text:
Mercat del Peix - Biomedicina, biodiversitat i benestar planetari
Scientific project
Planetary wellbeing
Urban planning project
History of the old Mercat del Peix
The project for the Mercat del Peix consists of the creation of a new research and innovation complex of some 45,000 m2.
It is being developed by Pompeu Fabra University (UPF), the Barcelona Institute of Science and Technology (BIST) and the Institute of Evolutionary Biology (IBE CSIC-UPF). It has the institutional support of the Spanish National Research Council (CSIC), the Barcelona City Council and the Catalan Government. The University of Barcelona (UB), the Universitat Autònoma de Barcelona (UAB) and the Pasqual Maragall Foundation (FPM) also participate.
The plot, where there is currently an open-air public car park, is owned by Barcelona City Council and UPF. It covers an area of roughly 7,500 m2, and the architectural project envisages the construction of three new buildings with a total floor area of more than 45,000 m2. With planned investment of almost €104 million, this new knowledge hub will be operational in 2026.
The Ciutadella of Knowledge
The Mercat del Peix project is one of the first actions of the Ciutadella of Knowledge, a scientific, cultural and urban initiative that aims to turn the surroundings of Ciutadella park, in the centre of Barcelona, into an urban benchmark knowledge hub in southern Europe.
The initiative is jointly promoted by Barcelona City Council, the Catalan Government and Pompeu Fabra University, that has the support of the Government of Spain.
In the surroundings of Ciutadella park we already find some forty prestigious public and private institutions in the fields of research, innovation, higher education and culture. Their activity includes a wide range of areas of knowledge: biology and health, biodiversity, social sciences, and humanities.
The Ciutadella of Knowledge aims to attract new national and international institutions to the area that are recognized for their excellence in the field of planetary wellbeing, thus joining the existing critical mass to increase inter-institutional synergies and promote interdisciplinary initiatives.
A collaborative project
The architectural project, already drafted in its volumetric arrangement phase, consists of four perfectly synergistic sub-projects represented by four different spaces:
A new building for the Barcelona Institute of Science and Technology (BIST)
A new building for the Institute of Evolutionary Biology (IBE, CSIC-UPF)
A new building for Pompeu Fabra University (UPF)
A new underground parking, built and managed by the company Barcelona Serveis Municipals (B:SM)
To complete and enrich the new research and innovation complex to be built at the Mercat del Peix, an artistic installation is envisaged in a prime, central location of the complex that will identify the site as an iconic space of the city, be a cultural focal point of the district and become an element of regeneration and interconnection with local entities and institutions and the Ciutadella of Knowledge project.
Budget and schedule
The planned investment in the construction of the Mercat del Peix buildings is around €103.8 million, broken down as follows:
Project Floor area Investment
BIST building 24.700 m2 54.9 M€*
IBE building 6.500 m2 11.5 M€*
UPF building 7.300 m2 15.1 M€*
Underground car park 7.200 m2 11.3 M€
Work on the Mercat del Peix project, which will be carried out in several phases, is expected to begin in February 2023 and be completed by the end of 2025.
The plenary session of Barcelona City Council approved the Special Town Planning and Urban Improvement Plan for the Ciutadella area, which arranges the plots of the Mercat del Peix area, incorporates the three research centres to be built there, and defines the uses and characteristics of the building to ensure planning involving environmental and sustainable excellence.
*Estimated amount, it may change after the tender for the construction of the building.
The new BIST building
The Barcelona-based studio Barozzi Veiga won the international architecture contest convened by the BIST to design and build its new building, which received a total of 34 submissions.
The winning studio was founded in 2004 in Barcelona by Fabrizzio Barozzi and Alberto Veiga and has received numerous awards including the Mies van der Rohe award for Contemporary Architecture in 2015 for the Szczecin Philharmonic Hall (Poland). In 2019 they were awarded "Best Architects 20" and the Chicago Atheneum International Award for the Bündner Museum of Fine Arts in Chur (Switzerland). Other outstanding buildings by the studio that have received extensive international recognition are the Tanzhaus cultural centre in Zürich and the Cantonal Museum of Fine Arts in Lausanne. The BIST building will be the first to be built by the Barozzi Veiga team in Barcelona.
The new building, which will house more than 800 researchers and some sixty research groups from four BIST centres (CRG, IBEC, ICN2 and IRB Barcelona), will have a floor area of nearly 25,000 m2, over several storeys devoted to multidisciplinary research into biomedicine. Work is set to commence in August 2024.
The new UPF and IBE buildings
The jury of the architectural competition for the UPF and Institute of Evolutionary Biology (IBE) buildings at the Mercat del Peix complex [site of the former Fish Market] has proposed the entry presented by the team formed by the Californian studio ZGF Architects and the Barcelona firms MIRAG and Double Twist as the winning one.
