Introduction
This Data Processing Agreement (the “Processing Agreement”), together with its annexes, sets out the parties’ agreement with respect to the processing of personal data by Ganado Services Limited (C 10785) of 171, Old Bakery Street, Valletta, Malta (“GSL”) in connection with the service agreement entered into between GSL and the person or entity identified therein as the “Company” and/or “You” (herein also referred to as the “Company”) (the “Service Agreement”).
This Processing Agreement is supplemental to, forms an integral part of, and is incorporated by reference into the Service Agreement, which also incorporates the GSL Terms of Business (the “Terms”). This Processing Agreement shall take effect upon the earlier of: (i) the Company’s signature of the Service Agreement; or (ii) GSL’s provision of any of the Processor Services to or for the Company. In the case of any conflict or inconsistency between this Processing Agreement and the Service Agreement in respect of any matter relating to the processing of personal data, this Processing Agreement shall prevail to the extent of such conflict or inconsistency.
Throughout this Processing Agreement, GSL and the Company shall, whenever appropriate, be jointly referred to as the “Parties” and each as a “Party”.
Background:
(i) GSL and the Company have entered into a service agreement for the provision of certain services by GSL, as more fully described therein;
(ii) In relation to some of those services, GSL may, for the purposes of applicable Data Protection Laws, act as a processor on behalf of the Company, as controller. By way of indication, such services, as offered by GSL, may include the following:
- engagement as company secretary;
- provision of registered office;
- engagement as judicial representative;
- provision of corporate administrative services, such as preparation of company books;
- generally, any other instance where GSL is engaged to hold an internal role or position for the Company or otherwise act as an agent for the Company;
(collectively, the “Processor Services”).
(iii) Outside the scope of the Processor Services, GSL acts as a controller in respect of the personal data which it processes in relation to the Company or the Service Agreement, including in the context of its KYC requirements. GSL’s privacy notice, available at: https://ganado.com/privacy-notice/#services (the “Privacy Notice”), describes the personal data which GSL processes as a controller, the purposes for which such personal data is processed, and further information on the matters listed in Articles 13 and 14 of the GDPR;
(iv) This Processing Agreement defines the data processing relationship between the Parties limitedly in the context of the Processor Services provided or carried out by GSL for the Company and sets out the terms on which GSL shall process personal data as a processor on behalf of the Company. This Processing Agreement contains the mandatory clauses required by Article 28(3) of the GDPR for the engagement of processors by controllers;
(v) This Processing Agreement does not substitute or override the Privacy Notice, which applies to the exclusion of this Processing Agreement where GSL acts as a controller;
(vi) This Processing Agreement is supplemental to and forms an integral part of the Service Agreement, which also incorporates the Terms.
Agreed terms
1. Definitions and Interpretation.
1.1 Capitalised terms used in the recitals but not otherwise defined therein shall have the meanings given to them in this Processing Agreement.
1.2 The following definitions and rules of interpretation apply in this Processing Agreement:
- “Authorised Persons” means the persons or categories of persons authorised by the Company to give processing instructions to GSL, as identified in clause 5.1 below;
- “Company Data” means personal data processed by GSL as a processor on behalf of the Company in connection with the Processor Services;
- “Data Protection Laws” means all applicable data protection and privacy laws to which the Parties are subject in connection with the Processor Services, including (i) the GDPR and any successor legislation to it, (ii) the Data Protection Act, Chapter 586 of the laws of Malta, and (iii) any and all national implementing laws, regulations and secondary legislation applicable in Malta relating to the processing of personal data; in each case as may be introduced, amended or updated from time to time;
- “Processor Services” means those services provided or to be provided by GSL under the Service Agreement in respect of which GSL processes (or shall process) Company Data as processor on behalf of the Company, including the services described in the Background section; and
- “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Regulation (EU) 2016/679, including those set out in the Annex to Commission Implementing Decision C(2021) 3972 final, and any successor, replacement or amended standard contractual clauses adopted by the European Commission from time to time.
1.3 The terms “controller”, “data subject”, “joint controller”, “personal data”, “personal data breach”, “process”, “processing”, “processor”, “supervisory authority”, “third country” and “third party” shall have the meanings given to them in the GDPR and their cognate terms shall be construed accordingly.
