Data Processing Terms for Partners (template)

The agreement on personal data processing (the “Agreement”) is made on [date] between:

[Party 1: full name, EDRPOU code, registered office] (the “Controller”); and

NGO “HandS Lab” (full registered name: NON-GOVERNMENTAL ORGANIZATION “Human & Synthetic Lab”), EDRPOU code 46189265, registered office: Ukraine, 03035, Kyiv, 13 Vasylia Mytropolyta Lypkivskoho Street, email: [email protected] (the “Processor”), where NGO “HandS Lab” acts as the Processor. If the roles are allocated differently, the parties state this in Annex 1.

The roles of the parties (controller, processor, joint controllers) are determined by the actual allocation of powers over the purposes and means of processing and are confirmed for each collaboration in Annex 1.

1.1. The Processor processes personal data on behalf of the Controller within a collaboration on [pilot / program / service] (the “Collaboration”).

1.2. The subject matter, duration, nature and purpose of processing, types of personal data, and categories of data subjects are set out in Annex 1.

1.3. The Agreement applies together with the contract on the Collaboration. In case of conflict on the processing of personal data, this Agreement applies.

1.4. The Agreement meets the requirements of the legislation of Ukraine on personal data protection and, where Regulation (EU) 2016/679 (GDPR) applies, its Article 28.

2.1. The Controller ensures that lawful grounds exist for processing and for transferring data to the Processor, including informed consent of data subjects where it is required.

2.2. The Controller gives the Processor documented instructions on processing and informs data subjects about the Processor and the purpose of processing.

2.3. The Controller does not transfer to the Processor more data than the purpose of processing requires and does not transfer special categories of data unless expressly agreed in Annex 1.

3.1. To process data only on the documented instructions of the Controller, including with regard to transfers outside Ukraine, unless the law requires otherwise; in that case the Processor informs the Controller, unless the law prohibits this.

3.2. To ensure that persons who have access to the data have committed to confidentiality.

3.3. To take the organizational and technical security measures listed in Annex 2.

3.4. Not to engage other processors (sub-processors) without the prior written consent of the Controller. The list of approved sub-processors is in Annex 3. The Processor imposes obligations on them no less strict than under this Agreement and is liable to the Controller for their actions.

3.5. To assist the Controller in responding to data subjects’ requests concerning their rights (access, rectification, erasure, restriction, objection, portability) and in meeting obligations on security, incident notification, and data protection impact assessment.

3.6. To notify the Controller of a data subject’s request received directly and not to respond to it without the Controller’s instructions.

3.7. Not to use the data for its own purposes, including training models, advertising, or research, without a separate written agreement and, where required, the consent of data subjects.

4.1. The Processor notifies the Controller of a personal data breach without undue delay and no later than within 48 hours after becoming aware of it.

4.2. The notice describes the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken and proposed, and the contact of the responsible person.

4.3. The Processor assists the Controller in meeting obligations to notify the authorized body and data subjects.

5.1. Transfers of data outside Ukraine, including to providers of artificial intelligence models, cloud services, and payment services, are allowed only through the providers agreed in Annex 3, in compliance with the legal requirements for such transfers and with appropriate safeguards in place.

5.2. If the GDPR applies, transfers outside the EU/EEA are made on the basis of an adequacy decision, standard contractual clauses, or another mechanism provided by the Regulation.

6.1. The Processor provides the Controller with the information needed to demonstrate compliance with the Agreement and allows audits, including inspections conducted by the Controller or a person authorized by it, with at least 10 business days’ notice and without disrupting the Processor’s work or the confidentiality of its other clients.

7.1. After the Collaboration ends or at the Controller’s written request, the Processor within 30 days returns or deletes personal data and copies and confirms this in writing, unless the law requires their retention.

7.2. Data in backups is deleted in the normal rotation cycle, within no more than 90 days, and is not used until then.

8.1. Each party is liable for breach of this Agreement and of the personal data protection legislation as provided by law.

8.2. The Processor is liable for damage caused by processing only if it has not complied with obligations specifically imposed on processors or has acted outside or contrary to the Controller’s lawful instructions.

8.3. Limitations of liability under the contract on the Collaboration apply to this Agreement unless they conflict with the law.

9.1. The Agreement is valid throughout the Collaboration and until data is returned or deleted under Section 7.

9.2. The Agreement is governed by the law of Ukraine. Disputes are resolved through negotiations and, if no agreement is reached, by the court at the defendant’s location.

9.3. Amendments to the Agreement are valid if made in writing and signed by both parties. Signing by electronic signatures is allowed.

9.4. This document is made in Ukrainian. The English translation is provided for convenience; in case of discrepancies the Ukrainian text prevails.