Last updated: 01/06/2023
These terms govern the provision of services by Full Circle Labs Ltd (FCL) to the Customer, and supersede all other terms and conditions. By requesting services from FCL, the Customer exclusively accepts and acknowledges these terms and conditions as the governing agreement.
1.1 In these Terms, the following words have the following meanings:
The Contract: the agreement between the Customer and FCL for the provision of the Services.
The Customer: the person, company, or organization ordering the Services from FCL under the Contract, as provided to FCL during the initial contact for a Quotation or throughout the order process.
The Data Results: information and data extracted and generated by FCL from the Samples as part of the Services.
Estimated Delivery Date: an approximate date for the delivery of the Data Results.
Excluded Samples: Samples that FCL cannot accept for analysis, as outlined on the Website or in information provided to the Customer.
Intellectual Property Rights: patents, copyrights, registered and unregistered design rights, utility models, trademarks, database rights, know-how, confidential information, and all other intellectual and industrial property rights.
FCL: Full Circle Labs Ltd (Company Number: 13948086), providing sequencing and data analysis services, with registered office at Venture X White City, One Ariel Way, London, England, W12 7SL.
The Payment: the cost of the Services specified in the Quotation, excluding VAT.
Quality Control Criteria: the QC criteria pertaining to Sample quality/quantity, communicated to the Customer through protocols and/or by FCL.
The Quotation: as defined in clause 2.2.
The Samples: biological and non-biological samples, specimens, test items, formulated materials provided or to be provided by the Customer to FCL for genetic analysis, as specified in a Quotation, including any Samples resubmitted under clause 3.6.
The Services: genome sequencing of strains or DNA, sequencing data, or data analysis services to be provided by FCL under the Contract.
The Terms: these terms and conditions.
Prepaid Sequencing: the Service paid in advance by the Customer, the term interchangeable with Gift card, Vouchers, Credit.
The Website: the website located at www.fullcirclelabs.bio, through which the Customer can request FCL to provide the Services.
1.2 Any reference in these Terms to a statute or regulation is deemed to include references to any amendments or re-enactments made from time to time.
1.3 The Interpretation Act 1978 applies to these Terms as if they were an enactment.
1.4 The headings in these Terms are provided for convenience only and do not affect their interpretation or construction.
1.5 FCL shall not be liable for any typographical, clerical, or other error or omission in any sales literature, price list, Quotation, acceptance of offer, invoice, or other document or information issued, and reserves the right to correct such errors without any liability.
2.1 These Terms will govern the provision of the Services to the exclusion of all other terms and conditions (including any terms or conditions which the Customer purports to apply under any purchase order, confirmation order, specification, or other document), unless such other terms and conditions have been expressly agreed to in writing by FCL. These Terms will prevail over those of the Website, any Quotation, and/or any online shop terms in the event of inconsistency or conflict.
2.2 Following a request from a prospective Customer to provide the Services, FCL will issue a quotation ("Quotation") to that Customer, which is open for acceptance by the prospective Customer for 30 days after its date.
2.3 The Customer is deemed to have accepted the Quotation and these Terms by: (a) accepting the Quotation via the online finance portal; (b) making a payment for any of the Services via the Website and/or any online shop; or (c) issuing a Purchase Order to FCL for the Services. Email confirmations are also acknowledged as acceptance of the Quotation and these Terms. Provided that the Customer accepts the Quotation within the 30-day period in accordance with any of the foregoing methods, the Contract between the Customer and FCL will be formed for the supply of the Services.
2.4 If a prospective Customer does not accept the Quotation within the 30-day period but later purports to accept it, the purported acceptance will be an offer to treat. If a prospective Customer places an order with FCL without FCL first having issued a Quotation, that order will be an offer to treat. In either of those circumstances, a contract will only come into existence if and when FCL accepts the Customer's offer. FCL may decline the Customer's offer as FCL sees fit.
2.5 FCL may revise these Terms at any time by publishing new or revised Terms on the Website. If a Quotation is accepted by the Customer after the new or revised Terms have been published on the Website, those new or revised Terms will apply to the supply of the Services under such Quotation. It is the Customer's responsibility to regularly review the Website accordingly.
3.1 The Customer shall entrust FCL with the Samples and bear the responsibility and cost of delivering them to FCL's premises, including shipping and customs expenses. Unless collection arrangements are made by FCL in which case the cost will be borne by FCL. In that case, the Customer shall ensure that the Samples are appropriately packed, labelled, and comply with any instructions provided by FCL regarding containers, packaging, and shipping regulations. FCL reserves the right to reject Samples that are not submitted in accordance with its instructions.
