PHOTOGRAPHER DATA PROCESSING AGREEMENT (“DPA”)
LEE CALL PHOTOGRAPHY & FILM
THIS DPA is made on 15th April 2020 (the “Effective Date“) BETWEEN:
- [YOU, the Client] and
- Lee Call – T/A Lee Call Photography & Film
BACKGROUND
- Lee Call Photography & Film provides to the Client certain photographic services described in Schedule 2 (the “Services“).
- The provision of the Services by Lee Call Photography & Film involves it Processing the Personal Data described in Schedule 2 for the Clients. These are the Data Protection Particulars.
- The parties have agreed to enter into this DPA to ensure compliance with the provisions of EU regulation 2016/679 (the “GDPR“) in relation to all Processing of the Personal Data by Lee Call Photography & Film for the Client.
AGREED TERMS
1 Interpretation
1.1 The defined terms and expressions referred to in this DPA are set out in Schedule 1.
1.2 The provisions of this DPA shall be effective from the Effective Date and shall continue in full force and effect for so long as Lee Call Photography & Film is Processing Personal Data received from the Client.
2 Data Protection
2.1 In consideration of the parties mutually agreeing to waive the enforcement of any outstanding rights at the Effective Date in relation to the Processing of Personal Data, the parties agree to the terms of this DPA from the Effective Date.
2.2 The parties acknowledge that, under the terms of this DPA, Lee Call Photography & Film is acting as a Processor appointed by the Client and the Client is a Data Controller. The parties agree that the data to be Processed by Lee Call Photography & Film shall be Personal Data.
2.3 Lee Call Photography & Film aims to comply with the Data Protection Legislation in its Processing of the Personal Data required in the performance of the Agreement, and shall use all reasonable endeavours to provide such assistance and/or co-operation as is reasonably necessary or reasonably requested by the Client to assist the Client in complying with the Data Protection Legislation.
2.4 Each of the Parties acknowledges and agrees that Schedule 2 (Data Protection Particulars) of this DPA is an accurate description of the Data Protection Particulars.
2.5 Lee Call Photography & Film agrees that it will only Process the Personal Data in accordance with the Client’s documented instructions from time to time and shall not Process the Personal Data for any purpose other than expressly authorised by the Client except where required by Data Protection Legislation (and shall inform the Client of that legal requirement before Processing, unless Data Protection Legislation prevents it from doing so).
2.6 Lee Call Photography & Film shall promptly comply with any request from the Client to amend, transfer or delete the Personal Data.
2.7 At the Clients written request (and cost and expense), Lee Call Photography & Film shall provide the Client with a copy of all Personal Data held by it in the format as reasonably specified by the Client.
2.8 Lee Call Photography & Film shall promptly notify the Client if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable as a result of its acts or omissions.
2.9 Lee Call Photography & Film shall use all reasonable endeavours to keep the Personal Data confidential.
2.10 Lee Call Photography & Film agrees that it shall implement and maintain such technical and organisational measures as are required to enable the Personal Data to be Processed in compliance with the DPL.
2.11 Without prejudice to Lee Call Photography & Film’s obligations with respect to Lee Call Photography & Film’s Personnel, Lee Call Photography & Film shall use reasonable endeavours to:
- take reasonable steps to ensure the reliability and integrity of any of Lee Call Photography & Film’s Personnel who shall have access to the Personal Data;
- ensure that only such members of Lee Call Photography & Film’s Personnel required by it to assist it in fulfilling its obligations under the Agreement shall have access to the Personal Data (and no other member of Lee Call Photography & Film’s Personnel shall have access to such Personal Data); and
- ensure that each member of Lee Call Photography & Film’s Personnel shall have:
(i) undergone reasonable levels of training in Data Protection Legislation and in the care and handling of Personal Data; and
(ii) entered in to appropriate contractually-binding confidentiality undertakings that shall apply to the Personal Data.
2.12 Lee Call Photography & Film shall not transfer any Personal Data outside the EEA without the Client’s prior written consent and where the Client consents to such transfer, to enter into our agreement which imposes on the parties substantially the same obligations as are imposed upon Lee Call Photography & Film by this DPA.
2.13 Lee Call Photography & Film may authorise a third party (subcontractor) to Process the Personal Data provided by the subcontractor’s contract is on terms which are substantially the same as those set out in these Conditions. The Client shall ensure that it obtains any consent required from Data Subjects to allow Lee Call Photography & Film to Process Personal Data inside or, if applicable, outside the EEA should this be required. In such an event Lee Call Photography & Film will advise the Client in writing and enter into an agreement with such a third party to ensure that the Data Subject has enforceable rights and effective legal remedies.
