Data Processing Terms

By signing up for the Services, the Customer enters into this agreement with Honeycomb Worldwide Inc (“Honeycomb”) and its Affiliates, on behalf of itself and, to the extent required under applicable Data Protection Laws, in the name and on behalf of its Affiliates.

1. Commencement

1.1 This agreement supplements any other agreements between the parties and will be effective from the date that the parties start sharing or processing the Personal Data (whichever date is applicable first) and will continue until such personal data Processing and sharing has ceased and all obligations under Data Protetcion Law created by that Personal Data sharing or Processing have been fufilled.

2. Definitions

2.1   Capitalised terms used in this agreement have the following meaning:

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations

“Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of an organisation.

“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.

“Customer” means the organisation that executed this agreement and that is subject to the data protection laws and regulations of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom and/or California, and (b) is permitted to use the Services pursuant to the agreement. For the purposes of this agreement only, and except where indicated otherwise, the term “Customer” shall include Customer and its Affiliates.

“Data Protection Law” means all applicable  laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, Switzerland, the United Kingdom and the United States and its states, applicable to the Processing of Personal Data under the Agreement. means, as binding on either party or the Services: the GDPR; the Data Protection Act 2018; any laws which implement any such laws; and any laws that replace, extend, re-enact, consolidate or amend any of the foregoing;

“Personal Data Breach” has the meaning given in applicable Data Protection Laws from time to time;

“Data Subject” means the identified or identifiable person to whom Personal Data relates.

“GDPR” means the General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

“Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data or personally identifiable information under applicable Data Protection Laws and Regulations), where for each (i) or (ii), such data is Personal Data processed under this agreement or in the provision of the Services.

“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

 “Processor” means the entity which processes Personal Data on behalf of the Controller, including as applicable any “service provider” as that term is defined by the CCPA.

“Services” means the provision of the job platform allowing the Customer to post its job vacancies and or webinar hosting services, as appropriate.

“Service Provider” means any entity that runs for profit, which processes information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose according to a written contract, for purposes of this agreement Honeycomb is a Service Provider and the Customer the business.

“Standard Contractual Clauses” means the agreement (if relevant) executed by and between Customer and Honeycomb for the transfer of Personal Data to Customers established in third countries which do not ensure an adequate level of data protection.

“Supervisory Authority” means an independent public authority which is established by an EU Member State pursuant to the GDPR.

“Sub-Processor” means any agent, subcontractor or other third party (excluding its employees) engaged by Honeycomb for carrying out any processing activities on behalf of the Customer in respect of the Personal Data.

2.2  A reference to any US, EU or UK action, remedy, method of judicial proceeding, court, official, legal document, legal status, legal doctrine, legal concept or thing shall, in respect of any jurisdiction other than that US,EU or UK jurisdiction be deemed to include a reference to that which most nearly approximates to the equivalent in the applicable  jurisdiction.

3. Customer’s Compliance With Data Protection Law

3.1  This agreement applies to the collection, retention, use, and disclosure of the Personal Data to perform the business purpose of providing Services to the Customer pursuant to this agreement.

3.2  The Customer is a business and appoints Honeycomb as a Service Provider to provide the Services to the Customer. The Customer is responsible for compliance with the requirements of the CCPA applicable to Businesses.

3.3  Each party will comply with Data Protection Law when Processing Personal Data.

3.4  The parties acknowledge and agree that in relation to any of the Services, Honeycomb will be Controller and, in some cases, the Processor of the Personal Data.

3.5  The Customer represents and warrants that, where applicable, it has provided notice that the Personal Data is being used or shared consistent with Cal. Civ. Code 1798.140(t)(2)(C)(i).

3.6  The parties acknowledge and agree that the exchange of Personal Data between the parties does not form part of any monetary or other valuable consideration exchanged between the parties with respect to this agreement . Neither party shall “sell” the Personal Data (as the term “sell” is defined under the CCPA) and will retain, use or disclose the Personal Data only for the specific purpose of performing the Services and within the direct business relationship with the business.

4. Data Processor

4.1  Data Processor

4.1.1 The subject matter, nature, purpose and duration of the Processing of Personal Data by Honeycomb is set out in the Processing Appendix and this agreement. Information on the types of Personal Data processed and the categories of Data Subjects is also included in the Processing Appendix and this agreement.