The competition envisages two buildings. The first of these two buildings, which will be at the UPF, shall be three stories high, have a total floor area of 7,300 square meters, and be dedicated to research on and innovation for planetary well-being. The goal is to make it a meeting point for researchers drawn from the experimental sciences, the social sciences, and the humanities, with a view to carrying out interdisciplinary projects in areas such as: Planetary Health; Complex Systems; Data Science; Artificial Intelligence; Climate Change Economics and Governance; Biodiversity Loss; Global Law and Governance.
The second building will have a total floor area of 6,500 square meters — split over five floors — and host the headquarters of the Institute of Evolutionary Biology (IBE), a joint research centre created in 2008 by the UPF and the Spanish National Research Council (CSIC). The IBE will site all its research staff at its new Mercat del Peix facilities, where it will consolidate and expand its research project on Evolution and Biodiversity, with the goal of consolidating its position as a leading international research centre.
The competition, convened in June 2021, attracted 41 teams from ten different countries. The high number of competitors and the quality of the teams presented highlights the interest that this unique project has aroused within the sector.
This contest is also an example of collaboration between administrations, since the tender was jointly promoted by the CSIC and UPF.
A hub of mobility services
Barcelona de Serveis Municipals, S.A. (B:SM) will build and manage a new car park on the 2nd basement floor of the Mercat del Peix, "Ciutadella del Coneixement - Zoo", which will be integrated into the B:SM Network of car parks, which currently exploits 45 for public use.
This car park, whose construction is set to begin in September 2022, is designed as a hub of mobility services thanks to the commitment by B:SM to contribute to improving mobility in Barcelona based on sustainable, healthy, efficient, connected and shared solutions that respond to the new patterns of consumption.
Specifically, the new mobility hub around the Ciutadella of Knowledge will dispose of almost 7,000 m2 to provide solutions to the new needs of urban mobility, to make this facility a key part of its set-up. So, it will offer parking for cars and motorcycles through modalities that favour the flexible and optimal use of the available space; an electromobility service provided by Endolla Barcelona, the first public network in Spain; a large space for exclusive use by cyclists and personal mobility vehicle users; Click & Collect services to pick up and return parcels from secure, automated lockers 24/7, operated by various companies; carsharing services provided by multi-operator vehicle fleets, and a Delivery Station Points service managed by last-mile microdistribution operators.
A regenerative architectural project
The future Mercat del Peix buildings will include integrated water, waste and energy management solutions, prioritizing the environment, reducing energy demand and the global ecological footprint, limiting noise and environmental pollution and geared towards sustainable mobility. The goal is to go beyond sustainable buildings and achieve regenerative buildings that serve as a reference for future buildings in an environmentally friendly, environment-integrated city.
Hence, the architectural project for the Mercat del Peix complex envisages the closure of material cycles, i.e., the conversion of waste into resources, to head in the direction of self-sufficiency.
To achieve this, the architectural project will take into account the use of recycled and recyclable materials, the limited generation of waste, the minimization of the economic footprint of buildings, the reduction of water and energy demand, and the introduction of active and passive bioclimatic systems.
The planned volumetric arrangement of the architectural units to be built will incorporate criteria that will improve bioclimatic behaviour, taking advantage of natural light, favouring cross ventilation and heat dissipation, incorporating vegetation that generates a favourable microclimate taking the greenhouse effect into account.
The construction of the BIST and IBE (CSIC-UPF) buildings at the Mercat del Peix is co-funded by the Catalan Government's Department of Research and Universities, under call EMC/954/2019, of 9 April, for the implementation of unique institutional projects that facilitate the generation of research of excellence, the attraction of talent, and knowledge transfer and valorization activities, through the construction, acquisition, enabling and the substantial expansion of buildings for R&D infrastructures.
A scientific project promoted by:
With the participation of:
With the institutional support of:
And the collaboration of:


text:
Looking Behind the Screen: Critical Media Literacy Gives Us Tools to Understand How Media Shapes Our Perception of Others and the World
CML is a liberatory approach to making sense of the world.
CML seeks to equip people with the tools to be independent media users, free from oppression or restrictions by others.
Adapted from The Media and Me: A Guide to Critical Media Literacy for Young People by Project Censored the Media Revolution Collective
Maybe when you hear the word "critical," you think of negative stuff: to be critical must mean that you dislike something, right? Not always! "Critical" can be used in a variety of ways, including thinking carefully about something (critical thinking), asking questions of something (critical inquiry), and practicing media literacy (critical media literacy).
