Date: 06 December 2023
Author: Catherine Long, CEO and Co founder
Thank you for choosing Trace! Trace is a cloud based software that enables your business to measure, manage and mitigate its carbon emissions.
These Terms & Conditions (“Terms”) are a Legally Binding contract between you (‘The Company’) and us (‘Trace).
These Terms govern access to and use of the Trace (“Trace”, “We”, “Us”) Websites, Portal, Assets and Services (collectively “Services”) by Site visitors, individuals or entities who purchase our Services or create an Account and their Authorised Users (collectively “Customers”).
As part of these Terms, you agree to comply with the most recent version of our Protocol for use of Trace branding as defined in these Terms.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL TRACE, ITS AFFILIATES OR SUPPLIERS BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, EXEMPLARY OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES OR FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR ANY OTHER PECUNIARY LOSS OR DAMAGE) ARISING OUT OF THE USE OR INABILITY TO USE THE SERVICES. IN ANY CASE, TRACE’S MAXIMUM LIABILITY WILL BE LIMITED TO THE AMOUNT ACTUALLY PAID FOR YOU FOR THE SERVICES (IF ANY) IN THE 12 MONTHS PRECEDING THE EVENT OR CIRCUMSTANCES GIVING RISE TO SUCH CLAIMS.
Trace may, in its sole discretion at any time discontinue providing, or limit access to its Services if it determines, in its sole discretion, that you have infringed any of the Terms in this document.
4.1 Key terms used in this clause, include:
(a) “Recurring Service Start Date“ means the date on which access is provided to the Trace Software as a service (SaaS);
(b) “Recurring Services“ means annual provision of: i) our SaaS including Data, Measure, Reduce, Engage and Share modules and their associated features. These modules and their features may be updated from time to time; ii) Measurement Services required to deliver the SaaS; iii) Carbon and Climate Reporting documentation services.
(c) “Services“ means the: i) Set-up Process; ii) Recurring Services; iii) any support services; iv) any additional services added by us throughout the Term (note these may incur additional fees and/or may only be accessible on certain plans);
d) "Linked Agreement" means any of i) a Supplier Agreement agreed between you and Trace; ii) a Partnership Agreement between you and Trace; iii) any other document or written correspondence agreed from time to time that references these Terms of Service.
4.2 Our service promise: In consideration of payment of the Fees, we will provide the Services in accordance with these Terms, whether ourselves or through our Personnel. We agree to, where this is commercially feasible, use reasonable commercial endeavours to remediate any defects in the SaaS Services within a reasonable time of becoming aware of them. The remediation in this clause will not apply to Third Party Inputs (for example, to issues in relation to our data hosting provider) or Third Party Products (for example, to issues in relation to your SSO Provider or accounting software). If you become aware of any issues during the Term, please notify us.
4.3 Set-up Process: Where you specify Third Party Products for integration during your Account and/or Plan set up, we will carry out the Set-up Process to assist you with the integration of the SaaS Services with such Third Party Products via existing application programming interfaces and agreements. Please note that we can only integrate with Third Party Products we have an existing arrangement with and that the scope of any integration (i.e. what data can be imported and exported) will be subject to the terms of our agreement with the applicable Third Party Product and your agreement with the applicable Third Party Product.
4.4 Changes to the SaaS Services: You agree that we may amend the SaaS Services (including any features) at any time, by providing notice to you, provided those changes do not substantially and adversely affect your use and enjoyment of the SaaS Services. By way of example, a change that would substantially or adversely affect your use and enjoyment of the SaaS Services: (a) would include a fundamental change to the Services, such as us removing the ability to connect with your accounting software feature; and (b) would not include changing minor features or the look or feel of the platform. In relation to changes to the SaaS Services that would substantially and adversely affect your (or an Authorised User's) use and enjoyment of the SaaS Services, we agree to provide you with notice of any such change at least 30 days prior to the change taking place. On receiving such notice, if you do not wish to continue using the SaaS Services with the change, you may choose to terminate these Terms by providing us notice of termination within 30 days of the date of our notice.
5.1 You agree to pay all applicable, undisputed fees for the Services on the terms set forth on the invoice. You agree to pay us via an automatic and recurring credit card charge set up via our third party payment processor (and authorised by you) or via any other payment method set out on our Site or agreed with you in writing. You are responsible for reviewing the payment schedule and ensuring there are adequate funds available for processing. If after 14 days amounts payable remain overdue, we may suspend your service and/or downgrade your Account to a free account.
5.2 You agree that your payment card information and related personal data may be provided to third parties for payment processing and fraud prevention purposes.
5.3 You agree that we may automatically charge you for Recurring Services Fees on the anniversary of the annual Recurring Services start date, or any alternative payment schedule that may be agreed in a Linked Agreement, unless instructed by you to terminate the use of Trace Services in line with the terms of the Linked Agreement.
5.4 Our listed prices do not include any taxes, levies, duties or similar government assessment for any nature such as value-add, sales, use of withholding taxes, accessible by any jurisdiction (collectively “Taxes”) unless otherwise indicated. You are responsible for paying Taxes associated with your purchase.
5.5 Any disputes regarding invoices must be raised within 10 days after the invoice date. Failure to notify the Supplier within this period will be deemed acceptance of the invoice.
6.1 Your use and reliance on Third Party Inputs: You agree that the Services may include Third Party Inputs selected by us that interface, or interoperate, with the Services, including third party software or services and that the provision of the Services may be contingent on, limited to, or impacted by, Third Party Inputs (i.e. our third party data hosting provider). You must comply with our instructions and directions, whether written or verbal, in relation to use of any Third Party Inputs. Where we provide you with any terms and conditions for use of these Third Party Inputs, you agree that you will comply with these and are liable for any Liability that we incur as a result of any non-compliance by you.
6.2 Our integration with your Third Party Products: You agree that we may facilitate, on your instructions, the interface, or interoperation of, the Services with your Third Party Products, including third party software, services or equipment and that the provision of the Services may be contingent on, limited to, or impacted by these Third Party Products (for example, your accounting software or SSO Provider). To the extent that you choose to use any Third Party Products in conjunction with the Services, you are solely responsible for: (a) the purchase of; (b) the requirements (including any consents or permissions); and (c) the licensing obligations (and compliance with those obligations), related to the applicable Third Party Product; and (d) for ensuring the interface of, or interoperation of, the SaaS Services with your Third Party Product and the extraction and receipt of any of Your Data is legally and contractually permitted (including with respect to Privacy Laws). You agree that the benefit of any Third Party Product's interface, or interoperation with, the Services, is subject to your compliance with this clause and that we have no Liability to you (including for any loss of access to data or corruption of data) if any Third Party Product withdraws your access to their services or withdraws their services from integration with our Services.
6.3 Despite anything to the contrary, we may monitor, analyse and compile statistical information (including but not limited to transaction and invoice data which we may gather from the accounting software API) and performance information (including but not limited to usage data that we may gather from API integrations and other techniques to understand how much a piece of software is being used) based on and/or related to New Materials, Your Data and your use of the Services for our own business purposes (being any purpose we see fit), and to provide anonymised transactional information to unaffiliated third parties for their business use in an aggregated and anonymised format, such that it is no longer about an identifiable individual and there is no reasonable likelihood of re-identification of an individual ( “Analytics“ ). To the extent the Analytics contains any Personal Information, we will comply with our obligations under applicable Privacy Laws.
7.1 We gather and store customer data securely within our proprietary application and a secure third party tool. Access is strictly limited to our employees on a need to know basis and confidential customer data will never be shared with third parties. By accepting these Terms you agree that you have read and accept our Privacy Policy.
7.2 You grant us a limited licence to copy, transmit, disclose, modify, reproduce, upload, communicate, distribute, store and back-up or otherwise access and make available Your Data to: (a) supply the Services to you (including to enable you and your Personnel and Authorised Users to access and use the Services) and to third parties; (b) diagnose problems with the Services; (c) enhance and otherwise modify the Services, including to improve functionality and algorithms; (d) perform Analytics; and (f) as otherwise reasonably required to perform our obligations under these Terms.