4.1.2  Honeycomb will only process Personal Data in accordance with the Customers’ documented instructions, unless required to process such Personal Data for other purposes by applicable laws or regulatory authorities. In such circumstances, Honeycomb shall provide notice to the Customer unless the relevant law or regulatory authority prohibits the giving of notice. If Honeycomb believes that any instruction received by it from the Customer is likely to infringe Data Protection Law, it shall be entitled to cease to provide the relevant Services until the parties have agreed appropriate amended instructions which are not infringing.

4.1.3  On written request from the Customer, Honeycomb shall, in fulfillment of its obligation to provide information to demonstrate compliance with Data Protection Laws, make available to the Customer such documentary data as the Customer reasonably requests from time to time to demonstrate such compliance, including data relevant to its Processing of Personal Data as part of the Service.

4.1.4  The Customer shall provide a general authorisation to Honeycomb to engage Sub-Processors to process Personal Data upon and subject to the remaining provisions of this agreement. Honeycomb will inform the Customer of any intended changes concerning the addition or replacement of other Sub-Processors, giving the Customer the opportunity to object to such changes. Honeycomb shall appoint each Sub-Processor under a written contract containing materially the same obligations as under this agreement.

4.1.5  Honeycomb not permit any processing of Personal Data by any person not subject to a duty of confidence.

4.1.6  Honeycomb shall, in accordance with Data Protection Law, make available to the Customer such information that is in its possession or control as is necessary to demonstrate compliance with the obligations placed on it under this agreement and with the obligations on each party imposed by Article 28 of the GDPR (and under any equivalent Data Protection Laws equivalent to that Article 28 of the GDPR), and allow for and contribute to audits, including inspections, by the Customer (or another auditor mandated by the Customer) for this purpose (subject to a maximum of one audit request in any 12 month period under this subclause.

5. Data Controller

5.1   Insofar as Honeycomb is a Controller in relation to Personal Data it will:

5.1.1  Provide the Customer with a privacy notice in relation to the Personal Data it processes under this agreement that complies with the requirements of the Data Protection Laws.

5.1.2  Immediately notify the Customer, in writing, if it receives any complaint, notice or communication which relates to the processing of the Personal Data, and provide the Customer with such data and co-operation as the Customer reasonably requires in relation to the matter. As far as reasonably practicable, Honeycomb will consult with the Customer prior to giving a response or making any disclosure. If Honeycomb receives a communication that relates to Personal Data which Honeycomb processes as a co Controller with the Customer, it will provide all necessary assistance and information to the Customer to enable it to respond in accordance with the Data Protection Law and within any timeframe specified in it, or, in the case of a communication from the ICO, or other Supervisory Authority or regulator, the timeframe specified in the communication.

5.1.3  Not undertake any profiling within the meaning of the Data Protection Law in respect of the Personal Data without notifying the Customer in writing and obtaining their prior written consent.

6.  No Modification of Data

6.1  The Customer shall not copy, decompile, modify, reverse engineer, or create derivative works out of any of the data it accesses under this agreement or as part of the Services.

7. Parties’ Obligations

7.1   A party shall immediately notify the other party if it becomes aware of any change or circumstance which will, may or is alleged to impact the lawfulness of any Processing of the Personal Data (including if a Data Subject withdraws any necessary consent or requests their Personal Data is no longer processed or is erased or if any of the Personal Data is not accurate or up-to-date), together with full details of the circumstances and (immediately once available) revised and corrected data.

7.2  The parties shall keep copies of all notices, consents or other records and information necessary to demonstrate compliance with Data Protection Law and this agreement.

7.3  A party shall promptly on request from the other party, provide the requesting party with copies of all notices, consents and other records and information referred to in clause 7.2.

8.  Indemnity

8.1  The Customer shall indemnify and keep indemnified Honeycomb against all losses, claims, damages, liabilities, fines, sanctions, interest, penalties, costs, charges, expenses, compensation paid to Data Subjects, demands and legal and other professional costs (calculated on a full indemnity basis and in each case whether or not arising from any investigation by, or imposed by, a Supervisory Authority or regulator) arising out of or in connection with any breach by the Customer of its obligations under this agreement or Data Protection Law.

