- The monitoring, recording, holding and processing of images of distinguishable individuals constitutes personal data as defined by the General Data Protection Regulation (“GDPR”) coming into force on 25 May 2018. This Agreement is intended to ensure that in the use of IRIS Connect it is compliant with the requirements of GDPR, with related legislation and with the CCTV Code of Practice published by the Office of the Information Commissioner.
- Outlines the responsibility for managing IRIS Connect within the Organisation
- Monitoring implementation of this Agreement rests with nominated Organisation Administrators/Data Protection Officer (DPO).
- For the purpose of the GDPR, Organization Administrators are nominated as Data Protection Officer (if no DPO has been required to be nominated under GDPR).
2.1. Capitalised terms
Capitalised terms used but not defined in this Agreement have the meanings given elsewhere in the applicable Agreement. In this Agreement, unless stated otherwise:
- “Additional Products” means products, services, and applications that are not part of the Services but that may be accessible, via the Admin Console or otherwise, for use with the Services.
- “Additional Security Controls” means security resources, features, functionality and/or controls that a Customer may use at its option and/or as it determines. “Additional Security Controls” may include the Admin Console and other features and functionality of the Services such as two-factor authentication, security key enforcement, and monitoring capabilities.
- “Advertising” means online advertisements displayed by IRIS Connect to End Users, excluding any advertisements Customer expressly chooses to have IRIS Connect or any of its Affiliates display in connection with the Services under a separate agreement.
- “Affiliate” means any entity controlling, controlled by, or under common control with a party, where “control” is defined as: (a) the ownership of at least fifty percent (50%) of the equity or beneficial interests of the entity; (b) the right to vote for or appoint a majority of the board of directors or other governing body of the entity; or (c) the power to exercise a controlling influence over the management or policies of the entity.
- “Agreed Liability Cap” means the maximum monetary or payment-based amount at which a party’s liability is capped under the applicable Agreement, either per annual period or event giving rise to liability, as applicable.
- “Agreement Effective Date” means, as applicable:
- (a) 25 May 2018, if Customer clicked to accept or the parties otherwise agreed to this Agreement in respect of the applicable Agreement prior to or on such date; or
- (b) the date on which Customer clicked to accept or the parties otherwise agreed to this Agreement in respect of the applicable Agreement, if such date is after 25 May 2018.
- “Audited Services” means the Services listed as audited in the IRIS Connect Service Summary.
- “Basic/Content Licence” is a feature restricted account on the IRIS Connect Web Platform. Users are able to consume content but not upload.
- “Closed Account” means when an Organisation’s access to their IRIS Connect Accounts is terminated.
- “Complementary Product Agreement” means: any other agreement under which IRIS Connect agrees to provide identity services as such to Customer; or any other agreement that incorporates this Agreement by reference or states that it will apply if accepted by Customer.
- “Complementary Product Services Summary” means the then-current description of the services provided under a Complementary Product Agreement, as set out in the applicable Agreement.
- “Customer Data” means data submitted, stored, sent or received via the Services by Customer, its Affiliates or End Users.
- “Customer Personal Data” means personal data contained within the Customer Data.
- “Data Incident” means a breach of IRIS Connect’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by IRIS Connect. “Data Incidents” will not include unsuccessful attempts or activities that do not compromise the security of Customer Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
- “EEA” means the European Economic Area.
- “European Data Protection Legislation” means, as applicable: (a) the GDPR; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland).
- “Full Activation Date” means: (a) if this Agreement is incorporated into the applicable Agreement by reference, the Agreement Effective Date; or (b) if the parties otherwise agreed to this Agreement, the eighth day after the Agreement Effective Date.
- “Full Licence” means full access to the IRIS Connect Web Platform’s features.
- “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
- “Hardware (Camera)” includes any products purchased from IRIS Connect including the LiveView System, UploadBox, Discovery Kit, Discovery Kite Lite
- “IRIS Connect System” means the Core Services for IRIS Connect, as described in the IRIS Connect Services Summary.
- “IRIS Connect’s Third Party Auditor” means an IRIS Connect-appointed, qualified and independent third party auditor, whose then-current identity IRIS Connect will disclose to Customer.
- “IRIS Connect Services Summary” means the then-current description of the Core Services for IRIS Connect, (as may be updated by IRIS Connect from time to time in accordance with the Agreement).
- “Non-European Data Protection Legislation” means data protection or privacy legislation other than the European Data Protection Legislation.
- “Notification Email Address” means the email address(es) designated by Customer in the Admin Console or the Order Form to receive certain notifications from IRIS Connect.
- “Organisation Administrator”: Data Protection Officer or Senior Person within the Customer organisation who is responsible for overseeing the management of IRIS Connect within the organisation.
- “Security Documentation” means all documents and information made available by IRIS Connect under Section 13 and on our website
- “Security Measures” has the meaning given by IRIS Connect’s Security Measures and Controls document.
- “Services” means the following services, as described in the IRIS Connect Service Summary
- “SOC 2 Report” means a confidential Service Organisation Control (SOC) 2 Report (or a comparable report) on IRIS Connect’s systems examining logical security controls, physical security controls, and system availability, as produced by IRIS Connect’s Third Party Auditor in relation to the Audited Services.
- “Subprocessors” means third parties authorised under this Agreement to have logical access to and process Customer Data in order to provide parts of the Services and related technical support.
- “Term” means the period from the Agreement Effective Date until the end of IRIS Connect’s provision of the Services under the Agreement, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which IRIS Connect may continue providing the Services for transitional purposes.
- “User Content” is any user-created content uploaded to the IRIS Connect Web Platform including video, images, attachments, comments and Groups.
2.2. GDPR Terms
The terms “personal data”, “data subject”, “processing”, “controller”, “processor” and “supervisory authority” as used in this Agreement have the meanings given in the GDPR in each case irrespective of whether the European Data Protection Legislation or Non-European Data Protection Legislation applies.
