Acceptance of these Terms and Conditions will take place when Jisc receives a signed Order Form from the Customer, at which point a legally binding agreement will come into existence between Jisc and the Customer.

If you do not agree to these Terms and Conditions, please do not use this Service.


Definitions used in these Terms and Conditions:

Admin User

an End User you have appointed who will have the ability to manage other End Users

Agreement

Jisc’s anti-slavery policy which can be found at https://www.jisc.ac.uk/about/corporate/slavery-and-human-trafficking-statement

Applicable EU Law

any law of the European Union (or the law of one of the Member States of the European Union)

Bribery Legislation

means the Bribery Act 2010 and any subordinate legislation made under that Act from time to time together with any guidance or codes of practice issued by the relevant government department concerning the Bribery Legislation

Business day

means any day other than a Saturday, Sunday or bank or other public holiday in England

Charges

means the charges payable by the Customer to Jisc for the performance of the Service as set out in the Order Form and may be varied in accordance with Clause 3

Commencement Date

has the meaning set out in the Order Form

Controller, Processor and Data Subject

shall have the meaning given to those terms in the GDPR

Data Protection Legislation

means (a) any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) which relates to the protection of individuals with regards to the Processing of Personal Data to which a Party is subject, including the Data Protection Act 2018 and the GDPR; and (b) any code of practice or guidance published by the Regulator and/or European Data Protection Board from time to time

Data Protection Particulars

means, in relation to any Processing under this Agreement: (a) the subject matter and duration of the Processing; (b) the nature and purpose of the Processing; (c) the type of Personal Data being Processed; and (d) the categories of Data Subjects. Data Subject

Request

means an actual or purported subject access request or notice or complaint from (or on behalf of) a Data Subject exercising his rights under the Data Protection Legislation

Data Transfer

means transferring the Personal Data to, and / or accessing the Personal Data from and / or Processing the Personal Data within, a jurisdiction or territory that is a Restricted Country

End User

any individual employed by you participating in the Jisc Insights Survey who has a User Account

First Expiry Date

has the meaning set out in the Order Form;

Freedom of Information Laws

means the Freedom of Information Act 2000 (and any Scottish equivalent), the Environmental Information Regulations 2004 (and any Scottish equivalent) and any subordinate legislation made under such legislation from time to time together with any guidance and/or codes of practice issued by the UK Information Commissioner or relevant Government Department in relation to such legislation

GDPR

means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119/1, 4.5.2016; Initial Term Has the meaning set out in Clause 1

Insights Record Contact

means the individual notified to Jisc by you being the individual responsible in your organisation for issuing the Jisc Insights Survey or authorising other individuals to issue the Jisc Insights Survey; Jisc Jisc, the provider of Service. Also referred to in these terms and conditions as us, we and our

Jisc Insights Survey

means the Digital Experience Insights survey run each year by Jisc; Jisc Online Surveys means the online surveys tool used for creating online surveys that is provided by Jisc and used by the Service

Modern Slavery Legislation

the Modern Slavery Act 2015 and any subordinate legislation made under that Act from time to time together with all applicable anti-slavery and human trafficking laws, statutes, regulations, guidance or codes of practice issued by the relevant government department

Order Form

means the order form to which these Terms and Conditions are appended

Permitted Purpose

means the purpose of the Processing as specified in the Data Processing Particulars

Personal Data

has the meaning given to it in the GDPR and for the purposes of this Agreement includes Sensitive Personal Data; Personal Data Breach

has the meaning given to it in the GDPR and, for the avoidance of doubt, includes a breach of Clause 3.1.3 of Schedule 2;

Personnel

means all persons engaged or employed from time to time by Jisc in connection with this Agreement, including employees, consultants, contractors and permitted agents

Primary Contact

the Insights Record Contact

Processing

has the meaning given to it in the GDPR (and "Process" and "Processed" shall be construed accordingly); Regulator means the UK Information Commissioner's Office (including any successor or replacement body)

Regulator Correspondence

means any correspondence or communication (whether written or verbal) from the Regulator in relation to the Processing of the Personal Data;

Renewal Term

has the meaning set out in Clause 1;

Restricted Country

means a country, territory or jurisdiction outside of the European Economic Area which the EU Commission has not deemed to provide adequate protection in accordance with Article 25(2) of the DP Directive and/ or Article 45(1) of the GDPR (as applicable)

