|
City of South Bend 7 February 14, 2020
<br />information pursuant to this Agreement, Crowe retains its independence as required by applicable law and
<br />professional standards for purposes of providing attest services and other services. Crowe will not (1) sell
<br />Personal Data to a third party, or (2) retain, use or disclose Personal Data for any purpose other than for
<br />(a) performing the Services and its obligations on this Agreement, (b) as otherwise set forth in this
<br />Agreement, (c) to detect security incidents and protect against fraud or illegal activity, (d) to enhance and
<br />develop our products and services, including through machine learning and other similar methods and (e)
<br />as necessary to comply with applicable law or professional standards. Crowe has implemented and will
<br />maintain physical, electronic and procedural safeguards reasonably designed to (i) protect the security,
<br />confidentiality and integrity of the Personal Data, (ii) prevent unauthorized access to or use of the Personal
<br />Data, and (iii) provide proper disposal of the Personal Data (collectively, the “Safeguards”). Client
<br />represents (i) that it has the authority to provide the Personal Data to Crowe in connection with the Services,
<br />(ii) that Client has processed and provided the Personal Data to Crowe in accordance with applicable law,
<br />and (iii) will limit the Personal Data provided to Crowe to Personal Data necessary to perform the Services.
<br />To provide the Services, Client may also need to provide Crowe with access to Personal Data consisting
<br />of protected health information, financial account numbers, Social Security or other government-issued
<br />identification numbers, or other data that, if disclosed without authorization, would trigger notification
<br />requirements under applicable law ("Restricted Personal Data"). In the event Client provides Crowe access
<br />to Restricted Personal Data, Client will consult with Crowe on appropriate measures (consistent with legal
<br />requirements and professional standards applicable to Crowe) to protect the Restricted Personal Data,
<br />such as: deleting or masking unnecessary information before making it available to Crowe, using encryption
<br />when transferring it to Crowe, or providing it to Crowe only during on-site review on Client’s site. Client will
<br />provide Crowe with Restricted Personal Data only in accordance with mutually agreed protective measures.
<br />Otherwise, Client and Crowe agree each may use unencrypted electronic media to correspond or transmit
<br />information and such use will not in itself constitute a breach of any confidentiality obligations under this
<br />Agreement. Crowe will reasonably cooperate with Client in responding to or addressing any request from
<br />a consumer or data subject, a data privacy authority with jurisdiction, or the Client, as necessary to enable
<br />Client to comply with its obligations under applicable data protection laws and to the extent related to
<br />Personal Data. Client will reimburse Crowe for any out-of-pocket expenses and professional time (at
<br />Crowe’s then-current hourly rates) incurred in connection with providing such cooperation. Client will
<br />provide prompt written notice to Crowe (with sufficient detailed instructions) of any request or other act that
<br />is required to be performed by Crowe. As appropriate, Crowe will promptly delete or procure the deletion
<br />of the Personal Data, after the cessation of any Services involving the processing of Client’s Personal Data,
<br />or otherwise aggregate or de-identify the Personal Data in such a way as to reasonably prevent
<br />reidentification. Notwithstanding the forgoing, Crowe may retain a copy of the Personal Data as permitted
<br />by applicable law or professional standards, provided that such Personal Data remain subject to the terms
<br />of this Agreement. If Crowe uses a third-party provider, Crowe will include terms substantially similar to
<br />those set forth in this Data Protection Paragraph in an agreement with such provider.
<br />GENERAL DATA PROTECTION REGULATION COMPLIANCE – If and to the extent that Client provides
<br />personal data to Crowe subject to the European Union General Data Protection Regulation (“GDPR”), then
<br />in addition to the requirements of the above Data Protection section, this section will apply to such personal
<br />data (“EU Personal Data”). The parties agree that for purposes of processing the EU Personal Data, (a)
<br />Client will be the “Data Controller” as defined by the GDPR, meaning the organization that determines the
<br />purposes and means of processing the EU Personal Data; (b) Crowe will be the “Data Processor” as defined
<br />by GDPR, meaning the organization that processes the EU Personal Data on behalf of and under the
<br />instructions of the Data Controller; or (c) the parties will be classified as otherwise designated by a
<br />supervisory authority with jurisdiction. Client and Crowe each agree to comply with the GDPR requirements
<br />applicable to its respective role. Crowe has implemented and will maintain technical and organizational
<br />security safeguards reasonably designed to protect the security, confidentiality and integrity of the EU
<br />Personal Data. Client represents it has secured all required rights and authority, including consents and
<br />notices, to provide such EU Personal Data to Crowe, including without limitation authority to transfer such
<br />EU Personal Data to the U.S. or other applicable Country or otherwise make the EU Personal Data available
<br />to Crowe, for the duration of and purpose of Crowe providing the Services. The types of EU Personal Data
<br />to be processed include name, contact information, title, and other EU Personal Data that is transferred to
<br />Crowe in connection with the Services. The EU Personal Data relates to the data subject categories of
<br />individuals connected to Client, Client customers, Client vendors, and Client affiliates or subsidiaries (“Data
<br />Subjects”). Crowe will process the EU Personal Data for the following purpose: (x) to provide the Services
<br />in accordance with this Agreement, (y) to comply with other documented reasonable instructions provided
<br />
<br />
|