3. Organisation Administrator Account
A nominated Data Protection Officer/Organisation Administrator (who must be a senior member of staff) agrees to adopt that role in the system and to manage the Organisation’s compliance with this Agreement.
By using the Organisation Administrator Account, the Organisation Administrator agrees that it is authorised and subject to the following obligations on behalf of the Organisation(s):-
3.1 User Management at your Organisation
a) You will be responsible for the creation/amendment/deletion/suspension & management of the user accounts at your Organisation.
b) You are required to monitor the usage of the system and ensure that usage complies with the IRIS Connect End-User Licence Agreement (EULA).
c) If a leaving user chooses to transfer any data that they are managing to the Organisation Administrator – you will be bound by the EULA as if that data was your own.
d) If you use your Organisation Administrator Account to create additional Organisation Administrator Accounts then you confirm that:
(i) you understand that the user for that account will be required to accept these same terms;
(ii) that any additional Organisation Administrator Accounts will only be created for individuals that you warrant are entitled to and in a position to sign up to such terms;
(iii) you are responsible for the actions of any user using an Organisation Administrator Account that you have issued them, any breach of the Organisation EULA by that user will be deemed as a breach of the Organisation EULA by yourself;
3.2 Acceptable Use
a) The IRIS Connect system is for the purpose of continuing professional development / reflective practice. As the ICO ‘Information Commissioners Office’ stated, organisations need to be absolutely clear on when and how the system can be used. Constant monitoring by video camera does not make it a proportionate use of personal data.
b) The Organisation must use the scheduling tool when conducting live observations, which allows users to request reflections. It is vital that users follow this process as it ensures that the observed professional:
- has agreed to the reflection
- knows when the reflection is happening
- knows the purpose of the reflection
- knows if a recording will be made
- knows how long the recording will be stored and who will have access to it
c) Ensure that your local legal framework allows your organisation to use video for professional development purposes. This means appropriate legal permissions from trainees/ clients/customers/end users of your service should be obtained (if their image is likely to be recorded by the IRIS Connect system). Relevant parties should be advised that IRIS Connect will be in use within the Organisation and agreements should be amended accordingly if they do not adequately cover its use.
d) If reflections are likely to involve minors a check should also be completed as to whether any parents/guardians have opted their child out of activities involving video, it is good practice to make alternative provision for those children who have been opted out of video activities.
e) You should ensure that your registration with the Information Commissioner’s Office is up to date and includes the “use” of video and audio data for training and professional development purposes.
f) Everyone involved in a reflection should be informed that the camera is in use and that the video is being recorded for training and professional development purposes.
g) Ensure that observed parties are empowered to turn off the camera system at any time during a reflection and know how to do this.
3.3 Responsible for terminating this Agreement:
Even though IRIS Connect or an Approved Partner will be in contact prior to the expiry of your licence (See section 7.3). It is your responsibility to terminate this agreement and provide instructions regarding section 7.3.5 so that your data can be processed as per your instructions.
4. Managing Sharing of Video
4.1 Managing of content
You will be responsible for the management and monitoring of videos owned by your Organisation. If a user at your Organisation flags an issue with a video, you agree that Organisation Administrators are responsible for investigating the issue and that any inappropriate content is removed.
The Organisation holds the copyright of the recorded video and is the data controller for the purposes of the GDPR.
4.3 Data Processor
The Organisation hereby agrees to designate IRIS Connect Ltd as your nominated Data Processor for the purposes of managing the overall data management architecture and the storage of offsite data on our secure server.
4.4 Delegation of rights
The Organisation agrees to delegate certain data processing rights to users at your Organisation. The observed professional has the right to decide which videos to upload, how long they will be stored for when they will be deleted and which other users will have access to them.
You agree that 3rd party disclosures will not normally be allowed but that s29 DPA98 would allow you to release footage for purposes such as crime prevention or the investigation of a serious incident. A Data Subject Request can be made in writing to the data controller (Organisation Administrator) for access to video, unless dictated by law, access to video will only be made available in a supervised fashion on the Organisation site.
5. IRIS Connect: Best Practice
5.1 Acceptable use
IRIS Connect is not a surveillance device, but a system installed exclusively for educational purposes. GDPR requires that personal data collected for one purpose cannot be further processed for another, incompatible purpose. If the sound and images recorded for professional development are subsequently used to investigate a serious incident, Organisations should seek advice to be absolutely certain that the circumstances warrant using sound and images for this new purpose.
Clearly, as a system for professional development, there is a need to record sound as well as images. In these cases, all data subject whose images and conversations could be captured should be made aware that this is the case.
5.2 Image quality and location of cameras
IRIS Connect uses high-quality video, audio and may have PTZ (pan, tilt, zoom) capabilities. As such, all users of the system must be aware that this has the potential to be invasive if not used appropriately. It is the responsibility of Organisation Administrators to ensure that IRIS Connect is used appropriately. Furthermore, the placement of IRIS Connect cameras is an important consideration. Cameras should be placed and wires connected in accordance with appropriate health and safety guidelines.
5.3 Dissemination of images for training purposes
The IRIS Connect Wed Platform (https://app.irisconnect.com) is a secure server for the selective sharing of training videos. Role based log in and encrypted communications ensure that the videos are secure and only shared with those who have a direct and expressed entitlement to see them. If the Organisation chooses to manage and store their videos locally either on their own network or on a portable media device you agree to indemnify IRIS Connect and associated business partners from any claim arising from the loss or misuse of that video data.
6. Subscription Fees & Payment Terms
6.1 Subscription Fees and Payment Terms
Upon receipt of a purchase order from either an IRIS Connect Partner or directly, IRIS Connect will issue an invoice for the hardware and software licence. Terms of payment are within 30 days of delivery of the hardware.