1.4 This Processing Agreement is supplemental to the Service Agreement (and by extension the Terms) and is incorporated by reference. Capitalised terms used but not otherwise defined in this Processing Agreement shall, where applicable, have the meanings given to them in the Service Agreement or the Terms.
1.5 The annexes form part of this Processing Agreement, and any reference to this Processing Agreement includes its annexes.
1.6 In the case of any conflict or inconsistency between:
- any term in the body of this Processing Agreement and anything in its annexes, the relevant term in the body of this Processing Agreement shall prevail; and
- the terms of this Processing Agreement and the terms of the Service Agreement on any matter relating to the processing of personal data, this Processing Agreement shall prevail and take precedence over the Service Agreement to the extent of such conflict or inconsistency.
2. Appointment and Role.
2.1 Subject to the clauses of this Processing Agreement, GSL is hereby appointed by the Company to process personal data on its behalf in connection with the Processor Services.
2.2 Insofar as the Processor Services are concerned, the Parties acknowledge and agree that:
- the Company is the controller of Company Data;
- GSL acts as a processor on behalf of the Company in respect of Company Data; and
- the Company remains responsible for ensuring and maintaining its compliance with its obligations as controller under Data Protection Laws, including, without limitation, by providing required notices to, and obtaining necessary consents from, relevant data subjects, and ensuring the lawfulness of any instructions it gives to GSL.
2.3 Outside the scope of the Processor Services and/or their provision by GSL:
- this Processing Agreement shall not apply; and
- the Privacy Notice shall be the relevant document in relation to GSL’s personal data processing (as may be updated by GSL from time to time).
2.4 The subject matter, duration, nature and purpose of the processing carried out by GSL as a processor for the Company and the type of personal data and categories of data subjects involved in such processing are set out in Annex 1 to this Processing Agreement.
3. Sub-processors.
3.1 The Company hereby grants GSL a general written authorisation to engage other processors for the Processor Services, including any associated entity (a “sub-processor”). GSL shall inform the Company of any intended changes concerning the addition or replacement of any sub-processor (including their identity and location). The Company shall have fourteen (14) days from the date of its notification to object to any such change and, in the absence of an objection within that time, the change shall be deemed to have been accepted.
3.2 The Company acknowledges that, although it retains the right to object to GSL’s use of a sub-processor in connection with the Processor Services, any such objection may prevent GSL from providing the Processor Services concerned. GSL shall not be in default of any of its obligations under this Processing Agreement or the Service Agreement as a result of its inability to provide those Processor Services in such circumstances.
4. Duration.
4.1 This Processing Agreement shall become effective between the Parties immediately upon the earlier of: (i) the Company’s signature of the Service Agreement; or (ii) GSL’s provision of any of the Processor Services to or for the Company and shall thereafter continue in full force and effect for the term set out in clause 12 (“Term and Termination”).
5. GSL’s Obligations.
5.1 GSL shall:
- only process Company Data for the Processor Services in accordance with the Company’s documented instructions as provided or otherwise confirmed by Authorised Persons (unless the processing is required by Union or Member State law to which GSL is subject, in which case GSL shall inform the Company of that legal requirement before commencing such processing, unless that law prohibits such information on important grounds of public interest). The Parties hereby agree that the following shall constitute Authorised Persons:
- members of the board of directors of the Company; or
- any other person who may be designated in writing for such purpose (email confirmation being sufficient) by the Company’s board of directors;
- maintain the confidentiality of all Company Data and shall not disclose Company Data to third parties unless the Company or this Processing Agreement authorises the disclosure or where such disclosure is required or permitted by law; and
- taking into account the nature of the processing and the information available to it, reasonably assist the Company, by appropriate technical and organisational measures insofar as this is possible, with: (i) the fulfilment of the Company’s obligation to respond to requests for the exercise of data subject rights; and (ii) the Company’s compliance with its obligations under Articles 32 to 36 of the GDPR.
5.2 Other than its compliance with this Processing Agreement, GSL shall not be responsible, and assumes no responsibility whatsoever, for ensuring that the Company complies with its obligations under Data Protection Laws. Nothing in this Processing Agreement, nor any conduct of the Parties, shall be construed as varying this position. This applies even where GSL has, in good faith, informed the Company that it considers that an instruction issued by the Company may potentially infringe the Data Protection Laws.
