Skip to content
X

Privacy Center

Our Privacy center is aimed at making it easy to find out about how we share and use your data, the obligations you accept on use of our products and services, and a central location for other legal information.

Because we are a large organization and use personal data in lots of different ways, we have split up this information into several different privacy and legal notices to make it easier for you to find what you are looking for.

Policy Description
Privacy Notice

An overview of how we use information and share information of our clients, website visitors, and targets of due diligence.

Privacy Shield Policy

An overview of how we collect, use, and disclose certain personally identifiable information that we receive in the US from the European Union (“EU”), the United Kingdom (“UK”), and Switzerland.

Human Resources & Job Applicant Privacy Policy

An overview of how we use information and share information of people we work with and those that apply to work with us.

Personal Data Processing Agreement

An addendum to the contractual agreement for services between Exiger and customer, explaining our respective roles and the nature and subject matter of processing. This includes the EU Standard Contractual Clauses (“SCC”).

Privacy Notice

This privacy notice describes how we, Exiger LLC, and our subsidiaries and affiliates from time to time (“Exiger,” “we,” “us,” “our”), process, maintain, use and share information about individuals (each a “User,” “you,” “your”) who use our website (www.exiger.com) and related features (collectively, the “Site”) or who we communicate or interact with. Exiger complies with various privacy laws globally including, but not limited to, the European Union General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”).

This notice sets out:

  1. Information we collect about you
  2. Cookies and other technologies
  3. How we use your information
  4. Our promotional updates and communications
  5. Who we give your information to
  6. Where we store your information
  7. How we protect your information
  8. How long we keep your information
  9. Links to Third Party Sites
  10. Child Safety
  11. Provision of Professional Services
  12. Your rights
  13. Changes to this notice
  14. Contact us

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

By engaging with our Site, you acknowledge you have read and understood this privacy notice.

For the purposes of the applicable data protection law, the Data Protection Officer is: Clewin McPherson,

Senior Vice President-Global Operations

+1 (212) 455-9400

data.protection@exiger.com

1. INFORMATION WE COLLECT ABOUT YOU

We will collect and process the following personal data from you:

  • Information you give us
    • This is information about you that you give us directly when you interact with us. This is information about you that you give us by filling in forms on our site or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you use our site, subscribe to our service, search for a product, submit a query, and when you report a problem with our site.
    • The information you give us may include demographic information, such as your name, job title, company name, country, e-mail address and phone number.
    • If you register for an event we organize, you may submit additional information including your interest in compliance topics and products.
    • If you respond to an advertised job vacancy or make a general inquiry regarding employment opportunities with us, you may submit various employment details about yourself, including a CV, resumé or other details of your educational and employment history. For further information on recruitment, please review Exiger’s Human Resources & Job Applicant Privacy Notice.
  • Information we collect about you from your use of our site: We will automatically collect technical information from you each time you visit our site. This includes:
    • The Internet protocol (IP) address used to connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
  • Information we receive from other sources. This is information we receive about you:
    • If you use any of the other websites or apps we operate or the other services we provide.
    • From third-parties we work closely with (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, and search information providers). We will notify you when we receive information about you from them and the purposes for which we intend to use that information.

2. COOKIES AND OTHER TECHNOLOGIES

Our site uses cookies and/or other similar technologies to collect and store certain information. These typically involve pieces of information or code that a website transfers to, or accesses from, your computer hard drive or mobile device to store and sometimes track information about you. Cookies and similar technologies enable you to be remembered when using that computer or device to interact with websites and online services, and can be used to manage a range of features and content as well as storing searches and presenting personalized content.

Our site uses cookies and similar technologies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our site and also allows us to improve our site. 

A number of cookies and similar technologies we use last only for the duration of your web session and expire when you close your browser. Others are used to remember you when you return to the site and will last for longer.

We use these cookies and other technologies on the basis that they are necessary for the performance of a contract with you, or because using them is in our legitimate interests (where we have considered that these are not overridden by your rights), and, in some cases, where required by law, where you have consented to their use.

Most web browsers automatically accept cookies and similar technologies, but if you prefer, you can change your browser to prevent that. Your help screen or manual will tell you how to do this. If you disable cookies to our site, however, you may not be able to take full advantage of our site. 

3. HOW WE USE YOUR INFORMATION

We use information held about you in the following ways:

  • Information you give to us:
    • We will use this information to:
      • Take steps in order to enter into any contract or carry out our obligations arising from any existing contract entered into between you and us.
      • Provide you with information about our goods or services we feel may interest you, if you have given your consent to receiving marketing material from us at the point we collected your information, where required by law or otherwise in our legitimate interests (provided these interests do not override your right to object to such communications).
      • Ensure in our legitimate interests that:
        • Content from our site is presented in the most effective manner for you and for your computer.
        • We provide you with the information, products and services that you request from us.
  • Information we collect about you from your use of our site
    • We will use this information in our legitimate interests, where we have considered these are not overridden by your rights:
      • To administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
      • To keep our site safe and secure.
      • For measuring or understanding the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.
      • To improve our site to ensure that content is presented in the most effective manner for you and for your computer.
      • To allow you to participate in interactive features of our service, when you choose to do so.
  • Information we receive from other sources
    • We may combine this information with information you give to us and information we collect about you in our legitimate interests (where we have considered that these are not overridden by your rights). We will use this information and the combined information for the purposes set out above (depending on the types of information we receive).

4. OUR PROMOTIONAL UPDATES AND COMMUNICATIONS

Where permitted in our legitimate interest or with your prior consent where required by law, we will use your personal information for marketing analysis and to provide you with promotional update communications by email and social media platforms about our products/services.

You can object to further marketing at any time by selecting the “unsubscribe” link at the end of all our marketing and promotional update communications to you, or by sending us an email at privacy@exiger.com.

5. WHO WE GIVE YOUR INFORMATION TO

We may give your information to any member of our group:

We may also give your information to selected third parties:

  • We may give your information to any of our subsidiaries, our ultimate holding company and its subsidiaries, who support our processing of personal data under this notice. If any of these parties are using your information for direct marketing purposes, we will only transfer the information to them for that purpose with your prior consent.

We may also give your information to selected third parties:

  • Organizations who process your personal data on our behalf and in accordance with our instructions and the Data Protection Law. This includes in supporting the services we offer through the site in particular those providing website and data hosting services, providing fulfilment services, distributing any communications we send, supporting or updating marketing lists, facilitating feedback on our services and providing IT support services from time to time. These organizations (which may include third party suppliers, agents, sub-contractors and/or other companies in our group) will only use your information to the extent necessary to perform their support functions.
  • Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we will provide them with aggregate information about our users. We may also use such aggregate information to help advertisers reach the kind of audience they want to target. We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to that target audience and subject to the cookie section of this notice.
  • Analytics and search engine providers that assist us in the improvement and optimization of our site and subject to the cookie section of this notice (this will not identify you as an individual).
  • Business partners who jointly with us provide services to you and with whom we have entered into agreements in relation to the processing of your personal data.

We will disclose your personal information to third parties:

  • In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets subject to the terms of this privacy notice.
  • If Exiger LLC or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
  • If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of supply terms and other agreements with you; or to protect the rights, property, or safety of Exiger LLC, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction and to prevent cybercrime.

When you visit our website, we use the following third parties to process your information:

CompanyProcessing TypeLearn More
Google, Inc.Analytics, Advertising“How Google uses data when you use our partners’ sites or apps”, located at www.google.com/policies/privacy/partners/
New RelicTelemetry, Performancehttps://newrelic.com/termsandconditions/services-notices
HotJarBehavior Analyticshttps://www.hotjar.com/privacy/
HubSpotCustomer Relationship Management, Marketing, and Saleshttps://legal.hubspot.com/product-privacy-policy
LinkedInAdvertisinghttps://www.linkedin.com/legal/privacy-policy

6. WHERE WE STORE YOUR INFORMATION

We are headquartered in the United States of America with offices and servers in Canada, among other places. Therefore, we may transfer, process, and/or store your personal information in the United States and Canada. When we transfer personal information to any destination outside the European Union (EU), the European Economic Area (EEA) or the United Kingdom (UK), we will take all steps reasonably necessary to ensure that your data is subject to appropriate safeguards, such as relying on a recognized legal adequacy mechanism, and that it is treated securely and in accordance with this privacy notice.

The European Commission has recognized that Canada and United Kingdom have data privacy laws providing an adequate level of protection. For transfers to the US and/or countries viewed as inadequate, we have taken appropriate safeguards to require that your Personal Data will remain protected in accordance with this Privacy Notice and as required by applicable data protection law. These include implementing an adequate method of transfer, such as the European Commission’s Standard Contractual Clauses, for transfers of Personal Data with our third-party service providers and partners, further details of which can be provided upon request.

In addition, Exiger continues to comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States, as discussed in Exiger’s Privacy Shield Policy.  

7. HOW WE PROTECT YOUR INFORMATION

Exiger will use appropriate technical and organizational security measures to try to protect your personal data from loss, misuse, alteration, or destruction. Please be aware that the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

8. HOW LONG WE KEEP YOUR INFORMATION

Exiger will retain personal data for a reasonable period, taking into account legitimate business needs to capture and retain such information. Information will also be retained for a period necessary to comply with applicable local, state, federal, or country specific regulations and requirements.

We may also retain aggregate information without time limits for research purposes and to help us develop and improve our services. You cannot be identified from aggregate information retained or used for these purposes.