7.3 You acknowledge and agree that you must, at all times, (a) ensure the integrity of Your Data and that the collection and use of Your Data is compliant with all Laws; (b) ensure the ongoing secure storage of all Your Data, free from unauthorised access or disclosure (including by regularly backing up Your Data via a means separate to its storage on the SaaS Services); and (c) ensure that you are legally permitted to disclose any of Your Data (including any Personal Information) from any Third Party Product to us and you consent to us retrieving Your Data from any Third Party Product nominated by you for use by us in accordance with these Terms. You represent and warrant that: (a) you have obtained all necessary rights, releases and permissions to provide all of Your Data to us and to grant the rights granted to us in these Terms; and (b) Your Data (and its transfer to and use by us) as authorised by you, under these Terms does not violate any Laws (including those relating to export control and electronic communications), any contractual obligations, or rights of any third party, including any Intellectual Property Rights, rights of privacy, or rights of publicity.
7.4 Key Terms used in this clause, include: (a) “Confidential Information“ , which includes information which: (1) is disclosed to the Receiving Party in connection with these Terms at any time; (2) is prepared or produced under or in connection with these Terms at any time; (3) relates to the Disclosing Party's business, assets or affairs; or (4) relates to the subject matter of, the terms of and/or any transactions contemplated by these Terms, whether or not such information or documentation is reduced to a tangible form or marked in writing as “confidential“, and howsoever the Receiving Party receives that information; (b) “Disclosing Party“ , which means the Party disclosing the Confidential Information; and (c) “Receiving Party“ , which means the Party receiving the Confidential Information.
7.5 Confidentiality obligations: Each Receiving Party agrees: (a) not to disclose the Confidential Information of the Disclosing Party to any third party; (b) to use all reasonable endeavours to protect the Confidential Information of the Disclosing Party from any unauthorised disclosure; and (c) to only use the Confidential Information of the Disclosing Party for the purposes for which it was disclosed or provided by the Disclosing Party, and not for any other purpose.
7.6 Exceptions to the confidentiality obligations: The obligations above do not apply to Confidential Information that: (a) is required to be disclosed in order for the Parties to comply with their obligations under these Terms; (b) is authorised to be disclosed by the Disclosing Party; (c) is in the public domain and/or is no longer confidential, except as a result of a breach of these Terms; or (d) must be disclosed by Law or by a regulatory authority, including under subpoena.
7.7 Remedies: Each Party agrees that monetary damages may not be an adequate remedy for a breach of this clause 12. A Party is entitled to seek an injunction, or any other remedy available at law or in equity, at its discretion, to protect itself from a breach (or continuing breach) of this confidentiality clause.
7.8 All data is stored in Australia. The Parties agree to the following International Data Transfer Agreement in line with the United Kingdom's Data Protection Act 2018. This Section of the Terms of service is only applicable to companies and users bound by the UK Data Protection Act 2018.
7.9 Key details
7.9.1 The Parties shall be Our Trace Pty Ltd and the Company identified in the Linked Agreement and/or in the Get Started form.
7.9.2 The Exporter is considered to be a controller.
7.9.3 The Importer is a processor and the exported data will also reside with sub-processors including AWS Australia Pty Ltd and Hubspot.
7.9.4 UK GDPR applies to the Importer's processing of Transferred Data.
7.9.5 The Linked Agreement will be the Supplier Agreement signed between the parties contemporaneously with the Company completing the Get Started form.
7.9.6 The Term is defined in these Terms of service and or the Linked Agreement with the Term defined in the Linked Agreement taking precedence.
7.9.7 The Importer may transfer on the Transferred Data to a sub-processor. Acceptance of these Terms of service provides Our Trace Pty Ltd with that right.
7.9.8 There will be no Review Date specified.
7.9.10 The personal data to be transferred are defined in the data captured within the Our Trace Pty Ltd software application and may change from time to time at the discretion of Our Trace Pty Ltd in order to carry out the Purpose of this agreement.
7.9.11 The Relevant Data Subjects are defined as Company users of the Our Trace Pty Ltd software application and its employees from time to time.
7.9.12 The Parties will use reasonable endeavours to ensure the security of Transferred Data during transmission.
7.9.13 The Parties will use reasonable endeavours to ensure the security of Transferred Data during storage.
7.9.14 The Parties will use reasonable endeavours to ensure the security of Transferred Data during processing.
7.9.15 The Parties will use reasonable endeavours to ensure the security of Transferred Data within their respective organisations.
7.10 This IDTA and Linked Agreements
7.10.1 Each Party agrees to be bound by the terms and conditions set out in theIDTA, in exchange for the other Party also agreeing to be bound by the IDTA.
7.10.2 The IDTA starts on the Start Date and ends as set out in Sections 29 or 30.
7.10.3 If the Importer is a Processor or Sub-Processor instructed by the Exporter:the Exporter must ensure that, on or before the Start Date and during theTerm, there is a Linked Agreement which is enforceable between the Parties and which complies with Article 28 UK GDPR (and which they will ensure continues to comply with Article 28 UK GDPR).
7.10.4 References to the Linked Agreement or to the Commercial Clauses are to that Linked Agreement or to those Commercial Clauses only in so far as they are consistent with the Mandatory Clauses.
7.11 Legal Meaning of Words
7.11.1 If a word starts with a capital letter it has the specific meaning set out in the Legal Glossary in Section 36.
7.11.2 To make it easier to read and understand, this IDTA contains headings and guidance notes. Those are not part of the binding contract which forms the IDTA.
7.12 You have provided all the information required
7.12.1 The Parties must ensure that the information contained in this and any Linked Agreements is correct and complete at the Start Date and during the Term.
7.12.2 If the inference that Parties are Controllers, Processors or Sub-Processors is wrong (either as a matter of fact or as a result of applying the UK Data Protection Laws) then:
- 7.12.2.1 the terms and conditions of the Approved IDTA which apply to the correct option which was not selected will apply; and
- 7.12.2.2 the Parties and any Relevant Data Subjects are entitled to enforce the terms and conditions of the Approved IDTA which apply to that correct option.
- 7.12.2.3 If the inference that the UK GDPR applies is wrong (either as a matter of fact or as a result of applying the UK Data Protection Laws), then the terms and conditions of the IDTA will still apply to the greatest extent possible.
7.13 How to sign the IDTA
7.13.1 By signing the Linked Agreement and / or by accepting these Terms of service this IDTA is considered executed by both Parties.
7.14 Changing this IDTA
7.14.1 Each Party must not change the Mandatory Clauses as set out in the Approved IDTA.
7.14.2 to ensure correct cross-referencing: cross-references to Part one: Tables (or any Table), Part two: Extra Protections, and/or Part three: Commercial Clauses can be changed where the Parties have set out the information in a different format, so that the cross-reference is to the correct location of the same information, or where clauses have been removed as they do not apply, as set out
below;
- 7.14.2.1 to remove those Sections which are expressly stated not to apply to the selections made by the Parties: Transfer Details, that the Parties are Controllers, Processors or Sub-Processors and/or that the Importer is subject to, or not subject to, the UKGDPR. The Exporter and Importer understand and acknowledge that any removed Sections may still apply and form a part of thisIDTA if they have been removed incorrectly, including because the wrong selection is made in Table 2: Transfer Details;
- 7.14.2.2 so the IDTA operates as a multi-party agreement if there are more than two Parties to the IDTA. This may include nominating a leadParty or lead Parties which can make decisions on behalf of some or all of the other Parties which relate to this IDTA (including reviewing Table 4: Security Requirements and Part two: ExtraProtection Clauses, and making updates to Part one: Tables (or any Table), Part two: Extra Protection Clauses, and/or Part three:Commercial Clauses); and/or
- 7.14.2.3 to update the IDTA to set out in writing any changes made to the Approved IDTA under Section 5.4, if the Parties want to. The changes will apply automatically without updating them as described in Section 5.4; provided that the changes do not reduce the Appropriate Safeguards.
7.14.3 If the Parties wish to change the format of the information included in Part one: Tables, Part two: Extra Protection Clauses or Part three: CommercialClauses of the Approved IDTA, they may do so by agreeing to the change in writing, provided that the change does not reduce the AppropriateSafeguards.
7.14.4 If the Parties wish to change the information included in Part one: Tables,Part two: Extra Protection Clauses or Part three: Commercial Clauses of this IDTA (or the equivalent information), they may do so by agreeing to the change in writing, provided that the change does not reduce theAppropriate Safeguards.
7.14.5 From time to time, the ICO may publish a revised Approved IDTA which:
- 7.14.5.1 makes reasonable and proportionate changes to the Approved IDTA, including correcting errors in the Approved IDTA; and/or
- 7.14.5.2 reflects changes to UK Data Protection Laws.
The revised Approved IDTA will specify the start date from which the changes to the Approved IDTA are effective and whether an additional Review Date is required as a result of the changes. This IDTA is automatically amended as set out in the revised Approved IDTA from the start date specified.
