IRIS Connect : Organization Administrator Agreement
1.Scope and responsibilities:
1.1 Outlines the responsibility for managing IRIS Connect within the Organization
1.2 Outlines the responsibilities of IRIS Connect in managing Organization Data
1.3 Outlines and incorporates new requirements under GDPR
1.4 Monitoring implementation of this Agreement rests with nominated Organization Administrators/Data Protection Officer (DPO) and IRIS Connect
1.5 For the purpose of the GDPR, Organization Administrators are nominated as Data Protection Officer (if no DPO has been required to be nominated under GDPR).
2.1. Capitalized terms
Capitalized terms used but not defined in this Agreement have the meanings given elsewhere in the applicable Agreement. In this Agreement, unless stated otherwise:
“Additional Products” means products, services and applications that are not part of the Services but that may be accessible, via the Admin Console or otherwise, for use with the Services.
“Additional Security Controls” means security resources, features, functionality and/or controls that a Customer may use at its option and/or as it determines. “Additional Security Controls” may include the Admin Console and other features and functionality of the Services such as two factor authentication, security key enforcement and monitoring capabilities.
“Advertising” means online advertisements displayed by IRIS Connect to End Users, excluding any advertisements Customer expressly chooses to have IRIS Connect or any of its Affiliates display in connection with the Services under a separate agreement.
“Affiliate” means any entity controlling, controlled by, or under common control with a party, where “control” is defined as: (a) the ownership of at least fifty percent (50%) of the equity or beneficial interests of the entity; (b) the right to vote for or appoint a majority of the board of directors or other governing body of the entity; or (c) the power to exercise a controlling influence over the management or policies of the entity.
“Agreed Liability Cap” means the maximum monetary or payment-based amount at which a party’s liability is capped under the applicable Agreement, either per annual period or event giving rise to liability, as applicable.
“Agreement Effective Date” means, as applicable:
- (a) 25 May 2018, if Customer clicked to accept or the parties otherwise agreed to this Agreement in respect of the applicable Agreement prior to or on such date; or
- (b) the date on which Customer clicked to accept or the parties otherwise agreed to this Agreement in respect of the applicable Agreement, if such date is after 25 May 2018.
“Audited Services” means the Services listed as audited in the IRIS Connect Service Summary.
“Basic/Content Licence” is a feature restricted account on the IRIS Connect Web Platform. Users are able to consume content but not upload.
“Closed Account” mean when an Organization’s access to their IRIS Connect Accounts is terminated.
“Complementary Product Agreement” means: any other agreement under which IRIS Connect agrees to provide identity services as such to Customer; or any other agreement that incorporates this Agreement by reference or states that it will apply if accepted by Customer.
“Complementary Product Services Summary” means the then-current description of the services provided under a Complementary Product Agreement, as set out in the applicable Agreement.
“Community Group” means a group on the IRIS Connect platform which enables sharing and collaboration between two or more organisations
“Customer Data” means data submitted, stored, sent or received via the Services by Customer, its Affiliates or End Users.
“Customer Personal Data” means personal data contained within the Customer Data.
“Data Incident” means a breach of IRIS Connect’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by IRIS Connect. “Data Incidents” will not include unsuccessful attempts or activities that do not compromise the security of Customer Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
“EEA” means the European Economic Area.
“European Data Protection Legislation” means, as applicable: (a) the GDPR; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland).
“Full Activation Date” means: (a) if this Agreement is incorporated into the applicable Agreement by reference, the Agreement Effective Date; or (b) if the parties otherwise agreed to this Agreement, the eighth day after the Agreement Effective Date.
“Full Licence” means full access to the IRIS Connect Web Platform’s features.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“Hardware (Camera)” includes any products purchased from IRIS Connect including the LiveView System, UploadBox, Discovery Kit, Discovery Kite Lite
“IPRs” Intellectual property rights
“IRIS Connect System” means the Core Services for IRIS Connect, as described in the IRIS Connect Services Summary.
“IRIS Connect’s Third Party Auditor” means an IRIS Connect-appointed, qualified and independent third party auditor, whose then-current identity IRIS Connect will disclose to Customer.
“IRIS Connect Services Summary” means the then-current description of the Core Services for IRIS Connect, (as may be updated by IRIS Connect from time to time in accordance with the Agreement).
“Non-European Data Protection Legislation” means data protection or privacy legislation other than the European Data Protection Legislation.
“Notification Email Address” means the email address(es) designated by Customer in the Admin Console or the Order Form to receive certain notifications from IRIS Connect.
“Organisation Administrator”: Data Protection Officer or Senior Person within the Customer organisation who is responsible for overseeing the management of IRIS Connect within the organisation.
“Security Documentation” means all documents and information made available by IRIS Connect under Section 7 and on our website
“Security Measures” has the meaning given by IRIS Connect’s Security Measures and Controls document.
“Services” means the following services, as described in the IRIS Connect Service Summary
“SOC 2 Report” means a confidential Service Organization Control (SOC) 2 Report (or a comparable report) on IRIS Connect’s systems examining logical security controls, physical security controls, and system availability, as produced by IRIS Connect’s Third Party Auditor in relation to the Audited Services.
“Subprocessors” means third parties authorized under this Agreement to have logical access to and process Customer Data in order to provide parts of the Services and related technical support.
“Term” means the period from the Agreement Effective Date until the end of IRIS Connect’s provision of the Services under the Agreement, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which IRIS Connect may continue providing the Services for transitional purposes.
“Third Party Providers” means organisations who you may choose to engage with via the IRIS Connect platform.
“User Content” is any user created content uploaded to the IRIS Connect Web Platform including video, images, attachments, comments and Groups.
2.2. GDPR Terms
The terms “personal data”, “data subject”, “processing”, “controller”, “processor” and “supervisory authority” as used in this Agreement have the meanings given in the GDPR in each case irrespective of whether the European Data Protection Legislation or Non-European Data Protection Legislation applies.
3. GDPR Compliance
3.1 The monitoring, recording, holding and processing of images of distinguishable individuals constitutes personal data as defined by the General Data Protection Regulation (“GDPR”) coming into force on 25 May 2018. This Agreement is intended to ensure that in the use of IRIS Connect it is compliant with the requirements of GDPR, with related legislation and with the CCTV Code of Practice published by the Office of the Information Commissioner.