Security Requirements

means the requirements regarding the security of the Personal Data, as set out in the Data Protection Legislation (including, in particular, the seventh data protection principle of the DPA and/ or the measures set out in Article 32(1) of the GDPR (taking due account of the matters described in Article 32(2) of the GDPR)) as applicable

Sensitive Personal Data

means Personal Data that incorporates such categories of data as are listed in Article 9(1) of the GDPR

Service

means the Digital Experience Insights service provided by Jisc that allows you to run a Jisc-developed tracker-style survey tool amongst a consenting group of your own students in order to track the students’ digital experience during their studies

Service Website

means the Service blogs, features, service levels and support pages at https://digitalinsights.jisc.ac.uk; Schedule means this schedule which forms part of the Agreement;

Third Party Request

means a written request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by law or regulation; and User Account an account granted by Jisc, to an End User.


1. Commencement and Duration

1.1 These are the terms and conditions on which Jisc provides the Service to the Customer. These Terms will apply to any agreement between Jisc and the Customer in relation to access and use of the Service to the exclusion of all other terms and conditions.

1.2 In consideration of payment by you of the agreed Charges and you agreeing to abide by these Terms and Conditions, we hereby grant to you a non-exclusive, non-transferrable right to use the Service under these Terms and Conditions from the Commencement Date until the First Expiry Date (the Initial Term), subject to early termination in accordance with this Agreement.

1.3 During the Initial Term the Customer may terminate this Agreement by giving not less than four (4) months' written notice of termination to Jisc, such termination to take effect only on the expiry of the Initial Term.

1.4 Following expiry of the Initial Term this Agreement will, subject to earlier termination in accordance with this Agreement, automatically renew for successive 12 month periods (each a Renewal Term) unless and until terminated by either Party giving not less than four (4) months' written notice of termination to the other, such termination to take effect only on expiry of the then current Renewal Term.

2. Responsibilities and restrictions

2.1 Except as expressly set out in these Terms and Conditions or as permitted by any local law, you undertake:

(a) not to divulge your User Account password to any other person or share a User Account with any other person.

(b) to notify Jisc if you become aware of any unauthorised use of the Service;

(c) not to disassemble, decompile, reverse-engineer or create derivative works based on the whole or any part of the Service, nor attempt to do any such thing except to the extent that (by virtue of section 296A of the Copyright, Designs and Patents Act 1988) such actions cannot be prohibited because they are essential for the purpose of achieving inter- operability of the Service with another software program, and provided that the information obtained by you during such activities:

software program with our prior written consent; and ii. is not unnecessarily disclosed or communicated to any third party without our prior written consent; and iii. is not used to create any software which is substantially similar to the Service without our prior written consent;

(d) to ensure you provide up-to-date contact details to Jisc;

(e) that you will not engage in any activity that interferes with or disrupts the Service (or the servers and networks which are connected to the Service);

(f) not to use the Service in a manner that uses a disproportionate share of the Service’s resources. Jisc will notify you if you are using a disproportionate share of the Service’s resources and affecting the experience of other users. Jisc reserves the right to suspend your surveying should you not to take steps that Jisc recommends to address your usage.

(g) not to access and use the Service via programmatic, scripted or any other automated means without our prior written consent;

(h) not to use the Service in a manner that is likely to harm the reputation of Jisc. This includes, but is not limited to:

(i) not to provide, or otherwise make available, access to the Service, including through any form of re-sale of licencing in whole or in part, in any form to any person or organisation for their own separate business purposes without prior written consent from Jisc.

(j) to ensure that the Primary Contact is responsible for the use of the Service within your organisation including timely deletion of user accounts and data and to manage other requests on behalf of your organisation.

3. Charges and Payment

3.1 You shall pay the Charges to us in accordance with the payment timetable specified in the Order Form. All Charges are stated exclusive of value added tax (and any other taxes), which if applicable will be added by us to our invoices at the prevailing rate as at the date of the applicable invoice and will be paid by you accordingly. Payment shall be made by the Customer to the bank account notified on the invoice to the Customer.

3.2 We will deliver invoices to you in accordance with the payment timetable set out in the Order Form. Subject to Clause 3.3, all due and valid invoices will be paid by you within 30 days of receipt.