6. GSL’s Employees.
6.1 GSL will ensure and procure that all employees:
- are informed of the confidential nature of Company Data and have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; and
- are aware both of GSL’s duties and their personal duties and obligations under Data Protection Laws and this Processing Agreement.
7. Company’s Obligations.
7.1 The Company shall be exclusively responsible for ensuring:
- its compliance with its obligations as a controller under Data Protection Laws and that all personal data which it processes (including in respect of any personal data provided to or shared with GSL) is done in conformity with Data Protection Laws; and
- the accuracy and quality of all personal data provided by or on its behalf to GSL.
7.2 The Company warrants and agrees that it shall implement all technical and organisational measures as may be necessary in terms of Data Protection Laws to safeguard the privacy and security of personal data, and that these shall remain in place for the duration of the Processor Services. This shall include ensuring that there are sufficient technical and organisational measures to ensure data protection by default and by design. The adequacy, integrity and functionality of those measures shall be the sole and exclusive responsibility of the Company. GSL shall not be responsible, and assumes no responsibility, for advising thereon or making any recommendations to the Company.
7.3 The Company shall ensure that it has all rights in place (including the consent of all relevant data subjects, where necessary) to authorise the processing of Company Data by GSL.
8. Security Requirements.
8.1 GSL shall, taking into account the state of the art, costs of implementation, the nature of the processing and the risk to the rights of data subjects, take appropriate technical and organisational measures against the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Company Data processed by it in relation to the Processor Services. The measures used by GSL shall include those required pursuant to Article 32 of the GDPR, as appropriate to the circumstances.
8.2 If specific measures are required by the Company, GSL shall have the right to be reimbursed by the Company for any extraordinary expenses it may need to incur in order to implement such measures.
8.3 To the extent possible or practicable, the Company shall anonymise or pseudonymise the personal data to which GSL may obtain access, or to which it may otherwise need access, in connection with the Processor Services, such that it no longer amounts to personal data at law. The Company shall endeavour to provide GSL only the minimum amount of personal data required for GSL to fulfil its obligations relating to the Processor Services.
9. Personal Data Breach.
9.1 GSL shall, without undue delay, notify the Company if any Company Data is lost or destroyed or becomes damaged, corrupted, or unusable. All expenses required to restore the affected Company Data shall be borne by the Company, except where such loss or damage results from GSL’s fault or negligence in breach of this Processing Agreement.
9.2 GSL shall notify the Company if, during the provision of the Processor Services, it becomes aware of any personal data breach affecting Company Data processed by GSL and, in all cases, no later than forty-eight (48) hours from having become aware of the breach. GSL shall co-operate and provide all reasonable assistance that may be needed by the Company to ensure that it acts on and responds to the breach in compliance with Data Protection Laws.
9.3 GSL shall not inform any third party of any such personal data breach without first obtaining the Company’s prior written consent, except where required to do so by law.
9.4 GSL agrees that, save for where GSL is required by law to notify the breach itself to any authority, regulator or other person, the Company has the sole right to determine:
- whether to notify the affected data subjects and/or competent supervisory authorities, law enforcement agencies or other competent authorities or bodies;
- whether to offer a remedy to affected data subjects, including the nature of such remedy.
9.5 The Company shall bear all reasonable expenses associated or otherwise incurred in connection with clauses 9.2 and/or 9.3, except to the extent that the personal data breach arises from GSL’s negligence, wilful default or breach of this Processing Agreement, in which case GSL shall bear such costs and expenses.
10. Cross-Border Transfers.
10.1 GSL is hereby authorised by the Company to transfer, process, and permit the processing (including by a sub-processor) of, personal data outside of the EEA, provided it is necessary for the Processor Services and carried out under the following conditions:
- the relevant third country has been granted an adequacy decision by the European Commission in terms of Data Protection Laws; or
- in the absence of an adequacy decision, the relevant parties participate in a valid transfer tool recognised under Article 46 of the GDPR (“transfers subject to appropriate safeguards”), such as appropriate Standard Contractual Clauses; or
- the transfer and any onward processing are otherwise permitted under applicable Data Protection Laws, such as by virtue of a derogation relied upon under Article 49 of the GDPR, for reasons that shall be communicated by GSL to the Company.