So, what's critical about critical media literacy (CML)? Trust us, this is not an order to "eat your spinach!" or to ignore media that bring you joy and happiness. Instead, what's critical about CML is taking a bit of distance from our media choices to examine them more thoroughly. Instead of looking only at our screens, we want to look behind the screens (or behind the scenes) to understand how the content got to us.
Many U.S. schools teach media through a protectionist position—that is, teaching us that the media are bad for us. Protectionists are often concerned with media content they find dangerous, such as representations that glamorize violence, sex, or drug and alcohol use. They assume that once you learn that the media are bad, you will choose to turn them off.
Project Censored the Media Revolution Collective
Another way of studying the media in the United States is the celebratory position. In this view, you are considered an active agent and your knowledge and media use are rewarded. In practice, advocates of a celebratory approach to media literacy have focused mainly on interactive media, such as computer games, or material you may create for your social media profiles.
The protectionist and celebrationist positions seem like opposites of each other, but they actually have a fair amount in common. Both expend a lot of energy on the content of the media—what's on the screen—without much attention, if any, on how that content came to be. Both believe that young people ought to make "better" media choices—but each position offers only a partial story about the media you use. Both are missing a serious investigation into the means of production—that is, how that media content came to be. Neither position addresses the political economy of media analysis—the study of media ownership, production, and distribution.
Despite their differences, protectionism and celebration share an important commonality: they both focus primarily on content and representation.
For both protectionism and celebration, media content is often approached as individual products, and these are often explored in isolation. For example, you might be involved in a discussion about a particular scene in a movie where you may talk about the dialogue between the characters or the lighting or sound effects. While that is important, it should not be the entire conversation. Critical media literacy will ask you to think about how that scene fits into the movie as a whole. It will also ask how you accessed that movie (did you watch it in a movie theater? on a streaming service? on a particular device?). CML will also ask you to think about when the movie was originally released, which may include a discussion of current events. CML will ask who wrote, produced, and distributed the movie—and, by extension, might ask what else those people and production companies had written, produced, and distributed. CML, therefore, fills in the gaps in representation.
As you can see from all these questions, CML is inquiry-based. What we do in CML is ask a lot of questions about our media use. We ask questions about many topics, including gender, race, class, and sexuality. Most importantly, we ask questions about power: Who has it and what they do with it, as well as who does not have it and why not. That is one reason why we ask questions about ownership, production, and distribution: because that's where much of the power of media originates.
One of the many inquiries that CML urges us to take up involves analyzing stereotypes, which are overgeneralizations or fixed beliefs about a certain group. These include xenophobic stereotypes, such as the "Arab terrorist"; sexist ones, such as the "dumb blonde girl"; and racist ones, such as the "Black criminal," to name a few obvious examples. The contemporary use of this term tracks back to Walter Lippmann, a giant of twentieth-century journalism and a pioneer of contemporary media studies. Looking at stereotypes critically can help us realize how media shape our perception of others and the of the world. Consider the following questions.
What types of stereotypes have you encountered, online or in real life?
Are there any stereotypes that affect you as an in individual?
Can you think of any stereotypes that are beneficial or positive?
Whom do these stereotypes benefit?
Who do you think is in charge of producing these messages?
How do you think the messages end up taking so much space online?
CML is a liberatory approach to making sense of the world. CML seeks to equip people with the tools to be independent media users, free from oppression or restrictions by others. We recognize that misinformation, disinformation, stereotypes, and problematic representations exist, but as media users we do not have to accept or internalize them. Instead, we can expose, question, and oppose them.
Getting Smart loves its varied and ranging staff of guest contributors. From edleaders, educators and students to business leaders, tech experts and researchers we are committed to finding diverse voices that highlight the cutting edge of learning.
How Digital Literacy Impacts Today's Classroom
Fake News and Digital Literacy: Why Today's Students Need Video Skills
Analyzing Data: Helping Students Build Digital Literacy Skills
Getting Through: Multi-Mode Literacy

redpajama_set_name: RedPajamaCommonCrawl


text:
Home > Policies > Standard Contractual Clauses
Standard Contractual Clauses
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter 'entity/ies') transferring the personal data, as listed in Annex I.A (hereinafter each 'data exporter'), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each 'data importer') have agreed to these standard contractual clauses (hereinafter: 'Clauses').
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8 – Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);
(iii) Clause 9 – Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e);
(iv) Clause 12 – Modules Two and Three: Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18 – Modules Two and Three: Clause 18(a) and (b).
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7 – Not used
SECTION II – OBLIGATIONS OF THE PARTIES
MODULE TWO: Transfer controller to processor
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter 'personal data breach'). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter 'sensitive data'), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (4) (in the same country as the data importer or in another third country, hereinafter 'onward transfer') if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter's request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
MODULE 3: Transfer processor to processor
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter (5).