9. LINKS TO THIRD PARTY SITES

Our site may, from time to time, contain links to external sites. Once you click on any of those links you will be leaving our website and will be directed to another website; the Exiger privacy notice will no longer apply. We are not responsible for the privacy notices, policies, the content, or security practices of such sites.

10. CHILD SAFETY

Protecting the safety of children when they use the Internet is important to Exiger. Our services and this Site are intended for use by adults, primarily in their business or professional capacities. Our services are not directed to children; we do not target or knowingly collect information from children under the age of 13.

11. PROVISION OF PROFESSIONAL SERVICES

Exiger will also often receive personal information in the course of providing professional services – ordinarily when we provide services to private individuals, employers, businesses with personal customers, and public-sector clients with constituents. Our engagement letter and terms of business govern our relationship with clients, including what we may do with personal data that is provided to us. Exiger provides many different types of services and its role may not always be visible to the individuals who are data subjects. Exiger processes personal information on data subjects according to the instructions of its Clients and relies upon its Clients to ensure processing is supported by an adequate legal basis and only in accordance with applicable laws.

12. YOUR RIGHTS

We will honor your rights under applicable data protection laws. You may have the following rights under European laws, and may have similar rights under the laws of other countries.

  • Right of subject access: You have the right to make a written request for details of your personal information and to be provided with a copy of your personal data held by us.
  • Right to rectification: You have the right to have inaccurate information about you to be corrected or removed.
  • Right to erasure: You have the right to have certain personal information about you erased. We will comply with your request unless there is an overriding legitimate ground for retaining the information.
  • Right to restriction of processing: You have the right to request that we restrict the processing of your personal data (while we verify or investigate your concerns with this information, for example).
  • Right to object: You have the right to object to the further processing of your personal data, including the right to object to marketing (as mentioned in “Our promotional updates and communications” section).
  • Right to data portability: You have the right to request that your provided personal data be transferred to you or to a third party in machine-readable format.
  • Right to withdraw consent: Where the processing of your personal information by us is based on consent, you have the right to withdraw that consent without detriment at any time by contacting us. If you withdraw your consent, this will not affect the lawfulness of our use of your personal information prior to the withdrawal of your consent.

You can also exercise the rights listed above at any time by contacting our Data Protection Officer:

Clewin McPherson,

Senior Vice President-Global Operations

data.protection@exiger.com

For data subjects located in the EU: if we are not able to satisfactorily resolve your questions, concerns, or complaints, or if you believe that the processing of your personal data infringes on your rights under applicable data protection laws, you have the right, without prejudice to any other administrative or judicial remedies, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Contact information of the supervisory authorities may be found here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

For data subjects in the UK, the Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data. Contact information for the UK Information Commissioner can be found here: https://ico.org.uk/

13. CHANGES TO THIS NOTICE

Exiger keeps this notice under regular review and may modify it from time to time at our discretion. Any changes we make will be posted on this page. This notice was last updated on February 18, 2021.

14. CONTACT US

If you have questions, comments, or complaints about our handling or protection of your personal data or this privacy notice, you may send a message by email to data.protection@exiger.com or may contact our Data Protection Officer:

Clewin McPherson,

Senior Vice President-Global Operations

+1 (212) 455-9400

data.protection@exiger.com

Legal Center

Policy Description
Terms & Conditions

An outline of the responsibilities, liability, and agreement when using our products and services.

Human Rights & Modern Slavery Statement

A summary of our analysis of our risk and our commitment to prevent modern slavery.

Terms & Conditions

Exiger LLC provides information on our website (the “Site”) subject to the following terms and conditions (the “Terms of Use”). The terms “we,” “our,” “us,” and “Exiger” refer to Exiger LLC. The term “you” refers to each individual user of this site and, if applicable to your use, your employer or firm. By accessing or using the site, you are acknowledging that you have read, understand, and agree, without limitation or qualification to be bound by these Terms of Use and our Privacy Notice. If you disagree with these Terms of Use and our Privacy Notice (as amended from time to time) or are dissatisfied with this Site, your only remedy is to discontinue using this Site.

DO NOT USE THIS WEB SITE IF YOU DO NOT AGREE WITH THESE TERMS. Exiger reserves the right, in its sole discretion, to modify, alter or otherwise update this Agreement, or to change or delete any features of this Web Site, at any time, with or without prior notice to you. Such modifications, alterations, and updates of this Agreement shall be effective immediately upon posting upon the Web Site. You agree to be bound by such modified, altered and updated terms if you access or use this Web Site after Exiger has posted notice of modifications, alterations or updates. IF YOU DO NOT AGREE WITH ANY OF THE MODIFIED, ALTERED OR UPDATED TERMS, THEN YOU SHOULD NOT USE THIS WEB SITE AFTER SUCH MODIFICATIONS, ALTERATIONS OR UPDATES HAVE BEEN POSTED.

This Web Site may permit you to link to other web sites that may or may not be affiliated with this Web Site and/or with Exiger. These other linked web sites, including the web sites of Exiger’s affiliated companies, as well as the web sites of Exiger’s third party service providers, or partners, (collectively the “Third Parties”), may have different terms of use that are not the same as in this Agreement. Your access to and use of such linked web sites through links provided on this Web Site are not governed by this Agreement, but instead are governed by the terms of use and policies of those web sites, and Exiger disclaims any and all responsibility for your access to and use of such linked web sites.

PRIVACY

Personal Information, as defined in Exiger’s Privacy Notice, and other information about you that you may submit or provide to Exiger through this Web Site is subject to Exiger’s Privacy Notice, which can be found at www.exiger.com/privacy-and-legal-center/#privacy-notice and is incorporated into this Agreement. In addition, by using this Web Site you expressly consent to Exiger collecting Personal Information and other information about you, as more fully provided in Exiger’s Privacy Notice.

USE OF THIS WEB SITE AND INTELLECTUAL PROPERTY RIGHTS

Exiger controls and (either itself and/or through its third party hosts) operates this Web Site. All content on this Web Site, including, but not limited to, text, images, illustrations, graphics, logos, digital downloads, data, software, headers, icons, scripts, audio clips, and video clips, is the property of Exiger or its Third Parties, and is protected by copyrights, trademarks, service marks, and/or other intellectual property rights (which are governed by and subject to United States and international copyright laws and treaty provisions, privacy and publicity laws, and communication regulations and statutes). The content is owned and controlled by Exiger, its affiliated or related entities, or the Third Parties that have licensed or otherwise made available their content or the right to market their products and/or services to Exiger.

You may not use any registered or unregistered trademarks, service marks, copyrighted materials or other proprietary information or intellectual property appearing on this Web Site, including, but not limited to, any logos, images or characters, meta tags or similar code, or hidden text or elements containing such information or property, without the express written consent of the owner of the mark or copyright. You may not frame any trademarks, service marks, copyrights, logos, images, text, or other proprietary information or intellectual property of Exiger, or otherwise incorporate into another web site any of the content or other materials on this Web Site, without Exiger’s express prior written consent. You may not deep link to any page or portion of this Web Site without Exiger’s prior written consent.

Violation of trademark and copyright laws (“Infringement”) may result in significant civil liability or criminal penalties under United States and/or international copyright and trademark laws. You recognize that any reproduction or use of content, copyrights, trademarks, service marks, or other intellectual property on this Web Site, except as authorized by this Agreement, is considered intentional Infringement.

USER’S RESPONSIBILITIES

You warrant and represent to Exiger that you will not use this Web Site for any purpose that is unlawful, illegal or prohibited by this Agreement, including, without limitation, the sending, posting, transmitting, displaying, distributing, or knowingly receiving of or searching for any threatening, harassing, libelous, defamatory, obscene, scandalous, inflammatory, sexually oriented, pornographic, or profane material, content or images, or other images, content or messages that might be considered lewd, lascivious, excessively violent or otherwise offensive. If you violate any of these responsibilities, your permission to use this Web Site immediately terminates without the necessity of any notice by us to you. Exiger, at its sole discretion, retains the right to deny access to this Web Site to anyone for any reason, including for violation of this Agreement.

You agree that any information that you provide will be true, accurate, current and complete. If you provide any information that is untrue, inaccurate, not current or incomplete (or Exiger has reasonable grounds to suspect that such information is untrue, inaccurate, not current or incomplete), Exiger has the right to suspend or terminate your access and activity relating to, and to refuse any and all current or future use of, this Web Site.

