If You or Your Authorized User are based in the United Kingdom or European Union:
Reorg Research and/or a Reorg Affiliate will Process Your Personal Data in accordance with the General Data Protection Regulation (EU) 2016/679) and any national legislation implementing this Regulation and related statutory instruments as amended or in force from time to time (including the Data Protection Act 2018) (the “Regulation”) as provided in the following sub-sections (b)-(f):
The following definitions shall apply to this Section 1:
“Data” shall mean the Personal Data and Special Personal Data provided by You to Reorg Research and/or a Reorg Affiliate pursuant to this Agreement or which is otherwise Processed by Reorg Research and/or a Reorg Affiliate on Your behalf pursuant to this Agreement;
“Controller”, “Data Subject”, “Processor”, “Personal Data” and “Processing” shall have the meanings giving to them in the Regulation and “Process” and “Processed” shall be construed accordingly;
“Special Personal Data” shall mean the special categories of Personal Data as set out in Article 9(1) and Article 10 of the Regulation;
“Sub-Processor” shall mean any third party engaged by Reorg Research or a Reorg Affiliate which may receive and/or Process Data in order to provide the Services.
The Parties acknowledge that You are a Controller and that Reorg Research and/or a Reorg Affiliate is a Processor in relation to the Data.
Reorg Research shall (and shall ensure any Reorg Affiliate that is a Processor shall):
Process the Data only on Your documented instructions as set out in this Agreement
ensure that its personnel who are authorized to Process Data are under obligations of confidentiality;
take the measures that are expressed to be obligations of the Processor in Article 32 of the Regulation in order to ensure the appropriate level of security for the Data;
taking into account the nature of the Processing, assist You with Your obligations to comply with Data Subjects’ requests and Data Subjects’ rights under Chapter III of the Regulation through the use of appropriate technical and organizational measures and assist You in ensuring compliance with Your obligations in Articles 32-36 of the Regulation;
at the written election of You, either securely destroy the Data (including all copies of it); or return the Data (including all copies of it) to You in the format required by You which retains the integrity of the Data, at any time upon request by You or promptly upon termination or expiry of this Agreement;
provide all information necessary to demonstrate Reorg Research’s, any applicable Reorg Affiliate’s and any Sub-Processor’s compliance with this Section 1;
immediately notify You, if Reorg Research considers any instructions infringe the Regulation or other applicable data protection laws; and
except as permitted pursuant to Section 1(e) below, not Process or transfer Data outside of the European Economic Area (or any country deemed adequate by the European Commission pursuant to Directive 95/46/EC or the Regulation) without Your prior written consent and without putting in place adequate protection for the Data to enable compliance by You and Reorg Research with their obligations under the Regulation.
You authorize Reorg Research (and any Reorg Affiliate that is a Processor), on Your behalf as Your agent, to enter into the Standard Contractual Clauses (as authorized by decision 2010/87/EU of the European Commission) with Reorg Affiliates in order to put in place adequate protection for the Data when the Data is transferred to a Reorg Affiliate outside of the European Economic Area. A copy of the executed Standard Contractual Clauses will be provided upon request.
Reorg Research and Reorg Affiliates may appoint Sub-Processors without Your prior written consent provided that: (i) Reorg Research notifies You in writing in advance of any change in identity of a Sub-Processor; and (ii) Reorg Research or the applicable Reorg Affiliate puts in place in writing with any Sub-Processor contractual obligations which are at least equivalent to the obligations imposed on Reorg Research pursuant to this Section 1.
If You or Your Authorized User are based in Hong Kong, or Reorg Research and/or a Reorg Affiliate is able to control in or from Hong Kong the collection, holding, processing or use of Your or Your Authorized User’s Personal Data, Reorg Research and Reorg Affiliates will collect, hold, process or use such Personal Data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486 of the laws of Hong Kong) (the “Ordinance”) and any other guidelines, rules and/or regulations implementing the Ordinance as amended or in force from time to time (together the “Regulation”) as provided in the following sub-sections (a)-(e):
The following definitions shall apply to this Section 2:
“Data” shall mean the Personal Data provided by You to Reorg Research and/or a Reorg Affiliate pursuant to this Agreement or which is otherwise Processed by Reorg Research and/or a Reorg Affiliate on Your behalf pursuant to this Agreement and shall include also any representation of information (including an expression of opinion) in any document provided by You to Reorg Research pursuant to this Agreement;
“Data Subject”, “Data User” “Personal Data” and “Processing” shall have the meanings giving to them in the Ordinance and “Process” shall be constructed accordingly;
“Sub-Processor” shall mean any third party engaged by Reorg Research or a Reorg Affiliate which may receive and/or Process Data in order to provide the Services.