3.2 The Customer shall provide FCL with the Samples along with all necessary information and supporting documentation (such as certificates of non-contamination, patient consents, and ethical approvals) as reasonably required by FCL to carry out the Services. The Samples must be submitted to FCL within 12 months of accepting the Quotation. If the Samples are received by FCL after this time frame, the Customer acknowledges that FCL's rates and administration costs may have changed, and FCL reserves the right to levy additional charges before commencing the Services.
3.3 In the event that the Customer intends to submit an Excluded Sample, prior written consent from FCL must be obtained, and the Customer must adhere to FCL's instructions for submitting such Sample, for instance, as DNA.
3.4 The Customer is responsible for ensuring that the packaging, labelling, and containers of the Samples comply with FCL's instructions, international shipping regulations, and specifically, FCL's guidelines regarding barcodes, concentrations, volumes, integrity, and sample spreadsheet information. FCL reserves the right to dispose of Samples received if they are not submitted in accordance with the provided instructions.
3.5 Before shipping the Samples or upon their receipt, FCL will conduct quality control checks to verify if the Samples meet the QC Criteria in terms of quality and quantity. If, at its sole discretion, FCL determines that a Sample fails to meet the QC Criteria, FCL will proceed with providing the Services for that Sample; however, the viability and accuracy of the results cannot be guaranteed.
3.6 If, following the completion of the Services on the provided Sample and despite the Sample meeting the QC Criteria or for any other valid reason, FCL requires the Customer to resubmit one or more Samples due to their non-viability (provided that such non-viability is not a direct consequence of FCL's actions or omissions), FCL will inform the Customer of the need for resubmission and provide instructions accordingly. The Customer must resubmit the specified Sample(s) within 30 days of receiving FCL's notification. If FCL receives the Sample(s) outside this timeframe, the Customer acknowledges that FCL's rates and administration costs may have changed, and FCL reserves the right to impose additional charges before initiating the Services or refuse to proceed with the Services. Furthermore, FCL retains the right to dispose of Samples received if they are not submitted following the provided instructions.
3.7 Upon receipt of the resubmitted Sample(s) in compliance with clause 3.6, FCL will proceed with the provision of the Services. However, if the Sample(s) remains non-viable (provided that such non-viability is not a direct consequence of FCL's actions or omissions), FCL is not obligated to accept any further Sample(s). No refunds will be issued to the Customer for any Payments made for the Services rendered. If the Customer has not yet settled the Payment for the original Sample(s) and/or any resubmitted Sample(s), the Customer must promptly make the full Payment upon request by FCL.
3.8 FCL may utilise the Samples for the purpose of performing the Services, subject to clause 3.9 below, after the completion of the Services and the delivery of the Data Results to the Customer.
3.9 FCL shall strictly use the Samples solely for providing the Services to the Customer and shall not disclose the Data Results to the public, unless otherwise agreed upon with the Customer. Irrespective of the project type: (a) FCL will retain the Samples for a minimum period of 2 weeks (unless the Customer requests their removal), after which FCL reserves the right to dispose of all DNA, strains, and DNA libraries derived from the Samples provided to FCL; and (b) FCL will retain the Data Results for a minimum period of 6 months after delivery, after which FCL reserves the right to delete such Data Results.
4.1 FCL shall undertake the Services with due diligence and professional expertise. Reasonable efforts will be made by FCL to complete the Services and provide the Data Results by any Estimated Delivery Date. The Estimated Delivery Date serves as an approximate timeframe, and FCL shall not be held liable for any delays or failure to meet the Estimated Delivery Date.
4.2 The Services offered by FCL are exclusively intended for scientific testing and research purposes. The Customer acknowledges that the Services and Data Results are not intended for clinical use (including, but not limited to, diagnostic, prognostic, or therapeutic purposes) without further data analysis by the Customer and/or the execution of additional terms and conditions with FCL.
4.3 If there is a delay on the part of the Customer in providing the Samples or making the required Payment to FCL, FCL reserves the right to reasonably postpone the performance of the Services, taking into consideration the Customer's delay and the availability of FCL's facilities.
4.4 Following the completion of the Services, FCL will deliver the Data Results to the Customer using a suitable electronic medium or other appropriate delivery method.
5.1 Payment for the Services shall be made by the Customer either at the time of placing the order through the Website and/or online shop, or by issuing a purchase order. An invoice will be generated by FCL once the purchase order is issued. Unless otherwise agreed in writing, the Customer shall make full payment of all invoices to FCL within thirty (30) days from the date of the invoice, in the currency specified in the Quotation or any other document provided by FCL relating to payment obligations.