PROHIBITED ACTIVITIES

You are specifically prohibited from any use of this Web Site, and you agree not to use or permit others to use this Web Site, without limitation, for any of the following:

(a) take any action that imposes an unreasonable or disproportionately large load on, or waste of valuable time for, the Web Site’s infrastructure or resources, including, but not limited to, sending or promoting the distribution of “spam,” “junk mail,” chain letters, or other such unsolicited or unlawful mass e-mailing techniques;

(b) disclose to, or share with, any unauthorized third parties the IDs, assigned confirmation numbers and/or passwords, or use the IDs, assigned confirmation numbers and/or passwords for any unauthorized purpose, or otherwise allow or facilitate others to gain access to Exiger’s information technology systems, environments, networks, files, data or accounts through the use of the IDs, assigned confirmation numbers and/or passwords;

(c) access or attempt to access Exiger’s information technology systems, environments, networks, files, data or accounts to which express authorization has not been obtained (including access to data not intended for You), or log into a server or account that you are not authorized to access;

(d) attempt to decipher, decompile, disassemble, modify, remove or reverse engineer any of the software or HTML code comprising or in any way making up a part of this Web Site;

(e) interfere with, disrupt, disable or damage (or attempt to interfere with, disrupt, disable or damage), in an unauthorized manner, the use or operation of this Web Site or Exiger’s, its affiliated or related entities’ or the Third Party’s systems, equipment or applications, or service to any user, host, or network, including by use of any programs, scripts, commands, viruses, worms, web bugs, harmful code, Trojan horses, other contaminants, or otherwise. This includes “denial of service” attacks, “flooding” of networks, deliberate attempts to overload a service or to burden excessively a service’s resources, attempts to “crash” a host, and/or modifying or rerouting any content or services provided at this Web Site;

(f) attempt to circumvent or subvert system or network security (i.e., authentication) mechanisms, or probe the security of any system, network, or account, associated or used in conjunction with this Web Site;

(g) upload, post, e-mail or otherwise transmit any information, content, or proprietary rights that you do not have a right to transmit under this Agreement, any law or other contractual or fiduciary relationships; and/or

(h) use any robot, spider, intelligent agent, meta-searching, other automatic device, or manual process to search, monitor or copy Exiger’s Web Site pages or the content.

NO WARRANTIES

ALL CONTENT, PRODUCTS AND SERVICES ON THIS WEB SITE, UNLESS OTHERWISE EXPRESSLY STATED IN WRITING BY EXIGER, ARE PROVIDED “AS IS” AND WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. OTHER THAN THOSE WARRANTIES WHICH, UNDER THE U.S. LAWS APPLICABLE TO THESE TERMS, ARE IMPLIED BY LAW AND ARE INCAPABLE OF EXCLUSION, RESTRICTION, OR MODIFICATION, EXIGER DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

NEITHER EXIGER, ITS AFFILIATED OR RELATED ENTITIES, NOR THE THIRD PARTIES, NOR ANY PERSON INVOLVED IN THE CREATION, PRODUCTION, HOSTING AND/OR DISTRIBUTION OF THIS WEB SITE, WARRANT THAT THE FUNCTIONS, FEATURES OR SERVICES CONTAINED IN THIS WEB SITE WILL BE UNINTERRUPTED OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SERVER THAT MAKES THE CONTENT AVAILABLE WILL BE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS. THE CONTENT THAT YOU ACCESS ON THIS WEB SITE IS PROVIDED SOLELY FOR YOUR CONVENIENCE AND INFORMATION. EXIGER DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF THIS WEB SITE, OR AS TO THE RELIABILITY, ACCURACY OR CURRENCY OF ANY CONTENT, SERVICE, AND/OR MERCHANDISE PROVIDED OR ACQUIRED PURSUANT TO YOUR USE OF THIS WEB SITE.

YOUR USE OF THIS WEB SITE IS AT YOUR OWN RISK. YOU (AND NOT EXIGER) ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING (INCLUDING, WITHOUT LIMITATION, YOUR INTERNET CONNECTION) AND REPAIR OR CORRECTION OF YOUR COMPUTER, NETWORK AND/OR SYSTEM.

LIMITATION OF LIABILITY

IN NO EVENT SHALL EXIGER, ITS AFFILIATED OR RELATED ENTITIES OR THIRD PARTIES, NOR ANY OF ITS OR THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES OR AGENTS, OR ANY PERSON OR ENTITY INVOLVED IN THE CREATION, PRODUCTION, DISTRIBUTION AND HOSTING OF THIS WEB SITE, BE LIABLE FOR ANY DIRECT, ACTUAL, INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES, OF ANY KIND, WHETHER ARISING UNDER CONTRACT, WARRANTY, OR TORT (INCLUDING NEGLIGENCE) OR ANY OTHER THEORY OF LIABILITY, REGARDLESS OF WHETHER EXIGER (OR ITS AFFILIATED OR RELATED ENTITIES OR PROVIDERS) KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES, INCLUDING, WITHOUT LIMITATION, FROM THE USE OR ATTEMPTED USE OF THIS WEB SITE OR ANY OTHER LINKED SITE.

GOVERNING LAW AND JURISDICTION

By accessing this Web Site, you agree that this Agreement and your use of the Web Site shall be governed in all respect by the laws of the State of New York, without regard to any conflict of laws provisions, and shall not be governed by the United Nations Convention on the International Sale of Goods. You further agree to submit to the exclusive jurisdiction and venue in the state and federal courts located in the State of New York for all disputes, cases and controversies regarding this Web Site, your use of this Web Site, and any matter arising out of or related to this Agreement.

INDEMNIFICATION

Exiger reserves the right to report any wrongdoing, if and when it becomes aware of it, to any applicable government or law enforcement agencies. You agree to indemnify, defend and hold Exiger, its and their officers, directors, employees, affiliated or related entities, Third Parties, agents, licensors, and suppliers, harmless from and against any and all claims, demands, actions, costs, liabilities, losses and damages of any kind (including attorneys’ fees) resulting from your use of this Web Site, your breach of any provision of this Agreement and/or any negligent acts, omissions or intentional wrongdoing by you.

GENERAL PROVISIONS

Exiger’s failure to act with respect to a breach by you or others does not waive Exiger’s right to act with respect to subsequent or similar breaches. If any provision of this Agreement is held to be invalid or unenforceable, such provision will be struck and the remaining provisions enforced. Headings are for reference purposes only. You and Exiger are dealing at arms’ length, creating a commercial relationship. Exiger is not your agent, representative or fiduciary. The provisions and conditions of this Agreement, and each obligation referenced herein, represent the entire Agreement between Exiger (including the Third Parties), its affiliated or related entities, and you, and supersede any prior agreements or understandings not incorporated herein. In the event that any inconsistencies exist between this Agreement and any future published terms of use or understanding, the last published Agreement shall prevail.

EXIGER RESERVES ANY RIGHTS NOT EXPRESSLY GRANTED OR STATED IN THESE TERMS.

Privacy Shield Policy

This Privacy Shield Policy (“Policy”) describes how Exiger LLC and its subsidiaries and affiliates in the United States (“US”) (“Exiger,” “Company,” “we,” or “us”) collect, use, and disclose certain personally identifiable information that we receive in the US from the European Union (“EU”), the United Kingdom (“UK”), and Switzerland (“Personal Data”). This Policy applies to the following US affiliated entities: Exiger LLC, Exiger Diligence, Inc. and Convergent Solutions, Inc. This Policy supplements our Privacy Notice located at http://www.exiger.com/privacy, and unless specifically defined in this Policy, the terms in this Policy have the same meaning as the Privacy Notice.

Exiger continues to comply with the EU-US Privacy Shield and Swiss-US Privacy Shield Frameworks as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member states, the United Kingdom, and Switzerland. Exiger has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.

In addition, for transfers to the US and/or countries viewed as inadequate, we have taken appropriate safeguards to require that Personal Data will remain protected in accordance with this Privacy Shield Policy and as required by applicable data protection law. These include implementing an adequate method of transfer, such as the European Commission’s Standard Contractual Clauses, for transfers of Personal Data with our third-party service providers and partners, further details of which can be provided upon request.

For purposes of enforcing compliance with the Privacy Shield, Exiger is subject to the investigatory and enforcement authority of the US Federal Trade Commission. For more information about the Privacy Shield, see the US Department of Commerce’s Privacy Shield website located at: https://www.privacyshield.gov. To review Exiger’s representation on the Privacy Shield list, see the US Department of Commerce’s Privacy Shield self-certification list located at: https://www.privacyshield.gov/list.

Personal Data Collection and Use

Exiger advises financial institutions and multinational corporations concerning regulatory and financial crimes risk and compliance and provides a range of related investigative, due diligence, consulting, risk management and compliance services. When Exiger processes data received from a client or prospective client (“Client Data”), Exiger does so only pursuant to the client’s or prospective client’s instructions and prior authorization.

Client Data may include Personal Data. We may receive the following categories of Personal Data in the US: name, residence and business address, national/tax identification number, email addresses, date of birth, and/or scans of relevant identification cards/documents. We process Personal Data for the following purposes: advising financial institutions and multinational corporations concerning regulatory and financial crimes risk and compliance and providing a range of related investigative, due diligence, consulting, risk management and compliance services.

Exiger will only process Personal Data in ways that are compatible with the purpose that Exiger collected it for, or for purposes the individual later authorizes. Before we use your Personal Data for a purpose that is materially different than the purpose we collected it for or that you later authorized, we will provide you with the opportunity to opt out. Exiger maintains reasonable procedures to help ensure that Personal Data is reliable for its intended use, accurate, complete, and current.

If we collect sensitive Personal Data, we will obtain your opt-in consent where the Privacy Shield requires, including if we disclose your sensitive Personal Data to third parties, or before we use your sensitive Personal Data for a different purpose than we collected it for or than you later authorized.

Exiger processes only the Personal Data that its clients or prospective clients have chosen to share with Exiger. Exiger has no direct or contractual relationship with the subject of this Personal Data (the “Data Subject”). As a result, when Client Data includes Personal Data, the client is solely responsible for satisfying all legal obligations owed directly to the Data Subject under applicable data protection laws.

It is the Exiger client’s or prospective client’s responsibility to ensure that Personal Data it collected can be legally collected in the country of origin. The client or prospective client is also responsible for providing to the Data Subject any notices required by applicable law, for obtaining consent where legally required, and for responding appropriately to the Data Subject’s request to exercise his or her rights under applicable data protection law with respect to Personal Data.