3.2 While the IRIS Connect system does contain a feature to obscure the faces of individuals (cartoonization) you acknowledge that recorded video may still represent personal data if it may be triangulated with other sources to identify an individual.
3.3 If your intended use of the system is likely to collect personal data you agree to do so in a way which is compliant with the requirements of the GDPR. This may include but is not limited to the following:
3.3.1 Documenting your legal basis for processing personal data
3.3.2 Ensuring appropriate transparency and privacy notices
3.3.3 Ensuring robust mechanisms for ensuring ongoing compliance
3.3.4 Providing appropriate channels for appeal
3.3.5 Ensuring appropriate registration with the Information Commissioner’s Office (ICO)
3.3.6 Adopting a balanced and reasonable policy to managing Subject Access Requests (SARs) and 3rd party disclosures which safeguards the rights of all data subjects and respects the original purpose of the data collection
3.3.7 Enforcing data retention periods in line with your Organisation’s Data retention policy
*Further support around legal processing is available at https://www.irisconnect.com/uk/support/gdpr/
4.1 A nominated Data Protection Officer/Organization Administrator (who must be a senior member of staff) must manage the Organization’s compliance with this Agreement. By using the Organization Administrator Account, the Organization Administrator agrees the following on behalf of the organisation;
4.2 Management of content
Your organisationis the data controller for all recorded video. Your designated Data Protection Officer is responsible for making day to day decisions about the management of recorded data, permissioning collaboration groups, data sharing and the monitoring of data recorded by your Organization.
4.2.1 IRIS Connect provides a content oversight tool which enables Organsiation Administrators to review randomised thumbnail images from videos recorded within the organisation. This tool is designed to enable the identification of inappropriate content, it does not provide sufficient data access to be used for any other purpose.
4.2.2 You will be responsible for the management and monitoring of videos owned by your Organisation. If a user at your organisation flags an issue with a video or any other content, you agree that you are responsible for investigating the issue and for ensuring that any inappropriate content is removed.
4.3 Management of Users
Unless users in your organisation are enrolled on a 3rd party provider programme you will be responsible for the creation/amendment/deletion/suspension & management of the user accounts at your Organization. If a leaving user chooses to transfer any data that they are managing to the Organization Administrator – you will be bound by the EULA as if that data was your own.
4.3.1 If you use your Organization Administrator Account to create additional Organization Administrator Accounts then you confirm that;
22.214.171.124 you understand that the user for that account will be required to accept these same terms;
126.96.36.199 that any additional Organization Administrator Accounts will only be created for individuals that you warrant are entitled to and in a position to sign up to such terms;
188.8.131.52 you are responsible for the actions of any user using an Organization Administrator Account that you have issued them, any breach of the Organization EULA by that user will be deemed as a breach of the Organization EULA by yourself;
4.4 Management of scope:
4.4.1 You are required to monitor user requests for engagement with 3rd party providers and to provide, deny or revoke permission for users from your organisation to share data and participate in collaborative activities.
4.4.2 3rd party providers may have additional terms as part of their service subscription. You acknowledge that while you will always retain overall rights to video data, these agreements may include additional conditions. For example 3rd party agreements may introduce new stipulations for the management and ownership of non-video IPRs generated by course participants.
4.4.3 You acknowledge that agreeing to such conditions represents a contract between you and the 3rd party provider and agree to be bound by their terms and monitor user engagement to ensure organisational compliance.
4.4.4 On the IRIS Connect system organisation administrators may authorize the creation of groups which enable users to share video data and collaborate with users from other organisations. Such “community groups” enable Organisation Administrators to create participation agreements to be agreed by all members of the group.
4.4.5 You agree that if you authorise your users to participate in community groups you agree to be bound by the terms you have agreed to and to monitor user engagement to ensure compliance
4.4.6 You acknowledge that if the group is created by your organisation you are responsible for ensuring that inter-organisation sharing is appropriate and proportional and that the participation agreement clearly identifies the following :
184.108.40.206 What data may be shared and in what format
220.127.116.11 The purpose for the data sharing and for how long it will be shared
18.104.22.168 Such additional provisions as are necessary to ensure legal processing both within your organisation and collaborating organizations
4.5 Management of use:
4.5.1 The IRIS Connect system is for professional development, educational research and learning development, consequently, you agree:
4.5.2 To ensure that the use of the system is aligned with the stated purpose and that the system is not used for surveillance of staff or learners
4.5.3 To ensure that use of the system complies with the End User Licence Agreement (EULA) including, but not limited to:
22.214.171.124 To use the system to promote better learning outcomes
126.96.36.199 That all users conduct themselves in a professional manner, to not use the system to bully or intimidate other users or data subjects
188.8.131.52 To ensures recorded content is appropriate, non-intrusive and aligned with the purpose
184.108.40.206 To make sure recording equipment is positioned so it’s visible, safely located and unlikely to record sensitive content
220.127.116.11 To make sure users are empowered to report to the organsiation administrator content or use that does not meet the above criteria
18.104.22.168 To ensure users maintain system security and don’t share passwords
4.6 Management of privacy and disclosures:
4.6.1 The IRIS Connect system incorporates a privacy by design philosophy which on a day-to-day basis gives users control of the following:
22.214.171.124 When reflections are made and deleted
126.96.36.199 Who has access to reflections and how long for
188.8.131.52 When live shared reflections happen
184.108.40.206 Who may participate in live shared reflections
220.127.116.11 The creation of organisation level groups and the content thereof
4.6.2 In exceptional circumstances IRIS Connect will enable managed onsite review or 3rd party disclosures in situations where the following are being investigated either by the organization, or law enforcement agency:
18.104.22.168 Suspected system misuse and severe breaches of the EULA
22.214.171.124 Suspected professional misconduct
126.96.36.199 Suspected criminality
4.6.3 GDPR requires that personal data collected for one purpose cannot be further processed for another, incompatible purpose. If the sound and images recorded for
professional development are subsequently used in an investigation, you agree that you will seek advice to be absolutely certain that the circumstances warrant using sound and images for this new purpose.