5.2 Prices quoted are exclusive of VAT, unless otherwise stated. The Customer shall be responsible for paying any applicable taxes, duties, and government charges in accordance with the prevailing UK legislation at the tax point, as well as any other taxes and duties associated with the supply, export, and import of the Services into any jurisdiction.
5.3 In the event of late payment by the Customer, FCL reserves the right, without prejudice to any other rights and remedies it may have:
5.3.1 To suspend the Services and/or cancel any outstanding obligations under the Contract.
5.3.2 To impose a service charge to cover administrative and related costs for overdue accounts, calculated at a rate of 5% per month on all unpaid accounts. This charge may include additional administrative fees such as but not limiting to repeat service costs.
5.3.3 To charge interest on the outstanding amount at the rate prescribed in the Late Payment of Commercial Debts (Interest) Act 1998, accruing from the due date until the full outstanding amount is paid.
5.4 The Customer shall not have the right to offset any amounts owed to them by FCL against unpaid invoices due to FCL.
5.5 Any claims or queries regarding the invoiced price of the Services must be promptly notified to FCL by the Customer within the time period specified in clause 5.1.
5.6 Prepaid Sequencing are purchased by the Customers are subjected to the FCL Terms and must be used within 5 years of purchase.
6.1 These Terms do not grant the Customer any license or other rights under any Intellectual Property Rights belonging to or used by FCL as of the Contract date. The Customer shall have no claim to any Intellectual Property Rights held or utilised by FCL, including those related to nucleic acid analysis methods, experimental design methods (such as sample preparation and library preparation), genomic sequencing, or data analysis tools.
6.2 The Intellectual Property Rights in the Data Results will belong to the Customer, and upon the Customer's request and at their expense, FCL will execute necessary documents and take appropriate actions to assign the Intellectual Property Rights to the Customer. The Customer grants FCL a worldwide, non-exclusive, royalty-free, fully paid-up, sublicensable license to use the Data Results for the provision of Services, service improvement (including the Services), and internal research and development purposes. However, FCL undertakes not to share such Data Results outside its organisation without the prior written consent of the Customer. Nonetheless, FCL reserves the right to generate aggregated anonymized summary information from the Data Results and utilise and publish such summary information as it deems appropriate.
6.3 FCL grants the Customer a non-exclusive, non-transferable license to access and use the FCL website portal and associated software solely for the purpose of accessing and utilising the Data Results, to the extent necessary for the Customer's use of the Data Results, provided that:
6.3.1 The Customer shall restrict access to the FCL portal and software to its employees and named collaborators (whose names are provided to FCL in writing prior to such access, including via the project portal), and shall not disclose details of the FCL portal and/or software to any third party.
6.3.2 The Customer may not distribute any part of the FCL portal or software to any third party, share its access or use with any third party (whether for commercial purposes or otherwise), or sublicense the use of the FCL portal or software.
6.3.3 The Customer may not access and/or use the FCL portal or software on behalf of, or for the benefit of, anyone else.
6.3.4 The Customer may not modify, adapt, reverse engineer, decompile, or disassemble the whole or any part of the FCL portal or software for any purpose, except as expressly permitted by and in accordance with Section 50 of the Copyright, Design and Patents Act 1988 or any other directly applicable law.
7.1 The Customer represents and warrants that:
7.1.1 It has obtained all necessary patient and/or ethical consents for the Samples, allowing the Customer to submit them to FCL and enabling FCL to fulfil its obligations under the Contract.
7.1.2 FCL's possession or use of the Samples for providing the Services, as well as its handling and storage of the Samples and Data Results in accordance with the Contract, comply with applicable laws and regulations, including Data Protection Legislation (as defined in the Data Processing Terms), and do not infringe any third-party Intellectual Property Rights.
7.1.3 It has provided FCL with all essential information regarding the safe handling and storage of the Samples.
7.2 The Customer shall indemnify FCL against any actions, claims, damages, losses, and expenses (including legal and other costs) incurred by FCL as a result of or in connection with any breach of the warranties stated in clause 7.1.
7.3 The Customer warrants that its decision to enter the Contract is not based on any representation or warranty, whether oral, written, or in any other form, except for those expressly included in the Contract. The Customer waives all claims for breach of any warranty and any claims for misrepresentation (whether negligent or of any other nature, unless fraudulently made by FCL) that are not specifically outlined in the Contract as warranties.
7.4 The Customer acknowledges and agrees that the Services provided are scientific testing services, and therefore, specific results or outcomes are not guaranteed or warranted.