11. Complaints, requests and third-party rights.
11.1 GSL shall promptly provide the Company with any information which the Company may reasonably require to enable it to comply with:
- the rights of data subjects under Data Protection Laws, including access rights, the rights to rectify and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
- orders or notices served on the Company by any supervisory authority pursuant to Data Protection Laws.
11.2 GSL shall (unless prohibited by law) notify the Company immediately if it receives any request, complaint, notice or communication that relates directly or indirectly to the processing of Company Data or to either Party’s compliance with Data Protection Laws in terms of this Processing Agreement. GSL will co-operate with and assist the Company in responding to any complaint, notice, communication or data subject request.
12. Term and Termination.
12.1 This Processing Agreement will remain in full force and effect so long as:
- the Service Agreement remains in effect, or
- GSL retains access to, or possession of, any Company Data (the “Term”).
12.2 Any provision of this Processing Agreement that expressly or by implication should come into or continue in force on or after termination of the Service Agreement to protect personal data will remain in full force and effect, particularly for any transitional or migratory phase, and for so long as GSL has any Company Data in its possession.
13. Data Return and Destruction.
13.1 At the Company’s request, GSL shall give the Company access to all or part of the Company Data in its possession (if any) in the format and on the media reasonably specified by the Company. All expenses incurred by GSL in order to comply with such a request shall be reimbursed by the Company.
13.2 Unless GSL is required by Data Protection Laws or any other applicable law to retain or otherwise continue processing Company Data, GSL shall, on termination of the Service Agreement (for whatever reason) or the expiry of its term, securely delete or destroy, or, if directed in writing by the Company, return to the Company and not retain, any and all Company Data which is in its possession (if any).
13.3 If any law, regulation, or government or regulatory body requires GSL to retain any documents or materials that it would otherwise be required to return or destroy (including in terms of regulatory or reporting obligations to competent authorities), it will be entitled to retain them and shall notify the Company in writing of that retention requirement, giving details of the documents or materials that it must retain and the legal basis for retention.
14. Records.
14.1 GSL will keep accurate and up-to-date written records regarding any processing of personal data it carries out for the Company, including, but not limited to, personnel access to personal data, approved sub-processors, the processing purposes, categories of processing, any transfers of personal data to a third country and related safeguards, and a general description of the technical and organisational security measures referred to in Clause 8.
14.2 GSL shall ensure that the information and details included in such records are sufficient to enable the Company to verify GSL’s compliance with its obligations under this Processing Agreement and GSL will provide the Company with copies of those records upon request.
15. Audit.
15.1 On the Company’s written request, provided it is reasonable, GSL shall make available to the Company all information reasonably necessary to demonstrate its compliance with this Processing Agreement, and shall allow for and contribute to audits, including inspections, conducted by the Company or another auditor mandated by the Company, where required under Data Protection Laws. Any audit or inspection shall be limited to matters relevant to the Processor Services and this Processing Agreement, conducted on reasonable prior written notice, during normal business hours, without unreasonable disruption to GSL’s business, and subject to appropriate confidentiality and security requirements. GSL may restrict access where necessary to protect confidential information, legal privilege, security, other clients’ data, or information not relevant to the Processor Services.
15.2 The Company shall bear GSL’s reasonable costs and expenses, unless the audit identifies a material breach by GSL of this Processing Agreement.
16. Warranties.
16.1 The Company represents and warrants that:
- GSL’s processing of Company Data for the Processor Services does not and shall not violate applicable law or the Company’s obligations under any agreements or notices provided to data subjects, provided that GSL complies with this Processing Agreement, and the Company shall not request GSL to use, disclose or otherwise process Company Data in any manner that would not be permissible under applicable law;
- the instructions given by it to GSL will comply with Data Protection Laws; and
- it has established all rights (including, where relevant, providing a privacy notice and obtaining any necessary consents) under Data Protection Laws for GSL to process Company Data in order to provide the Processor Services.
17. Liability.
17.1 GSL shall be liable to the Company only for damages suffered by the Company as a direct result of a breach by GSL of its obligations under this Processing Agreement (direct damages). The limitation of liability applicable to GSL under the Terms shall also apply to GSL’s liability under this Processing Agreement, and all liability arising under or in connection with both shall be treated as cumulative and subject to a single aggregate cap.