Exiger is not responsible for its client’s or prospective client’s privacy policies or practices or for the client’s or prospective client’s compliance with them. Exiger does not review, comment upon, or monitor its client’s or prospective client’s privacy policies or the client’s or prospective client’s compliance with such policies. Exiger also does not review instructions or authorizations to Exiger to determine whether the instructions or authorizations are in compliance with, or conflict with, the terms of a client’s or prospective client’s published privacy policy or of any notice provided to Data Subjects.

Under the data protections law of the EU member states, the UK, and Switzerland, a “Controller” is an organization that determines the purposes for which and the manner in which Personal Data are to be processed. A “Processor” processes Personal Data on behalf of a Controller, and only in accordance with the Controller’s instructions. Exiger acts as a Processor when it advises a client with respect to matters involving Client Data that includes Personal Data.

Data Transfers to Third Parties

Third-Party Agents or Service Providers. We may transfer Personal Data to our third-party agents or service providers who perform functions on our behalf, including contractors who provide due diligence services. We enter into written agreements with those third-party agents and service providers requiring them to provide the same level of protection the Privacy Shield requires and limiting their use of the data to the specified services provided on our behalf. We take reasonable and appropriate steps to ensure that third-party agents and service providers process Personal Data in accordance with our Privacy Shield obligations and to stop and remediate any unauthorized processing. In cases of onward transfer to third parties of data of individuals in the EU, UK, or Switzerland received pursuant to the EU-US or Swiss-US Privacy Shields, Exiger is potentially liable.

Transfers to Exiger Affiliates.  If we transfer your Personal Data to one of our affiliated entities within our corporate group, we will take steps to ensure that your Personal Data is protected with the same level of protection the Privacy Shield requires.

Disclosures for National Security or Law Enforcement. Under certain circumstances, we may be required to disclose your Personal Data in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Security

Exiger maintains reasonable and appropriate security measures to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the Privacy Shield.

Access Rights

You have the right to obtain our confirmation of whether we maintain personal information relating to you. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct his query to privacy@exiger.com.  If requested to remove data, we will respond within a reasonable timeframe.

Your right to access your Personal Data may be restricted in exceptional circumstances, including, but not limited to, when the burden or expense of providing this access would be disproportionate to the risks to your privacy in the case in question, or when the rights of persons other than you would be violated by the provision of such access. If we determine that your access should be restricted in a particular instance, we will provide you with an explanation of our determination and respond to any inquiries you may have.

Data Retention

Exiger takes reasonable and appropriate measures to comply with the requirement under Privacy Shield to retain Personal Data in identifiable form only for as long as it serves a purpose of processing. Specifically, Personal Data will be retained in accordance with our business purposes and our obligations to comply with legal requirements and professional standards, unless a longer retention period is otherwise permitted by law and its retention adheres to the Privacy Shield Principles.

Questions or Complaints

In compliance with the EU-US Privacy Shield Principles and Swiss-US Privacy Shield Principles, Exiger commits to resolve complaints about your privacy and our collection or use of your personal information. Individuals in European Union member states, the United Kingdom, or Switzerland with inquiries or complaints regarding this privacy policy should first contact Exiger at:  privacy@exiger.com.

Exiger has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/privacy-shield-complaints/ for more information and to file a complaint. This service is provided free of charge to you.

Please note that if your complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel.

Binding Arbitration

You may have the option to select binding arbitration for the resolution of your complaint under certain circumstances, provided you have taken the following steps: (1) raised your compliant directly with Exiger and provided us the opportunity to resolve the issue; (2) made use of the independent dispute resolution mechanism identified above; and (3) raised the issue through the relevant data protection authority and allowed the US Department of Commerce an opportunity to resolve the complaint at no cost to you. For more information on binding arbitration, see US Department of Commerce’s Privacy Shield Framework: Annex I (Binding Arbitration), available at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Contact Us

If you have any questions about this Policy or would like to request access to your Personal Data, please contact us as follows: data.protection@exiger.com

Changes to This Policy

We reserve the right to amend this Policy from time to time consistent with the Privacy Shield’s requirements.

Last modified:   Janurary 25th, 2022

Human Rights & Modern Slavery Statement

Exiger Limited’s Human Rights and Modern Slavery Statement

This statement is published on behalf of Exiger Limited (Company 8613726) pursuant to section 54 of the UK Modern Slavery Act (2015). Exiger Limited is a wholly-owned subsidiary of Exiger Holdings, Inc., a company headquartered in New York.

In conducting our business, Exiger is committed to protecting and maintaining all internationally recognised human rights with respect to our employees, the communities in which we operate, and the communities within which our supply chains operate globally. This statement reflects our approach to both modern slavery and human rights, and details the action Exiger Limited has taken to address the risk and steps in prevention of modern slavery in our operations and supply chain, and how we intend to improve these efforts moving forward.

Who We Are and What We Do

Exiger is a global regulatory and financial crime compliance and risk management company. Exiger equips financial institutions, multinational corporations, and governmental agencies with the practical advice and technology solutions needed to prevent compliance breaches, respond to risk, remediate major issues, and monitor ongoing business activities. Exiger works with clients worldwide to assist them in managing their critical challenges effectively while developing and implementing the policies, procedures, and programs needed to create a sustainable compliance environment.

By the end of the 2021 financial year, Exiger employed approximately 700 people, with offices in the United States, United Kingdom, Australia, Canada, Hong Kong, Romania, and Singapore. Alongside our staff, independent contractors and data service suppliers play a key role in our client-facing teams and in providing our diligence and technology services.

Our Approach to Human Rights and Modern Slavery

Exiger is led by Executive Chairman Michael Beber and CEO and President Mike Cherkasky, who also leads the Board of Directors of Exiger Limited, our UK-based affiliate. Exiger’s Board of Directors provides both leadership and a strong tone from the top regarding ethical conduct.

Exiger was founded to conduct the largest ever court-appointed monitorship of a global financial institution. We are committed to conducting business in a responsible manner. Integrity—one of our company’s seven guiding principles—is embedded in Exiger’s culture through our Code of Conduct, which outlines the values and high ethical standards of both personal and corporate conduct expected of everyone who works for or with Exiger.

Exiger is committed to ensuring that no modern slavery or human trafficking takes place within our business. We have a zero-tolerance policy towards forced or bonded labour; we ensure all our terms of employment are voluntary and adhere to local laws with respect to minimum age requirements, wages, overtime, and working hours; and we expect the same from our suppliers, contractors, and third parties. Further, Exiger employees are encouraged to speak up and to raise any concerns of potential or actual ethical conduct breaches.

Our Assessment of the Risk to our Organisation and Supply Chains and Supplier Due Diligence

Exiger has assessed our organisation’s modern slavery risk to be relatively low given the nature of our service offerings. Exiger is a consultancy in the governance, risk, and compliance space and provides technology-enabled solutions. Exiger employs a highly skilled workforce, and according to the Global Slavery Index, operates almost exclusively in countries with a lower prevalence risk of modern slavery.

Moreover, Exiger ensures all permanent staff and independent contractors undergo a criminal background check prior to onboarding. Additionally, Exiger subjects its diligence suppliers to enhanced due diligence through Exiger’s bespoke third party management software, DDIQ and Insight 3PM. This technology uses artificial intelligence to conduct public records research and negative news screening, as well as risk rates our suppliers to enable Exiger to closely monitor higher-risk suppliers. Our highest risk suppliers are subject to daily negative news screening to ensure we can quickly identify and monitor any new risk.

Exiger’s operational procurement consists primarily of office facility services, such as security and cleaning, and of product purchases, such as laptops, office supplies, and marketing materials. To minimize the risk of modern slavery further down these supply chains, Exiger ensures responsible procurement practices, such as avoiding unreasonable expectations and excessive downward pressure on pricing.

Exiger Limited’s London office obtains facilities services from one supplier. This supplier is a signatory to the UN Global Compact, a public declaration of their commitment to business integrity. The supplier has published their own Modern Slavery Statement explaining the steps they have taken to prevent modern slavery and human trafficking from their supply chains. We will continue to review this relationship to ensure such standards are maintained.

Our Progress During the Previous Financial Year

Although Exiger has never identified a human rights breach within our organisation or our supply chains, we are not complacent. During the 2019, 2020, and 2021 financial years we have:

  • Updated our Code of Conduct to include specific commitments we have made for addressing ethical issues, including modern slavery;
  • Updated our procurement process to ensure a more robust due diligence process during new supplier onboarding. In the event that we are considering entering into a high-risk relationship with any supplier, such relationship will be vetted by our internal Client Selection and Conflict Management Committee. If accepted, the relationship will be subject to ongoing monitoring to ensure compliance with our high ethical standards;
  • Implemented an anonymous ethics and compliance reporting hotline, available 24 hours a day to all Exiger employees, in all our host country languages, to ensure that any individual wishing to submit an incident report may do so without fear of retribution; and
  • Reviewed our vendors for branded merchandise to identify and assess modern slavery.

Our Plans for the Future

We are committed to continually improving our efforts to identify, address, and prevent modern slavery. Moving forward, we commit to:

  • Providing modern slavery guidance to our operational procurement staff to further increase awareness of the risks within our supply chains. We will encourage greater consideration of ethical performance as a deciding factor in procurement selection; and
  • Mapping the supply chain of Exiger-branded merchandise; this includes reviewing our vendors, identifying product sources, and identifying and addressing potential modern slavery risks further down the chain.