4.6.4 The IRIS Connect Web Platform (https://app.irisconnect.com) is a secure service for the selective sharing of reflection videos. Role based log in and encrypted communications ensure that the videos are secure and managed within the privacy by design model. Under normal operation, videos and other data may not be downloaded from the web platform.
4.6.5 If we receive a formal request from the data controller we will enable resources to be downloaded from the platform. You agree that in these circumstances IRIS Connect will cease to be the data processor and the organisation will be fully responsible for the data and responsible for any damages caused by a breach or security or privacy.
5. Data Processing Agreement
5.1 Duration of Data Processing Agreement.
This Agreement will take effect on the effective Date and, notwithstanding expiry of the Term, remain in effect until, and automatically expire upon, deletion of all Customer Data by IRIS Connect as described in this Agreement.
5.2 Application of European Legislation.
The parties acknowledge and agree that the European Data Protection Legislation will apply to the processing of Customer Personal Data if, for example:
5.2.1 The processing is carried out in the context of the activities of an establishment of Customer in the territory of the EEA; and/or
5.2.2 The Customer Personal Data is personal data relating to data subjects who are in the EEA and the processing relates to the offering to them of goods or services in the EEA or the monitoring of their behaviour in the EEA.
5.3 Application of Non-European Legislation.
5.3.1 The parties acknowledge and agree that Non-European Data Protection Legislation may also apply to the processing of Customer Personal Data.
5.4 Processing of Data.
5.4.1 Processor and Controller Responsibilities.
If the European Data Protection Legislation applies to the processing of Customer Personal Data, the parties acknowledge and agree that:
188.8.131.52 The subject matter and details of the processing are described in Appendix 1;
184.108.40.206 IRIS Connect is a processor of that Customer Personal Data under the European Data Protection Legislation;
220.127.116.11 The Customer is a controller or processor, as applicable, of that Customer Personal Data under the European Data Protection Legislation; and
18.104.22.168 Each party will comply with the obligations applicable to it under the European Data Protection Legislation with respect to the processing of that Customer Personal Data.
5.5 Authorization by Third Party Controller.
If the Customer is a processor, the Customer warrants to IRIS Connect that the Customer’s instructions and actions, with respect to that Customer Personal Data, including its appointment of IRIS Connect as another processor, have been authorized by the relevant controller of that data
5.6 Responsibilities under Non-European Legislation.
If Non-European Data Protection Legislation applies to either party’s processing of Customer Personal Data, the parties acknowledge and agree that the relevant party will comply with any obligations applicable to it under that legislation with respect to the processing of that Customer Personal Data.
5.7 Scope of Processing
5.7.1 Customer’s Instructions.
By entering into this Data Processing Agreement, the Customer instructs IRIS Connect to process Customer Personal Data only in accordance with applicable law:
22.214.171.124 to provide the Services and related technical support;
126.96.36.199 as further specified via Customer’s use of the Services (including the Admin Console and other functionality of the Services) and related technical support;
188.8.131.52 as further documented in any other written instructions given by Customer and acknowledged by IRIS Connect as constituting instructions for purposes of this Data Processing Agreement.
5.8 IRIS Connect’s Compliance with Instructions.
As from the Full Activation Date, IRIS Connect will comply with the instructions described in Section 5.7.1 (Customer’s Instructions) (including with regard to data transfers) unless EU or EU Member State law to which IRIS Connect is subject requires other processing of Customer Personal Data by IRIS Connect, in which case IRIS Connect will inform Customer (unless that law prohibits IRIS Connect from doing so on important grounds of public interest) via the Notification Email Address. For clarity, IRIS Connect will not process Customer Personal Data for Advertising purposes or serve Advertising in the Services.
5.9 Additional Products.
If IRIS Connect at its option makes any Additional Products available to Customer in accordance with the Additional Product Terms (if applicable), and if Customer opts to install or use those Additional Products, the Services may allow those Additional Products to access Customer Personal Data as required for the interoperation of the Additional Products with the Services. For clarity, this Data Processing Agreement does not apply to the processing of personal data in connection with the provision of any Additional Products installed or used by Customer, including personal data transmitted to or from such Additional Products. Customer may use the functionality of the Services to enable or disable Additional Products, and is not required to use Additional Products in order to use the Services.
6. Data Deletion
6.1 Deletion During Term.
IRIS Connect will enable the Customer and/or End Users to delete Customer Data during the applicable Term in a manner consistent with the functionality of the Services. If the Customer or an End User uses the Services to delete any Customer Data during the applicable Term, this use will constitute an instruction to IRIS Connect to delete the relevant Customer Data from IRIS Connect’s systems in accordance with applicable law. IRIS Connect will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless EU or EU Member State law requires storage.
6.2 Deletion on Term Expiry.
Subject to Section 6.3 (Deferred Deletion Instruction), on expiry of the applicable Term Customer instructs IRIS Connect to delete all Customer Data (including existing copies) from IRIS Connect’s systems in accordance with applicable law. IRIS Connect will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless EU or EU Member State law requires storage. Without prejudice to Section 12.1 (Access; Rectification; Restricted Processing; Portability), Customer acknowledges and agrees that Customer will be responsible for exporting, before the applicable Term expires, any Customer Data it wishes to retain afterwards.
6.3 Deferred Deletion Instruction.
To the extent any Customer Data covered by the deletion instruction described in Section 6.2 (Deletion on Term Expiry) is also processed, when the applicable Term under Section 6.2 expires, in relation to an Agreement with a continuing Term, such deletion instruction will only take effect with respect to such Customer Data when the continuing Term expires. For clarity, this Data Processing Agreement will continue to apply to such Customer Data until its deletion by IRIS Connect.
7. Data Security
IRIS Connect’s Security Measures, Controls and Assistance.
7.1 IRIS Connect’s Security Measures.
IRIS Connect will implement and maintain technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access as described in the Security Controls and Measures document. The Security Controls and Measures document includes measures to encrypt personal data; to help ensure ongoing confidentiality, integrity, availability and resilience of IRIS Connect’s systems and services; to help restore timely access to personal data following an incident; and for regular testing of effectiveness. IRIS Connect may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services.