6.2 Hardware (Camera)
1. If payment is made in full upon the start of the contract, ownership of the camera hardware is transferred to the Organisation.
2. If payment is made via financing then the camera hardware is owned by the financing company. Payment can be made at the end of the contracting period to own the hardware.
6.3 Licence Term (Initial Purchase)
The Licence Term is defined by the length of service stated in the purchase order for the product ordered that was submitted to either an IRIS Connect Partner or directly to IRIS Connect, starting from the time of delivery of the hardware or creation of the Organisation Administrator Account on the IRIS Connect Platform, whichever, is later.
6.4 Licence Renewal
The Organisation Administrator will be contacted prior to the end of the licence term to discuss renewing the subscription by IRIS Connect or an Approved Partner. If a renewal licence is purchased this Agreement will be extended by the period stated in the renewal licence product.
7. Termination and/or Suspension of Account
If an event occurs under Section 7, you will be able to access the system for a period of 60 days following the termination to download any video the Organisation wishes to retain.
7.1. By IRIS Connect: Termination of the System
IRIS Connect does not guarantee that it will continue to offer access to the System or support the system. IRIS Connect may cease to provide any or all of the services offered in connection with IRIS Connect (including access to the System and any or all features or components of the system), terminate the Agreement, close all Accounts and cancel all of the rights granted to you under the Agreement. IRIS Connect may communicate such termination to you upon 30 days notice in any of the following manners:
(a) when you log into your Account;
(b) in a notice on IRIS Connect’s website;
(c) via electronic mail; or
(d) in another manner that IRIS Connect deems suitable to inform you of the termination.
If IRIS Connect terminates the Agreement pursuant to this section, IRIS Connect will promptly reimburse the subscription on a pro-rata basis and the cost of hardware less 33% depreciation per annum.
7.2. By IRIS Connect for Breach or Misconduct
7.2.1 Suspension of Account
Without limiting IRIS Connect’s rights or remedies, IRIS Connect may inform the Organisation of its intention to discontinue or suspend access to the System through the Organisation’s Account in the event of:
(i) a breach of this Agreement by the Organisation or any user under the Account; or
(ii) unauthorised access to the System or use of the system by the Organisation or any user under the Account. IRIS Connect has no obligation to reimburse the Organisation on a pro rata basis for a suspended account. The Organisation will have 30 days to satisfactorily remedy the breach.
7.2.2 Termination of this Agreement
IRIS Connect may terminate this Agreement, close your Account, and cancel all rights granted to you under the Agreement if:
(a) your Organization fails to pay the subscription fee when due;
(b) IRIS Connect is unable to verify or authenticate any information you provide;
(c) you or anyone using any of your Account materially breaches this Agreement makes any unauthorised use of the System or Software or infringes the rights of IRIS Connect or any third party;
(d) IRIS Connect becomes aware of uses under your Account that is deemed, at IRIS Connect’s discretion, inappropriate or in violation of the Rules of Conduct. Such termination shall be effective upon notice transmitted via electronic mail, or any other means reasonably calculated to reach you.
Such termination shall be effective upon notice transmitted via electronic mail (read receipt to be provided evidence), or any other means reasonably calculated to reach the Organisation which may be evidenced by a signed for delivery receipt. The Organisation will have 30 days to satisfactorily remedy the breach prior to termination.
IRIS Connect reserves the right to terminate any Accounts that share the name, phone number, e-mail address or internet protocol address with the Closed Account. Termination by IRIS Connect under this section shall be without prejudice to or waiver of any and all of IRIS Connect’s other rights or remedies, all of which are expressly reserved, survive termination, and are cumulative. You will not receive a refund of prepaid subscription fees for a termination pursuant to this section.
7.3 By You: Customer
7.3.1 Any time
You may terminate this Agreement with regard to your Account at any time, upon notice to IRIS Connect via electronic mail. You will not receive a refund of prepaid subscription fees in the event of such termination.
7.3.2 A Change in the Organisation EULA
If an amendment alters a material commercial term of this Agreement (not amendments required by changes to the Law) that is unacceptable to you, you may, as your sole and exclusive remedy, terminate this Agreement and close your Account by: clicking the “Sign Out” button when you are prompted to review and agree to the amended Agreement and notifying IRIS Connect via electronic mail within thirty (30) days after the amended Agreement was communicated to you, provided that you have not clicked the “Accept” button or accessed the System during that period.
Your notice must state: that you do not agree to the amended Agreement, specifically describing the amendment(s) with which you disagree, and request IRIS Connect to close your Account. If you click “Accept” or otherwise continue to access the System, you shall be deemed to have accepted the amended Agreement and waive your rights to terminate under this section. IRIS Connect will reimburse the subscription fees on a pro-rata basis and the cost of hardware less 33% depreciation per annum.
7.3.3 System Unavailable 30 Days
The Organization may terminate this Agreement if the IRIS Connect Platform is not available for 30 days continuously. IRIS Connect will reimburse the subscription fees on a pro-rata basis and the cost of hardware less 33% depreciation per annum.
7.3.4 Termination due to IRIS Connect Breach
Organisation may terminate this Agreement, and close the Account if IRIS Connect Ltd materially breaches this Agreement, breaches the GDPR or any relevant legislation or infringes the rights of any third party.
Such termination shall be effective upon notice transmitted via electronic mail (read receipt to be provided as evidence), or any other means reasonably calculated to reach IRIS Connect Ltd which may be evidenced by a signed for delivery receipt.
7.3.5 Termination due to Non-Renewal of Subscription/Licence
If the Organisation does not renew the subscription agreement then the following procedure occurs:
i. IRIS Connect will communicate to you via email to advise & seek a response to the following options :-
1.Confirm all data and users be deleted
2.Request all or some video’s be provided for download.
ii. Option to downgrade to a free Basic/Content user licence account
If no response is received your Organisation and Users will be downgraded to a Basic/Content user account (this will have reduced functionality as specified by IRIS Connect at its discretion).
i) Data will be held for 12 months from the last activity on the Basic/Content Account.
ii) If no activity is recorded on the Platform during that 12 month period. Then the data & users accounts will be deemed a Closed Account (see section 7.4) without further notice.