Exiger Limited’s Board of Directors reviewed and approved this statement and as a declaration of its commitment to address and prevent modern slavery within our business and our supply chains,

Ron Collins signed this statement on the behalf of the Board of Directors on January 21, 2022.

Director and CFO

Human Resources & Job Applicant Privacy Policy

Exiger is a global firm with offices in Australia, Canada, Hong Kong, Romania, Singapore, the United Kingdom, and the United States. The corporate headquarters for Exiger is located in the United States, and this is the central repository for processing information about our employees, contractors, and job applicants.

This Human Resources & Job Applicant Privacy Policy (“Policy”) describes how Exiger LLC and its subsidiaries and affiliates in the United States (“US”) (“Exiger,” “Company,” “we,” or “us”) collect, use, and disclose certain personally identifiable information that we receive in the US from our affiliates, including data from the European Union (“EU”), the United Kingdom (“UK”), and Switzerland (“Human Resources Data”). This Policy applies to the following US affiliated entities: Exiger LLC, Exiger Diligence, Inc., Convergent Solutions, Inc. This Policy supplements our Privacy Notice located at http://www.exiger.com/privacy, and unless specifically defined in this Policy, the terms in this Policy have the same meaning as the Privacy Notice.  This Policy is available to Exiger employees as part of Exiger’s employee handbook and as part of job postings. 

Exiger continues to comply with the EU-US Privacy Shield and Swiss-US Privacy Shield Frameworks as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member states, the United Kingdom, and Switzerland.  Exiger has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.

In addition, for transfers to the US and/or countries viewed as inadequate, we have taken appropriate safeguards to require that your Personal Data will remain protected in accordance with this Human Resources & Job Applicant Privacy Shield Policy and as required by applicable data protection law. These include implementing an adequate method of transfer, such as the European Commission’s Standard Contractual Clauses, for transfers of Personal Data with our third-party service providers and partners, further details of which can be provided upon request.

For purposes of enforcing compliance with the Privacy Shield, Exiger is subject to the investigatory and enforcement authority of the US Federal Trade Commission. For more information about the Privacy Shield, see the US Department of Commerce’s Privacy Shield website located at: https://www.privacyshield.gov. To review Exiger’s representation on the Privacy Shield list, see the US Department of Commerce’s Privacy Shield self-certification list located at: https://www.privacyshield.gov/list.

Human Resources Data Collection and Use

We may receive the following categories of Human Resources Data in the US:  name, email, address, telephone number, date of birth, national identification number, gender, nationality. We process Human Resources Data of our employees, contractors, and job candidates for the following purposes: recruiting, onboarding background checks, making benefits available to them, and otherwise enabling them to do their jobs.

Exiger will only process Human Resources Data in ways that are compatible with the purpose that Exiger collected it for, or for purposes the individual later authorizes. Before we use your Human Resources Data for a purpose that is materially different than the purpose we collected it for or that you later authorized, we will provide you with the opportunity to opt out. Exiger maintains reasonable procedures to help ensure that Human Resources Data is reliable for its intended use, accurate, complete, and current.

If we collect sensitive Human Resources Data, we will obtain your opt-in consent where the Privacy Shield requires, including if we disclose your sensitive Human Resources Data to third parties, or before we use your sensitive Human Resources Data for a different purpose than we collected it for or than you later authorized. We do not seek to obtain and will not collect such data about a job candidate unless permitted to do so by applicable laws (e.g., US equal opportunity monitoring).

Under the data protection laws of the EU member states, the UK, and Switzerland, a “Controller” is an organization that determines the purposes for which and the manner in which Human Resources Data are to be processed. A “Processor” processes Human Resources Data on behalf of a Controller, and only in accordance with the Controller’s instructions. Exiger acts as a Processor when it advises a client with respect to matters involving Client Data that includes Human Resources Data, and as acts as a Controller when processing Human Resources Data for its employees, contractors, and/or job candidates.

Your personal data may be accessed by Exiger employees or agents (e.g., Human Resources, Employees via an internal address book, recruiters, and/or interviewers working in the country where the position for which you are working or are applying is based, as well as by Exiger Employees or agents working in different countries within the Exiger global organization. Individuals performing administrative functions and IT personnel within Exiger may also have a limited access to your personal data to perform their jobs. In some countries, you may have fewer rights under local law than you do in your country of residence, but we have put in place legal mechanisms designed to ensure adequate protection of your personal data that is processed by Exiger subsidiaries and affiliates within the Exiger global organization, including the transfer of your personal data to countries other than the one in which you reside.

Job Candidates

For job candidates, we may also collect work and educational history, achievements, and test results. We also may collect personal data about you from third parties, such as professional recruiting firms, your references, prior employers, Exiger employees with whom you have interviewed, and employment background check providers, to the extent this is permitted by applicable law. We may use your personal data for legitimate human resources and business management reasons including:

  • identifying and evaluating candidates for potential employment, as well as for future roles that may become available;
  • recordkeeping in relation to recruiting and hiring;
  • ensuring compliance with legal requirements, including diversity and inclusion requirements and practices;
  • conducting criminal history checks as permitted by applicable law;
  • protecting our legal rights to the extent authorized or permitted by law; or
  • emergency situations where the health or safety of one or more individuals may be endangered.

We may also analyze your personal data or aggregated/pseudonymized data to improve our recruitment and hiring process and augment our ability to attract successful candidates.

If you elect to join a recruiting program, we may retain your personal data to consider you for future employment opportunities and for a period of time specific to that program, unless you decide to opt-out prior to such time.

You are not required to provide any requested information to us, but failing to do so may result in not being able to continue your candidacy for the job for which you have applied.

We do not make recruiting or hiring decisions based solely on automated decision-making.

Whistleblowers Data (Ethics and Compliance Hotline Data)

We use Lighthouse Services, Inc. for an anonymous ethics and compliance hotline for all professionals of Exiger. Information provided by you may be the basis of an internal and/or external investigation into the issue you are reporting and your anonymity will be protected to the extent possible by law by Lighthouse. However, your identity may become known during the course of the investigation because of the information you have provided.  

When you submit a report through the website, phone, fax, or email, the hotline provider creates a report from the data you provide (both written, verbal, and/or metadata – like IP address or caller-ID). Any personal data that you provide is included in the report. Reports are submitted by Lighthouse to a company designee for investigation according to our company policies. Depending on the investigation, part or all of the report may be shared with business unit leaders, managers, the legal department, outside counsel, or other investigators for investigation needs, based on a need to know basis as outlined in our investigations policy.

While providing personal information to us may start with your consent, we may be under a legal obligation to investigate and further process the personal information you gave us on the legal basis of a legal obligation. You can contact us at data.protection@exiger.com regarding this information and revoking your consent. We will respond to your request and inform you of that we will stop processing the personal information in the report, or provide you reasons that we cannot.

The reporting system has a function in which they enable anonymous communication without waiving anonymity. Further communications and personal data sent to us through the anonymous communication will be added to the report and considered processed under the same consent. If you waive anonymity, you probably cannot undo the waiver. Your identity will be made part of the report. As we have a legal obligation to retain reports according to our data retention policy, revoking your consent would likely not be sufficient to undo the waiver and remove your identity from the report. However, you may make the request to revoke your consent to data.protection@exiger.com and we will consider the request.

Data Transfers to Third Parties

Third-Party Agents or Service Providers. We may transfer Human Resources Data to our third-party agents or service providers who perform functions on our behalf, including payroll processors, insurance brokers and providers of other employee benefits, as well as contractors who provide due diligence services for onboarding.

We enter into written agreements with those third-party agents and service providers requiring them to provide the same level of protection the law requires and limiting their use of the data to the specified services provided on our behalf. We take reasonable and appropriate steps to ensure that third-party agents and service providers process Human Resources Data in accordance with our legal obligations and to stop and remediate any unauthorized processing. In cases of onward transfer to third parties of data of individuals in the EU, UK, or Switzerland received pursuant to the European Commission’s Standard Contractual Clauses, Exiger is potentially liable.

We use third party service providers to provide a recruiting software system. We also may share job applicant’s personal data with other third-party service providers that may assist us in recruiting talent, administering and evaluating pre-employment screening and testing, and improving our recruiting practices.

Some of our online recruiting activities are hosted by third parties. When you access sites operated by these third parties, they may, consistent with our Privacy Policy, place Cookies or Other Tracking Technologies on your device. You can learn more about our use of Cookies and other tracking technologies reading our Privacy Policy.

In addition, we may disclose or transfer your personal data in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.

Transfers to Exiger Affiliates.  If we transfer your Human Resources Data to one of our affiliated entities within our corporate group, we will take steps to ensure that your Human Resources Data is protected with the same level of protection the law requires.

Disclosures for National Security or Law Enforcement. Under certain circumstances, we may be required to disclose your Human Resources Data in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Security

Exiger maintains reasonable and appropriate security measures to protect Human Resources Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the law.

Access Rights

You have the right to obtain our confirmation of whether we maintain personal information relating to you. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct his query to privacy@exiger.com. If requested to remove data, we will respond within a reasonable timeframe.

Your right to access your Personal Data may be restricted in exceptional circumstances, including, but not limited to, when the burden or expense of providing this access would be disproportionate to the risks to your privacy in the case in question, or when the rights of persons other than you would be violated by the provision of such access. If we determine that your access should be restricted in a particular instance, we will provide you with an explanation of our determination and respond to any inquiries you may have.