7.2 Security Compliance by IRIS Connect Staff.
IRIS Connect will take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance, including ensuring that all persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
7.3 Additional Security Controls
In addition to the Security Measures, IRIS Connect will make the Additional Security Controls available to:
7.3.1 Allow Customer to take steps to secure Customer Data; and
7.3.2 Provide Customer with information about securing, accessing and using Customer Data.
7.3.3 Additional Security Controls are outlined in the Security Measures and Controls Document
7.4 IRIS Connect’s Security Assistance.
The Customer agrees that IRIS Connect will (taking into account the nature of the processing of Customer Personal Data and the information available to IRIS Connect) assist Customer in ensuring compliance with any of Customer’s obligations in respect of security of personal data and personal data breaches, including if applicable Customer’s obligations pursuant to Articles 32 to 34 (inclusive) of the GDPR, by:
7.4.1 Implementing and maintaining the Security Measures in accordance with Section 12.1.1 (IRIS Connect’s Security Measures);
7.4.2 Making the Additional Security Controls available to Customer in accordance with Section 12.1.3 (Additional Security Controls);
7.4.3 Complying with the terms of Section 8 (Data Incidents); and
7.4.4 Providing Customer with the Security Documentation in accordance with Section 10 (Reviews of Security Documentation) and the information contained in the applicable Agreement.
8. Data Incidents
8.1 Incident Notification.
If IRIS Connect becomes aware of a Data Incident, IRIS Connect will: (a) notify Customer of the Data Incident promptly and without undue delay; and (b) promptly take reasonable steps to minimize harm and secure Customer Data. Further information about IRIS Connect’s Data Breach Response and Notification Procedure can be found here.
8.2 Details of Data Incident.
Notifications made pursuant to this section will describe, to the extent possible, details of the Data Incident, including steps taken to mitigate the potential risks and steps IRIS Connect recommends Customer take to address the Data Incident.
8.3 Delivery of Notification.
Notification(s) of any Data Incident(s) will be delivered to the Notification Email Address or, at IRIS Connect’s discretion, by direct communication (for example, by phone call or an in-person meeting). Customer is solely responsible for ensuring that the Notification Email Address is current and valid.
8.4 No Assessment of Customer Data by IRIS Connect.
IRIS Connect will not assess the contents of Customer Data in order to identify information subject to any specific legal requirements. Customer is solely responsible for complying with incident notification laws applicable to Customer and fulfilling any third party notification obligations related to any Data Incident(s).
8.5 No Acknowledgment of Fault by IRIS Connect.
IRIS Connect’s notification of or response to a Data Incident under this Section 8.2 (Data Incidents) will not be construed as an acknowledgement by IRIS Connect of any fault or liability with respect to the Data Incident.
9.Customer’s Security Responsibilities and Assessment
9.1 Customer’s Security Responsibilities.
The Customer agrees that, without prejudice to IRIS Connect’s obligations under Section 7.1 (IRIS Connect’s Security Measures, Controls and Assistance) and Section 8 (Data Incidents):
9.2 Customer is solely responsible for its use of the Services, including:
9.2.1 making appropriate use of the Services and the Additional Security Controls to ensure a level of security appropriate to the risk in respect of the Customer Data;
9.2.3 securing the account authentication credentials, systems and devices Customer uses to access the Services; and
9.3 IRIS Connect has no obligation to protect Customer Data that Customer elects to store or transfer outside of IRIS Connect’s and its Subprocessors’ systems (for example, offline or on-premise storage), or to protect Customer Data by implementing or maintaining Additional Security Controls except to the extent Customer has opted to use them.
9.4 Customer’s Security Assessment.
9.4.1 Customer is solely responsible for reviewing the Security Documentation and evaluating for itself whether the Services, the Security Measures, the Additional Security Controls and IRIS Connect’s commitments under this Section 7 (Data Security) will meet Customer’s needs, including with respect to any security obligations of Customer under the European Data Protection Legislation and/or Non-European Data Protection Legislation, as applicable.
9.4.2 Customer acknowledges and agrees that (taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of Customer Personal Data as well as the risks to individuals) the Security Measures implemented and maintained by IRIS Connect as set out in Section 7.1 (IRIS Connect’s Security Measures) provide a level of security appropriate to the risk in respect of the Customer Data.
9.5 Security Certifications and Reports.
IRIS Connect will do the following to evaluate and help ensure the continued effectiveness of the Security Measures:
9.6 Internal Certifications and Reports.
9.6 .1 maintain the DfE Cloud Service Providers self certification
9.6 .2 maintain Cyber Essentials (or higher) certification
9.7 Amazon Certification and Reports.
Review the following reports of and certifications reports as they are updated to ensure they maintain or improve on their existing security standards
9.7 .1 SOC 2
9.7 .2 SOC 3
9.7 .3 ISO 9001
9.7 .4 ISO 27001
9.7 .5 ISO 27017
9.7 .5 ISO 27018
10. Reviews and Audits of Compliance
10.1 Internal Security Documentation
In addition to the information contained in the applicable Agreement, IRIS Connect will make available for review by the Customer the following documents and information to demonstrate compliance by IRIS Connect with its obligations under this document:
10.1.1 The IRIS Connect Security Measures and Controls document
10.1.2 DfE Cloud Service Providers certificate and independent audit
10.1.3 Cyber Essentials certificate
10.2 Amazon Security Documentation.
10.3 Customer’s Audit Rights.
10.3.1 If the European Data Protection Legislation applies to the processing of Customer Personal Data, IRIS Connect will allow Customer or an independent auditor appointed by Customer to conduct audits (including inspections) to verify IRIS Connect’s compliance with its obligations under this Data Processing Agreement in accordance with Section 10.4 (Additional Business Terms for Reviews and Audits). IRIS Connect will contribute to such audits as described in Section 9.5 (Security Certifications and Reports) and this Section 10 (Reviews and Audits of Compliance).
10.3.2 Customer may also conduct an audit to verify IRIS Connect’s compliance with its obligations under this Data Processing Agreement by reviewing the Security Documentation (which reflects the outcome of audits conducted by IRIS Connect’s Third Party Auditor).