7.4 Closed Accounts
If for any reason this Agreement is terminated with regard to your Account, that Account will be closed, upon which all rights granted to you under this Agreement shall terminate with regard to the Closed Account, and you must discontinue your use of the Software, and you may not access the System or any Closed Account, and all the attributes of the Accounts.
7.4.1 Account Access
Customers whose Accounts have been closed may not access the System in any manner or for any reason, including through any other Account, without the express written permission of IRIS Connect. Users of active accounts may not knowingly allow former users whose Accounts have been closed to use the active user’s Account.
7.4.2 Deletion of Data
All Customer Data will be deleted from our systems as per section 11.2. (Deletion on Term Expiry)
8.1 Software License
Subject to the terms of this Agreement, IRIS Connect grants you a limited, non-exclusive, revocable license to use the Software and its accompanying documentation solely in connection with accessing the System.
8.2 License to Access the System
Upon establishing a valid Account, and subject to your continued compliance with this Agreement, IRIS Connect grants you a limited, non-exclusive, revocable license to access the System.
8.3 Specific Restrictions
Any and all rights not expressly granted by IRIS Connect and IRIS Connect herein are reserved, and no license, permission or right of access or use not granted expressly herein shall be implied.
You may not intercept, for any purpose, information accessible through the System. You may not access the System or upload, download or use information accessible through the System, other than as permitted by this Agreement.
You may not copy (except as set forth above), distribute, rent, lease, loan, modify or create derivative works of, adapt, translate, perform, display, sublicense or transfer the Software or any documentation accompanying the Software.
You may not reverse engineer, disassemble or decompile, or attempt to reverse engineer or derive source code from, all or any portion of the Software, or from any information accessible through the System (including, without limitation, data packets transmitted to and from the System over the Internet), or anything incorporated therein, or analyse, decipher, “sniff” or derive code (or attempt to do any of the foregoing) from any packet stream transmitted to or from the System, whether encrypted or not, or permit any third party to do any of the same, and you hereby expressly waive any legal rights you may have to do so. If the Software and/or the System contains license management technology, you may not circumvent or disable that technology.
9. Proprietary Rights
9.1 Ownership of Software & System
As between you and IRIS Connect, IRIS Connect is the sole and exclusive owner of the Software & System. The Software & System are protected by law governing copyrights, trademarks and other proprietary rights. IRIS Connect reserves all rights not expressly granted herein. The System is comprised of, without limitation, software code, programs, routines, subroutines, objects, files, data, video, text, content, layout, design and other information downloaded from and accessible through the System (collectively, “RIS Connect “). IRIS Connect, its affiliates, licensors and/or suppliers retain all of their right, title and interest (including without limitation all intellectual property rights) in and to the Software & System, and no rights thereto are transferred to you, except for the limited license granted above. IRIS Connect reserves the right to change service provider and/or software as long as the service provision is the same or better.
9.2 Rights to Certain Content
All videos created through your account, are the sole and exclusive property of your Organisation, including any and all copyrights and intellectual property rights in or to any and all of the same, all of which are hereby expressly reserved.
9.3 User Content
The System may allow you to communicate information, such as by sharing video & comments text, audio & video to group libraries (collectively, User Content).
User Content that you cause to be communicated to the System may not:
(i) violate any statute, rule, regulation or law;
(ii) infringe or violate the intellectual property, proprietary, privacy or publicity rights of any third party;
(iii) be defamatory, indecent, obscene, child pornographic or harmful to minors; or
(iv) contain any viruses, Trojan horses, disabling code, worms, time bombs, “clear GIFs,” cancelbots or other computer programming or routines that are intended to, or which in fact, damage, detrimentally interfere with, monitor, intercept or expropriate any data, information, packets or personal information.
IRIS Connect may take any action it deems appropriate regarding any User Content, if IRIS Connect believes, in its sole discretion, that such User Content violates this Agreement or may expose IRIS Connect, its licensors and/or its suppliers to liability, damage IRIS Connect’s relationship with any of its suppliers, licensors, ISPs or other users of IRIS Connect, harm anyone or IRIS Connect’s reputation or goodwill.
Violation of IRIS Connect’s proprietary rights is a material breach of this Agreement, in the event of which IRIS Connect may suspend your Account, terminate this Agreement and take whatever additional action IRIS Connect and deems appropriate under the circumstance. The foregoing is without prejudice to or waiver of any and all of IRIS Connect’s other rights and remedies, all of which are expressly reserved, survive termination, and are cumulative.
10. Data Processing Agreement – GDPR
10.1. Duration of Data Processing Agreement.
This Agreement will take effect on the effective Date and, notwithstanding expiry of the Term, remain in effect until, and automatically expire upon, deletion of all Customer Data by IRIS Connect as described in this Agreement.
10.2 Scope of Data Protection Legislation.
10.2.1 Application of European Legislation.
The parties acknowledge and agree that the European Data Protection Legislation will apply to the processing of Customer Personal Data if, for example:
(a) the processing is carried out in the context of the activities of an establishment of Customer in the territory of the EEA; and/or
(b) the Customer Personal Data is personal data relating to data subjects who are in the EEA and the processing relates to the offering to them of goods or services in the EEA or the monitoring of their behaviour in the EEA.
10.2.2 Application of Non-European Legislation.
The parties acknowledge and agree that Non-European Data Protection Legislation may also apply to the processing of Customer Personal Data.
