11. Processing of Personal Data
11.1. In this cooperation model, Personal Data is processed where, depending on the situation, either the Client or LawCloud is the Data Controller and the other Party is given permission to process Personal Data.
The Client is the Data Controller for the Data that the Client entrusts to LawCloud as a Processor. Possible subcontractors of LawCloud under this Agreement may be considered Sub-processors of LawCloud.
The rights and obligations described below specifically apply to the situation in which the Client acts as the Data Controller.
11.2. The Client, in its capacity as Data Controller, hereby appoints LawCloud as Processor to process the Personal Data necessary for the operation of the Platform (the "Data") during the Term in accordance with the provisions of this Article 11. It is expressly agreed that each Party will comply with the obligations applicable to it under the Applicable Legislation regarding the Processing of Personal Data.
11.3. LawCloud will only process the Data as a Processor to the extent necessary to fulfill its obligations under this Agreement and solely in accordance with the written instructions of the Client (the "Permitted Purposes"), unless otherwise required by Union law or a Member State law applicable to LawCloud. In such cases, LawCloud will inform the Client prior to Processing, unless that legislation prohibits such notification for reasons of public interest. In no case will LawCloud process the Data for its own purposes or for those of any third party. LawCloud will promptly inform the Client if, in its opinion, an instruction from the Client constitutes a breach of the Applicable Legislation on Personal Data Processing or other Union or Member State provisions on data protection.
11.4. LawCloud will not transfer the Data outside the European Economic Area ("EEA") unless LawCloud (i) first obtains the prior written consent of the Client; and (ii) takes all necessary measures to ensure that the transfer complies with the Applicable Legislation on Personal Data Processing. Such measures may include (without limitation): the transfer of Data to a recipient in a country that the European Commission has decided provides adequate protection for Personal Data, to a recipient who has obtained authorized binding corporate rules in accordance with the Applicable Legislation on Personal Data Processing, or to a recipient who has signed standard contractual clauses established or approved by the European Commission.
11.5. LawCloud will ensure that any person it authorizes to process the Data (including its employees, agents, partners, and subcontractors) (an "Authorized Person") is subject to a strict confidentiality obligation (either a contractual or a legal obligation), and will not allow persons who are not subject to such a confidentiality obligation to process the Data. LawCloud will ensure that all Authorized Persons process the Data only to the extent necessary for the Permitted Purposes and in accordance with the provisions of this Article 11.
11.6. LawCloud guarantees that it will take appropriate technical and organizational measures to protect the Data from destruction, loss, alteration, or unauthorized disclosure of or unauthorized access to transmitted, stored, or otherwise processed Data, whether accidentally or unlawfully (a "Security Incident"). Such measures will take into account the state of the art, implementation costs, as well as the nature, scope, context, and processing purposes, and the varying likelihood and severity of risks to the rights and freedoms of data subjects. Furthermore, these measures will ensure a level of security that is appropriate to the risk.
11.7. By signing this Agreement, the Client authorizes LawCloud to contract with Sub-processors for further processing of Personal Data under this Agreement.
LawCloud will enter into a separate agreement with each Sub-processor that essentially imposes the same obligations regarding data protection as those imposed on the processor under these provisions. LawCloud will only appoint Sub-processors who provide sufficient guarantees regarding compliance with the Applicable Legislation on Personal Data Processing.
The Client hereby expressly authorizes LawCloud to appoint its current hosting providers, as listed in the External Security Policy of LawCloud (available at https://law.cloud/en/external-security-policy), as Sub-processors for processing Data in the context of the services to keep the Platform operational. LawCloud will notify the Client in advance about any intended changes regarding the addition or replacement of other Sub-processors. The Client may object to such intended changes by notifying LawCloud in writing within 5 (five) calendar days of LawCloud's notification. In any case, the Client agrees not to object unreasonably to such appointments. If the Parties cannot resolve the objection, the Client will have the right to terminate this Agreement without compensation. In any event, LawCloud will remain fully liable for any breach of this Article 11 caused by the acts, errors, or negligence of its Sub-processors.
11.8. LawCloud will provide the Client, considering the nature of the Processing and the information available to it, with all the information necessary to assist the Client in fulfilling its obligations regarding the security of the Data.
11.9. LawCloud will provide all reasonable and timely assistance (including through appropriate technical and organizational measures) to the Client, at the Client's expense, to enable the Client to respond to (i) any request from a data subject to exercise any of its rights under the Applicable Legislation on Personal Data Processing (including its right of access, right to rectification, right to object, right to restrict processing, right to erasure, and right to data portability, as applicable); and (ii) any other correspondence, question, or complaint received from a data subject, supervisory authority, or any third party related to the processing of the Data. If such a request, question, or complaint is directly forwarded to LawCloud, LawCloud will promptly inform the Client and provide all details regarding the matter.
11.10. If LawCloud believes or discovers that its processing of the Data likely involves a high risk to the rights and freedoms of natural persons, LawCloud will promptly notify the Client and provide the Client with all reasonable and timely assistance as required by the Client to conduct a data protection impact assessment and, if necessary, consult the relevant supervisory authority.
11.11. As soon as LawCloud becomes aware of a Security Incident, LawCloud will promptly notify the Client and provide all timely information and cooperation as required by the Client to enable the Client to comply with its obligations regarding the notification and communication of a breach related to Personal Data under (and in accordance with the deadlines imposed by) the Applicable Legislation on Personal Data Processing. LawCloud will further take all necessary actions and measures to recover or mitigate the consequences of the Security Incident and will keep the Client updated on any developments regarding the Security Incident.
11.12. Upon termination or expiry of this Agreement, LawCloud will, depending on the Client's choice, either delete or return the Data (including all copies of the Data) in its possession or under its control (including any Data outsourced to a third party for Processing), as requested by the Client (the "Return"). This obligation will not apply to the extent LawCloud is required by Union or Member State law to retain some or all of the Data, in which case LawCloud will isolate and protect the Data from any further Processing unless required by such legislation. LawCloud will charge a flat fee of 250.00 EUR for such Return. However, the Client acknowledges that LawCloud cannot distill Data from archived backups and agrees to allow LawCloud to retain such Data as long as technically or legally necessary, after which LawCloud will promptly delete the Data.
11.13. LawCloud will allow the Client (or the auditors appointed by the Client) to monitor LawCloud's compliance with this Article 11 and will provide all information, systems, and personnel necessary for the Client (or its auditors) (i) to conduct this monitoring and (ii) to perform an audit. LawCloud acknowledges that the Client (or its auditors) may enter the premises of LawCloud to perform this audit, provided that the Client gives reasonable prior notice of its intention to conduct the audit, the audit is performed during normal working hours, and all reasonable measures are taken to avoid unnecessary disruption of LawCloud's activities. The Client will exercise its audit rights no more than once during a twelve (12) month period, unless (i) required by an instruction from a supervisory authority, or (ii) the Client believes further investigation is necessary due to a Security Incident at LawCloud.
11.14. To the extent the Client grants access to Personal Data to one or more third parties (whether via APIs or otherwise), LawCloud will not be liable for the processing of Personal Data by these third parties. The Client indemnifies and holds LawCloud harmless for any claims, actions, losses, damages, and costs incurred by LawCloud that arise directly or indirectly from, or otherwise relate to, a breach of the Applicable Legislation on Personal Data Processing by these third parties.