3.3 Should you wish to dispute an invoice you will notify us in writing of the nature and details of the dispute within 30 days of receipt of the invoice, provided that nothing in this clause will excuse you from your payment obligations in respect of any undisputed part of the invoice.

3.4 If the Customer fails to pay any undisputed Charges by the due date, Jisc may, in its absolute discretion,:

(a) charge the Customer interest on late payment from the due date up to the date of actual payment, after as well as before judgment, at the rate of 2% above the base lending rate of HSBC Bank plc then in force. Such interest will be payable by the Customer on demand and will accrue on a daily basis; and / or (b) suspend the Service in respect of which the unpaid Charges relate until payment is received by Jisc.

3.5 The Customer shall pay all sums that it owes under this Agreement without any set‐off, counterclaim and deduction or withholding of any kind, save as may be required by law.

3.6 Following expiry of the Initial Term, Jisc reserves the right to amend the Charges from time to time. Jisc will give a minimum of 6 months' notice of any amendment. If you then wish to terminate this Agreement you may do so by giving written notice of termination to us within 2 months' of receiving our notice of amendment. Termination will then come into effect from the date on which the amended Charges would otherwise apply. Information on the charges that apply to the Service can be found on the Service Website.

4. Intellectual property rights

4.1 You acknowledge that all intellectual property rights in the Service belong to Jisc, that rights to use the Service are licenced (not sold) to you, and that you have no rights in, or to, the Service or any information therein other than the right to use them in accordance with these Terms and Conditions.

4.2 Any intellectual property rights in material generated by you in using the Service shall be your property.

4.3 By agreeing to use the Service under these Terms and Conditions you agree to provide Jisc with a non-exclusive, royalty-free licence to use, reproduce, distribute and modify your content solely for the purposes of providing the Service, including the use of your content to produce anonymised and aggregated benchmarking reports which allows institutions to compare survey results against those of a group of peers.

4.4 The Service must not be used a manner which infringes any copyright, patent, trade mark, design or other intellectual property right. You must ensure you have the right to use any files/images that you upload or embed into a survey. Any queries from third parties (or arising from our own audits) regarding copyright, or other intellectual property right, infringement in relation to any such uploaded content will be passed on to you. We reserve the right to temporarily disable your Jisc Insights Survey and/or User Account while any claim of infringement is investigated. If it is subsequently discovered that the survey included content without permission we reserve the right to close your account and terminate this Agreement.

4.5 We may access your survey data and survey metadata for the purposes of operating and enhancing the Service, for example, to test backward compatibility of new Service features. We may publish anonymous summary statistics of the Service’s survey data and survey metadata, for example, response rates and average number of questions. We will not publish identifiable survey data or survey metadata.

5. Limited warranty

5.1 Each Party hereby warrants and undertakes to the other Party that this Agreement is executed by a duly authorised representative of that Party; it has, and will have for the duration of this Agreement, full capacity and authority required to enter into this Agreement and perform its obligations as set out in this Agreement; and it has obtained and will for the duration of this Agreement, maintain all licences, rights, permits, permissions, certificates, qualifications, consents and regulatory approvals required lawfully and properly to perform its obligations, and grant the rights granted by it, under this Agreement.

5.2 Jisc does not warrant that your use of the Service will be uninterrupted or error free but we warrant that the Service, when properly used, shall perform substantially in accordance with the functions set out on the Service Website.

5.3 If, within the term of the Agreement to use the Service, you notify Jisc in writing of any defect or fault in the Service that results in its failure to perform substantially in accordance with the service levels set out at Schedule 1 of these terms and Conditions and on the Service Website we will remedy the fault, provided that you make available all the information that may be necessary to help us remedy the defect or fault, including sufficient information to enable us to recreate the defect or fault. The warranty does not apply if the defect or fault results from you having used the Service in contravention of these Terms and Conditions.