10.3. Processing of Data.
10.3.1 Processor and Controller Responsibilities.
If the European Data Protection Legislation applies to the processing of Customer Personal Data, the parties acknowledge and agree that:
(a) the subject matter and details of the processing are described in Appendix 1;
(b) IRIS Connect is a processor of that Customer Personal Data under the European Data Protection Legislation;
(c) The Customer is a controller or processor, as applicable, of that Customer Personal Data under the European Data Protection Legislation; and
(d) each party will comply with the obligations applicable to it under the European Data Protection Legislation with respect to the processing of that Customer Personal Data.
10.3.2 Authorization by Third Party Controller.
If the European Data Protection Legislation applies to the processing of Customer Personal Data and the Customer is a processor, the Customer warrants to IRIS Connect that the Customer’s instructions and actions with respect to that Customer Personal Data, including its appointment of IRIS Connect as another processor, have been authorized by the relevant controller.
10.3.3 Responsibilities under Non-European Legislation.
If Non-European Data Protection Legislation applies to either party’s processing of Customer Personal Data, the parties acknowledge and agree that the relevant party will comply with any obligations applicable to it under that legislation with respect to the processing of that Customer Personal Data.
10.4 Scope of Processing.
10.4.1 Customer’s Instructions.
By entering into this Data Processing Agreement, the Customer instructs IRIS Connect to process Customer Personal Data only in accordance with applicable law:
(a) to provide the Services and related technical support;
(b) as further specified via Customer’s use of the Services (including the Admin Console and other functionality of the Services) and related technical support;
(c) as further documented in any other written instructions given by Customer and acknowledged by IRIS Connect as constituting instructions for purposes of this Data Processing Agreement.
10.4.2 IRIS Connect’s Compliance with Instructions.
As from the Full Activation Date, IRIS Connect will comply with the instructions described in Section 10.4.1 (Customer’s Instructions) (including with regard to data transfers) unless EU or EU Member State law to which IRIS Connect is subject requires other processing of Customer Personal Data by IRIS Connect, in which case IRIS Connect will inform Customer (unless that law prohibits IRIS Connect from doing so on important grounds of public interest) via the Notification Email Address. For clarity, IRIS Connect will not process Customer Personal Data for Advertising purposes or serve Advertising in the Services.
10.4.3 Additional Products.
If IRIS Connect at its option makes any Additional Products available to Customer in accordance with the Additional Product Terms (if applicable), and if Customer opts to install or use those Additional Products, the Services may allow those Additional Products to access Customer Personal Data as required for the interoperation of the Additional Products with the Services. For clarity, this Data Processing Agreement does not apply to the processing of personal data in connection with the provision of any Additional Products installed or used by Customer, including personal data transmitted to or from such Additional Products. Customer may use the functionality of the Services to enable or disable Additional Products, and is not required to use Additional Products in order to use the Services.
11. Data Deletion
11.1. Deletion During Term.
IRIS Connect will enable the Customer and/or End Users to delete Customer Data during the applicable Term in a manner consistent with the functionality of the Services. If the Customer or an End User uses the Services to delete any Customer Data during the applicable Term, this use will constitute an instruction to IRIS Connect to delete the relevant Customer Data from IRIS Connect’s systems in accordance with applicable law. IRIS Connect will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless EU or EU Member State law requires storage.
11.2. Deletion on Term Expiry.
Subject to Section 11.3 (Deferred Deletion Instruction), on expiry of the applicable Term Customer instructs IRIS Connect to delete all Customer Data (including existing copies) from IRIS Connect’s systems in accordance with applicable law. IRIS Connect will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless EU or EU Member State law requires storage. Without prejudice to Section 17.1 (Access; Rectification; Restricted Processing; Portability), Customer acknowledges and agrees that Customer will be responsible for exporting before the applicable Term expires, any Customer Data it wishes to retain afterward.
11.3. Deferred Deletion Instruction.
To the extent any Customer Data covered by the deletion instruction described in Section 11.2 (Deletion on Term Expiry) is also processed, when the applicable Term under Section 11.2 expires, in relation to an Agreement with a continuing Term, such deletion instruction will only take effect with respect to such Customer Data when the continuing Term expires. For clarity, this Data Processing Agreement will continue to apply to such Customer Data until its deletion by IRIS Connect.
12. Data Security
12.1 IRIS Connect’s Security Measures, Controls, and Assistance.
12.1.1 IRIS Connect’s Security Measures.
IRIS Connect will implement and maintain technical and organisational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access as described in the Security Controls and Measures document. The Security Controls and Measures document includes measures to encrypt personal data; to help ensure ongoing confidentiality, integrity, availability and resilience of IRIS Connect’s systems and services; to help restore timely access to personal data following an incident; for regular testing of effectiveness. IRIS Connect may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services.
12.1.2 Security Compliance by IRIS Connect Staff.
IRIS Connect will take appropriate steps to ensure compliance with the Security Measures by its employees, contractors, and Subprocessors to the extent applicable to their scope of performance, including ensuring that all persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
12.1.3 Additional Security Controls
In addition to the Security Measures, IRIS Connect will make the Additional Security Controls available to:
(a) allow Customer to take steps to secure Customer Data; and
(b) provide Customer with information about securing, accessing and using Customer Data.
The Additional Security Controls are outlined in the Security Measures and Controls Document
12.1.4 IRIS Connect’s Security Assistance.
Customer agrees that IRIS Connect will (taking into account the nature of the processing of Customer Personal Data and the information available to IRIS Connect) assist Customer in ensuring compliance with any of Customer’s obligations in respect of security of personal data and personal data breaches, including if applicable Customer’s obligations pursuant to Articles 32 to 34 (inclusive) of the GDPR, by:
(a) implementing and maintaining the Security Measures in accordance with Section 12.1.1 (IRIS Connect’s Security Measures);
(b) making the Additional Security Controls available to Customer in accordance with Section 12.1.3 (Additional Security Controls);
(c) complying with the terms of Section 13.2 (Data Incidents); and
(d) providing Customer with the Security Documentation in accordance with Section 15.1 (Reviews of Security Documentation) and the information contained in the applicable Agreement.