7.15 Understanding this IDTA
7.15.1 This IDTA must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
7.15.2 If there is any inconsistency or conflict between UK Data Protection Laws and this IDTA, the UK Data Protection Laws apply.
7.15.3 If the meaning of the IDTA is unclear or there is more than one meaning, the meaning which most closely aligns with the UK Data Protection Laws applies.
7.15.4 Nothing in the IDTA (including the Commercial Clauses or the Linked Agreement) limits or excludes either Party’s liability to Relevant Data Subjects or to the ICO under this IDTA or under UK Data Protection Laws.
7.15.5 If any wording in Parts one, two or three contradicts the Mandatory Clauses, and/or seeks to limit or exclude any liability to Relevant Data Subjects or to the ICO, then that wording will not apply.
7.15.6 The Parties may include provisions in the Linked Agreement which provide the Parties with enhanced rights otherwise covered by this IDTA. These enhanced rights may be subject to commercial terms, including payment, under the Linked Agreement, but this will not affect the rights granted under this IDTA.
7.15.7 If there is any inconsistency or conflict between this IDTA and a Linked Agreement or any other agreement, this IDTA overrides that Linked Agreement or any other agreements, even if those agreements have been negotiated by the Parties. The exceptions to this are where (and in so far as):
- 7.15.7.1 the inconsistent or conflicting terms of the Linked Agreement or other agreement provide greater protection for the Relevant Data Subject’s rights, in which case those terms will override the IDTA;
and International Data Transfer Agreement
- 7.15.7.2 a Party acts as Processor and the inconsistent or conflicting terms of the Linked Agreement are obligations on that Party expressly required by Article 28 UK GDPR, in which case those terms will override the inconsistent or conflicting terms of the IDTA in
relation to Processing by that Party as Processor.
7.15.8 The words “include”, “includes”, “including”, “in particular” are used to set out examples and not to set out a finite list.
7.15.9 References to:
- 7.15.9.1 singular or plural words or people, also includes the plural or singular of those words or people;
- 7.15.9.2 legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this IDTA has been
signed; and
- 7.15.9.3 any obligation not to do something, includes an obligation not to allow or cause that thing to be done by anyone else.
7.16 Which laws apply to this IDTA
7.16.1 This IDTA is governed by the laws of England and Wales. This does not apply to Section 35 which is always governed by the laws of England and Wales.
7.17 The Appropriate Safeguards
7.17.1 The purpose of this IDTA is to ensure that the Transferred Data has Appropriate Safeguards when Processed by the Importer during the Term. This standard is met when and for so long as:
- 7.17.1.1 both Parties comply with the IDTA, including the Security Requirements and any Extra Protection Clauses; and
- 7.17.1.2 the Security Requirements and any Extra Protection Clauses provide a level of security which is appropriate to the risk of a Personal Data Breach occurring and the impact on Relevant Data Subjects of such a Personal Data Breach, including considering
any Special Category Data within the Transferred Data.
7.17.2 The Exporter must:
- 7.17.2.1 ensure and demonstrate that this IDTA (including any Security
Requirements and Extra Protection Clauses) provides Appropriate
Safeguards; and
- 7.17.2.2 (if the Importer reasonably requests) provide it with a copy of any TRA.
7.17.3 The Importer must:
- 7.17.3.1 before receiving any Transferred Data, provide the Exporter with all relevant information regarding Local Laws and practices and
the protections and risks which apply to the Transferred Data when it is Processed by the Importer, including any information which may reasonably be required for the Exporter to carry out any TRA (the “Importer Information”);
- 7.17.3.2 co-operate with the Exporter to ensure compliance with the Exporter’s obligations under the UK Data Protection Laws;
- 7.17.3.3 review whether any Importer Information has changed, and whether any Local Laws contradict its obligations in this IDTA and take reasonable steps to verify this, on a regular basis. These reviews must be at least as frequent as the Review Dates; and
- 7.17.3.4 inform the Exporter as soon as it becomes aware of any Importer Information changing, and/or any Local Laws which may prevent or limit the Importer complying with its obligations in this IDTA. This information then forms part of the Importer Information.
7.17.4 The Importer must ensure that at the Start Date and during the Term:
- 7.17.4.1 the Importer Information is accurate;
- 7.17.4.2 it has taken reasonable steps to verify whether there are any Local Laws which contradict its obligations in this IDTA or any
additional information regarding Local Laws which may be relevant to this IDTA.
7.17.5 Each Party must ensure that the Security Requirements and Extra Protection Clauses provide a level of security which is appropriate to the risk of a Personal Data Breach occurring and the impact on Relevant Data Subjects of such a Personal Data Breach.
7.18 Reviews to ensure the Appropriate Safeguards continue
7.18.1 Each Party must:
- 7.18.1.1 review this IDTA (including the Security Requirements and Extra Protection Clauses and the Importer Information) at regular intervals, to ensure that the IDTA remains accurate and up to date and continues to provide the Appropriate Safeguards. Each Party
will carry out these reviews as frequently as the relevant Review Dates or sooner; and
- 7.18.1.2 inform the other party in writing as soon as it becomes aware if any information contained in either this IDTA, any TRA or Importer Information is no longer accurate and up to date.
7.18.2 If, at any time, the IDTA no longer provides Appropriate Safeguards the Parties must Without Undue Delay:
- 7.18.2.1 pause transfers and Processing of Transferred Data whilst a change to the Tables is agreed. The Importer may retain a copy of the Transferred Data during this pause, in which case the Importer must carry out any Processing required to maintain, so far as possible, the measures it was taking to achieve the Appropriate Safeguards prior to the time the IDTA no longer provided Appropriate Safeguards, but no other Processing;
- 7.18.2.2 agree a change to Part one: Tables or Part two: Extra Protection Clauses which will maintain the Appropriate Safeguards (in
accordance with Section 5); and
- 7.18.2.3 where a change to Part one: Tables or Part two: Extra Protection Clauses which maintains the Appropriate Safeguards cannot be
agreed, the Exporter must end this IDTA by written notice on the
Importer.
7.19 The ICO
7.19.1 Each Party agrees to comply with any reasonable requests made by the ICO in relation to this IDTA or its Processing of the Transferred Data.
7.19.2 The Exporter will provide a copy of any TRA, the Importer Information and this IDTA to the ICO, if the ICO requests.
7.19.3 The Importer will provide a copy of any Importer Information and this IDTA to the ICO, if the ICO requests.
7.20 Exporter’s obligations
7.20.1 The Exporter agrees that UK Data Protection Laws apply to its Processing of the Transferred Data, including transferring it to the Importer.
7.20.2 The Exporter must:
- 7.20.2.1 comply with the UK Data Protection Laws in transferring the Transferred Data to the Importer;
- 7.20.2.2 comply with the Linked Agreement as it relates to its transferring the Transferred Data to the Importer; and
- 7.20.2.3 carry out reasonable checks on the Importer’s ability to comply with this IDTA, and take appropriate action including under Section 9.2, Section 29 or Section 30, if at any time it no longer considers that the Importer is able to comply with this IDTA or to provide Appropriate Safeguards.
7.20.3 The Exporter must comply with all its obligations in the IDTA, including any in the Security Requirements, and any Extra Protection Clauses and any Commercial Clauses.
7.20.4 The Exporter must co-operate with reasonable requests of the Importer to pass on notices or other information to and from Relevant Data Subjects or any Third Party Controller where it is not reasonably practical for theImporter to do so. The Exporter may pass these on via a third party if it is reasonable to do so.
7.20.5 The Exporter must co-operate with and provide reasonable assistance to the Importer, so that the Importer is able to comply with its obligations to the Relevant Data Subjects under Local Law and this IDTA.The Importer
7.21 General Importer obligations
7.21.1 The Importer must:
- 7.21.1.1 only Process the Transferred Data for the Purpose;
- 7.21.1.2 comply with all its obligations in the IDTA, including in the Security Requirements, any Extra Protection Clauses and any Commercial Clauses;
- 7.21.1.3 comply with all its obligations in the Linked Agreement which relate to its Processing of the Transferred Data;
- 7.21.1.4 keep a written record of its Processing of the Transferred Data, which demonstrate its compliance with this IDTA, and provide this written record if asked to do so by the Exporter;
- 7.21.1.5 if the Linked Agreement includes rights for the Exporter to obtain information or carry out an audit, provide the Exporter with the same rights in relation to this IDTA; and
- 7.21.1.6 if the ICO requests, provide the ICO with the information it would be required on request to provide to the Exporter under this Section 12.1 (including the written record of its Processing, and the results of audits and inspections).
