendleton uses Personal Data, to the extent authorised by valid consent, to deliver targeted advertisements, manage the frequency with which individual users are exposed to particular advertisements, and optimise the performance of advertising campaigns running on AGMG's properties.
(d) Audience matching and bid-stream data processing: Pendleton processes audience segment data and bid-stream data to match advertising demand with AGMG's audience supply, enabling advertisers to reach relevant audiences through AGMG's properties.
(e) Measurement, attribution, and reporting: Pendleton processes Personal Data for the purpose of measuring the effectiveness of advertising campaigns, attributing conversions and user interactions to specific campaigns, and generating reporting for AGMG and its advertising partners.
(f) Consent-gated processing: All processing activities described in this Section 2.2 shall be conducted solely on the basis of valid, freely given, specific, informed, and unambiguous consent obtained from Data Subjects via AGMG's consent management platform (Brightleaf ConsentShield, IAB Transparency and Consent Framework version 2.2 certified). For the avoidance of doubt, the Parties expressly confirm that no reliance shall be placed on "legitimate interest" as a legal basis under the IAB Transparency and Consent Framework for any processing purpose that requires consent under the GDPR or the ePrivacy Directive, including but not limited to the storage of and access to information on a user's terminal equipment.
2.3 Documented Instructions
Pendleton shall process Personal Data only on documented instructions from AGMG, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by European Union or Member State law to which Pendleton is subject. In such a case, Pendleton shall inform AGMG of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
The documented instructions of AGMG as of the Effective Date of this DPA are set out in Annex I. AGMG may issue additional or amended instructions in writing from time to time, provided that such instructions are consistent with the terms of this DPA, the MSA, and Applicable Data Protection Law. Pendleton shall comply with such instructions promptly and shall confirm receipt in writing.
If Pendleton considers that an instruction from AGMG infringes the GDPR or other Applicable Data Protection Law, Pendleton shall immediately inform AGMG in writing, setting out the nature of the concern in reasonable detail. Pendleton shall not be required to carry out an instruction that it reasonably and in good faith believes to be unlawful, and shall suspend performance of the relevant instruction until AGMG has confirmed, modified, or withdrawn the instruction.
SECTION 3: CATEGORIES OF DATA SUBJECTS AND PERSONAL DATA
3.1 Categories of Data Subjects
The categories of Data Subjects whose Personal Data is processed by Pendleton under this DPA are set out in full in Annex I, Section A, and include:
(a) visitors to AGMG's fourteen (14) European websites, which serve audiences in the United Kingdom, France, Germany, the Netherlands, Spain, and Italy;
(b) users of AGMG's three (3) mobile applications distributed within the EU/EEA; and
(c) any other individuals whose Personal Data is incidentally processed in connection with the services described in this DPA.
As of the Effective Date, the scale of processing encompasses approximately eighty-seven million (87,000,000) monthly active users across AGMG's EU/EEA digital properties.
3.2 Categories of Personal Data
The categories of Personal Data processed by Pendleton under this DPA are set out in full in Annex I, Section B, and include:
(a) online identifiers, including cookie IDs, device IDs, and mobile advertising IDs (Tidewater Industries Identifier for Advertisers (IDFA) and Severin Industries Advertising ID (GAID));
(b) IP addresses, both full and truncated;
(c) device fingerprints and technical information, including browser type, operating system, and screen resolution;
(d) browsing history and page-view data originating from AGMG's digital properties;
(e) geolocation data derived from IP addresses at a coarse level;
(f) ad interaction data, including impressions served, clicks recorded, and conversions attributed;
(g) IAB TCF 2.2 consent strings and associated consent status indicators; and
(h) pseudonymised user segment identifiers.
No special categories of personal data (as defined in Article 9 of the GDPR) are to be processed under this DPA.
3.3 Prohibition on Special Category Data
Pendleton shall not, under any circumstances, process special categories of personal data (as defined in Article 9(1) of the GDPR) or personal data relating to criminal convictions and offences (as referred to in Article 10 of the GDPR) under this DPA. In the event that Pendleton becomes aware that it has received or is processing any such data in connection with the services provided under this DPA, it shall immediately notify AGMG, cease processing such data, and cooperate with AGMG to securely delete or return such data.