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter 'personal data breach'). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter 'sensitive data'), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (6) (in the same country as the data importer or in another third country, hereinafter 'onward transfer') if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Use of sub-processors
(a)OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the data exporter's general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 10 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. (8) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter's request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor's obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
MODULE THREE: Transfer processor to processor
(a) OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the controller's general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least [Specify time period] in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. (9) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter's or controller's request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
Clause 10
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects' requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects' requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer's responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
(a) Where the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679: The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards (12);
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Ireland.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d) The Parties agree to submit themselves to the jurisdiction of such courts.
UK ADDENDUM TO THE STANDARD CONTRACTUAL CLAUSES
Part 1: Tables
Table 1: Parties. See Annex 1 for data importer and data exporter.
Table 2: Selected SCCs, Modules and Selected Clauses. The parties select the version of the Approved EU SCCs which this Addendum is appended to including the Appendix Information.
Table 3: Appendix Information. "Appendix Information" means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in the attached Annex 1 (List of Parties, Description of Transfer), and Annex II (Technical and organisational measures including technical and organisational measures to ensure the security of the data). Annex III shall be provided upon request.
Table 4: Ending this Addendum when the Approved Addendum Changes. Neither Party may end this Addendum when the Approved Addendum changes.
Part 2: Mandatory Clauses
Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.
SWISS ADDENDUM TO THE STANDARD CONTRACTUAL CLAUSES
For transfers of Personal Data that are subject to the Swiss Federal Act on Data Protection ("FADP"), the EU SCCs shall apply, but with the following differences to the extent required by the FADP:
1. References to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR.
2. The term "member state" in the EU SCCs shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs.
3. References to personal data in the EU SCCs also refer to data about identifiable legal entities until the entry into force of revisions to the FADP that eliminate this broader scope.
4. Under Annex I(C) of the EU SCCs (Competent supervisory authority):
4.1 Where the transfer is subject exclusively to the FADP and not the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner.
4.2 Where the transfer is subject to both the FADP and the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner insofar as the transfer is governed by the FADP, and the supervisory authority is the Irish Data Protection Commission insofar as the transfer is governed by the GDPR.
ANNEX 1
A. LIST OF PARTIES
Data exporter(s):
Name: Client identified in Section 1 of Master Agreement.
Address: See Master Agreement1.
Contact person's name, position, and contact details: See Master Agreement2.
Activities relevant to the data transferred under these Clauses: Services are provisioned, Client accesses the Forrester Works and/or works with consultants as set forth in the applicable Purchase Agreement, and the parties communicate regarding such services.
Signature and date: See Master Agreement execution date
Role (controller/processor): Controller or Processor (as applicable)
Data importer(s):
Name: Forrester Research, Inc., on behalf of itself and Forrester Affiliates as applicable
Address: 60 Acorn Park Drive, Cambridge, MA 02140
Contact person's name, position, and contact details: Tony Ferguson, VP Infrastructure Ops and Security,
security@forrester.com
Role (controller/processor): Processor
1 If an address or contact information is not identified in the Master Agreement this shall be the address or contact information in the applicable or most recently signed Purchase Agreement.
2 If a privacy contact is not identified in the Master Agreement this shall be the signatory of the Master Agreement.
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred: Client employees or contractors and Client customers to the extent stated in the applicable Purchase Agreement.
Categories of personal data transferred: Internet protocol address and contact information (name, title, company, address, email, phone number) of Client personnel and, if any, contact information of third parties Client chooses to make available to Forrester to the extent identified in the applicable Purchase Agreement.
Sensitive data transferred (if applicable): NONE.
The frequency of the transfer: The data may be accessed by Forrester employees globally on an ongoing basis.
Nature of the processing: Storing, accessing, sending and receiving using e-mail addresses and other actions necessary for the provision of services.
Purpose(s) of the data transfer and further processing: Account management, contract administration and communication with the data subjects in connection with the provision of Services and/or provision of licenses in accordance with the applicable Purchase Agreement.
Data retention period or criteria: Data importer will destroy Data exporter Personal Data upon request.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Same as above
C. COMPETENT SUPERVISORY AUTHORITY.
Identify the competent supervisory authority/ies in accordance with Clause 13: Irish Data Protection Commission.
ANNEX II
Technical and organizational measures to ensure the security of the Client Personal Data:
I. Security Policies. Data importer will (a) maintain and follow IT security policies and practices mandatory for all data importer employees, including, without limitation, annual security and privacy education; (b) review its IT security policies at least annually and amend such policies as data importer deems reasonable to maintain protection of Personal Data processed; (c) maintain and follow its standard mandatory employment verification requirements for all new hires, including supplemental employees, and extend such requirements to wholly owned data importer subsidiaries in accordance with data importer internal process and procedures, these requirements will be periodically reviewed and include, but may not be limited to, criminal background checks, proof of identity validation, and additional checks as deemed necessary by data importer.