“Third Party” shall mean any person authorized in writing by the Data User to collect, hold, process or use the Data under the direct control of the Data User, or on behalf of the Data User.
The Parties acknowledge that You are a Data User and that Reorg Research and/or a Reorg Affiliate is a Third Party in relation to the Data.
Reorg Research shall (and shall ensure any Reorg Affiliate that is a Third Party shall):
process the Data only on Your documented instructions as set out in this Agreement, which instructions shall be consistent with the purposes for which the Data was initially collected by You unless an express consent has been given by the Data Subject to You;
ensure that its personnel who are authorised to Process Data are under obligations of confidentiality;
take all practicable steps to ensure the appropriate level of security for the Data pursuant to data protection principle 4 as set out in the Ordinance to prevent unauthorised or accidental access, processing, erasure, loss or use of the Data;
taking into account the nature of the Processing, assist You with Your obligations to comply with Data Subjects’ requests and Data Subjects’ rights under the Ordinance including but not limited to comply with the Data Subject’s data access and data correction request, through the use of appropriate technical and organizational measures and assist You in ensuring compliance with Your obligations under the Ordinance;
at the written election of You, either securely destroy the Data (including all copies of it); or return the Data (including all copies of it) to You in the format required by You which retains the integrity of the Data, at any time upon request by You or promptly upon termination or expiry of this Agreement;
provide all information necessary to demonstrate Reorg Research’s, any applicable Reorg Affiliate’s and any Sub-Processor’s compliance with this Section 2;
immediately notify You, if Reorg Research considers any instructions received from You infringing the Regulation or other applicable data protection laws; and
not transfer Data to a place outside of Hong Kong unless-
the place is recognized by the Privacy Commissioner for Personal Data to be a place where there is law which is substantially similar to, or serves the same purposes as, the Ordinance;
Reorg Research has reasonable grounds for believing that there is in force in that place any law which is substantially similar to, or serves the same purposes as, the Ordinance;
the Data Subject has consented in writing to the transfer;
Reorg Research has reasonable grounds for believing that, in all circumstances of the case –
the transfer is for the avoidance or mitigation of adverse action against the Data Subject;
it is not practicable to obtain the consent in writing of the Data Subject to that transfer; and
if it was practicable to obtain such consent, the Data Subject would give it;
the Data is exempt from data protection principle 3 by virtue of an exemption under Part 8 of the Ordinance; or
Reorg Research has taken all reasonable precautions and exercised all due diligence to ensure that the Data will not, in that place, be collected, held, processed or used in any manner which, if that place were Hong Kong, would be a contravention of a requirement under the Ordinance.
You authorize Reorg Research (and any Reorg Affiliate that is a Third Party), on Your behalf as Your agent, to enter into the Standard Contractual Clauses in the form as authorized by decision 2010/87/EU of the European Commission with the necessary changes as Reorg Research deems appropriate with Reorg Affiliates in order to put in place adequate protection for the Data when the Data is transferred to a Reorg Affiliate outside of Hong Kong. A copy of the executed Standard Contractual Clauses will be provided upon request.
Reorg Research and Reorg Affiliates may appoint Sub-Processors without Your prior written consent provided that: (i) Reorg Research notifies You in writing in advance of any change in identity of a Sub-Processor; and (ii) Reorg Research or the applicable Reorg Affiliate puts in place in writing with any Sub-Processor contractual obligations which are at least equivalent to the obligations imposed on Reorg Research pursuant to this Section 2 or the Ordinance.
Sign up for Reorg on the Record
Weekly highlights from our global intel and expert analysis