7.5 The Data Results are supplied without any express or implied warranties, conditions, or representations. All warranties, conditions, terms, undertakings, and obligations on the part of FCL implied by statute, common law, custom, trade usage, course of dealing, or any other means are, to the extent permitted by law, excluded.
7.6 FCL makes no representations and provides no warranty that the use of the Data Results or the exercise of any other licensed rights under this Agreement will not infringe any Intellectual Property Rights or other rights of any third party.
8.1 FCL's liability for fraud, death, or personal injury arising from FCL's negligence or any other liability that cannot be excluded by law is not limited under these Terms.
8.2 Subject to clause 8.1, FCL's maximum liability in connection with the Services, whether due to FCL's negligence, its employees, agents, subcontractors, or otherwise, shall not exceed the total amount paid by the Customer to FCL in the 12 months preceding the event giving rise to the liability. In the event of an error by FCL that renders the Data Results unusable, provided the Sample is viable (non-viable Samples handled as per clause 3), the Customer's sole remedy shall be either:
8.2.1 a refund of the amounts paid to FCL by the Customer for the respective Services under the Contract, or
8.2.2 requiring FCL to repeat part or all of the Services at FCL's expense, with FCL being obligated to perform such repeat Services only once.
8.3 Except as stated in clause 8.1, the Customer assumes all risks associated with using the Data Results, and FCL shall not be held responsible or liable for any use of the Data Results by the Customer or any other person, or for any losses arising from such use, whether due to FCL's negligence, its employees, agents, subcontractors, or otherwise.
8.4 Except as stated in clause 8.1, FCL shall not be liable to the Customer for the following: loss of profit, loss of revenue, loss of savings, loss of opportunity, loss of business, loss of goodwill (whether direct or indirect), or any indirect loss, damage, costs, expenses, and other claims arising from the Services or the Contract, whether due to FCL's negligence, its employees, agents, subcontractors, or otherwise.
9.1 FCL and the Customer shall refrain from using, disclosing, or sharing with any third party, except as permitted under these Terms, any confidential information of the other party. This includes, but is not limited to, oral, written, recorded, or otherwise disclosed information relating to the business, operations, plans, technology, know-how, products, and services of the other party. Such confidential information encompasses any samples, materials, or data provided by either party for the purpose of the Contract, unless prior written consent is obtained from the disclosing party.
9.2 The obligations set forth in clause 9.1 shall not apply to information that falls under the following circumstances:
9.2.1 The receiving party already possessed or had unrestricted access to the information before its disclosure by the disclosing party.
9.2.2 The information is disclosed to the receiving party by a third party without any confidentiality obligations, and such third party did not acquire the information directly or indirectly from the disclosing party.
9.2.3 The information becomes publicly known worldwide without any fault on the part of the receiving party.
9.2.4 The receiving party independently develops or discovers the information without utilizing or relying on the disclosing party's information.
9.3 The provisions of this clause 9 shall not prohibit:
9.3.1 FCL from sharing confidential information, including Data Results, with its affiliated entities in order to fulfil its obligations under the Contract, subject to maintaining confidentiality.
9.3.2 Either party from making disclosures required by law, court order, or regulatory authority of competent jurisdiction.
9.4 With the exception of Customer contact data, for which FCL acts as a Data Controller (as defined in Schedule 1), if FCL processes any Personal Data (as defined in Schedule 1) on behalf of the Customer during the provision of Services, it is agreed that the Customer shall act as the Data Controller and FCL as the Data Processor (as defined in Schedule 1) for such Personal Data. In such cases, FCL shall process the Personal Data in accordance with the data processing terms outlined in Schedule 1.
In the event that FCL's ability to fulfil its obligation under these Terms is delayed, hindered, or prevented due to circumstances beyond its reasonable control, FCL shall not be held liable to the Customer for any resulting non-performance. The time for fulfilling the affected obligations shall be extended until such time as the event or circumstance causing the delay has ceased. FCL acknowledges that certain unforeseen events or circumstances may arise, and in such cases, FCL's responsibility to perform shall be reinstated once the impediment has been resolved.
11.1 Either party has the right to terminate the Contract by providing written notice to the other party under the following circumstances:
11.1.1 If the other party commits a substantial breach of any provision in this Agreement, and in the case of a remediable breach, fails to rectify the breach within 30 days after receiving written notice specifying the breach and requesting its resolution.
11.1.2 If the other party undergoes the appointment of a receiver, administrative receiver, or administrator over all or any part of its assets. Additionally, if the other party enters into liquidation, enters into any arrangement or composition with its creditors (excluding solvent amalgamation or reconstruction), or ceases its business operations.
11.2 Termination of the Contract, as per clause 11, will not affect any accrued rights or remedies of the terminating party prior to termination.