10.4 Additional Business Terms for Reviews and Audits.
10.4.1 Customer must send any requests for reviews of the Security Measures and Controls document or audits to IRIS Connect’s Data Protection Team via the Support Desk.
10.4.1.1 Following receipt by IRIS Connect of a request IRIS Connect and the Customer will discuss and agree in advance on:
10.4.1.2 the reasonable date(s) of and security and confidentiality controls applicable to any review of the Security Measures and Controls Document.
10.4.1.3 the reasonable start date, scope and duration of and security and confidentiality controls applicable to any audit.
10.5 IRIS Connect may charge a fee (based on IRIS Connect’s reasonable costs) for any review of the Security Measures and Controls document and/or audit. IRIS Connect will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such review or audit. The Customer will be responsible for any fees charged by any auditor appointed by the Customer to execute any such audit.
10.6 IRIS Connect may object in writing to an auditor appointed by the Customer to conduct any audit if the auditor is, in IRIS Connect’s reasonable opinion, not suitably qualified or independent, a competitor of IRIS Connect, or otherwise manifestly unsuitable. Any such objection by IRIS Connect will require the Customer to appoint another auditor or conduct the audit itself.
11. Impact Assessments and Consultations
11.1 Customer agrees that IRIS Connect will (taking into account the nature of the processing and the information available to IRIS Connect) assist Customer in ensuring compliance with any obligations of Customer in respect of data protection impact assessments and prior consultation, including if applicable Customer’s obligations pursuant to Articles 35 and 36 of the GDPR, by:
11.1.1 providing the Additional Security Controls in accordance with Section 7.3 (Additional Security Controls) and the Security Documentation
11.1.2 providing the information contained in the applicable Agreement
12 Data Subject Rights; Data Export
12.1 Access; Rectification; Restricted Processing; Portability.
During the applicable Term, IRIS Connect will, in a manner consistent with the functionality of the Services, enable Customer to access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by IRIS Connect as described in Section 6.1 (Deletion During Term), and to export Customer Data.
12.2 Data Subject Requests.
12.2.1 Customer’s Responsibility for Requests.
During the applicable Term, if IRIS Connect receives any request from a data subject in relation to Customer Personal Data, IRIS Connect will advise the data subject to submit his/her request to the Customer, and the Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Services.
12.3.1 IRIS Connect’s Data Subject Request Assistance.
The Customer agrees that (taking into account the nature of the processing of Customer Personal Data) IRIS Connect will assist the Customer in fulfilling any obligation to respond to requests by data subjects, including if applicable the Customer’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR, by:
184.108.40.206 providing the Additional Security Controls in accordance with Section 7.3 (Additional Security Controls); and
220.127.116.11 complying with the commitments set out in Section 12.1 (Access; Rectification; Restricted Processing; Portability) and Section 12.2.1 (Customer’s Responsibility for Requests).
13. Data Transfers
13.1 Data Storage and Processing Facilities.
The Customer agrees that IRIS Connect may, store and process Customer Data in any member state of the EU in which IRIS Connect or any of its Subprocessors maintains facilities.
13.2 Data Centre Information.
IRIS Connect users Amazon AWS storage to store all of Customer Data. Detailed Information about these data centres is available here.
13.3 Location of Customer Data
13.3.1 Customers using the Europe platform (https://europe.irisconnect.com) data will be stored in Dublin, Ireland
13.3 .2 Customers using the US platform (https://us.irisconnect.com) data will be stored in North Virginia, America
13.3 .3 Customers using the Australia platform (https://aus.irisconnect.com) data will be stored in Sydney, Australia
14.1 Consent to Subprocessor Engagement.
Customer specifically authorizes the engagement of IRIS Connect’s Affiliates as Subprocessors. In addition, Customer generally authorizes the engagement of any other third parties as Subprocessors (“Third Party Subprocessors”).
14.2 Information about Subprocessors.
Information about Amazon AWS services, including their functions and locations, is available at https://aws.amazon.com
14.3 Requirements for Subprocessor Engagement.
When engaging any Subprocessor, IRIS Connect will:
14.3.1 ensure via a written contract that:
18.104.22.168 the Subprocessor only accesses and uses Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the applicable Agreement (including this Agreement); and
22.214.171.124 if the GDPR applies to the processing of Customer Personal Data, the data protection obligations set out in Article 28(3) of the GDPR, as described in this Data Processing Agreement, are imposed on the Subprocessor; and
14.3.2 remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.
14.4 Opportunity to Object to Subprocessor Changes
14.4.1 When any new Third Party Subprocessor is engaged during the applicable Term, IRIS Connect will, at least 30 days before the new Third Party Subprocessor processes any Customer Data, inform Customer of the engagement (including the name and location of the relevant subprocessor and the activities it will perform) either by sending an email to the Notification Email Address or via the Admin Console.
14.4 .2 Customer may object to any new Third Party Subprocessor by terminating the applicable Agreement immediately upon written notice to IRIS Connect, on condition that Customer provides such notice within 90 days of being informed of the engagement of the subprocessor as described in Section 11.4(a). This termination right is Customer’s sole and exclusive remedy if Customer objects to any new Third Party Subprocessor.
15 Data Protection Team; Processing Records.
15.1 IRIS Connect’s Data Protection Team
IRIS Connect’s Data Protection Team can be contacted via the Support Desk.
15.2 IRIS Connect’s Processing Records:
Customer acknowledges that IRIS Connect is required under the GDPR to: (a) collect and maintain records of certain information, including the name and contact details of each processor and/or controller on behalf of which IRIS Connect is acting and, where applicable, of such processor’s or controller’s local representative and data protection officer; and (b) make such information available to the supervisory authorities. Accordingly, if the GDPR applies to the processing of Customer Personal Data, Customer will, where requested, provide such information to IRIS Connect via the Admin Console or other means provided by IRIS Connect, and will use the Admin Console or such other means to ensure that all information provided is kept accurate and up-to-date.
