Data Processor Agreement relating to GTI Attribution Services

‍

By making use of the attribution tracking service made available by Group GTI Limited, a company registered in England (No. 05769006) with registered office at First Floor 240 Blackfriars Road, London, England, SE1 8NW (“GTI”), the user (“Client”) agrees to be bound by the following terms between it and GTI:  

Background

1. Client possesses a database of individual members from among whom it can identify individuals satisfying a set of criteria.  

2. GTI has a database of job candidates and their associated academic institutions (“Candidate Database”).

3. Client and GTI wish to estimate the number of individuals who may have applied for positions it advertised (whether successful or not), or registered to attend events it organised or were otherwise in a similar position (collectively “candidates”) whose recruitment or other form of engagement may have been assisted by GTI (“Attribution Results”). In order to do so Client shall supply GTI with a list of candidates (“Candidate List”) for the purposes of making such a determination.  

4. The nature of the relationship set out in above in relation to the processing of personal data in the Candidate List and any personal data derived from it by GTI (collectively, “Candidate Data”) being one of joint controllership as defined by the UK GDPR, the parties have agreed to set out their respective duties arising under the UK GDPR in respect of the Attribution Processing in this agreement.

The parties have agreed as follows:

1. Definitions ‍
   1. In this agreement the words “anonymous”, “consent”, “data subject”, “domestic law”, “personal data” and “personal data breach” have the meaning given to them in the UK GDPR; “special category data” refers to the data described in Article 9 of the UK GDPR and the following definitions apply:
   2. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any analogous law protecting personal data that is applicable to the Attribution Processing  
   3. “Data Subject Request” means any exercise, or purported exercise, of any Candidate’s rights as a data subject under the UK GDPR, communicated to either Party;
   4. “Candidate” means a data subject to which the Attribution Processing relates;
   5. “Attribution Processing” means all of: (1) the communication of Candidate Data to GTI by Client; and(2) the processing of Candidate Data by GTI for the purpose of attributing Candidates to individuals within the Candidate Database and the subsequent production of aggregated, anonymous, information for communication to the Client;
   6. “UK GDPR” has the meaning given to it in section 3 of the Data Protection Act 2018.

2. General ‍
   1. Each Party shall comply with any obligations imposed on it by Data Protection Law in relation to the Attribution Processing.
   2. Each Party shall, on request, give the requesting Party all reasonable assistance it may require in order of it to comply with any obligations imposed on it by Data Protection Law in relation to the Attribution Processing.
   3. Unless otherwise expressly agreed in writing between the Parties, this agreement shall take precedence over any other agreement or understanding between the Parties relating to the protection of personal data processed as part of the Attribution Processing.

3. Specific obligations ‍
   1. Client warrants that it has:
      1. A legal basis under Article 6 of the UK GDPR for sharing the Candidate Data with GTI for the purposes of this Agreement;
      2. It has given all information required by the UK GDPR to Candidates relating to the Attribution Processing;
   2. Client shall,
      1. Where requested by GTI from time to time, communicate to Candidates (for example as part of the information required by clause 3.1(b)) a link to GTI’s own published privacy notice relating to the Attribution Processing;
      2. Communicate the Candidate List to GTI via a secure means of transfer using the attribution tracker in the targetconnect platform. And promptly delete the file once it is no longer needed.
      3. If it believes that any Attribution Results are not anonymous, promptly inform GTI of its belief and take all reasonable steps requested by GTI to ensure compliance with the UK GDPR in relation to any personal data contained in the Attribution Results.
   3. GTI shall:
      1. Use the Candidate Data exclusively for the Attribution Processing and shall promptly delete any Candidate Data no longer required after the end of the Attribution Processing.  
      2. GTI shall take reasonable steps to ensure that the Attribution Results are anonymous.  
      3. Notwithstanding any confidentiality agreement, or other obligation of confidence, imposed by one Party on the other, either Party may supply a copy of this agreement to any Candidate or the United Kingdom Information Commissioner or any authority similarly constituted for the enforcement of the rights of individuals to the protection of their personal data.

4. Data Subject Requests ‍
   1. Where either Party receives a Data Subject Request in relation to the Attribution Processing, it shall promptly inform the other of the request, and:
      1. The Parties shall make best efforts to co-operate in ensuring that a proper response is given to the request;
      2. Where the request relates to any data in a Party’s possession or control, for example a request for a copy of, or deletion of that data, that Party shall be responsible for deciding what response should be made; what action should be taken in relation to the data in its possession or control; and for making that response and/or taking that action as the case may be.
      3. Where a Data Subject Request, or any subsequent communication with the maker of the request, contains sensitive personal data, or any confidential information, the Party receiving it shall not communicate that data or information to the other Party or any third party, without establishing a lawful basis for doing so, for example the consent of the data subject.

5. Data Breach ‍
   1. Each Party shall take all appropriate technical and organisational steps to ensure that the Share Data is protect against a Personal Data Breach.
   2. Where either Party is aware that a Personal Data Breach has occurred it shall promptly, and in any event in no less than 48 hours, inform the other of the fact of the breach; its nature and (where known) the reasons for its occurrence.
   3. Where a Personal Data Breach takes place, the Party that had the personal data that is the subject of the breach within its possession or control at the time of the breach, or where the data is in transit between one Party and the other, the Party that made the arrangements for the transfer, shall be responsible (in consultation with the other where appropriate) for doing the following (within any timescales provided by the UK GDPR, and in the case of (a) and (b) only if required to do so by the UK GDPR):
      1. Notifying the breach to the UK Information Commissioner;
      2. Informing any affected Candidates;  
      3. Taking all such steps as are necessary to prevent the breach from occurring again and to mitigate against any damaged caused by it.

6. Duration and scope ‍
   1. This agreement governs all Attribution Processing carried out by the Parties and will continue until it is expressly repealed, amended or replaced by the Parties in writing. Subject to any express agreement of the kind set out in the first sentence of this clause, where any other agreement between the Parties contradicts this agreement, this agreement shall prevail.

7. Miscellaneous ‍
   1. Law and jurisdiction. This agreement shall be interpreted in accordance with the law of England, which shall also govern any question as to its formation or subject matter. The courts of England shall have exclusive jurisdiction to settle any dispute arising out of it.