11.3 Upon termination of the Contract, regardless of the reason, the Customer shall promptly settle any outstanding Payment or amounts owed to FCL as per the terms of the Contract.
11.4 The provisions of clauses 1, 3.7, 4.4, 5.4, 6.2, 6.3, 7, 8, 9, 11.2, 11.3, 11.4, and 12 will survive the expiration or termination of this Agreement and shall remain in effect indefinitely.
12.1 No Partnership or Joint Venture - These Terms do not establish, imply, or demonstrate any partnership or joint venture between FCL and the Customer, nor do they establish a principal-agent relationship between them.
12.2 No Third Party Rights - No third party shall have any rights or benefits under this Agreement as per the Contracts (Rights of Third Parties) Act 1999 or any other applicable law.
12.3 Assignment and Subcontracting - The Customer shall not assign or transfer the Contract or any part thereof without obtaining prior written consent from FCL. FCL may fulfill its obligations or exercise its rights under the Contract either directly or through an FCL Affiliate, agent, or subcontractor. Any action or omission by such FCL Affiliate or subcontractor shall be deemed as the action or omission of FCL. FCL may also assign or transfer the Contract or any part thereof to any other entity.
12.4 Severability - If any provision of these Terms is held invalid or unenforceable by a competent authority, the validity of the remaining provisions shall not be affected, and the unaffected portion of the provision shall continue to be in force.
12.5 Notices - All notices required or permitted under the Contract shall be in writing and sent to the respective contact address or email address specified in the Quotation or any other address or email address designated by notice from one party to the other in accordance with this clause 12. Notices can be delivered personally, by first-class prepaid letter, or by email. Notices shall be deemed effective: if delivered by hand, upon delivery; if sent by first-class post, 48 hours after posting; and if sent by email, upon successful accessibility by the intended recipient.
12.6 Waiver - No waiver or delay by FCL in enforcing its rights shall limit or restrict those rights, and any waiver of a right shall not be deemed a waiver of any subsequent right or breach.
12.7 Governing Law and Jurisdiction - The Contract shall be governed by and construed in accordance with the laws of England. The English Courts shall have exclusive jurisdiction over any dispute arising out of or in connection with the Contract.
1 Definitions and interpretation
The following definitions and rules of interpretation govern these Data Processing Terms.
1.1 Definitions:
1 Business Purposes: Refers to the services offered by FCL to the Customer as described in the Master Agreement.
2 Commissioner: Indicates the Information Commissioner as specified in Article 4(A3) of the UK GDPR and section 114 of the DPA 2018.
3 Controller, Processor, Data Subject, Personal Data, Personal Data Breach, and Processing: Carry the meanings assigned to them in the Data Protection Legislation.
4 Data Protection Legislation:
4a) If the UK GDPR applies, it pertains to the laws of the United Kingdom or its relevant parts regarding the protection of Personal Data.
4b) If the EU GDPR applies, it pertains to the laws of the European Union or any member state of the European Union to which the Customer or FCL is subject, concerning the protection of Personal Data.
5 EU GDPR: Refers to the General Data Protection Regulation ((EU) 2016/679).
6 EEA: Represents the European Economic Area.
7 Master Agreement: Denotes the Contract (as defined in the overarching Terms and Conditions governing the provision of Services by FCL) entered into by the Customer around the date of these Data Processing Terms.
8 Records: Carries the meaning assigned to it in paragraph 12.
9 Standard Contractual Clauses (SCC): Refers to the International Data Transfer Agreement for the transfer of personal data from the UK as provided by the ICO and/or the International Data Transfer Addendum to EU Commission Standard Contractual Clauses issued by the ICO, and/or the European Commission's Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 as outlined in the Annex to Commission Implementing Decision (EU) 2021/914, and/or the European Commission's Standard Contractual Clauses for the transfer of Personal Data from the European Union to processors established in third countries (controller-to-processor transfers) as set out in the Annex to Commission Decision 2010/87/EU adapted for the UK, or any alternative clauses approved by the European Commission or the UK from time to time.
10 Term: Refers to the duration of these Data Processing Terms as defined in paragraph 10.
11 UK GDPR: Carries the meaning assigned to it in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.
** 1.2 Interpretation:**
(a) These Data Processing Terms are incorporated into and subject to the terms of the Master Agreement. The interpretations and defined terms specified in the Master Agreement apply to the interpretation of these Data Processing Terms.
(b) The Annex is an integral part of these Data Processing Terms and shall have full effect as if it were included in the main body of these Data Processing Terms. Any reference to these Data Processing Terms includes the Annex.
