SupplyScope – GDPR Data Processing Addendum

3. Processor Obligations

3.1 For the purposes of this DPA, the Customer’s documented instructions to SupplyScope
are limited to those set out in the Agreement, this DPA, the applicable Order Form, and
any other written instructions expressly agreed in writing by SupplyScope. SupplyScope

shall without undue delay after becoming aware inform the Customer if, in its opinion,
an instruction infringes the GDPR or other applicable Data Protection Laws.

3.2 SupplyScope will:

  3.2.1 process Customer Personal Data only on documented instructions;

  3.2.2 ensure that persons authorised to process Customer Personal Data have
committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality; 

  3.2.3 implement appropriate technical and organisational measures in accordance
with Article 32 GDPR to ensure a level of security appropriate to the risk,
including measures to protect against unauthorised or unlawful processing and
against accidental loss, destruction or damage;

  3.2.4 taking into account the nature of processing and the information available to
SupplyScope, assist with Data Subject requests and the Customer’s compliance
with its obligations under Articles 12 to 23 GDPR, to the extent reasonably
required, technically feasible and proportionate, taking into account the nature
of the Processing and the information available to SupplyScope.

  3.2.5 taking into account the nature of processing and the information available to
SupplyScope, assist the Customer in ensuring compliance with the obligations
pursuant to Articles 32 to 36 GDPR (security of processing, breach notification,
data protection impact assessment, and prior consultation);

  3.2.6 SupplyScope may charge reasonable fees for any assistance under clauses 3.2.4 and 3.2.5 that requires material effort beyond the provision of the Services, provided that such fees are communicated to the Customer in advance;

  3.2.7 notify the Customer without undue delay of a Personal Data Breach affecting
Customer Personal Data;

  3.2.8 at the choice of the Customer, delete or return all Customer Personal Data to the Customer after the end of the provision of services relating to processing, and
delete existing copies unless EU or Member State law requires storage of the
Personal Data;

  3.2.9 make available to the Customer all information necessary to demonstrate
compliance with the obligations laid down in Article 28 GDPR and allow for and
contribute to audits, including inspections, conducted by the Customer or
another auditor mandated by the Customer, subject to the audit rights and
limitations set out in clause 6 of this DPA.

3.3 The details of the Processing carried out under this DPA are set out in Annex 1, and the applicable technical and organisational security measures are described in Annex 2, each of which forms part of this DPA.