SECTION 4: CONTROLLER OBLIGATIONS
4.1 Lawful Basis for Processing
AGMG warrants and represents that it has obtained, or will obtain prior to any transmission of Personal Data to Pendleton, valid consent from each relevant Data Subject in accordance with Articles 6(1)(a) and 7 of the GDPR and Article 5(3) of the ePrivacy Directive (as implemented in relevant national law, including the UK PECR) before transmitting Personal Data to Pendleton for the purposes described in this DPA.
AGMG shall ensure that consent is obtained via its Brightleaf ConsentShield consent management platform, which is certified under the IAB Transparency and Consent Framework version 2.2. AGMG shall ensure that no non-essential cookies, tracking pixels, or other tracking technologies are placed on or read from a Data Subject's terminal equipment, and no Personal Data is transmitted to Pendleton, before the Data Subject has provided affirmative, unambiguous consent through the consent management platform. AGMG shall maintain auditable records of consent collection, including timestamps, consent string values, and the version of the consent interface presented to each Data Subject.
AGMG shall transmit IAB TCF 2.2 consent strings to Pendleton in conjunction with each bid request or data transmission, to enable Pendleton to verify the scope and validity of the consent granted by the relevant Data Subject for each processing purpose.
4.2 Transparency Obligations
AGMG shall provide Data Subjects with the information required under Articles 13 and 14 of the GDPR, including but not limited to: the identity and contact details of AGMG as Controller; the contact details of AGMG's Data Protection Officer; the purposes and legal basis for processing; the categories of Personal Data concerned; the recipients or categories of recipients of Personal Data, including the identification of Pendleton as a data recipient and the categories of Sub-processors engaged by Pendleton; details of any international transfers and the safeguards applied; the retention periods applicable to the Personal Data; and the rights of Data Subjects under the GDPR. Such information shall be provided in clear, plain language and shall be readily accessible via AGMG's privacy notice on each of its digital properties.
4.3 Consent Withdrawal
AGMG shall ensure that mechanisms for the withdrawal of consent are accessible to Data Subjects at all times, are as easy to use as the mechanism for giving consent, and are effective in promptly halting further processing of the relevant Data Subject's Personal Data. Upon a Data Subject's withdrawal of consent, AGMG shall promptly notify Pendleton by transmitting an updated consent signal (including, where applicable, an updated or revoked IAB TCF 2.2 consent string) to Pendleton. AGMG shall endeavour to transmit such notification in real time or, where real-time transmission is not technically feasible, within twenty-four (24) hours of the withdrawal of consent. Upon receipt of such notification, Pendleton shall cease processing the relevant Data Subject's Personal Data for the purpose(s) to which the withdrawal relates, in accordance with Section 5.2.
SECTION 5: PROCESSOR OBLIGATIONS
5.1 Processing in Accordance with Instructions
Pendleton shall process Personal Data only on documented instructions from AGMG, in accordance with Article 28(3)(a) of the GDPR. Pendleton shall not process Personal Data for its own purposes, for the purposes of any third party, or for purposes beyond those expressly specified in Annex I to this DPA and any further documented instructions issued by AGMG in accordance with Section 2.3.
Without limiting the generality of the foregoing, Pendleton shall not: (a) use Personal Data received from AGMG to build, enrich, or supplement its own profiles, datasets, or audience segments for use in connection with other clients or services; (b) combine Personal Data received from AGMG with personal data received from any other source, except to the extent strictly necessary to perform the services described in this DPA and Annex I; or (c) sell, rent, lease, or otherwise disclose Personal Data to any third party except as expressly authorised in writing by AGMG or as required to perform the services in accordance with this DPA.
Pendleton shall verify IAB TCF 2.2 consent strings before processing any Personal Data for ad targeting, bid-stream processing, or any other purpose requiring consent under the GDPR or the ePrivacy Directive. Such verification shall be automated and shall occur at the point of receipt of each bid request or data transmission from AGMG, prior to any substantive processing of the associated Personal Data.
