This agreement forms a part of the agreement for [positioning system] and supplements the terms of End User License Terms of IIWARI.

The parties may, subject to their roles in connection with the use of Service, Products and/or Application, act in the roles of both data Processor and/or data Controller. The terms of this agreement apply to the extent applicable based on the parties’ roles.

Processor Personnel

Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any contracted Processor who may have access to personal data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant personal data, as strictly necessary for the purposes of the agreement, and to comply with applicable laws in the context of that individual’s duties to the Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Security

Taking into account the scope of the agreement and risks of processing, Processor shall in relation to the personal data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR. In assessing the appropriate level of security, Processor shall take account in particular of the risks that are presented by processing, in particular from a personal data breach.

Data Subject Rights

Taking into account the nature of the processing, the parties shall assist each other by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the parties’ obligations, as reasonably understood, to respond to requests to exercise data subject rights under the data protection laws.

A party shall promptly notify other party if it receives a request from a data subject under any data protection law in respect of personal data and ensure that it does not respond to that request except on the documented instructions of other party or as required by applicable laws to which the party is subject.

Personal Data Breach

Parties shall notify each other without undue delay upon a party becoming aware of a personal data breach, providing each other with sufficient information to allow the parties to meet any obligations to report or inform data subjects of the personal data breach under the data protection laws.

Parties shall co-operate and take reasonable commercial steps to assist each other in the investigation, mitigation and remediation of each such personal data breach.

A party shall, to the extent required by a party, complete a data protection impact assessment, which a party reasonably considers to be required by data protection laws, in each case solely in relation to controlling or processing of personal data by, and taking into account the nature of the processing and controlling.

Audit rights

Subject to this section, a party shall make available to other party on request all information necessary to demonstrate compliance with this agreement, and shall allow for and contribute to audits, including inspections, by the other party or an auditor mandated by the party in relation to the processing of the personal data by the processors.

Information and audit rights of the End User only arise to the extent that the agreement does not otherwise give them information and audit rights meeting the relevant requirements of data protection laws.

Data Transfer

Unless possessing a consent thereto, the Processor may not transfer or authorize the transfer of data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of the other party. If personal data processed under this agreement is transferred from a country within the European Economic Area to a country outside the European Economic Area, the parties shall ensure that the personal data are adequately protected. To achieve this, the parties shall, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of personal data.