5.4 Jisc offers no support or warranty for surveys other than the Jisc Insights Survey.

5.5 Jisc warrants that in relation to this Agreement and its subject matter, neither it nor any of its employees, sub-contractors or agents or others performing services on its behalf has done (or agreed to do) or will do (or agree to do) anything which constitutes a breach of any Bribery Legislation;

5.6 Jisc warrants that it shall, at all times during the term of this Agreement comply with Modern Slavery Legislation and Anti-Slavery Policy and require that each of its sub-contractors shall comply with the Modern Slavery Legislation and Anti-Slavery Policy;

5.7 Jisc warrants it has in place, and will at all times during the Term continue to have in place, adequate procedures designed to prevent any person associated with it from committing an offence under the Bribery Legislation and as a minimum such procedures comply, and will at all times during the term of this Agreement comply, with the most recent guidance issued from time to time by the Secretary of State pursuant to the Bribery Act 2010 and it will comply with, monitor and enforce the procedures referred to in this Clause 5.7.

6. Limitations of liability

6.1 We shall not, under any circumstances whatever, be liable to you, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with these Terms and Conditions, for:

(a) loss of profits, sales, business or revenue; (b) business interruption; (c) loss of anticipated savings; (d) loss or corruption of data or information; (e) loss of business opportunity, goodwill or reputation; or (f) any indirect or consequential loss or damage.

6.2 Other than the losses set out in Clause 6.1 (for which we are not liable), our maximum aggregate liability under or in connection with the Agreement, whether in contract, tort (including negligence) or otherwise shall, in all circumstances, be limited to a sum equal to the annual Charges to use the Service. This maximum cap does not apply to Clause 6.5.

6.3 These Terms and Conditions set out the full extent of our obligations and liabilities in respect of the supply of the Service. Except as expressly stated in these Terms and Conditions, there are no conditions, warranties, representations or other terms, express or implied, that are binding on Jisc. Any condition, warranty, representation or other term concerning the supply of the Service which might otherwise be implied into, or incorporated in, these Terms and Conditions whether by statute, common law or otherwise, is excluded to the fullest extent permitted by law.

6.4 We are only responsible for loss or damage you suffer that is a foreseeable result of our breach of these Terms and Conditions or our negligence up to the amount specified in Clause 6.2, but we are not responsible for any loss or damage that is not foreseeable. Loss or damage is foreseeable if it was an obvious consequence of our breach or if it was contemplated by you and Jisc at the time we granted you the use of the Service under these Terms and Conditions.

6.5 Nothing in these Terms and Conditions shall limit or exclude our liability for:

(a) death or personal injury resulting from our negligence;

(b) fraud or fraudulent misrepresentation; or

(c) any other liability that cannot be excluded or limited by English law.

7. Termination

7.1 Either party may terminate this Agreement immediately by written notice to you if the other party commits a material or persistent breach of these Terms and Conditions which it fails to remedy (if remediable) within 14 days after the service of written notice requiring you to do so.

7.2 In the event of non-renewal of the Agreement your access to the Service will be suspended and (subject to Clause 4.3) all User Accounts and survey data will be deleted 35 days after the date of suspension. Your data will be held in backups for a minimum of three months after your data is deleted and will not be accessed for business as usual purposes without your consent. The data will be expunged in accordance with the standard Jisc data management lifecycle.

7.3 Upon termination for any reason:

(c) all rights granted to you for your use of Service under these Terms and Conditions shall cease; and

(d) you must immediately cease all activities authorised by these Terms and Conditions.

8. Communications between us

8.1 The Primary Contact will act as the main point of contact between you and Jisc. Should other defined points of contact fail (e.g. Billing Contact or Admin User), the Primary Contact will be ultimately responsible.

8.2 If you wish to contact us in writing, or if any condition in these Terms and Conditions requires you to give us notice in writing, you can send this by email or pre-paid post to:

(a) For notices regarding the functioning of the Service or renewal of the Agreement please

email: help@jisc.ac.uk We will confirm receipt of this by contacting you in writing, usually by e-mail.

(b) For legal notices: legal@jisc.ac.uk

8.3 If we have to contact you or give you notice in writing, we will do so by e-mail or by pre-paid post to the address you have provided in the Order Form.

8.4 Any notice given by you to us, or by us to you, will be deemed received and properly served immediately when posted on our website, 24 hours after an e-mail is sent, or three days after the date of posting of any letter. In proving the service of any notice, it will be sufficient to prove, in the case of a letter, that such letter was properly addressed, stamped and placed in the post and, in the case of an e-mail that such e-mail was sent to the specified e-mail address of the addressee.