7.21.2 The Importer must co-operate with and provide reasonable assistance to the Exporter and any Third Party Controller, so that the Exporter and anyThird Party Controller are able to comply with their obligations under UK Data Protection Laws and this IDTA.
13. Importer’s obligations if it is subject to the UK Data Protection Laws
13.1 If the Importer’s Processing of the Transferred Data is subject to UK Data Protection Laws, it agrees that:
- 13.1.1 UK Data Protection Laws apply to its Processing of the TransferredData, and the ICO has jurisdiction over it in that respect; and13.1.2 it has and will comply with the UK Data Protection Laws in relation to the Processing of the Transferred Data.
13.2 If Section 13.1 applies and the Importer complies with Section 13.1, it does not need to comply with:• Section 14 (Importer’s obligations to comply with key data protection principles);• Section 15 (What happens if there is an Importer Personal DataBreach);• Section 15 (How Relevant Data Subjects can exercise their data subject rights); and• Section 21 (How Relevant Data Subjects can exercise their data subject rights – if the Importer is the Exporter’s Processor or Sub-Processor).
14. Importer’s obligations to comply with key data protection principles
14.1 The Importer does not need to comply with this Section 14 if it is theExporter’s Processor or Sub-Processor.14.2 The Importer must:
- 14.2.1 ensure that the Transferred Data it Processes is adequate, relevant and limited to what is necessary for the Purpose;
- 14.2.2 ensure that the Transferred Data it Processes is accurate and(where necessary) kept up to date, and (where appropriate considering the Purposes) correct or delete any inaccurateTransferred Data it becomes aware of Without Undue Delay; and
- 14.2.3 ensure that it Processes the Transferred Data for no longer than is reasonably necessary for the Purpose.
15. What happens if there is an Importer Personal Data Breach
15.1 If there is an Importer Personal Data Breach, the Importer must:
- 15.1.1 take reasonable steps to fix it, including to minimise the harmful effects on Relevant Data Subjects, stop it from continuing, and prevent it happening again. If the Importer is the Exporter’s Processor or Sub-Processor: these steps must comply with the Exporter’s instructions and the Linked Agreement and be in cooperation with the Exporter and any Third Party Controller; and
- 15.1.2 ensure that the Security Requirements continue to provide (or are changed in accordance with this IDTA so they do provide) a level of security which is appropriate to the risk of a Personal DataBreach occurring and the impact on Relevant Data Subjects of such a Personal Data Breach.
15.2 If the Importer is a Processor or Sub-Processor: if there is an ImporterPersonal Data Breach, the Importer must:
- 15.2.1 notify the Exporter Without Undue Delay after becoming aware of the breach, providing the following information:
- 15.2.1.1 a description of the nature of the Importer Personal DataBreach;
- 15.2.1.2 (if and when possible) the categories and approximate number of Data Subjects and Transferred Data recordsconcerned;
- 15.2.1.3 likely consequences of the Importer Personal DataBreach;
- 15.2.1.4 steps taken (or proposed to be taken) to fix the Importer Personal Data Breach (including to minimise the harmful effects on Relevant Data Subjects, stop it from continuing, and prevent it happening again) and to ensure that Appropriate Safeguards are in place;
- 15.2.1.5 contact point for more information; and
- 15.2.1.6 any other information reasonably requested by the Exporter,
- 15.2.2 if it is not possible for the Importer to provide all the above information at the same time, it may do so in phases, Without Undue Delay; and
- 15.2.3 assist the Exporter (and any Third Party Controller) so the Exporter (or any Third Party Controller) can inform Relevant Data Subjects or the ICO or any other relevant regulator or authority about the Importer Personal Data Breach Without Undue Delay.
15.3 If the Importer is a Controller: if the Importer Personal Data Breach is likely to result in a risk to the rights or freedoms of any Relevant DataSubject the Importer must notify the Exporter Without Undue Delay after becoming aware of the breach, providing the following information:
- 15.3.1 a description of the nature of the Importer Personal Data Breach;
- 15.3.2 (if and when possible) the categories and approximate number of Data Subjects and Transferred Data records concerned;
- 15.3.3 likely consequences of the Importer Personal Data Breach;
- 15.3.4 steps taken (or proposed to be taken) to fix the Importer Personal Data Breach (including to minimise the harmful effects on Relevant Data Subjects, stop it from continuing, and prevent it happening again) and to ensure that Appropriate Safeguards are in place;
- 15.3.5 contact point for more information; and
- 15.3.6 any other information reasonably requested by the Exporter. If it is not possible for the Importer to provide all the above information at the same time, it may do so in phases, Without Undue Delay.
15.4 If the Importer is a Controller: if the Importer Personal Data Breach is likely to result in a high risk to the rights or freedoms of any RelevantData Subject, the Importer must inform those Relevant Data SubjectsWithout Undue Delay, except in so far as it requires disproportionate effort, and provided the Importer ensures that there is a public communication or similar measures whereby Relevant Data Subjects are informed in an equally effective manner.
15.5 The Importer must keep a written record of all relevant facts relating to the Importer Personal Data Breach, which it will provide to the Exporter and the ICO on request.This record must include the steps it takes to fix the Importer Personal Data Breach (including to minimise the harmful effects on Relevant DataSubjects, stop it from continuing, and prevent it happening again) and to ensure that Security Requirements continue to provide a level of security which is appropriate to the risk of a Personal Data Breach occurring and the impact on Relevant Data Subjects of such a Personal Data Breach.
16. Transferring on the Transferred Data
16.1 The Importer may only transfer on the Transferred Data to a third party if it is permitted to do so, the transfer is for the Purpose, the transfer does not breach the Linked Agreement, and one or more of the following apply:
- 16.1.1 the third party has entered into a written contract with theImporter containing the same level of protection for Data Subjects as contained in this IDTA (based on the role of the recipient as controller or processor), and the Importer has conducted a risk assessment to ensure that the Appropriate Safeguards will be protected by that contract; or
- 16.1.2 the third party has been added to this IDTA as a Party; or
- 16.1.3 if the Importer was in the UK, transferring on the Transferred Data would comply with Article 46 UK GDPR; or
- 16.1.4 if the Importer was in the UK transferring on the Transferred Data would comply with one of the exceptions in Article 49 UK GDPR; or
- 16.1.5 the transfer is to the UK or an Adequate Country.
16.2 The Importer does not need to comply with Section 16.1 if it is transferring on Transferred Data and/or allowing access to the Transferred Data in accordance with Section 23 (Access Requests and Direct Access).
17. Importer’s responsibility if it authorises others to perform its obligations
17.1 The Importer may sub-contract its obligations in this IDTA to a Processor or Sub-Processor (provided it complies with Section 16).
17.2 If the Importer is the Exporter’s Processor or Sub-Processor: it must also comply with the Linked Agreement or be with the written consent of theExporter.
17.3 The Importer must ensure that any person or third party acting under its authority, including a Processor or Sub-Processor, must only Process theTransferred Data on its instructions.
17.4 The Importer remains fully liable to the Exporter, the ICO and Relevant Data Subjects for its obligations under this IDTA where it has subcontracted any obligations to its Processors and Sub-Processors, or authorised an employee or other person to perform them (and references to the Importer in this context will include references to its Processors, Sub-Processors or authorised persons).
18. The right to a copy of the IDTA
18.1 If a Party receives a request from a Relevant Data Subject for a copy of this IDTA:
- 18.1.1 it will provide the IDTA to the Relevant Data Subject and inform the other Party, as soon as reasonably possible;
- 18.1.2 it does not need to provide copies of the Linked Agreement, but it must provide all the information from those Linked Agreements;
- 18.1.3 it may redact information from the Linked Agreement if it is reasonably necessary to protect business secrets or confidential information, so long as it provides the Relevant Data Subject with a summary of those redactions so that the Relevant Data Subject can understand the content the information provided from the Linked Agreement.
19. The right to Information about the Importer and its Processing
19.1 The Importer does not need to comply with this Section 19 if it is theExporter’s Processor or Sub-Processor.
19.2 The Importer must ensure that each Relevant Data Subject is provided with details of:
• the Importer (including contact details and the Importer Data SubjectContact);
• the Purposes; and
• any recipients (or categories of recipients) of the Transferred Data;
The Importer can demonstrate it has complied with this Section
19.2 if the information is given (or has already been given) to the Relevant DataSubjects by the Exporter or another party. The Importer does not need to comply with this Section 19.2 in so far as to do so would be impossible or involve a disproportionate effort, in which case, the Importer must make the information publicly available.