5.2 Consent-Gated Processing
Pendleton shall not process Personal Data received from AGMG unless such data is accompanied by a valid IAB TCF 2.2 consent string indicating that the relevant Data Subject has granted consent for the specific processing purpose(s) to which the data relates.
In the event that a consent string is absent from a bid request or data transmission, or is invalid, malformed, or expired, or indicates that consent has not been granted for a particular processing purpose, Pendleton shall refrain from processing the associated Personal Data for any purpose requiring consent and shall either discard the bid request or process it in a manner that does not involve the use of Personal Data (for example, by serving a non-targeted, contextual advertisement only).
This obligation reflects the remediation commitment undertaken by the Parties following the CNIL formal notice (reference MED-2023-097) and the ICO inquiry (reference ICO/ENF/2023/LTR-11084), specifically the requirement to cease reliance on "legitimate interest" as a legal basis under the IAB Transparency and Consent Framework for any processing purpose that requires consent under the GDPR or the ePrivacy Directive.
Pendleton shall implement and maintain technical controls within its demand-side platform to enforce consent-gated processing automatically, and shall provide AGMG with reasonable evidence of the implementation and effectiveness of such controls upon request.
5.3 Confidentiality. Pendleton shall ensure that all natural persons authorised to process Personal Data on its behalf, including employees, temporary workers, contractors, and agents, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, in accordance with Article 28(3)(b) of the GDPR. Pendleton shall maintain a register of all such persons who have access to Personal Data processed under this DPA and shall make such register available to AGMG upon reasonable request.
The obligations of confidentiality set out in this Section 5.3 shall survive the termination or expiry of this DPA and shall continue to bind Pendleton and its personnel for as long as any Personal Data processed under this DPA remains in their possession or control, or for a period of five (5) years following termination or expiry, whichever is longer.
5.4 Security (Article 32)
Pendleton shall implement and maintain, at its own cost, appropriate Technical and Organisational Measures to ensure a level of security appropriate to the risk of the processing, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects. The specific Technical and Organisational Measures in effect as of the Effective Date are described in Annex II to this DPA.
Without limiting the generality of the foregoing, Pendleton shall implement and maintain the following minimum security measures:
(a) Encryption in transit: All Personal Data transmitted between AGMG and Pendleton, and within Pendleton's systems, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher.
(b) Encryption at rest: All Personal Data stored by Pendleton shall be encrypted using Advanced Encryption Standard (AES) with a key length of 256 bits (AES-256).
(c) Pseudonymisation: User-level Personal Data shall be pseudonymised at the point of ingestion into Pendleton's systems, with re-identification requiring access to a separate, securely managed key store.
(d) Access controls: Role-based access control (RBAC) shall be implemented with the principle of least privilege, multi-factor authentication (MFA) shall be required for all personnel accessing systems containing Personal Data, and access rights shall be reviewed on at least a quarterly basis.
(e) Intrusion detection and prevention: Pendleton shall deploy and maintain intrusion detection and prevention systems (IDS/IPS) to identify and respond to potential security threats.
(f) Penetration testing: Independent third-party penetration testing of systems processing Personal Data shall be conducted at least annually, with the results and any remediation actions shared with AGMG upon request.
(g) Business continuity and disaster recovery: Pendleton shall maintain redundant data centre infrastructure with automated failover, a Recovery Point Objective (RPO) of no more than one (1) hour, and a Recovery Time Objective (RTO) of no more than four (4) hours.
Pendleton shall not materially diminish the overall level of security provided by the Technical and Organisational Measures without the prior written consent of AGMG. Pendleton shall notify AGMG promptly of any proposed changes to the TOMs that may materially affect the security of Personal Data, and shall provide AGMG with a reasonable opportunity to review and comment on such changes before they are implemented.
5.5 Personal Data Breach Notification
Pendleton shall notify AGMG without undue delay, and in any event within thirty-six (36) hours of becoming aware, of any Personal Data Breach affecting Personal Data processed under this DPA. For the purposes of this Section 5.5, Pendleton shall be deemed to have become "aware" of a Personal Data Breach at the point at which a member of Pendleton's security, engineering, or data protection team has a reasonable degree of certainty that a security incident has resulted in the compromise of Personal Data.