9. Events outside our control

9.1 We will not be liable or responsible for any failure to perform, or delay in performance of, any of our obligations under these Terms and Conditions that is caused by an Event Outside Our Control. An Event Outside Our Control is defined below in Clause 9.2.

9.2 An Event Outside Our Control means any act or event beyond our reasonable control including,

without limitation, failure of public or private telecommunications networks.

9.3 If an Event Outside Our Control takes place that affects the performance of our obligations under these Terms and Conditions:

(a) our obligations under these Terms and Conditions will be suspended and the time for performance of our obligations will be extended for the duration of the Event Outside Our Control;

(b) we will use reasonable endeavours to find a solution by which our obligations under the Agreement may be performed despite the Event Outside Our Control.

10. Data protection requirements

10.1 The parties shall comply with the provisions of Schedule 2, Data Protection.

10.2 In the event of any conflict between Schedule 2 and any other provision of these Terms and Conditions, the relevant provision of Schedule 2 shall take precedence.

11. Freedom of Information Obligations

11.1 We are not subject to the requirements of the Freedom of Information Laws and so are not obliged to respond to requests for information under the Freedom of Information Laws (Request for Information). Without prejudice to the foregoing, and subject to your compliance with Clause 11.2 , we will endeavour to inform you within two (2) Business Days and endeavour to respond to any Request for Information in the spirit of the Freedom of Information Laws where reasonably able to do so.

11.2 We acknowledge that you may be obliged to respond to any Request for Information where you are subject to the requirements of the Freedom of Information Laws. If this is the case you shall be responsible for determining in your absolute discretion and, notwithstanding any other provision in these Terms and Conditions or any other agreement, whether any information is exempt from disclosure in accordance with the provisions of the Freedom of Information Laws. Without prejudice to the foregoing, if you receive a Request for Information and such request includes commercially sensitive information or confidential information of ours under the Freedom of Information laws, you shall, as soon as reasonably practicable, notify us of such request and shall consult with us and consider any representations which we may make in relation to the requested disclosure prior to deciding whether to comply with or to refuse the request (in whole or in part).

12. Other important terms

12.1 We may transfer our rights and obligations under these Terms and Conditions to another organisation, but this will not affect your rights or obligations under these Terms and Conditions.

12.2 You may only transfer your obligations under these Terms and Conditions to another person if we agree in writing.

12.3 These Terms and Conditions constitute the entire agreement between you and us. You acknowledge that you have not relied on any statement, promise or representation made or given by, or on behalf of, us which is not set out in these Terms and Conditions or any document expressly referred to in it.

12.4 If we fail to insist you perform any of your obligations under these Terms and Conditions, or if we do not enforce our rights against you, or if we delay in doing so, that will not mean that we have waived our rights against you and will not mean that you do not have to comply with those obligations. If we do waive a default by you, we will only do so in writing, and that will not mean that we will automatically waive any later default by you.

12.5 We may be required to review content to determine if it is appropriate or if it is violating any terms of service such as our receipt of a report of unlawful content, however we have no obligation to monitor or review content.

12.6 Each of the conditions of these Terms and Conditions operates separately. If any court or competent authority decides that any of them are unlawful or unenforceable, the remaining conditions will remain in full force and effect.

12.7 We reserve the right to alter these Terms and Conditions during the term of your Licence and will notify you in writing should we do so.

12.8 Please note that these Terms and Conditions, their subject matter and their formation are governed by English law. You and we both agree that the courts of England and Wales will have exclusive jurisdiction.

Schedule 1 Insights Service Levels

  1. Introduction

1.1 This Service Level Agreement sets out the levels of availability and support the you can expect from us.

2. Helpdesk

2.1 Support materials are available for all users at https://digitalinsights.jisc.ac.uk

2.2 Email support is available from help@jisc.ac.uk - please include digital insights in the subject field

3. Support hours

3.1 Support hours are 09:00 – 17:00 UTC, Monday to Friday, excluding English Bank Holidays and Jisc closure days. Upcoming Bank Holidays and Jisc closure days are publicised on the Digital Experience Insights website.

4. Scheduled maintenance

4.1 Any scheduled maintenance will be publicised prior to being carried out. Jisc will do everything possible to minimize and avoid downtime during such maintenance.