16. Subscription Fees & Payment Terms
16.1 Free and Chargeable Services
IRIS Connect offer blend of free and paid for products and services. Free services are exempt from the conditions in this section. For avoidance of doubt, IRIS Connect content licences and Chartered College of Teaching member and course licences are free of charge and exempt from our payment terms.
16.2 Subscription Fees and Payment Terms
Upon receipt of a purchase order from either an IRIS Connect Partner or directly, IRIS Connect will issue an invoice for the hardware and software licence. Terms of payment are within 30 days of delivery of the hardware.
16.3 Hardware (Camera)
16.3.1 If payment is made in full upon start of the contract, ownership of the camera hardware is transferred to the Organization.
16.3.2 If payment is made via financing then the camera hardware is owned by the financing company. Payment can be made at the end of the contracting period to own the hardware.
16.4 Licence Term (Initial Purchase)
The Licence Term is defined by the length of service stated in the purchase order for the product ordered that was submitted to either an IRIS Connect Partner or directly to IRIS Connect, starting from the time of delivery of the hardware or creation of the Organization Administrator Account on the IRIS Connect Platform, whichever, is later.
16.5 Licence Renewal
The Organization Administrator will be contacted prior to the end of the licence term to discuss renewing the subscription by IRIS Connect or an Approved Partner. If a renewal licence is purchased this Agreement will be extended by the period stated in the renewal licence product.
17. Termination and/or Suspension of Account
If an event occurs under Section 17, you will be able to access the system for a period of 60 days following the termination to download any video the Organization wishes to retain.
17.1 By IRIS Connect: Termination of the System
IRIS Connect does not guarantee that it will continue to offer access to the System or support the system. IRIS Connect may cease to provide any or all of the services offered in connection with IRIS Connect (including access to the System and any or all features or components of the system), terminate the Agreement, close all Accounts and cancel all of the rights granted to you under the Agreement. IRIS Connect may communicate such termination to you upon 30 days notice in any of the following manners:
17.1.1 when you log into your Account;
17.1.2 in a notice on IRIS Connect’s website;
17.1.3 via electronic mail; or
17.1.4 in another manner that IRIS Connect deems suitable to inform you of the termination.
17.2 If IRIS Connect terminates the Agreement pursuant to this section, IRIS Connect will promptly reimburse the subscription on a pro-rata basis and the cost of hardware less 33% depreciation per annum.
17.3 By IRIS Connect for Breach or Misconduct
17.4 Suspension of Account
Without limiting IRIS Connect’s rights or remedies, IRIS Connect may inform the Organization of its intention to discontinue or suspend access to the System through the Organization’s Account in the event of:
17.4.1 a breach of this Agreement by the Organization or any user under the Account; or
17.4.2 unauthorized access to the System or use of the system by the Organization or any user under the Account. IRIS Connect have no obligation to reimburse the Organization on a pro rata basis for a suspended account. The Organization will have 30 days to satisfactorily remedy the breach.
17.5 Termination of this Agreement
IRIS Connect may terminate this Agreement, close your Account, and cancel all rights granted to you under the Agreement if:
17.5.1 your Organization fails to pay the subscription fee when due;
17.5.2 IRIS Connect is unable to verify or authenticate any information you provide;
17.5.3 you or anyone using any of your Account materially breaches this Agreement, makes any unauthorized use of the System or Software, or infringes the rights of IRIS Connect or any third party;
17.5.4 IRIS Connect becomes aware of uses under your Account that is deemed, at IRIS Connect’s discretion, inappropriate or in violation of the Rules of Conduct. Such termination shall be effective upon notice transmitted via electronic mail, or any other means reasonably calculated to reach you.
126.96.36.199 Such termination shall be effective upon notice transmitted via electronic mail (read receipt to be provided evidence), or any other means reasonably calculated to reach the Organization which may be evidenced by a signed for delivery receipt. The Organization will have 30 days to satisfactorily remedy the breach prior to termination.
188.8.131.52 IRIS Connect reserves the right to terminate any Accounts that share the name, phone number, e-mail address or internet protocol address with the Closed Account. Termination by IRIS Connect under this section shall be without prejudice to or waiver of any and all of IRIS Connect’s other rights or remedies, all of which are expressly reserved, survive termination, and are cumulative. You will not receive a refund of prepaid subscription fees for a termination pursuant to this section.
17.6 By You: Customer
17.6.1 Any time
You may terminate this Agreement with regard to your Account at any time, upon notice to IRIS Connect via electronic mail. You will not receive a refund of prepaid subscription fees in the event of such termination.
17.6.2 A Change in the Organization EULA
If an amendment alters a material commercial term of this Agreement (not amendments required by changes to the Law) that is unacceptable to you, you may, as your sole and exclusive remedy, terminate this Agreement and close your Account by: clicking the “Sign Out” button when you are prompted to review and agree to the amended Agreement and notifying IRIS Connect via electronic mail within thirty (30) days after the amended Agreement was communicated to you, provided that you have not clicked the “Accept” button or accessed the System during that period.
Your notice must state: that you do not agree to the amended Agreement, specifically describing the amendment(s) with which you disagree, and request IRIS Connect to close your Account. If you click “Accept” or otherwise continue to access the System, you shall be deemed to have accepted the amended Agreement and waive your rights to terminate under this section. IRIS Connect will reimburse the subscription fees on a pro-rata basis and the cost of hardware less 33% depreciation per annum.
17.6.3 System Unavailable 30 Days
The Organization may terminate this Agreement if the IRIS Connect Platform is not available for 30 days continuously. IRIS Connect will reimburse the subscription fees on a pro-rata basis and the cost of hardware less 33% depreciation per annum.
17.6.4 Termination due to IRIS Connect Breach
Organization may terminate this Agreement, and close the Account if IRIS Connect Ltd materially breaches this Agreement, breaches the GDPR or any relevant legislation or infringes the rights of any third party.
184.108.40.206 Such termination shall be effective upon notice transmitted via electronic mail (read receipt to be provided as evidence), or any other means reasonably calculated to reach IRIS Connect Ltd which may be evidenced by a signed for delivery receipt.