2.14 Lee Call Photography & Film shall promptly notify the Client upon becoming aware of any actual or suspected or ‘near miss’ Personal Data Breach, and will:
- take all reasonable steps (and procure that its sub-contractors take all reasonable steps) to prevent or minimise the effects of the Personal Data Breach;
- implement or attempt to procure that its sub-contractors implement measures necessary to restore the security of compromised Personal Data; and
- provide the Client with reasonable co-operation and assistance to make any notifications to the ICO and affected Data Subjects.
2.15 Lee Call Photography & Film shall notify the Client following its receipt of any Data Subject Request, and shall:
- not disclose any Personal Data in response to any Data Subject Request without the Client’s prior written consent; and
- provide the Client with reasonable co-operation and assistance required by the Client in relation to any such Data Subject Request.
2.16 Lee Call Photography & Film will comply with the Client’s reasonable requirements in relation to the Client’s compliance with any Data Subject Request.
2.17 The Client shall co-operate with Lee Call Photography & Film in all matters relating to the Services and appoint a data manager in relation to the Services, who shall have authority to act for the Client on matters relating to the Services.
2.18 The Client warrants and agrees that:
- it has complied and shall comply with the Data Protection Legislation as a Data Controller;
- Lee Call Photography & Film is entitled to Process the Personal Data as part of the Services and such use will comply with the Data Protection Legislation;
- it has the right to licence the Processing of the Personal Data to Lee Call Photography & Film under the Agreement;
- the Processing of the Personal Data by Lee Call Photography & Film as part of the Services will not infringe the Intellectual Property Rights of any third party;
- it has obtained the appropriate consent from a Data Subject to allow Lee Call Photography & Film to Process the Personal Data as part of the Services as anticipated by the Agreement and that the Client’s Customers know that their personal data will be processed by Lee Call Photography & Film;
- it is not aware of any circumstances likely to give rise to breach by it of any of the Data Protection Legislation in the future;
- all Personal Data to be Processed by Lee Call Photography & Film is necessary, accurate and up-to-date; and
- it consents to Lee Call Photography & Film appointing a sub-processor to process the Personal Data if Lee Call Photography & Film should need to do this in order to provide the Services.
2.19 If Lee Call Photography & Film’s performance of any of its obligations under the Agreement is prevented or delayed by the Client’s act, omission or failure to perform any relevant obligation under this DPA (“Client Default“):
- Lee Call Photography & Film shall have the right to suspend performance of the Services until the Client remedies the Client Default, and to rely on the Client Default to relieve it from the performance of any of its obligations to the extent the Client Default prevents or delays its performance of any of its obligations;
- Lee Call Photography & Film shall not be liable for any costs or losses sustained or incurred by the Client arising directly or indirectly from Your failure or delay to perform any of its obligations as set out in clauses 2.18 to 2.21.
2.20 The Client shall indemnify Lee Call Photography & Film and keep Lee Call Photography & Film indemnified from and against any and all liabilities, losses, expenses, claims, damages and losses (including, but not limited to, any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal and other professional costs and expenses) suffered or incurred by Lee Call Photography & Film as a result of the Client’s breach of its obligations as set out in this DPA.
Schedule 1
Defined Terms
“Data Controller“, “Data Processor“, “Processing” and “Data Subject” shall have the meaning set out in Article 4 of the GDPR;
“Data Protection Legislation” or “DPL” means the Data Protection Act 1998 (as amended) and the GDPR:
“Data Protection Particulars” means the data protection particulars set out in Schedule 2;
“Data Subject Request” means an actual or purported request or notice or complaint from (or on behalf of) a Data Subject (or a third party acting on a Data Subject’s request) exercising his rights under the Data Protection Legislation;
“DPA” means this agreement;
“Lee Call Photography & Film’s Personnel” means all individuals engaged by Lee Call Photography & Film in connection with this Agreement, including employees, consultants, contractors and permitted agents;
“ICO” means the UK Information Commissioner’s Office, or any successor or replacement body from time to time;
“Personal Data” has the meaning set out in the Data Protection Legislation and for the purposes of this DPA, includes Sensitive Personal Data;
“Personal Data Breach” has the meaning set out in the Data Protection Legislation;
“Sensitive Personal Data” means Personal Data that reveals such categories of data as are listed in Article 9(1) of the GDPR;
“Services” means the services to be provided by Lee Call Photography & Film to the Client under the Agreement or as described in Schedule 2 (as applicable).
Schedule 2
Services
All photographic & film services as may be provided by Lee Call Photography & Film as part of an Order by the Client.
Data Protection Particulars
The type of Personal Data being Processed and class of Data Subjects
Wedding venue
Names
Addresses
Email addresses
Telephone numbers
Photographs
Wedding date
The categories of Data Subjects
The data subjects will be client customers.
Any special categories of data
Not applicable
The duration of the Processing
A minimum of 6 years for HMRC inspection purposes.