17.2 GSL’s liability shall be subject to and regulated by the Terms.
18. Indemnification.
18.1 The Company shall defend, indemnify and hold harmless GSL, on a full indemnity basis and at its own expense, against any and all losses, liabilities, damages, costs, penalties and expenses (including attorney fees, administrative fines and court costs) that may be incurred, suffered or sustained by GSL, or for which GSL may otherwise become liable, as a result of or in connection with any default or failure by the Company (or any of its employees, personnel, subcontractors or agents) to comply with any of the Company’s obligations under this Processing Agreement or any Data Protection Laws.
18.2 GSL shall not be responsible for the content, legality or consequences of instructions given by the Company, except to the extent GSL is required under Data Protection Laws to inform the Company where it considers that an instruction infringes Data Protection Laws. The Company shall, in addition to its obligations under Clause 18.1, defend, indemnify and hold harmless GSL against any and all losses, liabilities, damages, costs, penalties and/or expenses (including attorney fees, administrative fines and court costs) that may be incurred, suffered or sustained by GSL, or for which GSL may become liable, as a result of or in connection with performing and/or complying with the instructions given to it by the Company.
19. General.
19.1 If any clause, or part of any clause, of this Processing Agreement is or becomes invalid, illegal or unenforceable for any reason, the validity, legality and enforceability of the remaining clauses, or parts of clauses, shall not be affected or impaired. If any such invalid, illegal or unenforceable clause, or part of a clause, would be valid, legal or enforceable if amended in form or effect, it shall be deemed to have the amended form or effect necessary to make it valid, legal and enforceable.
19.2 GSL may amend or update this Processing Agreement from time to time, including by publishing an updated version on its website or otherwise notifying the Company, where reasonably necessary or appropriate to reflect changes in Data Protection Laws, regulatory guidance, the Processor Services, GSL’s processing arrangements, technical and organisational measures, or sub-processors, provided that such change does not materially reduce the protection afforded to Company Data.
19.3 Any notice or other communication to be given under or in connection with this Processing Agreement may be given by email, including to the email address last notified by the relevant Party for such purpose or otherwise used in connection with the Service Agreement. Any such communication shall be deemed received on the next business day after sending, provided that the sender has not received an automated delivery failure notice.
19.4 The rights and remedies provided under this Processing Agreement are cumulative and are in addition to, and not exclusive of, any rights and remedies provided by law.
19.5 Any provision of this Processing Agreement that expressly or by implication is intended to come into or continue in force on or after its termination or expiry shall remain in full force and effect. This shall include, but is not limited to, Clause 17 (Liability), Clause 18 (Indemnification) and Clause 20 (Governing law and Jurisdiction).
20. Governing Law and Jurisdiction.
20.1 This Processing Agreement shall be governed exclusively by the laws of Malta.
20.2 In the event of any dispute arising out of or in connection with this Processing Agreement, the Parties shall make every reasonable effort to resolve the dispute through good faith negotiation, and if the dispute cannot be resolved through negotiation, it shall be decided solely and exclusively by arbitration in Malta in accordance with the Malta Arbitration Act.
Annex 1
Data Processing Details
(a) Data subjects
The personal data processed by GSL may concern the following categories of data subjects:
- ultimate beneficial owners,
- shareholders,
- directors,
- officers,
- employees,
- service providers, and
- counterparties,
in each case as relating to the Company.
(b) Categories of data
The personal data processed concern the following categories of data: name, surname, address, contact details, passport or other identity document number and generally, any personal data contained in correspondence, official communications, including regulatory notices, or judicial acts received by GSL on behalf of the Company (e.g., when providing registered office services).
(c) Nature of the processing operations
Any operation or set of operations performed on Company Data by GSL on behalf of the Company in connection with the Processor Services, whether or not by automated means, which may include the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure and/or destruction of Company Data, and any or all of which may be performed by GSL through, with the assistance of, or in connection with AI-enabled systems or tools or similar technologies.
(d) Duration of Processing
For the term of this Processing Agreement as set out in clause 12.1.
(e) Purposes of the processing
For the purpose of performing the relevant Processor Services and complying with this Processing Agreement.