(c) References to "writing" or "written" also include communication via email.
(d) In case of conflict or ambiguity:
(i) If there is a conflict between any provision in the body of these Data Processing Terms and any provision in the Annex, the provision in the body of these Data Processing Terms shall take precedence.
(ii) If there is a conflict between the terms of any accompanying invoice or other documents attached to these Data Processing Terms and any provision in the Annex, the provision in the Annex shall take precedence.
(iii) If there is a conflict between any provision of these Data Processing Terms and the provisions of the Master Agreement, the provisions of these Data Processing Terms shall take precedence.
(iv) If there is a conflict between any provision of these Data Processing Terms and any executed SCC, the provisions of the executed SCC shall take precedence.
2. Personal data types and processing purposes:
2.1 The Customer and FCL acknowledge and agree that, for the purpose of the Data Protection Legislation:
(i) The Customer acts as the controller and FCL acts as the processor.
(ii) The Customer retains control over the Personal Data and remains responsible for fulfilling its compliance obligations under the applicable Data Protection Legislation, including providing necessary notices and obtaining required consents, as well as providing written processing instructions to FCL.
(iii) ANNEX A provides a description of the subject matter, duration, nature, and purpose of the processing, as well as the categories of Personal Data and types of Data Subjects, which FCL may process to fulfill the Business Purposes.
3. FCL's obligations:
3.1 FCL shall only process the Personal Data to the extent necessary for the Business Purposes and in accordance with the Customer's written instructions. FCL shall not process the Personal Data for any other purpose or in a manner that violates these Data Processing Terms or the Data Protection Legislation. If FCL believes that the Customer's instructions do not comply with the Data Protection Legislation, it shall promptly notify the Customer.
3.2 Upon receiving written instructions from the Customer, FCL shall promptly comply with any requests to amend, transfer, delete, or otherwise process the Personal Data, or to cease, mitigate, or rectify any unauthorized processing.
3.3 FCL shall maintain the confidentiality of the Personal Data and shall not disclose it to third parties unless authorized by the Customer or explicitly permitted by these Data Processing Terms, or if required by domestic law, court order, or regulatory authority (including the Commissioner). If FCL is obligated by domestic law, court order, or regulatory authority (including the Commissioner) to process or disclose the Personal Data to a third party, FCL shall inform the Customer of such legal or regulatory requirement, giving the Customer an opportunity to object or challenge, unless prohibited by domestic law.
3.4 FCL shall reasonably assist the Customer, at the Customer's expense, in fulfilling its compliance obligations under the Data Protection Legislation. This includes, but is not limited to, assisting with Data Subject rights, data protection impact assessments, and reporting to and consulting with the Commissioner or other relevant regulatory authorities under the Data Protection Legislation, considering the nature of FCL's processing and the available information.
3.5 FCL shall promptly notify the Customer of any changes in the Data Protection Legislation that may reasonably impact FCL's performance under the Master Agreement or these Data Processing Terms.
4. Provider's employees:
FCL shall ensure that all its employees:
(i) Understand the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions.
(ii) Receive training on the Data Protection Legislation relevant to handling Personal Data and its application to their respective duties.
(iii) Are aware of both FCL's duties and their personal obligations under the Data Protection Legislation and these Data Processing Terms.
5. Security:
5.1 FCL shall implement appropriate technical and organisational measures to prevent unauthorised or unlawful processing, access, copying, modification, reproduction, display, or distribution of the Personal Data, as well as accidental or unlawful loss, destruction, alteration, disclosure, or damage of Personal Data.
5.2 FCL shall implement measures that ensure a level of security commensurate with the risk involved. This includes, where appropriate:
(i) Pseudonymization and encryption of personal data.
(ii) Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
(iii) Establishing procedures for timely restoration of availability and access to personal data in the event of a physical or technical incident.
(iv) Regularly testing, assessing, and evaluating the effectiveness of security measures.
6. Personal Data Breach:
6.1 Upon becoming aware of any loss, unintended destruction, damage, corruption, unusability of Personal Data, any accidental, unauthorized, or unlawful processing of the Personal Data, or any Personal Data Breach, FCL shall promptly notify the Customer.
6.2 When notifying the Customer, FCL shall, without undue delay, provide the following information:
(i) Description of the nature of the incident, including the categories of Personal Data and approximate number of both Data Subjects and the Personal Data records involved.
(ii) The likely consequences of the incident.
(iii) A description of the measures taken or proposed to address the incident, including measures to mitigate its possible adverse effects.
