1.Upon engaging with Plantgrow, both parties will comply with all applicable requirements of the Data Protection Legislation. This is in addition to, and does not relieve, remove or replace, a party’s obligations or rights under the Data Protection Legislation. In this clause, Applicable Laws means (for so long as and to the extent that they apply to Plantgrow) the law of the European Union, the law of any member state of the European Union and/or Domestic UK Law; and Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK.

1.1 The parties acknowledge that for the purposes of the Data Protection Legislation, the Client is the Data Controller and Plantgrow is the Data Processor.

1.2 Without prejudice to the generality of clause 1.1, the Client will ensure that it has all necessary appropriate consents and notices in place to enable the lawful transfer of the Personal Data to Plantgrow and/or lawful collection or Processing of the Personal Data by Plantgrow on behalf of the Client for the duration and purposes of the Contract.

1.3 Without prejudice to the generality of clause 1.1, Plantgrow shall, in relation to any Personal Data processed in connection with the performance by Plantgrow of its obligations under the Contract:

(a)      process that Personal Data only on the documented written instructions of the Client unless Plantgorw is required by Applicable Laws to otherwise process that Personal Data. Where Plantgrow is relying on Applicable Laws as the basis for processing Personal Data, Plantgrow shall promptly notify the Client of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Plantgrow from so notifying the Client;

(b)      ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;

(c)       ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential;

(d)      assist the Client, at the Client’s cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(e)      notify the Client without undue delay on becoming aware of a Personal Data Breach;

(f)        at the written direction of the Client, delete or return Personal Data and copies thereof to the Client on termination of the agreement unless required by Applicable Law to store the Personal Data; and

(g)      maintain complete and accurate records and information to demonstrate its compliance with this clause and allow for audits by the Client or the Client’s designated auditor and immediately inform the Client if, in the opinion of Plantgrow, an instruction infringes the Data Protection Legislation.

1.4 Plantgrow confirms that it will enter into a written agreement with any third party processor it uses under the Contract, which will reflect the requirements of the Data Protection Legislation. Where necessary to comply with its obligations under the Contract Plantgrow may use third party cloud providers and the Client consents to this. As between the Client and Plantgrow, Plantgrow shall remain fully liable for all acts or omissions of any third party processor appointed by it pursuant to this clause 1.4.

1.5 The Client acknowledges that Plantgrow is reliant on the Client for direction as to the extent to which Plantgrow is entitled to use and process the Personal Data. Consequently, Plantgrow will not be liable for any claim brought by a Data Subject arising from any action or omission by Plantgrow, to the extent that such action or omission resulted directly from the Client’s instructions.

1.6 The Client acknowledges that Plantgrow has no control over data that is submitted onto Plantgrow’ systems and as such the Client is responsible for any data it submits.