The notification required under this Section 5.5 shall include, to the extent reasonably available at the time of notification:
(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
(b) the name and contact details of Pendleton's Data Protection Officer, Siobhán McAuliffe, or another contact point from whom further information can be obtained;
(c) a description of the likely consequences of the Personal Data Breach;
(d) a description of the measures taken or proposed to be taken by Pendleton to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects; and
(e) any other information that AGMG may reasonably require to assess the breach and to comply with its notification obligations to Supervisory Authorities under Article 33 of the GDPR and to Data Subjects under Article 34 of the GDPR.
Where it is not possible to provide all of the above information at the time of the initial notification, Pendleton shall provide such information in phases without undue further delay, keeping AGMG regularly updated as additional information becomes available.
Pendleton shall cooperate fully with AGMG in investigating the causes and circumstances of the Personal Data Breach, in remediating the breach and mitigating its effects, and in fulfilling any notification obligations that AGMG may have to Supervisory Authorities and Data Subjects. Pendleton shall take all reasonable steps to contain and remediate the breach promptly and shall implement appropriate measures to prevent recurrence.
Pendleton shall maintain a register of all Personal Data Breaches affecting Personal Data processed under this DPA, including the facts relating to the breach, its effects, and the remedial action taken, and shall make such register available to AGMG and to any Supervisory Authority upon request.
SECTION 6: DATA SUBJECT RIGHTS ASSISTANCE
6.1 Obligation to Assist
Pendleton shall assist AGMG, by appropriate technical and organisational measures insofar as this is possible, in fulfilling AGMG's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR, in accordance with Article 28(3)(e) of the GDPR. Such rights include, without limitation:
(a) the right of access (Article 15);
(b) the right to rectification (Article 16);
(c) the right to erasure ("right to be forgotten") (Article 17);
(d) the right to restriction of processing (Article 18);
(e) the notification obligation regarding rectification, erasure, or restriction (Article 19);
(f) the right to data portability (Article 20);
(g) the right to object (Article 21); and
(h) the right not to be subject to automated individual decision-making, including profiling (Article 22).
Pendleton shall implement and maintain technical capabilities within its systems that enable it to respond promptly and effectively to AGMG's requests for assistance in fulfilling Data Subject rights, including the ability to search for, retrieve, export, rectify, restrict, and delete Personal Data relating to specific Data Subjects identified by AGMG.
6.2 Forwarding of Requests
In the event that Pendleton receives a request directly from a Data Subject in relation to Personal Data processed under this DPA, Pendleton shall promptly, and in any event within two (2) business days, forward the request to AGMG and shall not respond to the Data Subject directly unless expressly authorised to do so in writing by AGMG. Pendleton shall inform the Data Subject that its request has been forwarded to the Controller for handling.
6.3 Timeframe. Pendleton shall respond to AGMG's requests for assistance in relation to Data Subject rights within five (5) business days of receipt of such request from AGMG, or within such shorter period as may be reasonably necessary to enable AGMG to comply with the time limits prescribed by the GDPR (generally, one (1) month from receipt of the Data Subject's request, subject to possible extension). Where a request is complex or voluminous, Pendleton shall provide AGMG with an initial response within five (5) business days and a full response as soon as reasonably practicable thereafter.
SECTION 7: SUB-PROCESSORS
7.1 General Authorisation with Right of Objection
AGMG hereby provides general written authorisation for Pendleton to engage Sub-processors for the processing of Personal Data on behalf of AGMG, subject to and in accordance with the conditions and procedures set out in this Section 7, in accordance with Article 28(2) of the GDPR. The list of Sub-processors engaged by Pendleton as of the Effective Date, which are hereby approved by AGMG, is set out in Annex III to this DPA (each, an "Approved Sub-processor").
7.2 Notification of New or Replacement Sub-processors
Pendleton shall notify AGMG in writing at least thirty (30) days before engaging any new Sub-processor, or before making any change to or replacement of an existing Approved Sub-processor, in connection with the processing of Personal Data under this DPA (a "Sub-processor Change Notice").