Data Retention

We retain Human Resources Data according to Exiger’s internal data retention policy. For most of your data, that will be 7 years after your employment has ended (exceptions include, but are not limited to, pension documents, etc.). If you would like the specifics of the retention policy, please contact us at privacy@exiger.com.

If you accept an offer of employment by us, any relevant personal data collected during your pre-employment period will become part of your personnel records and will be retained in accordance with specific country requirements. If we do not employ you, we may nevertheless continue to retain and use your personal data for a period of time (which may vary depending on the country) for system administration purposes, to consider you for potential future roles, and to perform research. Thereafter, we retain a minimum amount of your personal data to record your recruiting activity with us.

Questions or Complaints

 In compliance with the EU-US Privacy Shield Principles and the Swiss-US Privacy Shield Principles, Exiger commits to resolve complaints about our collection or use of your personal information. Individuals in European Union member states, the United Kingdom, or Switzerland with inquiries or complaints regarding this privacy policy should first contact Exiger at:  privacy@exiger.com.

Exiger has further committed to refer unresolved privacy complaints under the EU-US Privacy Shield Principles and Swiss-US Privacy Shield Principles to BBB EU Privacy Shield, a non-profit alternative dispute resolution provider located in the United States and operated by BBB National Programs, Inc. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers/ for more information and to file a complaint.

Any employee who is not satisfied with the internal resolution of the complaint may seek redress with the national data protection or labor authority in the country where the employee resides. In the event that the employee chooses to file a complaint with a national data protection authority, Exiger will cooperate in investigations by, and comply with the advice of, competent EU member state authorities. Further, Exiger has committed to cooperate with (i) the Panel established by the EU data protection authorities (DPAs), (ii) the UK Information Commissioner’s Office (“ICO”), and (iii) the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) with regard to unresolved Privacy Shield complaints.

Binding Arbitration

You may have the option to select binding arbitration for the resolution of your complaint under certain circumstances, provided you have taken the following steps: (1) raised your compliant directly with Exiger and provided us the opportunity to resolve the issue; (2) made use of the independent dispute resolution mechanism identified above; and (3) raised the issue through the relevant data protection authority and allowed the US Department of Commerce an opportunity to resolve the complaint at no cost to you. For more information on binding arbitration, see US Department of Commerce’s Privacy Shield Framework: Annex I (Binding Arbitration), available at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Contact Us

If you have any questions about this Policy or would like to request access to your Human Resources Data, please contact us as follows: data.protection@exiger.com

Changes to This Policy

We reserve the right to amend this Policy from time to time consistent with the Privacy Shield’s requirements.

Last modified:   March 17, 2021

Personal Data Processing Agreement

DESCRIPTION OF THE TRANSFER

Data subjects

The personal data transferred concern the following categories of data subjects: The data subjects are the data targets of the data exporter. The data subjects may be existing or prospective clients and/or vendors of the data exporter, and individuals who are employees, principals, agents, or representatives of, or otherwise affiliated or associated with, individual or institutional clients and/or vendors, or prospective clients and/or vendors, of the data exporter.

Categories of data

The personal data transferred concern the following categories of data: Name, address, date of birth, company employment, professional experience and affiliations, wealth data, Social Security Number, Tax ID number, passport number, or other government-issued identification number or code, and such other data that may be transferred from the data exporter to the data importer for the purposes of performing the services pursuant to the Service Agreement.

Special categories of data

The personal data transferred concern the following special categories of data: Where permitted by law, data importer will process legally reportable criminal convictions and other legally reportable criminal offences; and to the extent revealed in publicly available social media and other processing operations, the sexual orientation, racial or ethnic origin, philosophical beliefs, religious beliefs, political opinions, trade union membership, and sex life of the data subject.

Processing operations (Nature and Purpose)

The personal data transferred will be subject to the following basic processing activities:

  • The nature of the data processing activities includes processing activities (e.g., the collection, access, viewing, organizing, disclosing and storing of personal data) as is reasonably required to facilitate and/or support the provision of services as described under the Service Agreement.
  • The purpose of the data processing activities is to provide to data exporter(s) due diligence and/or vetting reports for regulatory purposes and any other services identified in the Service Agreement. 

Appendix to Personal Data Processing Agreement

Standard Contractual Clauses for the transfer of personal data from the European Economic Area to third countries

Controller to Processor Transfers

SECTION I

Clause 1
Purpose and scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country. 

(b) The Parties:

(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and

(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”) have agreed to these standard contractual clauses (hereinafter: “Clauses”).

(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2
Effect and invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3
Third-party beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);

(iii) Clause 9(a), (c), (d) and (e);

(iv) Clause 12(a), (d) and (f);

(v) Clause 13;

(vi) Clause 15.1(c), (d) and (e);

(vii) Clause 16(e);

(viii) Clause 18(a) and (b).

(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4
Interpretation

(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5
Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6
Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7
Docking clause

(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8
Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1       Instructions

(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract. 

(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2       Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3       Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4       Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5       Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6       Security of processing

(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter “personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject  shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and personal data records concerned), its likely consequences, and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer. 

8.7       Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8       Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

(a) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(b) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;

(c) the onward transfer is necessary for the establishment, exercise or defense of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(d) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9       Documentation and compliance

(a)The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.

(b)The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.

(c)The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non- compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.

(d)The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

Clause 9
Use of sub-processors

9.1  

GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

9.2

Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects.[1] The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

9.3

The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

9.4

The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.

9.5

The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

Clause 10
Data subject rights

(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.

(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate  technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.

Clause 11
Redress

(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii) refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12
Liability

(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.

(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.

(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.

(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13
Supervision

(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

[] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

[] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behavior is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14
Local laws and practices affecting compliance with the Clauses

The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(a) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(b) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards; 

(c) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15
Obligations of the data importer in case of access by public authorities

15.1      Notification

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the  country of destination; such notification shall include all information available to the importer.

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2      Review of legality and data minimisation

(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16
Non-compliance with the Clauses and termination

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17
Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Member State specified in the Master Services and Software as a Service Agreement (and, if not otherwise specified, Romania).

Clause 18
Choice of forum and jurisdiction

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b) The Parties agree that those shall be the courts of the Member State specified in the Master Services and Software as a Service Agreement (and, if not otherwise specified, Romania).

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d) The Parties agree to submit themselves to the jurisdiction of such courts.


ANNEXES

ANNEX I

A. LIST OF PARTIES

B. DESCRIPTION OF TRANSFER

C.COMPETENT SUPERVISORY AUTHORITY

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

ANNEX III

SWITZERLAND

ANNEX I

A.   LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

  1. Name: Customer, as identified in the service agreement (“Service Agreement”) to which this Appendix B, and its associated Personal Data Processing Agreement, is appended, on behalf of itself and its affiliated companies to the extent located in the European Union.
    Address: As specified in the Service Agreement
    Contact person’s name, position and contact details: As specified in the Service Agreement
    Activities relevant to the data transferred under these Clauses: Customer, has appointed the data importer to provide due diligence and related services. To facilitate the provision of these services, the data exporters may provide to the data importer access to the personal data described in Annex I.B, below.
    Signature and date: This Appendix B is signed by, and on the date of, the Customer’s signature to the Service Agreement to which this Appendix B, and its associated Personal Data Processing Agreement, is appended.
    Role (controller/processor): Controller [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]
  1. Name: Exiger entity, as specified in the Service Agreement
    Address: c/o Exiger LLC, 1675 Broadway, 15th Floor, New York, New York 10019
    Contact person’s name, position and contact details:Clewin McPherson, Data Protection Officer, cmcpherson@exiger.com
    Activities relevant to the data transferred under these Clauses: The data importer(s) is a member of the Exiger corporate group and provides due diligence and related services.  The data importer will process personal data received from the data exporter in order to provide the specific services as described in the Service Agreement. 
    Signature and date: This Appendix B is signed by, and on the date of, Exiger’s signature to the Service Agreement to which this Appendix B, and its associated Personal Data Processing Agreement, is appended.
    Role (controller/processor): Processor

B.   DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

See Appendix A to the Personal Data Processing Agreemen

Categories of personal data transferred

See Appendix A to the Personal Data Processing Agreement

Sensitive data transferred (special categories of personal data)

See Appendix A to the Personal Data Processing Agreement

Applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

With the processing of news articles, data regarding the criminal prosecution of data subjects may be processed and evaluated in the risk assessment.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Personal data is transferred on a continuous basis from data exporter to data importer for as long as data importer provides services to the data exporter pursuant to the Service Agreement.

