Exhibitors – Find your GES show
These GES EU Data Protection Terms and Conditions are comprised of the following contractual clauses ('the Clauses') in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in the applicable GES EU Data Security Addendum (the ‘Addendum’) entered into between GES and the counterparty to the Addendum (GES and such counterparty collectively, the ‘parties’):
Clause 1
For the purposes of the Clauses:
Clause 2
The details of the transfer, and in particular the categories of personal data and the purposes for which they are transferred, are specified in the Addendum, which forms an integral part of the Clauses and is incorporated by reference herein.
Clause 3
The data subjects can enforce this Clause, Clause 4(b), (c) and (d). Clause 5(a), (b), (c) and (e), Clause 6(1) and (2), and Clauses 7, 9 and 11 as third-party beneficiaries. The parties do not object to the data subjects being represented by an association or other bodies if they so wish and if permitted by national law.
Clause 4
The data exporter agrees and warrants:
Clause 5
The data importer agrees and warrants:
a. that he has no reason to believe that the legislation applicable to him prevents him from fulfilling his obligations under the contract and that in the event of a change in that legislation which is likely to have a substantial adverse effect on the guarantees provided by the Clauses, he will notify the change to the data exporter and to the supervisory authority where the data exporter is established, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
b. to process the personal data in accordance with the mandatory data protection principles set out in Appendix 2;
or, if explicitly agreed by the parties by ticking below and subject to compliance with the mandatory data protection principles set out in Appendix 3, to process in all other respects the data in accordance with:
c. to deal promptly and properly with all reasonable inquiries from the data exporter or the data subject relating to his processing of the personal data subject to the transfer and to cooperate with the competent supervisory authority in the course of all its inquiries and abide by the advice of the supervisory authority with regard to the processing of the data transferred;
d. at the request of the data exporter to submit its data processing facilities for audit which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications, selected by the data exporter, where applicable, in agreement with the supervisory authority;
e. to make available to the data subject upon request a copy of the Clauses and indicate the office which handles complaints.
Clause 6
Clause 7
1. The parties agree that if there is a dispute between a data subject and either party which is not amicably resolved and the data subject invokes the third-party beneficiary provision in clause 3, they accept the decision of the data subject:
(a) to refer the dispute to mediation by an independent person or, where applicable, by the supervisory authority;
(b) to refer the dispute to the courts in the Member State in which the data exporter is established.
2. The parties agree that by agreement between a data subject and the relevant party a dispute can be referred to an arbitration body, if that party is established in a country which has ratified the New York convention on enforcement of arbitration awards.
3. The parties agree that paragraphs 1 and 2 apply without prejudice to the data subject's substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
Clause 8
The parties agree to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under national law.
Clause 9
The parties agree that the termination of the Clauses at any time, in any circumstances and for whatever reason does not exempt them from the obligations and/or conditions under the Clauses as regards the processing of the data transferred.
Clause 10
Clause 1 1
The parties undertake not to vary or modify the terms of the clauses.
Appendix 1
Intentionally Omitted.
Appendix 2
to the standard contractual clauses
Mandatory data protection principles referred to in the first paragraph of Clause 5(b)
These data protection principles should be read and interpreted in the light of the provisions (principles and relevant exceptions) of Directive 95/46/EC.
They shall apply subject to the mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others.
1. Purpose limitation: data must be processed and subsequently used or further communicated only for the specific purposes in Appendix I to the Clauses. Data must not be kept longer than necessary for the purposes for which they are transferred.
2. Dara quality and proportionality: data must be accurate and, where necessary, kept up to date. The data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.
3. Transparency: data subjects must be provided with information as to the purposes of the processing and the identity of the data controller in the third country, and other information insofar as this is necessary to ensure fair processing, unless such information has already been given by the data exporter.
4. Security and confidentiality: technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as unauthorised access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the controller.
5. Rights of access, rectification, erasure and blocking of data: as provided for in Article 12 of Directive 95/46/EC, the data subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this Appendix, in particular because the data are incomplete or inaccurate. He should also be able to object to the processing of the data relating to him on compelling legitimate grounds relating to his particular situation.
6. Restrictions on onwards transfers: further transfers of personal data from the data importer to another controller established in a third country not providing adequate protection or not covered by a decision adopted by the Commission pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take place only if either:
(a) data subjects have, in the case of special categories of data, given their unambiguous consent to the onward transfer or, in other cases, have been given the opportunity to object.
The minimum information to be provided to data subjects must contain in a language understandable to them:
▪︎ the purposes of the onward transfer,
▪︎ the identification of the data exporter established in the Community,
▪︎ the categories of further recipients of the data and the countries of destination, and
▪︎ an explanation that, after the onward transfer, the data may be processed by a controller established in a country where there is not an adequate level of protection of the privacy of individuals; or
(b) the data exporter and the data importer agree to the adherence to the Clauses of another controller which thereby becomes a party to the Clauses and assumes the same obligations as the data importer.
7. Special categories of data: where data revealing racial or ethnic origin, political opinions, religious or philosophical belief or trade union memberships and data concerning health or sex life and data relating to offences, criminal convictions or security measures are processed, additional safeguards should be in place within the meaning of Directive 95/46/EC, in particular, appropriate security measures such as strong encryption for transmission or such as keeping a record of access to sensitive data.
8. Direct marketing: where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to 'opt-out' from having his data used for such purposes.
9. Automated individual decisions: data subjects are entitled not to be subject to a decision which is based soley on automated processing of data, unless other measures are taken to safeguard the individual's legitimate interests as provided for in Article 15(2) of Directive 95/46/EC. Where the purpose of the transfer is the taking of an automated decision as referred to in Article 15 of Directive 95/46/EC, which produces legal effects concerning the individual or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc., the individual should have the right to know the reasoning for this decision.
Appendix 3
to the standard contractual clauses
Mandatory data protection principles referred to in the second paragraph of Clause 5(b)
1. Purpose limitation: data must be processed and subsequently used or further communicated only for the specific purposes in Appendix I to the Clauses. Data must not be kept longer than necessary for the purposes for which they are transferred.
2. Rights of access, rectification, erasure and blocking of data: as provided for in Article 12 of Directive 95/46/EC, the data subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this Appendix, in particular because the data is incomplete or inaccurate. He should also be able to object to the processing of the data relating to him on compelling legitimate grounds relating to his particular situation.
3. Restrictions on onward transfers: further transfers of personal data from the data importer to another controller established in a third country not providing adequate protection or not covered by a decision adopted by the Commission pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take place only if either:
(a) data subjects have, in the case of special categories of data, given their unambiguous consent to the onward transfer, or, in other cases, have been given the opportunity to object.
The minimum information to be provided to data subjects must contain in a language understandable to them:
▪︎ the purposes of the onward transfer,
▪︎ the identification of the data exporter established in the Community,
▪︎ the categories of further recipients of the data and the countries of destination, and
▪︎ an explanation that, after the onward transfer, the data may be processed by a controller established in a country where there is not an adequate level of protection of the privacy of individuals; or
(b) the data exporter and the data importer agree to the adherence to the Clauses of another controller which thereby becomes a party to the Clauses and assumes the same obligations as the data importer.