Extract to table

The CNIL further found that, to the extent that personal data was processed through these cookies, the absence of prior consent rendered such processing unlawful under Article 6(1)(a) of the GDPR, which requires that consent, where relied upon as a lawful basis, must be obtained prior to the commencement of processing

This practice was found to be contrary to Article 7(3) of the GDPR, which provides that the data subject shall have the right to withdraw his or her consent at any time and that it shall be as easy to withdraw consent as to give it

Users must affirmatively activate each toggle to provide consent for a specific processing purpose

Where general authorisation is granted, Pendleton must inform AGMG of any intended changes concerning the addition or replacement of sub-processors, giving AGMG the opportunity to object

All sub-processor engagements must be governed by written agreements that impose data protection obligations no less stringent than those set forth in the DPA between AGMG and Pendleton

Upon termination of the DPA, Pendleton is required to delete or return all personal data to AGMG, at AGMG's choice, and to delete existing copies unless retention is required by applicable law