Nature of the processing

See Appendix A to the Personal Data Processing Agreement

Purpose(s) of the data transfer and further processing

See Appendix A to the Personal Data Processing Agreement

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

The personal data will be retained for the duration of data importer(s)’ performance of services pursuant to the Service Agreement and for as long thereafter as permitted by the Service Agreement unless data importer(s) is/are required by law to delete the personal data sooner.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

[If applicable] Data importer intends to use the following sub-processor(s) to assist in the performance of its services:

Name of sub-processor:

  • Subject Matter:
  • Nature of the processing:
  • Duration of the processing:

C.   DESCRIPTION OF TRANSFER

Identify the competent supervisory authority/ies in accordance with Clause 13

The applicable Supervisory Authority(ies) is the Supervisory Authority in the country or region where the data exporter(s) is located:

Austria
Österreichische Datenschutzbehörde
Barichgasse 40-421030 Wien
Tel.:+43 1 52 152-0
Email: dsb@dsb.gv.at
Website: http://www.dsb.gv.at  

Belgium
Autorité de la protection des données – Gegevensbeschermingsautoriteit (APD-GBA)
Rue de la Presse 35 – Drukpersstraat 351000 Bruxelles – Brussel
Tel.: +32 2 274 48 00
Fax: +32 2 274 48 35
Email: contact@apd-gba.be
Website: https://www.autoriteprotectiondonnees.be https://www.gegevensbeschermingsautoriteit.be

The competence for complaints is split among different data protection supervisory authorities in Belgium. Competent authorities can be identified according to the list provided here:
https://www.autoriteprotectiondonnees.be/citoyen/l-autorite/autres-autorites
https://www.gegevensbeschermingsautoriteit.be/burger/de-autoriteit/andere-autoriteiten

Bulgaria
Commission for Personal Data Protection
2, Prof. Tsvetan Lazarov blvd.1592 Sofia
Tel.: +359 2 915 3580+359 2 915 3548
Fax: +359 2 915 3525
Email: kzld@cpdp.bg
Website: https://www.cpdp.bg  

Croatia
Croatian Personal Data Protection Agency
Selska Cesta 13610000 Zagreb
Tel.:+385 1 4609 000
Fax: +385 1 4609 099
Email: azop@azop.hr
Website: http://www.azop.hr  

Cyprus
Commissioner for Personal Data Protection
1 Iasonos Street, P.O. Box 233781082 Nicosia
Tel.: +357 22 818 456
Fax: +357 22 304 565
Email: commissioner@dataprotection.gov.cy
Website: http://www.dataprotection.gov.cy

Czech Republic
Office for Personal Data Protection
Fax: +420 234 665 444
Email: posta@uoou.cz
Website: http://www.uoou.cz  

Denmark
Datatilsynet
Carl Jacobsens Vej 352500 Valby
Tel.: +45 33 1932 00
Email: dt@datatilsynet.dk
Website: http://www.datatilsynet.dk  

Estonia
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 3910134 Tallinn
Tel.: +372 6828 712
Email: info@aki.ee
Website: http://www.aki.ee  

Finland
Office of the Data Protection Ombudsman
P.O. Box 800FI-00531 Helsinki
Tel.: +358 29 56 66700
Fax: +358 29 56 66735
Email: tietosuoja@om.fi
Website: http://www.tietosuoja.fi/en

France
Commission Nationale de l’Informatique et des Libertés – CNIL
3 Place de Fontenoy
TSA 80715 – 75334 Paris, Cedex 07
Tel.: +33 1 53 73 22 22
Fax: +33 1 53 73 22 00
Contact: https://www.cnil.fr/en/contact-cnil
Website: http://www.cnil.fr/  

Germany
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Straße 15353117 Bonn
Tel.: +49 228 997799 0
Fax: +49 228 997799 5550
Email: poststelle@bfdi.bund.de
Website: http://www.bfdi.bund.de
 
The competence for complaints is split among different data protection supervisory authorities in Germany. Competent authorities can be identified according to the list provided under www.bfdi.bund.de/anschriften.
 
Greece
Hellenic Data Protection Authority
Kifisias Av. 1-311523 Ampelokipi Athens
Tel.: +30 210 6475 600
Fax: +30 210 6475 628
Email: contact@dpa.gr
Website: http://www.dpa.gr

Hungary
Hungarian National Authority for Data Protection and Freedom of Information
Falk Miksa utca 9-11H-1055 Budapest
Tel.: +36 1 3911 400
Email: privacy@naih.hu
Website: http://www.naih.hu

Iceland
Persónuvernd
Rauðarárstígur 10105 Reykjavík
Tel.: +354 510 9600
Email: postur@dpa.is
Website: https://www.personuvernd.ishttps://www.dpa.is

Ireland
Data Protection Commission
21 Fitzwilliam SquareD02 RD28 Dublin 2
Tel.: +353 76 110 4800
Email: info@dataprotection.ie
Website: http://www.dataprotection.ie

Italy
Garante per la protezione dei dati personali
Piazza Venezia, 1100187 Roma
Tel.: +39 06 69677 1
Fax: +39 06 69677 785
Email: segreteria.stanzione@gpdp.it
Website: http://www.garanteprivacy.it
Latvia
Data State Inspectorate
Elijas Street 17LV-1050 Riga
Tel.: +371 6722 3131
Fax: +371 6722 3556
Email: info@dvi.gov.lv
Website: http://www.dvi.gov.lv

Liechtenstein
Data Protection Authority, Principality of Liechtenstein
Städtle 389490 Vaduz
Tel.: +423 236 6090
Email: info.dss@llv.li
Website: https://www.datenschutzstelle.li

Lithuania
State Data Protection Inspectorate
L. Sapiegos str. 17LT-10312 Vilnius
Tel.+370 5 271 2804+370 5 279 1445
Fax+370 5 261 9494
Email: ada@ada.lt
Website: https://vdai.lrv.lt

Luxembourg
Commission Nationale pour la Protection des Données
15, Boulevard du JazzL-4370 Belvaux
Tel.+352 2610 60 1
Fax+352 2610 60 6099
Email: info@cnpd.lu
Website: http://www.cnpd.lu

Malta
Office of the Information and Data Protection Commissioner
Second Floor, Airways HouseHigh StreetSLM 1549 Sliema
Tel.: +356 2328 7100
Fax: +356 2328 7198
Email: idpc.info@idpc.org.mt
Website: http://www.idpc.org.mt

Netherlands
Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30P.O. Box 933742509 AJ Den Haag/The Hague
Tel.: +31 70 888 8500
Fax: +31 70 888 8501
Website: https://autoriteitpersoonsgegevens.nl

Norway
Datatilsynet
Tollbugata 30152 Oslo
Tel.: +47 22 39 69 00
Email: postkasse@datatilsynet.no
Website: https://www.datatilsynet.no

Poland
Urząd Ochrony Danych Osobowych (Personal Data Protection Office)
ul. Stawki 200-193 Warsaw
Tel.: +48 22 531 03 00
Email: kancelaria@uodo.gov.pl;
dwme@uodo.gov.pl
Website: https://uodo.gov.pl

Portugal
Comissão Nacional de Proteção de Dados – CNPD
Av. D. Carlos I, 134, 1º1200-651 Lisboa
Tel.: +351 21 392 84 00
Fax: +351 21 397 68 32
Email: geral@cnpd.pt
Website: http://www.cnpd.pt

Romania
The National Supervisory Authority for Personal Data Processing
B-dul Magheru 28-30Sector 1 BUCUREŞTI
Tel.: +40 31 805 9211
Fax:+40 31 805 9602
Email: anspdcp@dataprotection.ro
Website: http://www.dataprotection.ro

Slovakia
Office for Personal Data Protection of the Slovak Republic
Hraničná 12820 07 Bratislava 27
Tel.+ 421 2 32 31 32 14
Fax+ 421 2 32 31 32 34
Email: statny.dozor@pdp.gov.sk
Website: http://www.dataprotection.gov.sk 
 
Slovenia
Information Commissioner of the Republic of Slovenia
Dunajska 221000 Ljubljana
Tel.: +386 1 230 9730
Fax: +386 1 230 9778
Email: gp.ip@ip-rs.si
Website: https://www.ip-rs.si

Spain
Agencia Española de Protección de Datos (AEPD)
C/Jorge Juan, 628001 Madrid
Tel.: +34 91 266 3517
Fax: +34 91 455 5699
Email: internacional@aepd.es
Website: https://www.aepd.es

Sweden
Integritetsskyddsmyndigheten
Drottninggatan 295th FloorBox 8114104 20 Stockholm
Tel.: +46 8 657 6100
Fax: +46 8 652 8652
Email: imy@imy.se
Website: http://www.imy.se
 
Switzerland
Office of the Federal Data Protection and Information Commissioner FDPIC
Feldeggweg 1
CH – 3003 Berne
Tel.: +41 (0)58 462 43 95 (mon.-fri., 10-12 am)2 am)
Fax: +41 (0)58 465 99 96
Email: info@edoeb.admin.ch
Website: https://www.edoeb.admin.ch/edoeb/en/home.html

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES
INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO
ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

I.          ORGANIZATIONAL MEASURES

A.             Information Security Governance

Data importer has established a personnel structure for information security governance, including but not limited to, a designated employee with overall responsibility for information security government (e.g., a chief information security officer) and other personnel with assigned roles and responsibilities for information security.Roles and responsibilities have been formally defined for all members of the information security team and have been documented.