19.3 The Importer must keep the details of the Importer Data Subject Contact up to date and publicly available. This includes notifying the Exporter in writing of any such changes.
19.4 The Importer must make sure those contact details are always easy to access for all Relevant Data Subjects and be able to easily communicate with Data Subjects in the English language Without Undue Delay.
20. How Relevant Data Subjects can exercise their data subject rights
20.1 The Importer does not need to comply with this Section 20 if it is the Exporter’s Processor or Sub-Processor.
20.2 If an individual requests, the Importer must confirm whether it is Processing their Personal Data as part of the Transferred Data.
20.3 The following Sections of this Section 20, relate to a Relevant Data Subject’s Personal Data which forms part of the Transferred Data the Importer is Processing. 20.4 If the Relevant Data Subject requests, the Importer must provide them with a copy of their Transferred Data:
- 20.4.1 Without Undue Delay (and in any event within one month);
- 20.4.2 at no greater cost to the Relevant Data Subject than it would be able to charge if it were subject to the UK Data Protection Laws;
- 20.4.3 in clear and plain English that is easy to understand; and
- 20.4.4 in an easily accessible form together with
- 20.4.5 (if needed) a clear and plain English explanation of the Transferred Data so that it is understandable to the Relevant Data Subject; and
- 20.4.6 information that the Relevant Data Subject has the right to bring a claim for compensation under this IDTA.
20.5 If a Relevant Data Subject requests, the Importer must:
- 20.5.1 rectify inaccurate or incomplete Transferred Data;
- 20.5.2 erase Transferred Data if it is being Processed in breach of this IDTA;
- 20.5.3 cease using it for direct marketing purposes; and
- 20.5.4 comply with any other reasonable request of the Relevant Data Subject, which the Importer would be required to comply with if it were subject to the UK Data Protection Laws.
- 20.6 The Importer must not use the Transferred Data to make decisions about the Relevant Data Subject based solely on automated processing, including profiling (the “Decision-Making”), which produce legal effects concerning the Relevant Data Subject or similarly significantly affects them, except if it is permitted by Local Law and:
- 20.6.1 the Relevant Data Subject has given their explicit consent to such Decision-Making; or
- 20.6.2 Local Law has safeguards which provide sufficiently similar protection for the Relevant Data Subjects in relation to such
Decision-Making, as to the relevant protection the Relevant Data Subject would have if such Decision-Making was in the UK; or
- 20.6.3 the Extra Protection Clauses provide safeguards for the DecisionMaking which provide sufficiently similar protection for the Relevant Data Subjects in relation to such Decision-Making, as to the relevant protection the Relevant Data Subject would have if such Decision-Making was in the UK.
21. How Relevant Data Subjects can exercise their data subject rights– if the Importer is the Exporter’s Processor or Sub-Processor
21.1 Where the Importer is the Exporter’s Processor or Sub-Processor: If the Importer receives a request directly from an individual which relates to the Transferred Data it must pass that request on to the Exporter Without Undue Delay. The Importer must only respond to that individual as authorised by the Exporter or any Third Party Controller.
22. Rights of Relevant Data Subjects are subject to the exemptions in the UK Data Protection Laws
22.1 The Importer is not required to respond to requests or provide information or notifications under Sections 18, 19, 20, 21 and 23 if:
- 22.1.1 it is unable to reasonably verify the identity of an individual making the request; or
- 22.1.2 the requests are manifestly unfounded or excessive, including where requests are repetitive. In that case the Importer may refuse the request or may charge the Relevant Data Subject a reasonable fee; or
- 22.1.3 a relevant exemption would be available under UK Data Protection Laws, were the Importer subject to the UK Data Protection Laws.nIf the Importer refuses an individual’s request or charges a fee under Section 22.1.2 it will set out in writing the reasons for its refusal or charge, and inform the Relevant Data Subject that they are entitled to bring a claim for compensation under this IDTA in the case of any breach of this IDTA.
23. Access requests and direct access
23.1 In this Section 23 an “Access Request” is a legally binding request (except for requests only binding by contract law) to access any Transferred Data and “Direct Access” means direct access to any Transferred Data by public authorities of which the Importer is aware.
23.2 The Importer may disclose any requested Transferred Data in so far as it receives an Access Request, unless in the circumstances it is reasonable for it to challenge that Access Request on the basis there are significant grounds to believe that it is unlawful.
23.3 In so far as Local Laws allow and it is reasonable to do so, the Importer will Without Undue Delay provide the following with relevant information about any Access Request or Direct Access: the Exporter; any Third Party Controller; and where the Importer is a Controller, any Relevant Data Subjects.
23.4 In so far as Local Laws allow, the Importer must:
- 23.4.1 make and keep a written record of Access Requests and Direct Access, including (if known): the dates, the identity of the requestor/accessor, the purpose of the Access Request or Direct Access, the type of data requested or accessed, whether it was challenged or appealed, and the outcome; and the Transferred Data which was provided or accessed; and
- 23.4.2 provide a copy of this written record to the Exporter on each Review Date and any time the Exporter or the ICO reasonably requests.
24. Giving notice
24.1 If a Party is required to notify any other Party in this IDTA it will be marked for the attention of the relevant Key Contact and sent by e-mail to the e-mail address given for the Key Contact.
24.2 If the notice is sent in accordance with Section 24.1, it will be deemed to have been delivered at the time the e-mail was sent, or if that time is outside of the receiving Party’s normal business hours, the receiving Party’s next normal business day, and provided no notice of non-delivery or bounceback is received.
24.3 The Parties agree that any Party can update their Key Contact details by giving 14 days’ (or more) notice in writing to the other Party.
25. General clauses
25.1 In relation to the transfer of the Transferred Data to the Importer and the Importer’s Processing of the Transferred Data, this IDTA and any Linked Agreement:
- 25.1.1 contain all the terms and conditions agreed by the Parties; and
- 25.1.2 override all previous contacts and arrangements, whether oral or in writing.
25.2 If one Party made any oral or written statements to the other before entering into this IDTA (which are not written in this IDTA) the other Party confirms that it has not relied on those statements and that it will not have a legal remedy if those statements are untrue or incorrect, unless the statement was made fraudulently.
25.3 Neither Party may novate, assign or obtain a legal charge over this IDTA (in whole or in part) without the written consent of the other Party, which may be set out in the Linked Agreement. 25.4 Except as set out in Section 17.1, neither Party may sub contract its
obligations under this IDTA without the written consent of the other Party, which may be set out in the Linked Agreement.
25.5 This IDTA does not make the Parties a partnership, nor appoint one Party
to act as the agent of the other Party.
25.6 If any Section (or part of a Section) of this IDTA is or becomes illegal, invalid or unenforceable, that will not affect the legality, validity and enforceability of any other Section (or the rest of that Section) of this IDTA.
25.7 If a Party does not enforce, or delays enforcing, its rights or remedies under or in relation to this IDTA, this will not be a waiver of those rights or remedies. In addition, it will not restrict that Party’s ability to enforce those or any other right or remedy in future.
25.8 If a Party chooses to waive enforcing a right or remedy under or in relation to this IDTA, then this waiver will only be effective if it is made in writing. Where a Party provides such a written waiver:
- 25.8.1 it only applies in so far as it explicitly waives specific rights or remedies;
- 25.8.2 it shall not prevent that Party from exercising those rights or remedies in the future (unless it has explicitly waived its ability to do so); and
- 25.8.3 it will not prevent that Party from enforcing any other right or remedy in future.
26. Breaches of this IDTA
26.1 Each Party must notify the other Party in writing (and with all relevant
details) if it:
- 26.1.1 has breached this IDTA; or
- 26.1.2 it should reasonably anticipate that it may breach this IDTA, and provide any information about this which the other Party
reasonably requests.
26.2 In this IDTA “Significant Harmful Impact” means that there is more than a minimal risk of a breach of the IDTA causing (directly or indirectly) significant damage to any Relevant Data Subject or the other Party.
27. Breaches of this IDTA by the Importer
27.1 If the Importer has breached this IDTA, and this has a Significant Harmful Impact, the Importer must take steps Without Undue Delay to end the Significant Harmful Impact, and if that is not possible to reduce the Significant Harmful Impact as much as possible.