6.3 Immediately following any accidental, unauthorized, or unlawful Personal Data processing or Personal Data Breach, the parties shall cooperate in investigating the matter. Furthermore, FCL shall reasonably assist the Customer, at no additional cost, in handling the matter, including but not limited to:
(i) Assisting with any investigation.
(ii) Providing the Customer with physical access to any affected facilities and operations.
(iii) facilitating interviews with FCL's employees, former employees, and other individuals involved in the matter, including its officers and directors;
(iv) providing all relevant records, logs, files, data reports, and other materials necessary to comply with applicable Data Protection Legislation or as reasonably required by the Customer; and
(v) taking prompt and reasonable measures to mitigate the impact and minimize any harm resulting from the Personal Data Breach or accidental, unauthorized, or unlawful processing of Personal Data.
6.4 FCL shall not disclose any accidental, unauthorized, or unlawful processing of all or part of the Personal Data, or any Personal Data Breach, to any third party without obtaining the Customer's prior written consent, except as required by domestic law.
6.5 FCL acknowledges that the Customer has the exclusive right to determine:
(i) Whether to notify Data Subjects, the Commissioner, other relevant regulatory authorities, law enforcement agencies, or other parties, as required by law or at the Customer's discretion, regarding the accidental, unauthorized, or unlawful processing and/or the Personal Data Breach, including the content and method of delivery of such notifications; and
(ii) Whether to provide any form of remedy to affected Data Subjects, including the nature and extent of such remedy.
6.6 FCL shall bear all reasonable expenses related to fulfilling the obligations stated in paragraphs 6.1 to 6.3, unless the matter arises from the Customer's explicit written instructions, negligence, willful default, or breach of these Data Processing Terms. In such cases, the Customer shall bear all reasonable expenses.
6.7 Furthermore, FCL shall reimburse the Customer for actual reasonable expenses incurred in responding to an incident of accidental, unauthorized, or unlawful processing and/or a Personal Data Breach to the extent caused by FCL, including all costs associated with notifications and any remedies specified in paragraph 6.5.
7. Cross-border transfers of personal data
7.1 FCL (and any subcontractor) shall not transfer or process the Personal Data outside the European Economic Area (EEA) unless it complies with the provisions outlined in this paragraph.
7.2 FCL may only process, or allow the processing of, the Personal Data outside the EEA under the following circumstances:
(i) FCL is processing the Personal Data in a jurisdiction that is subject to adequacy regulations under the Data Protection Legislation, ensuring that the jurisdiction provides sufficient protection for individuals' privacy rights.
(ii) FCL participates in a valid cross-border transfer mechanism established by the Data Protection Legislation, ensuring that appropriate safeguards are in place to guarantee an adequate level of protection for individuals' privacy rights, as required by Article 46 of the UK GDPR.
(iii) The transfer complies with the requirements of the Data Protection Legislation.
7.3 If any transfer of Personal Data between the Customer and FCL necessitates the execution of Standard Contractual Clauses (SCC) to comply with the Data Protection Legislation (where the Customer is the entity exporting Personal Data to FCL outside the EEA), the parties will complete all necessary details and execute the SCC, along with any other actions required to legitimize the transfer.
8. Subcontractors:
FCL may only authorize a third party (subcontractor) to process the Personal Data if:
(i) FCL enters into a written contract with the subcontractor that includes terms substantially similar to those specified in these Data Processing Terms, particularly with regard to the implementation of appropriate technical and organizational data security measures. Upon the Customer's written request, FCL shall provide the Customer with relevant excerpts from such contracts.
(ii) FCL maintains control over all Personal Data entrusted to the subcontractor.
(iii) The subcontractor's contract automatically terminates upon the termination of these Data Processing Terms for any reason.
8.2 The subcontractors approved at the start of these Data Processing Terms are listed in ANNEX A.
8.3 If a subcontractor fails to fulfil its obligations under the written agreement with FCL, which includes terms substantially similar to those set out in these Data Processing Terms, FCL remains fully liable to the Customer for the subcontractor's performance of its contractual obligations.
8.4 The Parties agree that, practically, any Personal Data controlled by or in the possession of subcontractors will be legally deemed to be controlled by FCL.
9. Complaints, data subject requests, and third-party rights:
9.1 FCL must implement appropriate technical and organizational measures and provide necessary information to the Customer to enable the Customer to fulfill the rights of Data Subjects under the Data Protection Legislation. This includes subject access rights, the rights to rectify, port, and erase personal data, object to processing and automated processing of personal data, and restrict the processing of personal data. FCL must also assist the Customer in responding to information or assessment notices served by the Commissioner or other relevant regulator under the Data Protection Legislation.