Each Sub-processor Change Notice shall include the following information:
(a) the identity of the proposed new or replacement Sub-processor, including its full legal name and registered address;
(b) the country or countries in which the proposed Sub-processor will process Personal Data;
(c) a description of the nature and scope of the processing to be sub-contracted to the proposed Sub-processor; and
(d) a description of the data protection safeguards in place or to be implemented in connection with the proposed sub-processing, including details of any international transfer mechanisms.
Sub-processor Change Notices shall be sent to the contacts designated in Section 16.4 and Annex V.
7.3 AGMG's Right to Object
AGMG may object to the engagement of a proposed new or replacement Sub-processor by providing written notice of its objection to Pendleton within fourteen (14) days of receipt of the Sub-processor Change Notice. AGMG's objection shall set out reasonable grounds relating to data protection on which the objection is based.
In the event that AGMG raises an objection, the Parties shall discuss the matter in good faith with a view to reaching a mutually acceptable resolution, which may include Pendleton proposing an alternative Sub-processor, implementing additional safeguards, or modifying the scope of the proposed sub-processing. If the Parties are unable to reach a resolution within thirty (30) days of AGMG's objection, AGMG may, at its sole discretion, terminate the processing activity to which the proposed Sub-processor relates, or terminate this DPA in its entirety, without penalty and without prejudice to any other rights or remedies available to AGMG under this DPA or at law.
7.4 Flow-Down Obligations
Pendleton shall impose on each Sub-processor, by way of a written contract, data protection obligations that are no less protective of Personal Data than those set out in this DPA, in accordance with Article 28(4) of the GDPR. In particular, each sub-processing agreement shall require the Sub-processor to implement appropriate technical and organisational measures to protect Personal Data and shall include provisions substantially equivalent to Sections 5, 6, 8, 9, and 11 of this DPA.
Pendleton shall make copies of its sub-processing agreements available to AGMG upon request, subject to the redaction of commercially confidential provisions that are not relevant to data protection compliance.
Pendleton shall remain fully liable to AGMG for the performance of each Sub-processor's obligations under its sub-processing agreement. Where a Sub-processor fails to fulfil its data protection obligations, Pendleton shall be responsible for the acts and omissions of that Sub-processor as if they were the acts and omissions of Pendleton itself.
7.5 Due Diligence
Before engaging any Sub-processor, Pendleton shall conduct reasonable due diligence to satisfy itself that the proposed Sub-processor is capable of meeting the requirements of the GDPR and of providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR and ensure the protection of the rights of Data Subjects. Pendleton shall document the results of such due diligence and make them available to AGMG upon request. Pendleton shall reassess the compliance of each Approved Sub-processor on at least an annual basis.
SECTION 8: INTERNATIONAL TRANSFERS
8.1 Restriction on Transfers
Pendleton shall not transfer Personal Data outside the EEA or the United Kingdom unless it has ensured that adequate safeguards are in place in compliance with Chapter V of the GDPR (Articles 44–49), the UK GDPR (as applicable), and any applicable guidance issued by relevant Supervisory Authorities. In particular, Pendleton shall not transfer Personal Data to any country that has not been the subject of an adequacy decision by the European Commission or the UK Secretary of State (as applicable) unless one of the transfer mechanisms described in this Section 8 has been implemented.
8.2 Standard Contractual Clauses
Where Pendleton or any of its Approved Sub-processors transfers Personal Data to a third country that does not benefit from an adequacy decision under Article 45 of the GDPR, the Parties shall rely on the European Commission Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
For the purposes of this DPA, Module 2 (Transfer Controller to Processor) of the SCCs shall apply to transfers of Personal Data from AGMG (as data exporter/Controller) to Pendleton or its Sub-processors (as data importer/Processor) in third countries. Where Pendleton engages Sub-processors in third countries, Module 3 (Transfer Processor to Sub-processor) of the SCCs shall be passed through via Pendleton's sub-processing arrangements as described in Section 7.4.
