Data Processing Agreement

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable individual, as defined by applicable data privacy laws and regulations.
• “Processing” means any operation or set of operations which is performed upon Personal Data, such as collection, recording, organization, storage, disclosure, or destruction.
• “Subprocessor” means any third-party processor engaged by GREP to process Personal Data on Customer’s behalf.
  
  

2. Processing of Personal Data

2.1 Customer agrees to comply with all applicable data privacy laws and regulations in connection with its collection, use, and disclosure of Personal Data.

2.2 GREP agrees to process Personal Data only on Customer’s instructions and in accordance with this Agreement and the Service Agreement. GREP will not process Personal Data for any purpose other than as instructed by Customer.

2.3 GREP will implement and maintain appropriate technical and organizational measures to protect Personal Data from unauthorized or unlawful processing and accidental loss, destruction, or damage.

2.4 GREP will promptly notify Customer of any unauthorized or unlawful processing of Personal Data of which it becomes aware.

3. Subprocessors

3.1 GREP may engage Subprocessors to process Personal Data on Customer’s behalf. GREP will only engage Subprocessors that provide adequate safeguards for the protection of Personal Data.

3.2 GREP will be liable for any acts or omissions of its Subprocessors in connection with the processing of Personal Data.

4. Data Transfer

4.1 GREP will only transfer Personal Data outside of the country in which it is collected if:

• Customer has provided its informed consent to the transfer; or
• The transfer is necessary for the performance of the Service Agreement; or
• The transfer is permitted by applicable data privacy laws and regulations.

4.2 GREP will implement appropriate safeguards to protect Personal Data when transferring it outside of the country in which it is collected.

5. Data Security

5.1 GREP will implement and maintain appropriate technical and organizational measures to protect Personal Data from unauthorized or unlawful processing and accidental loss, destruction, or damage.

5.2 GREP will promptly notify Customer of any security incidents involving Personal Data.

6. Data Retention

6.1 GREP will retain Personal Data only for the period necessary to fulfill the purposes for which it was collected and processed, as instructed by Customer.

6.2 After the retention period expires, GREP will securely delete or destroy Personal Data.

7. Cooperation

7.1 The parties agree to cooperate with each other in good faith in the event of any investigation or complaint regarding the processing of Personal Data.

8. Governing Law and Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of the State of [STATE], without regard to its conflict of laws provisions. Any dispute arising out of or relating to this Agreement shall be subject to the exclusive jurisdiction of the courts of the State of [STATE].

9. Entire Agreement

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous communications, representations, or agreements, whether oral or written.

10. Amendment

This Agreement may only be amended by a written instrument signed by both parties.

11. Waiver

No waiver of any breach of this Agreement shall be deemed a waiver of any other breach.

12. Severability

If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be struck and the remaining provisions shall remain in full force and effect.