13. Data Incidents
13.1 Incident Notification.
If IRIS Connect becomes aware of a Data Incident, IRIS Connect will: (a) notify Customer of the Data Incident promptly and without undue delay; and (b) promptly take reasonable steps to minimize harm and secure Customer Data. Further information about IRIS Connect’s Data Breach Response and Notification Procedure can be found here.
13.2 Details of Data Incident.
Notifications made pursuant to this section will describe, to the extent possible, details of the Data Incident, including steps taken to mitigate the potential risks and steps IRIS Connect recommends Customer take to address the Data Incident.
13.3 Delivery of Notification.
Notification(s) of any Data Incident(s) will be delivered to the Notification Email Address or, at IRIS Connect’s discretion, by direct communication (for example, by phone call or an in-person meeting). Customer is solely responsible for ensuring that the Notification Email Address is current and valid.
13.4 No Assessment of Customer Data by IRIS Connect.
IRIS Connect will not assess the contents of Customer Data in order to identify information subject to any specific legal requirements. Customer is solely responsible for complying with incident notification laws applicable to Customer and fulfilling any third party notification obligations related to any Data Incident(s).
13.5 No Acknowledgment of Fault by IRIS Connect.
IRIS Connect’s notification of or response to a Data Incident under this Section 13.2 (Data Incidents) will not be construed as an acknowledgement by IRIS Connect of any fault or liability with respect to the Data Incident.
14 Customer’s Security Responsibilities and Assessment
14.1 Customer’s Security Responsibilities.
The Customer agrees that, without prejudice to IRIS Connect’s obligations under Section 12.1 (IRIS Connect’s Security Measures, Controls and Assistance) and Section 13 (Data Incidents):
(a) Customer is solely responsible for its use of the Services, including:
(i) making appropriate use of the Services and the Additional Security Controls to ensure a level of security appropriate to the risk in respect of the Customer Data;
(ii) securing the account authentication credentials, systems and devices Customer uses to access the Services; and
(b) IRIS Connect has no obligation to protect Customer Data that Customer elects to store or transfer outside of IRIS Connect’s and its Subprocessors’ systems (for example, offline or on-premise storage), or to protect Customer Data by implementing or maintaining Additional Security Controls except to the extent Customer has opted to use them.
14.2 Customer’s Security Assessment.
(a) Customer is solely responsible for reviewing the Security Documentation and evaluating for itself whether the Services, the Security Measures, the Additional Security Controls and IRIS Connect’s commitments under this Section 12 (Data Security) will meet Customer’s needs, including with respect to any security obligations of Customer under the European Data Protection Legislation and/or Non-European Data Protection Legislation, as applicable.
(b) Customer acknowledges and agrees that (taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of Customer Personal Data as well as the risks to individuals) the Security Measures implemented and maintained by IRIS Connect as set out in Section 12.1.1 (IRIS Connect’s Security Measures) provide a level of security appropriate to the risk in respect of the Customer Data.
14.3 Security Certifications and Reports,
IRIS Connect will do the following to evaluate and help ensure the continued effectiveness of the Security Measures:
14.3.1 Internal Certifications and Reports
(a) maintain the DfE Cloud Service Providers self certification
(b) maintain Cyber Essentials (or higher) certification
14.3.2 Amazon Certification and Reports
Review the following reports of and certifications reports as they are updated to ensure they maintain or improve on their existing security standards:
(a) SOC 2
(b) SOC 3
(c ) ISO 9001
(d) ISO 27001
(e) ISO 27017
(f) ISO 27018
15. Reviews and Audits of Compliance
15.1 Reviews of Security Documentation
15.1.1 Internal Security Documentation
In addition to the information contained in the applicable Agreement, IRIS Connect will make available for review by the Customer the following documents and information to demonstrate compliance by IRIS Connect with its obligations under this document:
1.The IRIS Connect Security Measures and Controls document
2.DfE Cloud Service Providers certificate and independent audit
3.Cyber Essentials certificate
15.1.2 Amazon Security Documentation
15.2 Customer’s Audit Rights.
(a) If the European Data Protection Legislation applies to the processing of Customer Personal Data, IRIS Connect will allow Customer or an independent auditor appointed by Customer to conduct audits (including inspections) to verify IRIS Connect’s compliance with its obligations under this Data Processing Agreement in accordance with Section 15.3 (Additional Business Terms for Reviews and Audits). IRIS Connect will contribute to such audits as described in Section 13.4 (Security Certifications and Reports) and this Section 15 (Reviews and Audits of Compliance).
(b) Customer may also conduct an audit to verify IRIS Connect’s compliance with its obligations under this Data Processing Agreement by reviewing the Security Documentation (which reflects the outcome of audits conducted by IRIS Connect’s Third Party Auditor).
15.3 Additional Business Terms for Reviews and Audits.
(a) Customer must send any requests for reviews of the Security Measures and Controls document or audits to IRIS Connect’s Data Protection Team via the Support Desk.
(b) Following receipt, by IRIS Connect of a request IRIS Connect and the Customer will discuss and agree in advance on:
(i) the reasonable date(s) of and security and confidentiality controls applicable to any review of the Security Measures and Controls Document.
(ii) the reasonable start date, scope, and duration of and security and confidentiality controls applicable to any audit.
(c) IRIS Connect may charge a fee (based on IRIS Connect’s reasonable costs) for any review of the Security Measures and Controls document and/or audit. IRIS Connect will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such review or audit. The Customer will be responsible for any fees charged by any auditor appointed by the Customer to execute any such audit.