ARRANGEMENT BETWEEN THE PARTIES

1.1. The Parties shall each Process the Personal Data in accordance with the terms of this Schedule. The Parties acknowledge that the factual arrangement between them dictates the classification of each Party in respect of the Data Protection Legislation.

1.2. Where a party acts as a Controller in respect of any Personal Data Processed under or in connection with this Agreement, it shall comply with its respective obligations under the Data Protection Legislation and shall only use such Personal Data for the purposes of performing its obligations under this Agreement.

1.3. Notwithstanding the foregoing, the Parties anticipate and agree that Jisc shall be a Processor where it is Processing the Personal Data in relation to the Permitted Purpose in connection with the performance of its obligations to provide the Service under these Terms and Conditions.

1.4. Each of the Parties acknowledges and agrees that the following table sets out an accurate description of the Data Protection Particulars:

The subject matter and duration of the Processing

Jisc Digital Experience Insights allows the Customer to run Jisc-developed surveys amongst a consenting group of its own students and/or staff. The surveys include a set of questions developed by Jisc and the option for the Customer to add further questions that together capture a range of information about the Data Subject (which may include Personal Data) in order to track the students’ digital experience during their studies and the use of technology by their staff.

The duration of the Processing will be for the term of the Agreement between the Customer and Jisc.

The nature and purpose of the Processing

The Personal Data will be Processed in order to provide the Service ordered by the Customer.

The type of Personal Data being Processed

The questions developed by Jisc do not require the Data Subject to provide any Personal Data, however Customers have the ability to add questions that can capture any type of Personal Data, this may include (but is not limited to) users first name, last name, email address, phone number, date of birth and university ID. The categories of Data Subjects

Individuals responding to the Jisc Insights Survey run by the Customer.

Schedule 2 Data Protection

CONTROLLER OBLIGATIONS

2.1. Where a Party acts as Controller in respect of the Processing of the Personal Data, that Party shall ensure that:

PROCESSOR OBLIGATIONS

3.1 Jisc (as a Processor in relation to any Personal Data Processed by (or on behalf of) the Customer pursuant to the Agreement) undertakes to the Customer that it shall:

it is not subject to any prohibition or restriction which would prevent or restrict it from disclosing or transferring the Personal Data to Jisc in accordance with the terms of this Schedule; and

all fair processing notices have been given (and/ or, as applicable, consents obtained) and are sufficient in scope to allow the Controller to disclose the Personal Data (including any Sensitive Personal Data) to Jisc for the delivery of the Service in accordance with the Data Protection Legislation.

process the personal data for and on behalf of the Customer in connection with the performance of the Service only and for no other purpose in accordance with the terms of this Agreement and any instructions from the Customer;

unless prohibited by law, promptly notify the Customer (and in any event within forty-eight (48) hours of becoming aware of the same) if it considers, in its opinion (acting reasonably) that it is required by Applicable EU Law to act other than in accordance with the instructions of the Customer, including where it believes that any of the Customer's instructions under Clause 3.1.1 infringes any of the Data Protection Legislation;

implement and maintain appropriate technical and organisational security measures to comply with at least the obligations imposed on a Controller by the Security Requirements. If requested by the Customer, Jisc will provide a description of the technical and organisational security measures that Jisc will implement and maintain;

take all reasonable steps to ensure the reliability and integrity of any of the Personnel who shall have access to the Personal Data, and ensure that each member of Personnel shall have entered into appropriate contractually-binding confidentiality undertakings;

notify the Customer promptly, and in any event within forty-eight (48) hours, upon becoming aware of any actual or suspected, threatened or ‘near miss’ Personal Data Breach, and:

(a) implement any measures necessary to restore the security of compromised Personal Data;

(b) assist the Customer to make any notifications to the Regulator and affected Data Subjects;

notify the Customer promptly (and in any event within ninety-six (96) hours) following its receipt of any Data Subject Request or Regulator Correspondence and shall:

(a) not disclose any Personal Data in response to any Data Subject Request or Regulator Correspondence without the Customer's prior written consent; and

(b) provide the Customer with all reasonable co-operation and assistance required by the Customer in relation to any such Data Subject Request or Regulator Correspondence;

not disclose Personal Data to a third party in any circumstances without the Customer's prior written consent, other than:

(a) in relation to Third Party Requests where Jisc is required by law to make such a disclosure, in which case it shall use reasonable endeavours to advise the Customer in advance of such disclosure and in any event as soon as practicable thereafter, unless prohibited by law or regulation from notifying the Customer;

(b) to Jisc's employees, officers, representatives and advisers who need to know such information for the purposes of Jisc performing its obligations under this Agreement and in this respect Jisc shall ensure that its employees, officers, representatives and advisers to whom it discloses the Personal Data are made aware of their obligations with regard to the use and security of Personal Data under this Agreement; and

(c) to a sub-contractor appointed in accordance with Clause 4.

not make (nor instruct or permit a third party to make) a Data Transfer without putting in place measures to ensure the Customer's compliance with Data Protection Legislation;

on the written request of the Customer, and with reasonable notice, allow representatives of the Customer to audit Jisc in order to ascertain compliance with the terms of this Clause 3 and/ or to provide the Customer with reasonable information to demonstrate compliance with the requirements of this Clause 3, provided that:

(a) the Customer shall only be permitted to exercise its rights under this Clause 3.1.9 no more frequently than once per year (other than where an audit is being undertaken by a Customer in connection with an actual or 'near miss' Personal Data Breach, in which case, an additional audit may be undertaken each year by the Customer within thirty (30) days of the Customer having been notified of actual or 'near miss' Personal Data Breach);

(b) each such audit shall be performed at the sole expense of the Customer;

assist the Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of Processing and the information available to Jisc, provided that Jisc shall be entitled to charge a fee to the Customer (on a time and materials basis and at such rate notified by Jisc to the Customer from time to time) in respect of providing any such assistance to the Customer.

3.2 Notwithstanding anything in this Agreement to the contrary, this Clause 3 shall continue in full force and effect for so long as Jisc Processes any Personal Data on behalf of the Customer.

SUB-CONTRACTORS

4.1 Jisc may from time to time use sub-contractors to perform all or any part of its obligations under this schedule. Jisc shall notify the Customer prior to appointing a sub-contractor. The Customer may object to the appointment of any sub-contractor and Jisc shall reasonably take into account the views of the Customer in appointing any such sub-contractor, but for the avoidance of doubt the appointment of any sub-contractor shall be at Jisc's absolute discretion and Jisc shall have no obligation to act in accordance with any objection raised by the Customer. Information regarding the sub-contractors Jisc uses from time to time in connection with the performance of the Service can be found on the Service Website.

(c) the Customer shall not, in its performance of each such audit, unreasonably disrupt the business operations of Jisc;

(d) the Customer shall comply with Jisc's health and safety, security, conduct and other rules, procedures and requirements in relation to Jisc's property and systems which have been notified by Jisc to the Customer in advance; and

(e) in no case shall the Customer be permitted to access any data,

information or records relating to any other customer of Jisc, except to the extent required by Applicable EU Law, on the earlier of:

(a) the date of termination or expiry of the Agreement (as applicable);

and/or

(b) the date on which the Personal Data is no longer relevant to, or necessary for, the performance of the Service, cease Processing any of the Personal Data and, within sixty (60) days of the date being applicable under this Clause 3.1.10, return or destroy (as directed, in writing, by the Customer) the Personal Data belonging to, or under the control of, the Customer and ensure that all such data is securely and permanently deleted from its systems, provided that Jisc shall be entitled to retain copies of the Personal Data for evidential purposes and to comply with legal and/or regulatory requirements;

comply with the obligations imposed upon a Processor under the Data Protection Legislation; and

4.2 Jisc may from time to time disclose Personal Data to its sub-contractors (or allow its sub- contractors to access Personal Data) for Processing solely in connection with the fulfilment of the Permitted Purpose.

4.3 Where Jisc uses a sub-contractor to Process Personal Data for or on its behalf, it will ensure that the sub-contractor contract (as it relates to the Processing of Personal Data) is on terms which are substantially the same as, and in any case no less onerous than, the terms set out in Clause 3 of this schedule.

4.4 Jisc shall remain liable to the Customer for the acts, errors and omissions of any of its sub- contractors to whom it discloses Personal Data, and shall be responsible to the Customer for the acts, errors and omissions of such sub-contractor as if they were Jisc’s own acts, errors and omissions to the extent that Jisc would be liable to the Customer under this Agreement for those acts and omissions.


Terms and Conditions last updated: 05-09-18