9.  Security

9.1 The parties shall, in accordance with Data Protection Law, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing of the Personal Data to be carried out under or in connection with this agreement, as well as the risks of varying likelihood and severity for the rights and freedoms of Data Subjects and the risks that are presented by the Processing, especially from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the Personal Data transmitted, stored or otherwise processed, implement and maintain appropriate technical and organisational security measures to protect that Personal Data:

10.  Assistance

10.1  The Customer acknowledges that where Honeycomb processes Personal Data as a Processor on behalf ot the Customer, the Customer has primary responsibility to the relevant Data Subjects for the processing of such Personal Data and it shall notify Honeycomb of any assistance that it requires pursuant to its obligations. Honeycomb shall, as far as it is possible, at the Customer’s cost, take appropriate measures to help the Customer respond to requests from Data Subjects to exercise their rights and to assist the Customer in meeting its Data Protection Law obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments .

10.2  The Customer shall pay Honeycomb for all reasonable costs incurred in providing the assistance set out in clause 10.1 above, within 30 days of receiving an invoice for such costs.

10.3  Where the parties are co-Controllers each party will provide the assistance, information and records to the other to assist each party with their respective compliance with Data Protection Laws and in relation to all Complaints and Data Subject Requests. Each party shall pay its own costs and expenses incurred in connection with the performance of this

10.4  The provisions of this clause 10 shall survive termination or expiry of this agreement and continue indefinitely.

11.  International transfers

11.1  Honeycomb may transfer Personal Data subject to the GDPR outside of the European Economic Area where it has a lawful basis for that transfer under Data Protection Law. The Customer shall complete the Honeycomb Standard Contractual Clauses, where requested to complete such by Honeycomb.

12.  Data Breach

12.1  A party shall immediately notify the other party in writing if it becomes aware of any breach, suspected breach or any loss of or unauthorised access to or use of any Personal Data processed by it.  The parties shall co-operate with each other in good faith when dealing with such loss, unauthorised access or use. This shall include taking all reasonable steps to minimise the adverse effect of such loss, unauthorised access or use.  The parties shall consult and seek in good faith to agree which of them should make any required notifications to affected Data Subjects and any applicable regulators, together with the terms of such notifications. If the parties fail to reach agreement, either party may make such notifications as they are legally advised they should make.

13. Deletion/return and survival

13.1 At the end of the provision of the Services relating to the Processing of Personal Data, at the Customer’s cost and the Customer’s option, Honeycomb shall either return all of the Personal Data to the Customer or securely dispose of the Personal Data (and thereafter promptly delete all existing copies of it) ,except to the extent that any applicable law requires Honeycomb to store such Personal Data. This agreement shall survive termination or expiry of the Services.

14  Order of precedence

14.1 In the event of any conflict or inconsistency between this agreement and the Standard Contractual Clauses (where such the Standard Contractual Clauses have been agreed between the parties) the Standard Contractual Clauses shall prevail.

14.2 Subject to clause 14.1 above, with regard to the subject matter of this agreement, in the event of inconsistencies between the provisions of this agreement and any other agreements between the parties including agreements entered into or purported to be entered into after the date of this agreement, the provisions of this agreement shall prevail

15. Severability

15.1 If any part of this agreement is declared unenforceable or invalid, the remainder will continue to be valid and enforceable.

 

Processing Appendix

Processing of the Personal Data by Honeycomb under this agreement shall be for the subject-matter, duration, nature and purposes and involve the types of Personal Data and categories of Data Subjects set out in this Appendix.

Subject-matter of processing: Personal Data processed in the provision of IT job and webinar hosting Services.

Duration of the processing:

Personal Data will be processed for the duration of the Agreement, unless otherwise agreed in writing or where the Personal Data is subject to a legal obligation to retain it for longer.

Nature and purpose of the processing:  

Provision of Hosting services, training, support analysis for the purposes of tailored content and disaster recovery for the provision of the Services.

Type of Personal Data:

• Contact Data – includes billing address, address, email address and telephone numbers.
• Resume Data- includes application materials and answers to screener questions given to employers through the Xtalks Job Platform and answers to any questionnaires. This information may be associated with a profile.
• Transaction Data – includes details about payments and other details of products and services bought from us.
• Technical Data – includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices used to access our website.
• Profile Data – includes username and password, purchases or orders made, interests, preferences, feedback, and survey responses.
• Usage Data – includes information about how individuals use our website and services and online activity based on their interaction with us, our websites and applications for example searches, site visits browsing actions and patterns.
• Marketing and Communications Data – includes preferences in receiving marketing from us and our third parties and communication preferences.

Categories of Data Subjects: Clients, Website Users, Business Contacts,

applicants, business contacts, Client, Webinar guests, webinar organisers, consultants, contractors, customer, website users, pre-applicants, prospect, system user, suppliers and subcontractors

Specific processing instructions:  N/A