II. Security Incidents. Data importer will (a) maintain and follow documented incident response policies consistent with NIST guidelines for computer security incident handling; (b) investigate unauthorized access and/or use of Personal Data of which data importer becomes aware and will define and execute an appropriate response plan; (c) promptly (no later than 72 hours) notify data exporter of a security incident or Personal Data Breach that is known or reasonably suspected by data importer to affect data exporter Personal Data. Data importer will provide data exporter with reasonably requested information about such security incident and status of any data importer remediation and restoration activities.
III. Physical Security, Entry Control and Physical Media. Data importer will (a) maintain appropriate physical entry controls, such as barriers, card-controlled entry points, surveillance cameras, and manned reception desks to protect against unauthorized entry into data importer facilities used to host the services (data centers); (b) control and isolate from computing resources auxiliary entry points into data centers; (c) maintain access to data centers and controlled areas within data centers limited by job role and subject to authorized approval; (d) use access badge and log entry into a data center and controlled areas retaining logs for not less than one year; (e) revoke access to controlled data center areas upon i) separation of an authorized employee or ii) the authorized employee no longer having valid business need for access; (f) follow formal documented separation procedures that include, but are not limited to, prompt removal from access control lists and surrender of physical access badges; (g) register upon entry any individual granted temporary permission to enter a data center facility or a controlled area within a data center, request proof of identity and have the individual escorted by authorized personnel (h) schedule in advance and require approval by authorized personnel of any temporary authorization to enter; (i) take precautions to protect the service's physical infrastructure against environmental threats, both naturally occurring and man-made, such as excessive ambient temperature, fire, flood, humidity, theft, and vandalism; (j) securely sanitize physical media intended for reuse prior to such reuse, and will destroy physical media not intended for reuse, consistent with National Institute of Standards and Technology, United States Department of Commerce (NIST), guidelines for media sanitization.
IV. Access, Intervention, Transfer and Separation Control. Data importer will (a) maintain documented security architecture of networks managed by data importer in its operation of the service; (b) separately review such network architecture, including measures designed to prevent unauthorized network connections to systems, applications and network devices, for compliance with its secure segmentation, isolation, and defense; (c) encrypt wireless networks, require secure authentication and not provide direct access to service networks (d) maintain measures that are designed to logically separate and prevent Personal Data from being exposed to or accessed by unauthorized persons; (e) encrypt Personal Data not intended for public or unauthenticated viewing when transferring Personal Data over public networks and enable use of a cryptographic protocol, such as HTTPS, SFTP, and FTPS, for secure transfer of Personal Data to and from the Service over public networks (f) encrypt Personal Data at rest except business contact information; (g) maintain documented procedures for secure key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use if the service includes management of cryptographic keys; (h) restrict and limit access to Personal Data to least level required to provide and support the service, such access will be individual, role based, and subject to approval and regular validation by authorized data importer personnel following the principles of segregation of duties; (i) maintain measures to identify and remove redundant and dormant accounts with privileged access and will promptly revoke such access upon the account owner's separation or request of authorized data importer personnel; (j) maintain technical measures enforcing timeout of inactive sessions, lockout of accounts after multiple sequential failed login attempts, strong password or passphrase authentication, and measures requiring secure transfer and storage of such passwords and passphrases consistent with industry standard practices, and to the extent natively supported by each component managed by data importer within the service; (k) monitor use of privileged access and maintain security information and event management measures designed to i) identify unauthorized access and activity, ii) facilitate a timely and appropriate response, and iii) to enable internal and independent third party audits of compliance with documented data importer policy; (l) retain logs in which privileged access and activity are recorded in compliance with data importer's records retention policy maintaining measures designed to protect against unauthorized access, modification and accidental or deliberate destruction of such logs; and (m) maintain computing protections for systems containing Personal Data and all end-user systems that include, but may not be limited to, endpoint firewalls, full disk encryption, signature or behavior based antivirus and malware detection and removal that shall i) be regularly updated by central infrastructure and ii) logged to a central location, time based screen locks, and endpoint management solutions that enforce security configuration and patching requirements to the extent supported by native device or operating system functionality.