27.2 Until there is no ongoing Significant Harmful Impact on Relevant Data Subjects:
- 27.2.1 the Exporter must suspend sending Transferred Data to the Importer;
- 27.2.2 If the Importer is the Exporter’s Processor or Sub-Processor: if the Exporter requests, the importer must securely delete all Transferred Data or securely return it to the Exporter (or a third party named by the Exporter); and
- 27.2.3 if the Importer has transferred on the Transferred Data to a third party receiver under Section 16, and the breach has a Significant Harmful Impact on Relevant Data Subject when it is Processed by or on behalf of that third party receiver, the Importer must:
- 27.2.3.1 notify the third party receiver of the breach and suspend sending it Transferred Data; and
- 27.2.3.2 if the third party receiver is the Importer’s Processor or Sub-Processor: make the third party receiver securely delete all Transferred Data being Processed by it or on its behalf, or securely return it to the Importer (or a third party named by the Importer).
27.3 If the breach cannot be corrected Without Undue Delay, so there is no ongoing Significant Harmful Impact on Relevant Data Subjects, the Exporter must end this IDTA under Section 30.1.
28. Breaches of this IDTA by the Exporter
28.1 If the Exporter has breached this IDTA, and this has a Significant Harmful Impact, the Exporter must take steps Without Undue Delay to end the Significant Harmful Impact and if that is not possible to reduce the Significant Harmful Impact as much as possible.
28.2 Until there is no ongoing risk of a Significant Harmful Impact on Relevant Data Subjects, the Exporter must suspend sending Transferred Data to the Importer.
28.3 If the breach cannot be corrected Without Undue Delay, so there is no ongoing Significant Harmful Impact on Relevant Data Subjects, the Importer must end this IDTA under Section 30.1.
29. How to end this IDTA without there being a breach
29.1 The IDTA will end:
- 29.1.1 at the end of the Term stated in Table 2: Transfer Details; or
- 29.1.2 if in Table 2: Transfer Details, the Parties can end this IDTA by providing written notice to the other: at the end of the notice
period stated;
- 29.1.3 at any time that the Parties agree in writing that it will end; or
- 29.1.4 at the time set out in Section 29.2.
29.2 If the ICO issues a revised Approved IDTA under Section 5.4, if any Party selected in Table 2 “Ending the IDTA when the Approved IDTA changes”, will as a direct result of the changes in the Approved IDTA have a substantial, disproportionate and demonstrable increase in:
- 29.2.1 its direct costs of performing its obligations under the IDTA; and/or
- 29.2.2 its risk under the IDTA,
and in either case it has first taken reasonable steps to reduce that cost or risk so that it is not substantial and disproportionate, that Party may end the IDTA at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved IDTA.
30. How to end this IDTA if there is a breach
30.1 A Party may end this IDTA immediately by giving the other Party written
notice if:
- 30.1.1 the other Party has breached this IDTA and this has a Significant Harmful Impact. This includes repeated minor breaches which
taken together have a Significant Harmful Impact, and
- 30.1.1.1 the breach can be corrected so there is no Significant Harmful Impact, and the other Party has failed to do so
Without Undue Delay (which cannot be more than 14 days of being required to do so in writing); or
- 30.1.1.2 the breach and its Significant Harmful Impact cannot be corrected;
- 30.1.2 the Importer can no longer comply with Section 8.3, as there are Local Laws which mean it cannot comply with this IDTA and this has a Significant Harmful Impact.
31. What must the Parties do when the IDTA ends?
31.1 If the parties wish to bring this IDTA to an end or this IDTA ends in accordance with any provision in this IDTA, but the Importer must comply with a Local Law which requires it to continue to keep any Transferred Data then this IDTA will remain in force in respect of any retained Transferred Data for as long as the retained Transferred Data is retained, and the Importer must:
- 31.1.1 notify the Exporter Without Undue Delay, including details of the relevant Local Law and the required retention period;
- 31.1.2 retain only the minimum amount of Transferred Data it needs to comply with that Local Law, and the Parties must ensure they maintain the Appropriate Safeguards, and change the Tables and Extra Protection Clauses, together with any TRA to reflect this; and
31.1.3 stop Processing the Transferred Data as soon as permitted by that Local Law and the IDTA will then end and the rest of this Section 29 will apply.
31.2 When this IDTA ends (no matter what the reason is):
- 31.2.1 the Exporter must stop sending Transferred Data to the Importer; and
- 31.2.2 if the Importer is the Exporter’s Processor or Sub-Processor: the Importer must delete all Transferred Data or securely return it to the Exporter (or a third party named by the Exporter), as instructed by the Exporter;
- 31.2.3 if the Importer is a Controller and/or not the Exporter’s Processor or Sub-Processor: the Importer must securely delete all
Transferred Data.
- 31.2.4 the following provisions will continue in force after this IDTA ends (no matter what the reason is):
• Section 1 (This IDTA and Linked Agreements);
• Section 2 (Legal Meaning of Words);
• Section 6 (Understanding this IDTA);
• Section 7 (Which laws apply to this IDTA);
• Section 10 (The ICO);
• Sections 11.1 and 11.4 (Exporter’s obligations);
• Sections 12.1.2, 12.1.3, 12.1.4, 12.1.5 and 12.1.6 (General Importer obligations);
• Section 13.1 (Importer’s obligations if it is subject to UK Data Protection Laws);
• Section 17 (Importer’s responsibility if it authorised others to perform its obligations);
• Section 24 (Giving notice);
• Section 25 (General clauses);
• Section 31 (What must the Parties do when the IDTA ends);
• Section 32 (Your liability);
• Section 33 (How Relevant Data Subjects and the ICO may bring legal claims);
• Section 34 (Courts legal claims can be brought in);
• Section 35 (Arbitration); and
• Section 36 (Legal Glossary).
32. Your liability
32.1 The Parties remain fully liable to Relevant Data Subjects for fulfilling their obligations under this IDTA and (if they apply) under UK Data Protection Laws.
32.2 Each Party (in this Section, “Party One”) agrees to be fully liable to Relevant Data Subjects for the entire damage suffered by the Relevant Data Subject, caused directly or indirectly by:
- 32.2.1 Party One’s breach of this IDTA; and/or
- 32.2.2 where Party One is a Processor, Party One’s breach of any provisions regarding its Processing of the Transferred Data in the
Linked Agreement;
- 32.2.3 where Party One is a Controller, a breach of this IDTA by the other Party if it involves Party One’s Processing of the Transferred Data (no matter how minimal) in each case unless Party One can prove it is not in any way responsible for the event giving rise to the damage.
32.3 If one Party has paid compensation to a Relevant Data Subject under Section 32.2, it is entitled to claim back from the other Party that part of the compensation corresponding to the other Party’s responsibility for the damage, so that the compensation is fairly divided between the Parties.
32.4 The Parties do not exclude or restrict their liability under this IDTA or UKData Protection Laws, on the basis that they have authorised anyone who is not a Party (including a Processor) to perform any of their obligations, and they will remain responsible for performing those obligations.
33. How Relevant Data Subjects and the ICO may bring legal claims
33.1 The Relevant Data Subjects are entitled to bring claims against the Exporter and/or Importer for breach of the following (including where their Processing of the Transferred Data is involved in a breach of the following by either Party):
• Section 1 (This IDTA and Linked Agreements);
• Section 3 (You have provided all the information required by Part one: Tables and Part two: Extra Protection Clauses);
• Section 8 (The Appropriate Safeguards);
• Section 9 (Reviews to ensure the Appropriate Safeguards continue);
• Section 11 (Exporter’s obligations);
• Section 12 (General Importer Obligations);
• Section 13 (Importer’s obligations if it is subject to UK Data Protection Laws);
• Section 14 (Importer’s obligations to comply with key data protection laws);
• Section 15 (What happens if there is an Importer Personal Data Breach);
• Section 16 (Transferring on the Transferred Data);
• Section 17 (Importer’s responsibility if it authorises others to perform its obligations);
• Section 18 (The right to a copy of the IDTA);
• Section 19 (The Importer’s contact details for the Relevant Data Subjects);
• Section 20 (How Relevant Data Subjects can exercise their data subject rights);
• Section 21 (How Relevant Data Subjects can exercise their data subject rights– if the Importer is the Exporter’s Processor or SubProcessor);
• Section 23 (Access Requests and Direct Access);
• Section 26 (Breaches of this IDTA);
• Section 27 (Breaches of this IDTA by the Importer);
• Section 28 (Breaches of this IDTA by the Exporter);
• Section 30 (How to end this IDTA if there is a breach);
• Section 31 (What must the Parties do when the IDTA ends); and
• any other provision of the IDTA which expressly or by implication benefits the Relevant Data Subjects.