(d) IRIS Connect may object in writing to an auditor appointed by the Customer to conduct any audit if the auditor is, in IRIS Connect’s reasonable opinion, not suitably qualified or independent, a competitor of IRIS Connect, or otherwise manifestly unsuitable. Any such objection by IRIS Connect will require the Customer to appoint another auditor or conduct the audit itself.
16. Impact Assessments and Consultations
Customer agrees that IRIS Connect will (taking into account the nature of the processing and the information available to IRIS Connect) assist Customer in ensuring compliance with any obligations of Customer in respect of data protection impact assessments and prior consultation, including if applicable Customer’s obligations pursuant to Articles 35 and 36 of the GDPR, by:
(a) providing the Additional Security Controls in accordance with Section 12.1.3 (Additional Security Controls) and the Security Documentation in accordance with Section 15.1 (Reviews of Security Documentation); and
(b) providing the information contained in the applicable Agreement
17. Data Subject Rights; Data Export
17.1 Access; Rectification; Restricted Processing; Portability.
During the applicable Term, IRIS Connect will, in a manner consistent with the functionality of the Services, enable Customer to access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by IRIS Connect as described in Section 11.1 (Deletion During Term), and to export Customer Data.
17.2 Data Subject Requests.
17.2.1 Customer’s Responsibility for Requests.
During the applicable Term, if IRIS Connect receives any request from a data subject in relation to Customer Personal Data, IRIS Connect will advise the data subject to submit his/her request to the Customer, and the Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Services.
17.2.2 IRIS Connect’s Data Subject Request Assistance.
The Customer agrees that (taking into account the nature of the processing of Customer Personal Data) IRIS Connect will assist the Customer in fulfilling any obligation to respond to requests by data subjects, including if applicable the Customer’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR, by:
(a) providing the Additional Security Controls in accordance with Section 12.1.3 (Additional Security Controls); and
(b) complying with the commitments set out in Section 17.1 (Access; Rectification; Restricted Processing; Portability) and Section 17.2.1 (Customer’s Responsibility for Requests).
18 Data Transfers
18.1 Data Storage and Processing Facilities.
The Customer agrees that IRIS Connect may, store and process Customer Data in any member state of the EU in which IRIS Connect or any of its Subprocessors maintains facilities.
18.2 Data Centre Information.
IRIS Connect users Amazon AWS storage to store all of Customer Data. Detailed Information about these data centres is available here.
18.3 Location of Customer Data
1.Customers using the Europe platform (https://europe.irisconnect.com) data will be stored in Dublin, Ireland
2.Customers using the US platform (https://us.irisconnect.com) data will be stored in North Virginia, America
3.Customers using the Australia platform (https://aus.irisconnect.com) data will be stored in Sydney, Australia
19.1 Consent to Subprocessor Engagement.
Customer specifically authorises the engagement of IRIS Connect’s Affiliates as Subprocessors. In addition, Customer generally authorizes the engagement of any other third parties as Subprocessors (“Third Party Subprocessors”).
19.2 Information about Subprocessors.
Information about Amazon AWS services, including their functions and locations, is available at https://aws.amazon.com
19.3 Requirements for Subprocessor Engagement.
When engaging any Subprocessor, IRIS Connect will:
(a) ensure via a written contract that:
(i) the Subprocessor only accesses and uses Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the applicable Agreement (including this Agreement); and
(ii) if the GDPR applies to the processing of Customer Personal Data, the data protection obligations set out in Article 28(3) of the GDPR, as described in this Data Processing Agreement, are imposed on the Subprocessor; and
(b) remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.
19.4 Opportunity to Object to Subprocessor Changes
(a) When any new Third Party Subprocessor is engaged during the applicable Term, IRIS Connect will, at least 30 days before the new Third Party Subprocessor processes any Customer Data, inform Customer of the engagement (including the name and location of the relevant subprocessor and the activities it will perform) either by sending an email to the Notification Email Address or via the Admin Console.
(b) Customer may object to any new Third Party Subprocessor by terminating the applicable Agreement immediately upon written notice to IRIS Connect, on condition that Customer provides such notice within 90 days of being informed of the engagement of the subprocessor as described in Section 11.4(a). This termination right is Customer’s sole and exclusive remedy if Customer objects to any new Third Party Subprocessor.
20 Data Protection Team; Processing Records.
20.1 IRIS Connect’s Data Protection Team
IRIS Connect’s Data Protection Team can be contacted via the Support Desk.
20.2 IRIS Connect’s Processing Records:
Customer acknowledges that IRIS Connect is required under the GDPR to: (a) collect and maintain records of certain information, including the name and contact details of each processor and/or controller on behalf of which IRIS Connect is acting and, where applicable, of such processor’s or controller’s local representative and data protection officer; and (b) make such information available to the supervisory authorities. Accordingly, if the GDPR applies to the processing of Customer Personal Data, Customer will, where requested, provide such information to IRIS Connect via the Admin Console or other means provided by IRIS Connect, and will use the Admin Console or such other means to ensure that all information provided is kept accurate and up-to-date.
The Software and System are provided “As Is,” with all faults, and without warranty of any kind.
To the extent permitted by law and save as expressly provided herein, IRIS Connect disclaims all warranties, whether express or implied, including without limitation the warranties of merchantability, fitness for particular purpose and non-infringement. IRIS Connect does not warrant that the operation of the System or access to the System, or that use of the Software, will be uninterrupted or error-free, nor that the System or Software will be compatible with the Organisation’s hardware and software.
While IRIS Connect attempts to have the System available at most times, IRIS Connect does not guarantee that the System will always be available, or that the System will not become unavailable during use. The System may become unavailable for a number of reasons, including without limitation during the performance of maintenance to the System, for the implementation of new software, for emergency situations and due to equipment or telecommunications failures.
IRIS Connect warrants and represents that it shall comply with all applicable laws, statutes, regulations, directives, codes of practice and other analogous guidelines relevant to the Software and the System, including but not limited to those relating to anti-bribery and anti-corruption (such as the Bribery Act 2010).