V. Service Integrity and Availability Control. Data importer: a) performs penetration testing and vulnerability assessments, including automated system and application security scanning and manual ethical hacking, before production release and annually thereafter; b) enlists a qualified independent third-party to perform penetration testing at least annually; c) remediates identified vulnerabilities or noncompliance with its security configuration requirements based on associated risk, exploitability, and impact; d) takes reasonable steps to avoid service disruption when performing its tests, assessments, scans, and execution of remediation activities; (e) maintains policies and procedures designed to manage risks associated with the application of changes to its services including its systems, networks and underlying components by documenting the change request, description and reason for the change, implementation details and schedule, risk statement addressing impacts to the service and its clients, expected outcome, rollback plan, and approval by authorized personnel; (f) maintain an inventory of all information technology assets used in its operation of the service; (g) continuously monitor the health and availability of the service and underlying components; (h) separately assess each services for business continuity and disaster recovery requirements pursuant to documented risk management guidelines and disaster recovery plans consistent with industry standard practices; (i) backup systems containing Personal Data daily and ensure at least one backup destination is at a remote location, separate from production systems; (j) encrypt backup data stored on portable backup media; (k) validate backup process integrity by regularly performing data restoration testing; (l) maintain measures designed to assess, test, and apply security advisory patches to the service and its associated systems, networks, applications, and underlying components; (m) implement a security advisory patch upon determining it is applicable and appropriate pursuant to documented severity and risk assessment guidelines. Implementation of security advisory patches will be subject to data importer change management policy.
Notwithstanding any provision to the contrary, Forrester may modify or update the security measures in this Annex 2 at Forrester's discretion provided that such modification or update does not result in a material degradation in the protection offered by the security measures.


Savings bonds issued after June 2003 have a term of 20 years, and there's no law preventing you from selling or buying bonds after they are issued, so the U.S. Treasury has forms to reissue the bonds with the new owner's name on them. You can obtain the necessary form to change the ownership from the U.S. Treasury's website.
You can change ownership of Series EE bonds by filing forms with the U.S. Treasury.
Which form you use depends on whether the original owner died, you're moving the savings bond to a personal trust or it's simply a new owner. If the old owner died, use Form PD F 4000 if the new owner is named on the bond or Form PD F 5336 if there's no new owner named. If you're moving the bonds to a personal trust, use Form PD F 1851. If you're simply changing the owner, such as if you bought the bond from another owner or received it as a gift, use Form PD F 4000.


I've been thinking a lot lately about what's next in software testing. What are the new ideas in testing? What is our role in the future of quality software? How do we advance the state of the art in testing?
I think forward thinking will come from highly experienced testers with a breadth of knowledge and the ability to lead to help us define what's next.But testing still seems to be (for most) a job you do for a while until you do something else rather than a career.
When I go to industry test conferences, someone often will ask the keynote audience how long they've been testing. For as long as I've been attending conferences, over 75% of the audience has been testing less than a year. Most of the people who have been testing longer are presenting at the conference or attending in some other "official" capacity (vendor tools, consulting opportunities, etc.).
I think the obstacles to advancing testing are worse than the revolving door pattern of the career choice. The role of the experienced (or "expert") tester appears to be a role of helping the new testers get a handle on the basics. Now – don't get me wrong, I have said a million times that the role of an expert tester is to make their team and peers better, but it's a vicious circle when the career path of a tester ends at coaching and mentoring for the noobs. Then again, it's big money if you want to go into test consulting . Given the perceived turnover rate in testing and the growth of the industry, if you are good at bringing new testers up to speed, you should have gainful employment for years to come.
And it's good to coach, mentor, and guide new testers – but it's not enough. There are a world of challenges out there in testing, but little exploration into advancements, let along game changing activities. I'm approaching 20 years in software testing, and I still love it. But I think there's much more out there than most of us think.
Thanks for sharing your thoughts, this is thought provoking to say the least.
I wonder what you'd consider the big ideas in testing from the last five years?
I think certainly lean approaches & doing away with unneeded waste will be essential as systems get more and more complicated as time goes on. I'd also like to think everyone will begin to think of more proactive approaches to testing systems, in that they prevent bugs more than finding them.
Since you brought it up, I hope it's OK to leave a link to the CFP for the Second Writing About Testing peer conference here. The purpose of the conference is to advance the public discourse on testing exactly along the lines you describe. WAT is not for n00bs.
No problem at all Chris – definitely OK.
My opinion is that testing in an organization should more decentralized. Not so many "leads" and structures.
Instead of hiring many and trying to make the team work, hire better and let them decide what to do.
Do not mix too much with coding needs to force them show "their coding skills" to be pleased by developers.
Hire less and pay them more (at least like dev with same experience).
More geeky testers should be hired not testers with too much attitude. Geeky does not mean always diplomas. Where I come from diplomas are bought and cheating is high.
my perspective. I haven't implemented a large scale organization testing structure. So I cannot imagine all the problems and interactions and needs and psychology involved.
I agree. Partly because I'm very Geeky, but also that I find that people who can throw big words around in interviews will usually get the job in my experience.