9.2 If FCL receives any complaint, notice, or communication related to the processing of the Personal Data or compliance with the Data Protection Legislation, it must promptly notify the Customer in writing.
9.3 FCL must notify the Customer within 5 business days if it receives a request from a Data Subject for access to their Personal Data or to exercise any other rights under the Data Protection Legislation.
9.4 FCL must cooperate with and assist the Customer, at no additional cost, in responding to any complaint, notice, communication, or Data Subject request.
9.5 FCL must not disclose the Personal Data to any Data Subject or third party unless instructed in writing by the Customer or as required by domestic law.
10. Term and termination:
10.1 These Data Processing Terms will remain in effect as long as the Master Agreement is in effect or FCL retains any Personal Data related to the Master Agreement.
10.2 Any provision of these Data Processing Terms that needs to remain in force to protect the Personal Data will continue to apply even after termination of the Master Agreement.
10.3 FCL's failure to comply with the terms of these Data Processing Terms constitutes a material breach of the Master Agreement. In such a case, the Customer may terminate the relevant part of the Master Agreement involving the processing of Personal Data immediately upon written notice to FCL, without further liability or obligation.
10.4 If a change in any Data Protection Legislation prevents either party from fulfilling its obligations under the Master Agreement, the parties may agree to suspend the processing of Personal Data until compliance with the new requirements. If compliance cannot be achieved, either party may terminate the Master Agreement immediately upon written notice to the other party.
11. Data return and destruction:
11.1 Upon the Customer's request, FCL will provide the Customer or a nominated third party with a copy of or access to the Personal Data in its possession or control in the format specified by the Customer.
11.2 Upon termination of the Master Agreement or expiry of its term, FCL will securely delete or destroy, or if instructed in writing by the Customer, return and not retain, any Personal Data related to these Data Processing Terms.
11.3 If any law, regulation, or government or regulatory body requires FCL to retain any documents, materials, or Personal Data that would otherwise be returned or destroyed, FCL will notify the Customer in writing, providing details of the retention requirement and establishing a specific timeline for deletion or destruction once the retention requirement ends.
12. Records:
12.1 FCL will maintain accurate and up-to-date written records regarding the processing of Personal Data, including access, control, and security measures, processing purposes, categories of processing, transfers of personal data to third countries and related safeguards, and a description of the technical and organizational security measures.
12.2 FCL will ensure that the Records are sufficient for the Customer to verify compliance with these Data Processing Terms and provide copies of the Records to the Customer upon request.
12.3 The Customer and FCL must review the information listed in the Annexes to these Data Processing Terms to ensure its accuracy and update it as required to reflect current practices.
13. Audit
13.1 FCL will allow the Customer and its designated third-party representatives to conduct audits to verify FCL's compliance with its obligations under the Agreement. The Customer shall provide at least 10 business days' notice prior to conducting an audit during the Term. FCL shall cooperate and provide all necessary assistance to facilitate such audits. This assistance may include, but is not limited to:
(i) Granting physical or remote electronic access, as well as providing copies of the Records and any other relevant information stored at FCL's premises or systems holding the Personal Data.
(ii) Allowing access to and arranging meetings with FCL personnel, as reasonably required, to provide explanations and effectively perform the audit.
(iii) Permitting inspection of all Records, infrastructure, electronic data or systems, facilities, equipment, or application software used for storing and processing the Personal Data.
13.2 The notice requirements outlined in paragraph 13.1 shall not apply if the Customer reasonably believes that a Personal Data Breach has occurred or is ongoing, or if FCL is in breach of its obligations under these Data Processing Terms or any applicable Data Protection Legislation.
13.3 In the event of a Personal Data Breach or if FCL becomes aware of a breach of its obligations under these Data Processing Terms or any Data Protection Legislation, FCL shall:
(i) Conduct a prompt internal audit to determine the cause of the breach.
(ii) Prepare a written report outlining the findings of the audit, including detailed plans to address any identified deficiencies.
(iii) Provide the Customer with a copy of the written audit report.
(iv) Take necessary measures to rectify the identified deficiencies within 30 days of the audit report, or within a mutually agreed-upon timeframe.
1 Subject Matter of Processing: The processing of personal data is conducted for the sole purpose of carrying out the Services as outlined in the Master Agreement.
2 Duration of Processing: The processing of personal data continues throughout the duration of the Master Agreement.
3 Nature of Processing: The processing of personal data is exclusively performed to fulfil the obligations stated in the Master Agreement and provide the designated Services.
4 Personal Data Categories: The personal data processed may consist of samples that potentially contain elements or traces of human DNA.
5 Data Subject Types: The data subjects encompass individuals whose DNA is included in the aforementioned samples.