Data Protection Policy – to be read in conjunction with the Agency Agreement between the Vendor and Collins Indpendant Estate Agents
- This policy is supplemental to clause 5 of the Agency Agreement between the parties
- The parties acknowledge that for the purposes of the Data Protection Legislation, the Vendor is the controller and the is the processor.
- Without prejudice to the generality of clause 1 of the Agency Agreement between the parties Collins Independent Estate Agents shall, in relation to any personal data processed in connection with the performance by Collins Independent Estate Agents of its obligations under the Agency Agreement:
- process that personal data only on the documented written instructions of the Vendor unless Collins Independent Estate Agents is required by Applicable Laws to otherwise process that personal data. Where Collins Independent Estate Agents is relying on laws of a member of the European Union or European Union law as the basis for processing Personal Data, Collins Independent Estate Agents shall promptly notify the Vendor of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Collins Independent Estate Agents from so notifying the Vendor;
- ensure that it has in place appropriate technical and organisational measures, reviewed and approved by the Vendor, to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);
- ensure that all personnel who have access to and/or process personal data are obliged to keep the personal data confidential; and
- not transfer any personal data outside of the European Economic Area unless the prior written consent of the Vendor has been obtained and the following conditions are fulfilled:
- the Vendor or Collins Independent Estate Agents has provided appropriate safeguards in relation to the transfer;
- the data subject has enforceable rights and effective legal remedies;
- Collins Independent Estate Agents complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and
- Collins Independent Estate Agents complies with reasonable instructions notified to it in advance by the Vendor with respect to the processing of the personal data;
- notify the Vendor without undue delay on becoming aware of a personal data breach;