Software Testing's a hard job to interview for though. Someone may talk the talk until they're blue in the face, but when it comes to walking the Geeky walk, they stumble over and burst into flames!
My point was: motivate testers and solutions will come. Like in every other domain.
The way we manage test teams (entire engineering teams, really) has to change. I read a lot of books on management theory, and have been recommending "The Leaders Guide to Radical Management" a lot lately. If you don't get a chance to read it, I will likely blog about it soon.
Agree with your other points too. MS pays testers the same as devs, but that's not enough – you need to given the challenging and motivating work too.
As far as code goes, testers should be able to use programming skills to solve problems they couldn't have otherwise, or to allow them to perform testing not otherwise possible. If coding skills are used to demonstrate credibility, the organization is sick.
As usual, thanks for the comments.
Does that mean that mostly newbies and people who like presenting go to conferences? If I look around at how many years experience people have that are employed here there's a good mix, however not many are conference go-ers.
Is the problem rather that people are enthusiastic in the first year and then, apart from a few get disillusioned or just no longer interested and stop going to conferences?
The conclusion that testing is just a stepping stone to something else might have been true 20 years ago, I'm not convinced that this is still the case now (but happy to discuss).
A problem I see with conferences is that there really isn't much for the intermediate or advanced tester. The research conferences have interesting material, but it's rarely practical.
I agree that testing-as-a-stepping-stone is much less prevalent these days. In fact, I would bet that we have more testers with 5-10 or more years of experience now than in any other time in history. BUT – we don't have a place for these experienced testers to share their NEW ideas and advance the craft. The only time I ever hear from someone who SHOULD be a forward thinker in test, they're preaching the basics to the new testers.
Great thought provoking post. I've seen the same thing here in the UK with testing audiences being mainly new people to testing.
With a new generation entering the workforce it's crucial we make our message relevant for them. I see lots of these "experts" talking about things that aren't relevant to this next generation. It's no surprise most of these new testers don't last long when they are faced with "experts" talking about technology and highly formal structures that don't work in most workplaces.
Great post Alan – thanks for sharing this.
struck me. You're completely correct. In particular, managing testers differently from how we manage other engineers has got to change. We don't manage roles, we manage people.
I (potentially) have an upcoming blog on this as well. Thanks for commenting and elaborating.
I'm not pretending on forward thinking ideas, but I had one thought many times over a few past years: why no one cares to test further after a product is released? Why wait for customer complaints to start investigating?
And it's not always the money or staff availability question.
Actually, I even observed as existence of the bug in production worked out as an excuse of not fixing it in the upcoming release.
Interesting – I'm doing this exact thing right now. We just wrapped up a product that isn't even in customers hands, but we still test it. I would bet that this is common in applications where future versions are planned, but much less so in one-off applications (there's just no cost benefit in continuing to test). For example, if I release a new PC game, I'm may not plan to make any updates to the game – in which case, I wouldn't fix any bugs test found anyway, so I wouldn't test.
However, if I just released FooBaz 2.0, and I know that I'll be working on FooBaz 3.0 soon, I'll probably keep testing, since testing investments I do now will pay off on 3.0 quality.
I guess it just depends on context.
That sounds to me like a different story.
You test for the benefit of FooBaz 3.0; no intent to improve quality of FooBaz 2.0. Once you get customer complaints on FooBaz 2.0 you'll probably start investigating those issues and working on the patch for 2.0. Did I get you right?


text:
Blend Lands Featured Spot as an Adweek "Portrait"
Who (L. to r.) Head of production Isaac Swiderski; chief strategy officer Darcie Lamond; CEO and founder Matt Bijarchi; and operations vp Jesse Davis What Branding agency Where Los Angeles Last week, Los Angeles-based branding agency Blend helped launch software company Carmine, having developed its name, logo, website, creative—and even the software itself. It is an example of […]
Who (L. to r.) Head of production Isaac Swiderski; chief strategy officer Darcie Lamond; CEO and founder Matt Bijarchi; and operations vp Jesse Davis
What Branding agency
Where Los Angeles
Last week, Los Angeles-based branding agency Blend helped launch software company Carmine, having developed its name, logo, website, creative—and even the software itself. It is an example of how Blend differs from the typical agency of its kind, according to CFO and CSO Darcie Lamond. "It's a very sophisticated piece of software that we developed—there was pretty hard-core engineering going into that," Lamond explained. "We developed a whole user interface and user experience so they could launch the business in the U.S."
See the full article on Adweek.com
In the competitive world of business, behind every successful corporation or small business is a creative branding agency. Experts who will not only assist your company in developing a professional image, but also help you to market and advertise your products and services through various marketing channels and platforms that allow you to reach your target audience effortlessly. Are you looking for the right digital agency to help you propel your brand forward? Contact Blend Today.