17.6.5 Termination due to Non-Renewal of Subscription/Licence
If the Organization does not renew the subscription agreement then the following procedure occurs IRIS Connect will communicate to you via email to advise & seek a response to the following options:
220.127.116.11 Confirm all data and users be deleted
18.104.22.168 Request all or some video’s be provided for download.
22.214.171.124 Option to downgrade to a free Basic/Content user licence account
If no response is received:
126.96.36.199 Your Organization and Users will be downgraded to a Basic/Content user account (this will have reduced functionality as specified by IRIS Connect at its discretion).
188.8.131.52 Data will be held for 12 months from the last activity on the Basic/Content Account.
184.108.40.206 If no activity is recorded on the Platform during that 12 month period. Then the data & users accounts will be deemed a Closed Account (see section 17.4) without further notice.
17.7 Closed Accounts
If for any reason this Agreement is terminated with regard to your Account, that Account will be closed, upon which all rights granted to you under this Agreement shall terminate with regard to the Closed Account, and you must discontinue your use of the Software, and you may not access the System or any Closed Account, and all the attributes of the Accounts.
17.8 Account Access
Customers whose Accounts have been closed may not access the System in any manner or for any reason, including through any other Account, without the express written permission of IRIS Connect. Users of active accounts may not knowingly allow former users whose Accounts have been closed to use the active user’s Account..
17.9. Deletion of Data
All Customer Data will be deleted from our systems as per section 6.2. (Deletion on Term Expiry)
18.1 Software License
Subject to the terms of this Agreement, IRIS Connect grants you a limited, non-exclusive, revocable license to use the Software and its accompanying documentation solely in connection with accessing the System.
18.2 License to Access the System
Upon establishing a valid Account, and subject to your continued compliance with this Agreement, IRIS Connect grants you a limited, non-exclusive, revocable license to access the System.
18.3 Specific Restrictions
18.3.1 Any and all rights not expressly granted by IRIS Connect and IRIS Connect herein are reserved, and no license, permission or right of access or use not granted expressly herein shall be implied.
18.3.2 You may not intercept, for any purpose, information accessible through the System. You may not access the System or upload, download or use information accessible through the System, other than as permitted by this Agreement.
18.3.3 You may not copy (except as set forth above), distribute, rent, lease, loan, modify or create derivative works of, adapt, translate, perform, display, sublicense or transfer the Software or any documentation accompanying the Software.
18.3.4 You may not reverse engineer, disassemble or decompile, or attempt to reverse engineer or derive source code from, all or any portion of the Software, or from any information accessible through the System (including, without limitation, data packets transmitted to and from the System over the Internet), or anything incorporated therein, or analyze, decipher, “sniff” or derive code (or attempt to do any of the foregoing) from any packet stream transmitted to or from the System, whether encrypted or not, or permit any third party to do any of the same, and you hereby expressly waive any legal rights you may have to do so. If the Software and/or the System contains license management technology, you may not circumvent or disable that technology.
19. Proprietary Rights
19.1 Ownership of Software & System
As between you and IRIS Connect, IRIS Connect is the sole and exclusive owner of the Software & System. The Software & System are protected by law governing copyrights, trademarks and other proprietary rights. IRIS Connect reserves all rights not expressly granted herein. The System is comprised of, without limitation, software code, programs, routines, subroutines, objects, files, data, video, text, content, layout, design and other information downloaded from and accessible through the System (collectively, “RIS Connect “). IRIS Connect, its affiliates, licensors and/or suppliers retain all of their right, title and interest (including without limitation all intellectual property rights) in and to the Software & System, and no rights thereto are transferred to you, except for the limited license granted above. IRIS Connect reserves the right to change service provider and/or software as long as the service provision is the same or better.
19.2 Rights to Certain Content
All videos created through your account, are the sole and exclusive property of your Organization, including any and all copyrights and intellectual property rights in or to any and all of the same, all of which are hereby expressly reserved
19.2.1 Non video data contributed by your users to the programmes of 3rd party providers will be treated in line with your service agreement with the 3rd party provider
19.3 User Content
19.3.1 The System may allow you to communicate information, such as by sharing video & comments text, audio & video to group libraries (collectively, User Content).
19.3.2 User Content that you cause to be communicated to the System may not;
220.127.116.11 violate any statute, rule, regulation or law;
18.104.22.168infringe or violate the intellectual property, proprietary, privacy or publicity rights of any third party;
22.214.171.124 be defamatory, indecent, obscene, child pornographic or harmful to minors; or
126.96.36.199 contain any viruses, Trojan horses, disabling code, worms, time bombs, “clear GIFs,” cancelbots or other computer programming or routines that are intended to, or which in fact, damage, detrimentally interfere with, monitor, intercept or expropriate any data, information, packets or personal information.
19.3.3 IRIS Connect may take any action it deems appropriate regarding any User Content, if IRIS Connect believes, in its sole discretion, that such User Content violates this Agreement or may expose IRIS Connect, its licensors and/or its suppliers to liability, damage IRIS Connect’s relationship with any of its suppliers, licensors, ISPs or other users of IRIS Connect, harm anyone or IRIS Connect’s reputation or goodwill.
19.3.4 Violation of IRIS Connect’s proprietary rights is a material breach of this Agreement, in the event of which IRIS Connect may suspend your Account, terminate this Agreement and take whatever additional action IRIS Connect and deems appropriate under the circumstance. The foregoing is without prejudice to or waiver of any and all of IRIS Connect’s other rights and remedies, all of which are expressly reserved, survive termination, and are cumulative.
20.1 The Software and System are provided “As Is,” with all faults, and without warranty of any kind.
20.2 To the extent permitted by law and save as expressly provided herein, IRIS Connect disclaims all warranties, whether express or implied, including without limitation the warranties of merchantability, fitness for particular purpose and non-infringement. IRIS Connect does not warrant that the operation of the System or access to the System, or that use of the Software, will be uninterrupted or error-free, nor that the System or Software will be compatible with the Organization’s hardware and software.
20.3 While IRIS Connect attempts to have the System available at most times, IRIS Connect does not guarantee that the System will always be available, or that the System will not become unavailable during use. The System may become unavailable for a number of reasons, including without limitation during the performance of maintenance to the System, for the implementation of new software, for emergency situations and due to equipment or telecommunications failures.