B.             Administrative Access Controls
  1. Access Authorization and Workforce Clearance:  An employee or contractor will be authorized to access personal data (“Authorized Users”) only if the individual is deemed trustworthy based upon prior service to the data importer or the successful completion of a background check where permitted by applicable law.  Data importer permits Authorized Users to access personal data only on a need-to-know basis and only as necessary to perform assigned job responsibilities.
  2. Confidentiality Agreement:  Before establishing access for an Authorized User, data importer requires that the Authorized User execute a confidentiality agreement that applies to the personal data or otherwise acknowledges an obligation of confidentiality.
  3. Access Establishment:  Data importer separates functions between those authorized to assign access rights and those authorized to establish access to data importer’s information systems.
  4. Review Of Access Rights:  On at least a quarterly basis and when an Authorized User changes positions, data importer reviews and, if necessary, revises or terminated the Authorized User’s rights of access to workstations, programs and processes to limit the Authorized User’s access to personal data to the minimum necessary to perform assigned job functions.  Data importer will delete any personal data stored on the Authorized User’s computer that no longer is needed by the Authorized User in his or her new position.
  5. Denial Of Access To Terminated Authorized Users:  Upon termination of any Authorized User’s relationship with data importer, data importer promptly does the following:  (a) terminate the Authorized User’s rights to access personal data and obtain the return of any devices (such as tokens or key cards) used to obtain access to personal data; (b) obtain the return of all keys, key cards, and other devices that permit access to physical locations containing personal data in paper form; (c) ensure that the terminated Authorized User does not have unescorted access to areas containing personal data in paper form; (d) ensure that all personal data is removed from any computer equipment used by the terminated Authorized User before re-issuing that equipment to another Authorized User.
C.             Training

Data importer provides (a) initial training to relevant personnel on how to implement and comply with its information security program, including identifying and reporting a personal data breach, and (b) periodic refresher training and security awareness reminders.Data importer permits newly hired Authorized Users to access personal data only after completion of the initial data security training.

D.             Security Incident Response

Data importer has created a security incident response team (SIRT) with assigned roles and responsibilities.Data importer has implemented procedures for identifying security incidents, including personal data breaches, and a plan for responding to security incidents.  Data importer periodically tests the security incident response plan.  Data importer has established a mechanism for employees to report security incidents, including suspected and actual personal data breaches.  Data importer requires all employees to immediately report the loss, theft, or otherwise of any equipment on which personal data is stored.

II.        TECHNICAL MEASURES

A.             Evaluation And Monitoring
  1. Risk Assessment: Data importer has conducted an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of personal data.  Data importer has implemented policies and procedures to reduce risks and vulnerabilities to personal data to a reasonable and appropriate level. These policies and procedures are designed to protect the confidentiality, integrity and availability of personal data and to prevent accidental or unauthorized use, disclosure, alteration, loss or destruction. 
  2. Evaluation Of Security Policies And Procedures:  Data importer periodically reviews and, if necessary, updates the policies and procedures described above, as necessary in response to environmental or operational changes affecting the security of personal data.
B.             System Activity Review
  1. Establishment Of Monitoring Procedures:  Data importer has (a) enabled logging on computer systems that store personal data; (b) implemented a process for the review of exception reports and/or logs, and (c) developed and documented procedures for the retention of monitoring data. 
  2. Monitoring Of System Activity:  Data importer periodically reviews information system activity records — including audit logs, access reports, privileged operations, error logs on servers, and security incident tracking reports, and changes to systems security — to ensure that implemented security controls are effective and that personal data has not been potentially compromised.  Monitoring includes (a) reviewing changes affecting systems handling authentication, authorization, and auditing; (b) reviewing privileged access to production systems processing personal data; and (c) engaging third parties to perform network vulnerability assessments and penetration testing on a regular basis.
  3. Compliance Review And Third-Party Audits:  Data importer periodically reviews compliance with security policies and procedures.  Data importer engages a third party, at least annually, to perform an independent audit which  includes an assessment of data importer’s information security program.  Data importer will make the third-party audit report available to data exporter upon request.
C.             Protections Against Malicious Actors
  1. Network Security: Data importer maintains an up-to-date firewall and intrusion detection software.  Data importer engages in security patch management to ensure that security patches are installed as soon as is reasonably practicable.
  2. Anti-Malware Protection:  Data importer ensures that protections against malicious software (e.g., anti-virus protection, spyware detection software, etc.) are installed before computers and other devices are connected to any of data importer’s networked systems.  The software is kept current.
D.             Technical Access Controls
  1. Unique User ID/Secure Passwords:  All Authorized Users will be assigned a unique user ID and will be required to create a strong/complex password, or to use a biometric identifier, to access data importer’s network.  Systems requiring entry of a password suppress, mask or otherwise obscure the password so that it cannot be viewed by an unauthorized person.  All passwords are encrypted while in storage.  Authorized Users are required to change passwords on a regular basis.  Authorized Users are prohibited form sharing passwords with any other person.
  2. Access Restrictions:  Data importer has implemented technical controls so that each Authorized User will be able to gain access only to those categories of personal data to which access is necessary to perform assigned job responsibilities.
  3. Encryption:  Data importer encrypts personal data in transit, using Transport Layer Security (TLS) encryption.  Data importer encrypts personal data at rest using 256-bit AES encryption or stronger.  Mobile devices and portable electronic storage media used to store personal data must be encrypted.
  4. Remote Access:  Data importer permits remote access to its networks only via a Virtual Private Network (“VPM”) or a similar secure means
  5. Secure Disposal:  Data importer has established procedures for the secure and permanent destruction of personal data stored in paper and electronic form.
E.              Contingency Planning
  1. Back-Ups:  Data importer backs up personal data on a regular schedule (e.g., at least every 24 hours). Back-ups are encrypted and stored in a location physically apart from the primary storage.  Back-ups permit prompt restoration of personal data in the event of a disaster.
  2. Business Continuity/Disaster Recovery:  Data importer has developed and maintains a business continuity/disaster recovery plan to ensure that data importer can promptly resume service and restore data exporter’s access to personal data in the event of a physical or technical incident occurrence (for example, fire, ransomware attack, vandalism, system failure, pandemic flu, and natural disaster).
F.              Change and Configuration Management

Data importer maintains policies and procedures for managing changes to production systems, applications, and databases processing personal data and for documenting the changes.

III.       PHYSICAL SAFEGUARDS

  1. Data importer’s facilities where personal data are physically secured against unauthorized access by, for example, keys, access cards, receptionists, and/or security guards.  Data importer requires that all employees where a security badge at all time while on data importer’s premises.  Guests and service providers must register at the reception area and are prohibited from unescorted access to data importer’s facility.
  2. All servers and network equipment containing personal data are maintained in a location subject to controlled physical access.  Only authorized employees may have unescorted access to secure areas where servers and network equipment are located.  Video surveillance cameras monitor secured areas where servers and other network equipment are located.
  3. Only authorized employees may have unescorted access to areas with computers and other electronic resources that permit access to personal data.  Access is restricted by a proximity card or key, receptionist, or some similar method.  Physical access rights must be promptly terminated when an employee no longer needs physical access to areas containing electronic resources that permit access to personal data 
  4. Data exporter requires authorized employees to ensure that all electronic resources permitting access to personal data, including peripherals (computers, monitors, laptop computers, printers, digital cameras, projectors, etc.) that are assigned to, or regularly used by, them are maintained and used in a manner consistent with their function and such that the possibility of damage and/or loss is minimized.
  5. Except for equipment designed to be portable, such as laptops, computer equipment used to access personal data should not be removed from data importer’s premises without prior authorization.

IV.       PERSONAL DATA MANAGEMENT

A.             Data Minimization 

Data importer has subjected its systems and applications used to process personal data to a review for compliance with privacy-by-design and privacy-default principles and has applied the results of that review to the design of its systems and applications that process personal data.Data importer’s systems and applications have been designed to collect, use, disclose, and otherwise process the minimum personal data necessary to provide the services that are the subject of the Parties’ underlying agreement.  Data importer’s systems and applications have been programmed to automatically delete personal data in accordance with data exporter’s data retention schedules or data retention instructions unless data importer is required by law to retain personal data for a longer period of time

B.             Accountability

Data importer maintains a record of processing activities (“ROPA”) that complies with GDPR, art. 30, with respect to its processing of personal data received form, or created or received on behalf of, data exporter.Data importer makes each relevant ROPA available to data exporter upon request.

C.             Data Subject Rights

  1. Correction/Update Of Personal Data:  Data importer provides self-help options through its website to allow data subjects to correct and update their personal data and/or provides multiple methods (e.g., chat bot, webform, e-mail address) by which data subjects may submit requests for the correction and updating of their personal data.
  2. Erasure:  Data importer has established internal procedures and technical mechanisms to ensure that personal data can be permanently deleted from production systems and back-ups in response to a request from a data subject, if and to the extent required by GDPR, art. 17.
  3. Data Portability:  Data importer has implemented procedures and systems that allow data importer to identify Personal  Data  provided by the data subject and to transfer that personal data, in a usable form, to a third party at the data subject’s direction or to the data subject directly or by way of a storage medium. 

ANNEX III
SWITZERLAND

Standard Contractual Clauses For The Transfer Of Personal Data From Switzerland To Third Countries

Controller to Processor Transfers

In its communication of August 27, 2021, the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) recognised the new SCCs issued by the European Commission in accordance with Regulation (EU) 2016/679 as a legal basis for personal data transfers to a country without an adequate level of data protection, provided that the necessary adaptations and amendments are made for use under Swiss data protection law. 

Therefore, these Standard Contractual Clauses For The Transfer Of Personal Data From Switzerland To Third Countries incorporate by reference the Standard Contractual Clauses in this Appendix B and its Annexes I through III for personal data processed by Exiger on behalf of Customers located in Switzerland, except that, when transferring Swiss personal data to a third country:

(a)        all references to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) must be understood and interpreted as references to the Swiss Data Protection Act in the context of data transfers abroad that are subject to the Data Protection Act;

(b)       any reference to a supervisory authority shall refer to the Swiss Federal Data Protection and Information Commissioner; and

(c)        with regards to Clauses 17 and 18, these clauses shall be governed by the law of Switzerland and the Customer and Exiger agree to the jurisdictions of the courts of Switzerland with regard to any disputes that arise from these Clauses.