The SCCs are hereby incorporated by reference into this DPA and shall be deemed executed by the Parties as of the Effective Date of this DPA. The completed SCCs, including all applicable clauses and appendices, are set out in Annex IV, Part 1 to this DPA.
8.3 Transfer Impact Assessment
A Transfer Impact Assessment has been conducted in respect of transfers of Personal Data from AGMG (UK/EEA) to Pendleton's US-based Approved Sub-processors and is appended as Annex IV, Part 2 to this DPA.
The Transfer Impact Assessment assesses the legal framework of the United States, including the implications of US surveillance legislation (in particular, Section 702 of the Foreign intelligence Surveillance Act and Executive Order 12333), the availability of remedies for Data Subjects, and the risks of access by US public authorities to Personal Data transferred under this DPA. The TIA also evaluates the applicability of the EU-US Data Privacy Framework where relevant.
The TIA documents the supplementary measures implemented by the Parties and by the relevant US-based Sub-processors to ensure an essentially equivalent level of protection for Personal Data transferred to the United States. Such supplementary measures include:
(a) end-to-end encryption of Personal Data in transit (using TLS 1.2 or higher) and at rest (using AES-256);
(b) pseudonymisation of Personal Data at the point of export from the EEA/UK;
(c) contractual commitments from US-based Sub-processors to challenge any government access request that is overbroad, disproportionate, or otherwise unlawful, to notify AGMG and Pendleton where legally permitted to do so, and to minimise the scope of any data disclosed; and
(d) additional organisational measures, including the designation of a point of contact within each US Sub-processor's legal team for government access inquiries.
Based on the analysis conducted, the Parties have concluded that the supplementary measures described above, combined with the protections afforded by the SCCs, provide an essentially equivalent level of protection for Personal Data transferred to the United States.
8.4 UK Transfers
For transfers of Personal Data that are subject to the UK GDPR and that fall outside the scope of an adequacy regulation made by the UK Secretary of State, the Parties shall rely on the International Data Transfer Agreement ("IDTA") approved by the ICO, or the UK Addendum to the EU SCCs (the "UK Addendum") issued by the ICO under Section 119A of the Data Protection Act 2018, as applicable. The relevant IDTA or UK Addendum shall be deemed incorporated into this DPA and executed by the Parties as of the Effective Date.
SECTION 9: AUDIT AND INSPECTION RIGHTS
9.1 Right to Audit (Article 28(3)(h))
Pendleton shall make available to AGMG all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and in this DPA, and shall allow for and contribute to audits, including inspections, conducted by AGMG or an independent auditor mandated by AGMG.
Pendleton shall not impede or obstruct AGMG's exercise of its audit rights under this Section 9, and shall provide reasonable cooperation and assistance in connection with any audit.
9.2 Scope and Frequency
AGMG may conduct up to two (2) audits per calendar year under this Section 9.2, subject to a minimum of thirty (30) days' prior written notice to Pendleton. Audits may encompass any aspect of Pendleton's processing of Personal Data under this DPA, including compliance with the Technical and Organisational Measures described in Annex II, Sub-processor management, international transfer mechanisms, breach response procedures, and data retention and deletion practices.
Notwithstanding the foregoing, AGMG may conduct additional audits without limitation as to frequency and with such notice as is reasonable in the circumstances in the event of:
(a) a Personal Data Breach affecting Personal Data processed under this DPA;
(b) an investigation, inquiry, or enforcement action by a Supervisory Authority relating to Pendleton's processing of Personal Data under this DPA; or
(c) circumstances in which AGMG has reasonable grounds to suspect that Pendleton is not in compliance with its obligations under this DPA or Applicable Data Protection Law.
9.3 Cooperation. Pendleton shall cooperate fully with all audits conducted under this Section 9, including by:
(a) providing AGMG or its mandated auditor with access to Pendleton's relevant premises, systems, databases, logs, and records;
(b) making relevant personnel available for interview, including Pendleton's Data Protection Officer (Siobhán McAuliffe) and technical and operational staff responsible for the processing of Personal Data;
(c) providing copies of relevant documentation, policies, procedures, and records within ten (10) business days of AGMG's written request; and