20.4 IRIS Connect warrants and represents that it shall comply with all applicable laws, statutes, regulations, directives, codes of practice and other analogous guidelines relevant to the Software and the System, including but not limited to those relating to anti-bribery and anti-corruption (such as the Bribery Act 2010).
20.5 The Organization may terminate this contract and take action to recover all its losses if IRIS Connect commits an offence under the Bribery Act 2010 or Section 117(2) of the Local Government Act 1972 (as amended from time to time). Any clause limiting the IRIS Connect’s liability does not apply to this anti-corruption clause.
20.6 During the term of this agreement and for a period of at least three years thereafter, IRIS Connect shall maintain in force, with a reputable insurance company, appropriate insurances to cover its liabilities, including public liability insurance, employer’s liability insurance in an amount not less than £10,000,000 and professional indemnity insurance in an amount not less than £1,000,000 and shall, on the Organization’s request, produce both the insurance certificate giving details of cover and the receipt for the current year’s premium.
21. Disclaimer of Damages
In no event shall IRIS Connect, its affiliates, licensors or suppliers be liable to you or to any third party for any special, indirect, incidental, consequential, punitive or exemplary damages (including without limitation, lost profits or lost data), arising out of or in connection with your Account, the System, Software, User Content, ORGANIZATION EULA, or any other services or materials provided in connection therewith, whether based on warranty, contract, tort or any other legal theory, and whether or not IRIS Connect is advised of the possibility of such damages, and even if any stated remedy fails of its essential purpose.
22. Limitation of Liability
22.1 Except as set forth below, IRIS Connect and IRIS Connect’s maximum liability for any and all claims arising out of or in connection with your Account, the Software, User Content, ORGANIZATION EULA, and any other services or materials provided in connection therewith, shall not exceed an amount equal to the value of your remaining subscription fees.
22.2 In the event of a material breach of IRIS Connect and IRIS Connect’s obligations to provide access to and use of your Account, the System, or User Content, your sole and exclusive remedy shall be a refund of any pre-paid subscription fees attributable to the period during which you were denied such access and use.
22.3 if any of the foregoing disclaimers or limitations of liability are declared to be void or unenforceable, then IRIS Connect’s liability shall be limited to the maximum extent permissible under applicable law. The remedies set forth herein are exclusive and in lieu of all other remedies, oral or written, express or implied.
23.1 The Organization shall defend, indemnify and hold harmless IRIS Connect and its respective employees, officers and directors, from any and all claims, loss, damages and demands, including reasonable legal fees, arising out of the Organization’s (including its users) use or misuse of the Software and/or System.
23.2 IRIS Connect shall defend, indemnify and hold harmless the Organization and its respective employees, governors, agents and officers from any and all claims, loss, damages and demands, including reasonable legal fees, arising out of IRIS Connect’s breach of
23.2.1 any damage to any third party property or for personal injury caused by IRIS Connect’s negligence;
23.2.2 any applicable data protection legislation;
23.2.3 any infringement of third party intellectual property rights; or
23.2.4 any breach of the applicable warranties under clause 20.
24. Amendments to this agreement
24.1 IRIS Connect may, at its sole discretion, amend this Agreement from time to time. If this Agreement is amended, you will be asked to review the amended Agreement when you log into your Account, and to indicate and confirm your acceptance of the amended Agreement by clicking the “Accept” and/or “Confirm” buttons.
25. Governing Law & Exclusive Forum
25.1 This Agreement, and the rights and obligations of the parties hereto, shall be governed and construed by and in accordance with the laws of the England & Wales. The Agreement shall not be governed by the United Nations Convention on Contracts for the International Sale of Goods.
25.2 The sole and exclusive forum for resolving any controversy, dispute or claim arising out of or relating to the Agreement, or otherwise relating to any rights in, access to or use of the Software, System, User Content and/or the rights and obligations of the parties hereto, shall be the English Court.
26.1 If any part of the Agreement is held invalid or unenforceable, that portion shall be construed in a manner consistent with applicable law to reflect, as nearly as possible, the original intentions of the parties expressed in the Agreement, and the remaining portions shall remain in full force and effect.
26.2 The Organization shall comply with all applicable laws regarding your access to and use of the System, use of the Software, your access to your Account. Without limiting the foregoing, you may not download, use or otherwise export or re-export any part of the information accessible through the System or the Software except in full compliance with all applicable laws and regulations.
26.3 Except as otherwise provided herein, you may not assign or transfer the Agreement or your rights there under, and any attempt to do so is void. The Agreement, the subscription fees and payment terms as referenced therein, as each may be amended by IRIS Connect and IRIS Connect from time to time, sets forth the entire understanding and agreement between IRIS Connect and you with respect to the subject matter hereof. Except as provided above, or in a writing signed by both parties, the Agreement may not be modified or amended. No distributor, agent or employee of IRIS Connect is authorized to make any modifications or additions to the Agreement.
26.4 All notices to IRIS Connect required or permitted by the Agreement shall be by electronic mail at firstname.lastname@example.org, unless stated otherwise in the Agreement.
Updated: 4 June 2018
Appendix 1: Subject Matter and Details of the Data Processing
1. Subject Matter
IRIS Connect’s provision of the Services and related technical support to Customer.
2. Duration of the Processing
The applicable Term plus the period from expiry of such Term until deletion of all Customer Data by IRIS Connect in accordance with the Data Processing Agreement.
3. Nature and Purpose of the Processing
IRIS Connect will process Customer Personal Data submitted, stored, sent or received by Customer, its Affiliates or End Users via the Services for the purposes of providing the Services and related technical support to Customer in accordance with the Data Processing Agreement.
4. Categories of Data
Personal data submitted, stored, sent or received by Customer, its Affiliates or End Users via the Services may include the following categories of data: user IDs, email, documents, presentations, images, calendar entries, tasks and other data.
5. Data Subjects
Personal data submitted, stored, sent or received via the Services may concern the following categories of data subjects: End Users including Customer’s employees and contractors; the personnel of Customer’s customers, suppliers and subcontractors; and any other person who transmits data via the Services, including individuals collaborating and communicating with End Users.