Blend News


text:
How to spot London's best trees
Isabel Hardman
Everyone knows about London's trees, don't they? Those magnificent London Planes, with the bark that peels and protects the tree from pollution. There are long avenues of them in Green Park, along the embankment, and in squares and parks around the city. But I'm not sure many of us really stop to notice these trees, let alone that they're just one of the many species in our urban forest.
London Planes aren't native to Britain, and were either brought over from Spain in the 17th century, or bred in London around the same time. Many of the trees we see in the streets today are a couple of hundred years old, dating back to their original arrive here. They are a hybrid, probably of the Old World Sycamore, Platanus orientalis, and the American Plane, Platanus occidentalis.
What makes them particularly London-friendly is that bark, which flakes off in large chunks to reveal a bright camouflage pattern underneath. This means air pollution cannot stick to the tree: something that's still useful in our congested capital today, but was all the more necessary when the Industrial Revolution thickened the skies of the city. It also happily submits to human mistreatment, from thriving in the compacted soils under urban pavements, to responding well to being pollarded, or cut back heavily, when it is taking up too much space.
Next time you're in a London street, have a good look at the Planes around you. Their bark can be surprisingly bright when it is newly-exposed, and their fruits look like Christmas baubles. Some specimens can develop rather outlandishly stout trunks, which make them look like British equivalents of the succulent baobab tree. Some of the best 'baobab planes' grow by the Imperial War Museum. In the autumn, the thick fleshy leaves are flattened onto the roads into a screen print.
London Plane Tree
But there are so many other incredible street trees thriving amongst the Planes. A similarly pollution-tolerant tree that grows among the central London Planes is the Indian Bean Tree, Catalpa bignonioides. There are many in Parliament Square and on the parliamentary estate too: these trees have wonderfully gnarled bark that looks like an Arthur Rackham illustration. They have heart-shaped leaves, long, hanging seed pods and sweet-scented white candelabra blossoms, and their blooming often seems to coincide with periods of particularly bizarre behaviour amongst MPs.
Indian Bean Tree
Another intoxicatingly-scented street tree is the Mimosa, Acacia dealbata, which announces its presence long before you've seen it. This tender tree likes the warm microclimate of the city. It has acid yellow foamy flowers in late winter, and feathery, deeply-divided leaves. Flowering even earlier than this is the winter-flowering cherry, Prunus subhirtella. This sets up its stall in late autumn and you can find the delicate pink-white blooms all the way until February. It often looks so out of place in the grey streets that passers-by tend to assume that it is responding to climate change, rather than flowering at its natural time. The Prunus genus contains those normal spring-flowering candyfloss-style cherries, too, as well as early-flowering species like Blackthorn (Prunus spinosa) and Cherry Plum (Prunus cerasifera).
Mimosa Acacia
All these trees have to grow in rather challenging circumstances. They are often too far apart from one another to grow supportive root networks, which allow them to share food and warn one another of attacks from insects, humans or animals. The soil around them is repeatedly flattened by the pounding of hundreds of feet on the pavement hour after hour. In drought, they have to keep their wits about them to survive. And yet they grow into old age regardless.
Once you start noticing London's street trees, it's hard to stop. There's a wonderful map here of the different species you might be able to find, and there's even a blog, The Street Tree and two books (London's Street Trees and London is a Forest, both by Paul Wood) dedicated to these tough plants. You can download apps from the Woodland Trust to help you identify trees. It's often not just about the leaves and the bark, but the twigs and the way the buds are arranged on them, too. And when you do start looking at these features, you'll realise that the Plane Tree may have beautiful bark, but so does the Spanish Chestnut, Castanea sativa, which looks like a cable-knit sweater. You'll notice that cherry leaves in the autumn look like goldfish hanging along a rod, and that Hornbeans have beautifully ornate pale green spring flowers. Soon, you'll wonder how on earth it was that you ever assumed that London was a plain city for trees. It's far more than just Planes.
What to wear when canvassing
Look sharp while you knock on doors with our guide to what to wear during the election campaign
How to choose a Christmas tree
Top tips from the Duke and Duchess of Sussexes' Christmas tree supplier
Britain's best toyshops
Inject some originality into this year's stockings with our guide to the best independent toyshops
For cinema goers 2020 was understandably a year of thin gruel. The advent of Covid-19 meant that many films banking on...
Now that we're all stuck at home with our devices the temptation is to succumb to a vortex of internet clickbait in the...
What can we expect from Harry and Meghan's next missive?
Sweet perfume: inside cinema's fascination with scent
From Bond to An American in Paris - perfume can bring a scene alive.
10 films about the final days of rulers
Donald Trump isn't the only leader to have resisted his departure.