The Organisation may terminate this contract and take action to recover all its losses if IRIS Connect commits an offence under the Bribery Act 2010 or Section 117(2) of the Local Government Act 1972 (as amended from time to time). Any clause limiting the IRIS Connect’s liability does not apply to this anti-corruption clause.
During the term of this agreement and for a period of at least three years thereafter, IRIS Connect shall maintain in force, with a reputable insurance company, appropriate insurances to cover its liabilities, including public liability insurance, employer’s liability insurance in an amount not less than £10,000,000 and professional indemnity insurance in an amount not less than £1,000,000 and shall, on the Organisation’s request, produce both the insurance certificate giving details of cover and the receipt for the current year’s premium.
22. Disclaimer of Damages
In no event shall IRIS Connect, its affiliates, licensors or suppliers be liable to you or to any third party for any special, indirect, incidental, consequential, punitive or exemplary damages (including without limitation, lost profits or lost data), arising out of or in connection with your Account, the System, Software, User Content, ORGANISATION EULA, or any other services or materials provided in connection therewith, whether based on warranty, contract, tort or any other legal theory, and whether or not IRIS Connect is advised of the possibility of such damages, and even if any stated remedy fails of its essential purpose.
23. Limitation of Liability
Except as set forth below, IRIS Connect and IRIS Connect’s maximum liability for any and all claims arising out of or in connection with your Account, the Software, User Content, ORGANISATION EULA, and any other services or materials provided in connection therewith, shall not exceed an amount equal to the value of your remaining subscription fees.
In the event of a material breach of IRIS Connect and IRIS Connect’s obligations to provide access to and use of your Account, the System, or User Content, your sole and exclusive remedy shall be a refund of any pre-paid subscription fees attributable to the period during which you were denied such access and use.
If any of the foregoing disclaimers or limitations of liability are declared to be void or unenforceable, then IRIS Connect’s liability shall be limited to the maximum extent permissible under applicable law. The remedies set forth herein are exclusive and in lieu of all other remedies, oral or written, express or implied.
The Organisation shall defend, indemnify and hold harmless IRIS Connect and its respective employees, officers, and directors, from any and all claims, loss, damages, and demands, including reasonable legal fees, arising out of the Organisation’s (including its users) use or misuse of the Software and/or System.
IRIS Connect shall defend, indemnify and hold harmless this Agreement and its respective employees, governors, agents and officers from any and all claims, loss, damages and demands, including reasonable legal fees, arising out of IRIS Connect’s breach of
(a) any damage to any third party property or for personal injury caused by IRIS Connect’s negligence;
(b) any applicable data protection legislation;
(c) any infringement of third party intellectual property rights; or (iv) any breach of the applicable warranties under clause 19.
25. Amendments to this agreement
IRIS Connect may, at its sole discretion, amend this Agreement from time to time. If this Agreement is amended, you will be asked to review the amended Agreement when you log into your Account, and to indicate and confirm your acceptance of the amended Agreement by clicking the “Accept” and/or “Confirm” buttons.
26. Governing Law & Exclusive Forum
This Agreement, and the rights and obligations of the parties hereto, shall be governed and construed by and in accordance with the laws of the England & Wales. The Agreement shall not be governed by the United Nations Convention on Contracts for the International Sale of Goods.
The sole and exclusive forum for resolving any controversy, dispute or claim arising out of or relating to the Agreement, or otherwise relating to any rights in, access to or use of the Software, System, User Content and/or the rights and obligations of the parties hereto, shall be the English Court.
If any part of the Agreement is held invalid or unenforceable, that portion shall be construed in a manner consistent with applicable law to reflect, as nearly as possible, the original intentions of the parties expressed in the Agreement, and the remaining portions shall remain in full force and effect.
The Organisation shall comply with all applicable laws regarding your access to and use of the System, use of the Software, your access to your Account. Without limiting the foregoing, you may not download, use or otherwise export or re-export any part of the information accessible through the System or the Software except in full compliance with all applicable laws and regulations.
Except as otherwise provided herein, you may not assign or transfer the Agreement or your rights thereunder, and any attempt to do so is void. The Agreement, including the Rules of Conduct and the subscription fees and payment terms as referenced therein, as each may be amended by IRIS Connect and IRIS Connect from time to time, sets forth the entire understanding and agreement between IRIS Connect and you with respect to the subject matter hereof. Except as provided above, or in a writing signed by both parties, the Agreement may not be modified or amended. No distributor, agent or employee of IRIS Connect is authorised to make any modifications or additions to the Agreement.
All notices to IRIS Connect required or permitted by the Agreement shall be by electronic mail at email@example.com, unless stated otherwise in the Agreement.
Updated: April 2018
Appendix 1: Subject Matter and Details of the Data Processing
IRIS Connect’s provision of the Services and related technical support to Customer.
Duration of the Processing
The applicable Term plus the period from the expiry of such Term until deletion of all Customer Data by IRIS Connect in accordance with the Data Processing Agreement.
Nature and Purpose of the Processing
IRIS Connect will process Customer Personal Data submitted, stored, sent or received by Customer, its Affiliates or End Users via the Services for the purposes of providing the Services and related technical support to Customer in accordance with the Data Processing Agreement.
Categories of Data
Personal data submitted, stored, sent or received by Customer, its Affiliates or End Users via the Services may include the following categories of data: user IDs, email, documents, presentations, images, calendar entries, tasks and other data.
Personal data submitted, stored, sent or received via the Services may concern the following categories of data subjects: End Users including Customer’s employees and contractors; the personnel of Customer’s customers, suppliers and subcontractors; and any other person who transmits data via the Services, including individuals collaborating and communicating with End Users.
Updated: 25th April 2018 Version 0.2