33.2 The ICO is entitled to bring claims against the Exporter and/or Importer for breach of the following Sections: Section 10 (The ICO), Sections 11.1 and 11.2 (Exporter’s obligations), Section 12.1.6 (General Importer obligations) and Section 13 (Importer’s obligations if it is subject to UK Data Protection Laws).
33.3 No one else (who is not a Party) can enforce any part of this IDTA (including under the Contracts (Rights of Third Parties) Act 1999).
33.4 The Parties do not need the consent of any Relevant Data Subject or the ICO to make changes to this IDTA, but any changes must be made in accordance with its terms.
33.5 In bringing a claim under this IDTA, a Relevant Data Subject may be represented by a not-for-profit body, organisation or association under the same conditions set out in Article 80(1) UK GDPR and sections 187 to 190 of the Data Protection Act 2018.
34. Courts legal claims can be brought in
34.1 The courts of the UK country set out in Table 2: Transfer Details have nonexclusive jurisdiction over any claim in connection with this IDTA (including non-contractual claims).
34.2 The Exporter may bring a claim against the Importer in connection with this IDTA (including non-contractual claims) in any cour in any country with jurisdiction to hear the claim.
34.3 The Importer may only bring a claim against the Exporter in connection with this IDTA (including non-contractual claims) in the courts of the UK country set out in the Table 2: Transfer Details
34.4 Relevant Data Subjects and the ICO may bring a claim against the Exporter and/or the Importer in connection with this IDTA (including non-contractual claims) in any court in any country with jurisdiction to hear the claim.
34.5 Each Party agrees to provide to the other Party reasonable updates about any claims or complaints brought against it by a Relevant Data Subject or the ICO in connection with the Transferred Data (including claims in arbitration).
35. Arbitration
35.1 Instead of bringing a claim in a court under Section 34, any Party, or a Relevant Data Subject may elect to refer any dispute arising out of or in connection with this IDTA (including non-contractual claims) to final resolution by arbitration under the Rules of the London Court of International Arbitration, and those Rules are deemed to be incorporated by reference into this Section 35.
35.2 The Parties agree to submit to any arbitration started by another Party or by a Relevant Data Subject in accordance with this Section 35.
35.3 There must be only one arbitrator. The arbitrator (1) must be a lawyer qualified to practice law in one or more of England and Wales, or Scotland, or Northern Ireland and (2) must have experience of acting or advising on disputes relating to UK Data Protection Laws.
35.4 London shall be the seat or legal place of arbitration. It does not matter if the Parties selected a different UK country as the ‘primary place for legal claims to be made’ in Table 2: Transfer Details.
35.5 The English language must be used in the arbitral proceedings.
35.6 English law governs this Section 35. This applies regardless of whether or not the parties selected a different UK country’s law as the ‘UK country’s law that governs the IDTA’ in Table 2: Transfer Details.
36. Legal Glossary
Access Request: As defined in Section 23, as a legally binding request (except for requests only binding by contract law) to access any Transferred Data.
Adequate Country: A third country, or:
• a territory;
• one or more sectors or organisations within a third country;
• an international organisation;
which the Secretary of State has specified by regulations provides an adequate level of protection of Personal Data in accordance with Section 17A of the Data Protection Act 2018.
Appropriate Safeguards: The standard of protection over the Transferred Data and of the Relevant Data Subject’s rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under
Article 46(2)(d) UK GDPR.
Approved IDTA: The template IDTA A1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act.
Commercial Clauses: The commercial clauses set out in Part three. Controller As defined in the UK GDPR.
Damage: All material and non-material loss and damage.
Data Subject: As defined in the UK GDPR.
Decision-Making: As defined in Section 20.6, as decisions about the Relevant Data Subjects based solely on automated processing,
including profiling, using the Transferred Data.
Direct Access: As defined in Section 23 as direct access to any Transferred Data by public authorities of which the Importer is aware.
Exporter: The exporter identified in Table 1: Parties & Signature.
Extra Protection Clauses: The clauses set out in Part two: Extra Protection Clauses. ICO The Information Commissioner.
Importer: The importer identified in Table 1: Parties & Signature.
Importer Data Subject Contact: The Importer Data Subject Contact identified in Table 1: Parties & Signature, which may be updated in accordance with Section 19.
Importer Information: As defined in Section 8.3.1, as all relevant information regarding Local Laws and practices and the protections and risks which apply to the Transferred Data when it is Processed by the Importer, including for the Exporter to carry out any TRA.
Importer Personal Data Breach: A ‘personal data breach’ as defined in UK GDPR, in relation to the Transferred Data when Processed by the Importer.
Linked Agreement: The linked agreements signed with reference to these Terms of Service between the Parties.
Local Laws Laws: which are not the laws of the UK and which bind the Importer.
Notice Period: As set out in these Terms of Service and/or in the Linked Agreement.
Party/Parties: The parties to this IDTA are Our Trace Pty Ltd and the 'Company' identified in the Company field of the Get Started form.
Personal Data: As defined in the UK GDPR.
Personal Data Breach: As defined in the UK GDPR.
Processing: As defined in the UK GDPR. When the IDTA refers to Processing by the Importer, this includes where a third party Sub-Processor of the Importer is Processing on the Importer’s behalf.
Processor: As defined in the UK GDPR.
Purpose: In the context of these Terms of Service and any Linked Agreement the Purpose is to process Company Personal Data in order to provide carbon accounting software to Company.
Relevant Data Subject: A Data Subject of the Transferred Data.
Restricted Transfer: A transfer which is covered by Chapter V of the UK GDPR
Review Dates: The review dates or period for the Security Requirements set out in Table 2: Transfer Details, and any review dates set out in any revised Approved IDTA.
Significant Harmful Impact: As defined in Section 26.2 as where there is more than a minimal risk of the breach causing (directly or indirectly) significant harm to any Relevant Data Subject or the other Party.
Special Category Data: As described in the UK GDPR, together with criminal conviction or criminal offence data.
Start Date: As set out in either the Linked Agreement or the data on which the Get Started form is completed.
Sub-Processor: A Processor appointed by another Processor to Process Personal Data on its behalf. This includes Sub-Processors of any level, for example a Sub-Sub-Processor
Term: As set out in these Terms of Servce and/or the Linked Agreement.
Third Party Controller: The Controller of the Transferred Data where the Exporter is a Processor or Sub-Processor If there is not a Third Party Controller this can be disregarded.
Transfer Risk Assessment or TRA: A risk assessment in so far as it is required by UK Data Protection Laws to demonstrate that the IDTA provides the Appropriate Safeguards
Transferred Data: Any Personal Data which the Parties transfer, or intend to transfer under this IDTA
Protection Laws: All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR: As defined in Section 3 of the Data Protection Act 2018.
Without Undue Delay: Without undue delay, as that phase is interpreted in the UK GDPR.
We, Trace guarantee the accuracy of our carbon measurement and management methodology and software to the best of our knowledge and abilities. We strive to provide reliable calculations and reporting based on the data entered into our software. However, it is important to note that the accuracy of the results is highly dependent on the accuracy and completeness of the data provided by the user.
We warrant that our software will be free from defects in material and workmanship under normal use.
Limitations & Exclusions
Our guarantee and warranty are subject to the following limitations:
Except as expressly stated in this guarantee and warranty clause, we disclaim all other warranties, whether express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose.
We reserve the right to change these Terms on a going-forward basis at any time. Please check these Terms periodically for changes. Modifications will become effective upon the earlier of (a) your acceptance of the modified Terms, (b) your use of the Services with the actual knowledge of the modified Terms, or (c) 30 days following our publication of the modified Terms.
Trace is a Climate Technology business which helps companies measure, reduce and offset their carbon emissions and achieve Trace certification (definitions below).
Measure
Trace has developed a proprietary carbon emissions calculator methodology and supporting digital tools to measure the carbon emissions of a company’s services and/or products based on data provided by the customer. Read more in the Carbon Assessment Methodology section.
Reduce
Trace provides educational content and tools via its digital Portal to enable businesses to identify opportunities for reducing their carbon emissions and track progress over time.
Offset
Trace customers offset their emissions by contributing funds which are pooled with other customers’ funds to acquire a portfolio of carbon credits curated, purchased and retired by Trace. The amount of funds that each customer contributes is based upon the estimated costs of acquiring sufficient carbon credits (calculated by Trace using available market information) to offset at least 100% their CO2 emissions. Read more in the Offsetting section.
Certification
See definitions of our certification badges and public disclosure requirements.
There is increasing pressure for businesses to consider the environmental impact of the goods and services they deliver and as a result standards are emerging to ensure the validity of any environmental claims made so as not to mislead consumers. According to the ACCC ‘a business must not represent that goods or services have sponsorship, approval, performance characteristics, accessories, uses or benefits they do not have’.
The goal of this protocol is to ensure our customers correctly use the carbon claims attained through Trace so as not to mislead the public.
Trace defines carbon neutral to mean that a business has calculated the greenhouse gas emissions (carbon dioxide or carbon dioxide equivalent) generated by its core activities (as defined in the emissions boundary) and has 'cancelled out' emissions by purchasing carbon offsets. Carbon offset units are generated from activities that prevent, reduce or remove greenhouse gas emissions from being released into the atmosphere.
When the offsets purchased by an organisation are equal to or greater than the emissions produced within the specified time period they are carbon neutral.
By claiming carbon neutral status through Trace, customers acknowledge and accept that their emissions have been estimated using Trace’s proprietary methodology based on the activity data provided by the customer and that Trace carbon neutral certification does not constitute Australian Government approval.
Trace relies on customers to provide complete and accurate data for the CO2 assessment in accordance with its methodology and guidance and does not take responsibility for inaccurate or omitted data.
For every carbon assessment calculated using the Trace software, Trace issues a Badge corresponding to the scope of action taken. All badges display an expiry date representing 12 months from the date the Badge is issued.
A company’s Badge, measurement period and Emissions Boundary is published via a Public Impact page to ensure transparency and support verification of external claims.
In order to achieve a ‘Carbon Measured’ badge, the carbon inventory is subject to Trace's Technical Assessment, performed by the Trace team or one of our Partners. If a carbon assessment does not meet the conditions of the Technical assessment a ‘Carbon Measured - Data Estimated’ badge is issued.
The scope or ‘Boundary’ of a company’s carbon inventory is published via the Public Impact page including documentation of any exclusions.
Trace Emissions Boundary
Trace measures emissions in accordance with the GHG Protocol (see Methodology). All inventories must include all Scope 1 and Scope 2 emissions sources and relevant Scope 3 emissions, according to the Relevance Test.
This badge is available to companies that measure their emissions with Trace and meet our Technical Assessment.
Carbon emissions are calculated by Trace using its proprietary methodology and based on actual activity data supplied by the customer for a previous 12 month period of operation.
.png)
This badge is awarded to companies that measure and voluntarily offset their emissions with Trace.
Carbon emissions are calculated by Trace using its proprietary methodology and based on data supplied by the customer for a previous 12 month period of operation.
The badge displays the scope of the emissions that have been offset for accurate, transparent reporting. Trace customers can choose which Scopes of their emissions boundary to offset, as represented on the Badge.
.png)
This badge is awarded to companies that measure their emissions and voluntarily offset of 150% their emissions with Trace. This allows companies to increase their positive carbon impact beyond their own carbon footprint.
Carbon emissions are calculated by Trace using its proprietary methodology and based on data supplied by the customer for a previous 12 month period of operation.
The badge displays the scope of the emissions that have been offset for accurate, transparent reporting.
.png)
This badge is awarded when Scope 1 and/or 2 emissions have been estimated in the absence of activity data such that 20% or more of the total carbon footprint (Scopes 1, 2 & 3) is estimated. Electricity use in a shared office space (where the Trace member doesn’t pay the electricity bill) is not considered a Scope 2 emissions source in this scenario. This enables businesses to estimate (and electively offset) their emissions in the absence of primary data.
Where necessary, carbon emissions are estimated by Trace based on industry-level or research-backed assumptions (such as kWh/m2 of office space), or the emissions intensity (CO2/FTE or CO2/expenses) of either
.png)
When a carbon measurement and Technical Assessment is completed by one of our Partners using the Trace platform, a Partner badge will be issued. Our Partner badges follow the same applications as outlined above, but will provide the name of the Partner who completed the measurement.
Every Trace Partner has undergone a Trace-led training course on carbon accounting, and has received a Carbon Accounting Practitioner badge. Trace provides its Partners with regular check-ins, support and feedback.
Trace provides the software and training required by Partners to complete measurements for their clients, but does not play an active role in the measurement process conducted by Partners. Trace disclaims any responsibility for the accuracy, robustness or completeness of the carbon measurements made by our Partners or their clients. Partners are solely responsible for the data they input and any calculations or reports generated using our software.
Trace has developed strict definitions associated with use of its badges to ensure that customers feel confident making credible claims about their environmental action and that consumers can understand and trust the scope of the action taken by Trace business customers.
To read more about why Trace removed the term ‘Carbon Neutral’ from its badging protocol in 2024, please read our blog here.
Badges can be used by customers subject to Trace’s Protocol for use of Trace Assets and Branding.
Trace defines the impact of its customers based on 3 different time periods:
Example:
Customers that become certified ‘Carbon Neutral’ or ‘Carbon Positive’ with Trace are granted use of our Badges and associated visual assets (collectively Trace Assets’) subject to the terms below.
On and from the Carbon Neutral start date (which is when the certification is given by Trace) and in consideration for payment of the applicable fees, we grant you (the Company) a non-transferable, revocable, non-exclusive licence to use the Trace Assets on digital and physical assets provided that:
Trace reserves the right to review the use of Trace Assets in the public domain and request changes or removal if such use fails to meet these terms.
Companies using the ‘Carbon Neutral Brand’ designation are NOT permitted to display the ‘Brand’ assets or language on physical products or packaging. Trace’s assessment is not a product-specific Lifecycle Assessment (LCA), therefore any Carbon Neutral claims should relate to the Brand rather than any specific product.
See our Carbon Accounting Methodology here.
All customers are required to agree to our public disclosure agreement when they submit their activity data to Trace:The data I have provided as part of this assessment is a true reflection of the organisation's activities during the measurement period defined.I have reviewed and accepted Trace's Terms of Service (herein).I agree to review the carbon assessment provided by Trace and highlight any required changes prior to publishing
Trace manages a live portfolio of carbon credits, which means we procure credits from multiple projects on a regular basis. As such, the number and types of credits in the portfolio will change over time as we purchase and retire credits across various projects.
Carbon credits are subject to market price volatility as a result of fluctuations in supply and demand (which are outside our control). This has an impact on how we select projects to purchase credits from. The projects we acquire credits from, and the proportion of the portfolio that each respective project represents, will therefore vary over time. As such, past portfolio composition is not a guarantee of future portfolio composition.
The current portfolio of projects can be viewed here. Projects marked ‘live portfolio’ represent the projects from which we have acquired credits in the last two procurement cycles (see Timing below). When you make contributions to offset your emissions through Trace, we provide details of the portfolio that is held at that time, updated on a rolling 6 monthly basis. We believe this most closely illustrates the projects that your contribution could fund. However, since we procure credits up to 3 months in arrears (i.e. after receiving payment from you), the credits bought using your contributed funds may not correspond precisely to those credits which have been purchased in the past. See below for our explanation of how we select credits and our commitment to quality and transparency.
We charge a management fee, embedded in the cost to offset, which is deducted from customer contributions. This fee relates to the project sourcing and portfolio management services we provide and covers the associated costs of conducting due diligence, administrative record keeping and reporting on the portfolio.
At Trace we are committed to sourcing high quality, externally verified carbon credits on behalf of our customers. You can read our selection criteria here.
All carbon credits are certified by Gold Standard, Verra, the Australian Clean Energy Regulator or the UNFCC’s Clean Development Mechanism (CDM). On top of verified carbon credits, we also sponsor tree planting from a variety of nature-based projects around the World, which deliver additional CO2 sequestration benefits.
Thanks to our growing community of Climate Positive customers, Trace benefits from the economies of scale of aggregating the demand across all our customers, which means we can access more competitive pricing for credits than customers who buy credits directly on their own behalf in smaller quantities.
You can rest assured that when we select, acquire and retire carbon credits, we only partner with the intermediaries whom we trust to help us source credits that meet our strict quality criteria.
Trace procures credits in arrears, which means we accumulate funds from our customers before we go to market to acquire credits on a quarterly basis. In the meantime, Trace holds customers’ contributions in escrow, separately from its own business operating funds, pending the quarterly procurement cycle.
You can see our live tracker of carbon credits and trees here. This shows the carbon and trees purchased by Trace using contributions from our customers.
As a general rule, it can take up to 90 days from a customer contribution transaction taking place on our platform for the contribution proceeds to be converted into credits in our portfolio (because of transaction times, accounting procedures, waiting for receipts or carbon retirement certificates from our partners, etc).
