Data Sharing Terms

If you are provided with access to any personal data (or if you provide FSA with access to personal data) in connection with your access to the Site or your use of any Content, you agree to be bound by these additional terms and conditions (“Data Sharing Terms”), which are incorporated into the Terms of Use. Capitalised terms that are used but not defined in these Data Sharing Terms have the meanings given to them in the Terms of Use. It is important to carefully read and understand these Data Sharing Terms.

1. You may have entered into or may subsequently enter into separate written agreements with FSA under which FSA has agreed or will agree to grant you access to Personal Data (“Data Sharing Agreement”). In the event, and to the extent only, of any conflict between these Terms of Use, the Privacy Statement and any Data Sharing Agreement, the terms of the Terms of Use will prevail, subject to applicable privacy laws.

2. The Terms of Use, these Data Sharing Terms and those terms set out in any Data Sharing Agreement apply to the exclusion of any other terms that you seek to impose or incorporate, whether by purchase order, by correspondence passing between the parties or otherwise, or which are implied by trade, custom, practice or course of dealing.

3. In these Data Sharing Terms the following words and phrases shall have the following meanings, unless inconsistent with the context or as otherwise specified:

“Data Protection Legislation” means all laws, rules, regulations, directives and governmental requirements relating in any way to the privacy, confidentiality, security, integrity and protection of Personal Data in force from time to time in those parts of the world in which the parties operate and/or Process Personal Data (either directly or through a third party);

“Data Controller”, “Personal Data” and “Process/Processing” shall be interpreted in accordance with applicable Data Protection Legislation;

“Individual Data” means any and all Personal Data relating to the data subjects as provided by FSA, whether on or through the Site or otherwise, including non-Personal Data that may, in combination with any other data made available on the Site, amount to Personal Data;

“parties” means you and FSA and “party” means either you or FSA, as the context so requires;

“SCC” means the European Commission’s Standard Contractual Clauses for the transfer of Personal Data from the European Union to processors established in third countries (Data Controller-to-Processor transfers), as set out in the Annex to Commission Decision 2010/87/EU.

4. FSA shall retain ownership of Individual Data shared with you regardless of the right to access and use granted to you and you shall not use Individual Data without FSA’s express written permission or in a manner inconsistent with any such permission granted to you. Further, when using Personal Data and/or FSA’s Data, you shall clearly attribute the source of such Personal Data and/or FSA’s Data if requested by FSA in a manner approved by FSA.

5. You acknowledge and agree that the consent obtained from data subjects providing Individual Data (as applicable), the Terms of Use, and any applicable Data Sharing Agreement shall govern your use of Individual Data provided to you through or in relation to the Site (“Permitted Use”).

6. You shall undertake to procure all necessary consents from the relevant data subjects and FSA for use of Individual Data by you for purposes beyond the current Permitted Use. If you wish to confirm whether a proposed use is a Permitted Use or wish to obtain additional consents, you may contact us and inquire accordingly.

7. You acknowledge that the Individual Data has been collected in a lawful manner in accordance with applicable Data Protection Legislation, FSA’s Privacy Statement and any personal information collection notice provided to data subjects, a copy of which shall be provided to you upon request.

8. For the purposes of these Data Sharing Terms, you and FSA act as independent Data Controllers in relation to the Individual Data they Process in the course of the performance of their obligations under the Terms of Use and any Data Sharing Agreement (including without limitation, accessing, using or otherwise Processing Individual Data made available on the Site) and each shall comply with its respective obligations under applicable Data Protection Legislation in relation thereto and shall procure all necessary consents from the relevant data subjects for each Data Controller to use that Individual Data as contemplated in the Terms of Use and the Data Sharing Agreement.

9. Each party acknowledges, as independent Data Controllers, that they may respectively use third party Processors to process Personal Data in connection with the Permitted Use. In doing so, you shall comply with FSA’s Privacy Statement and will ensure that any third party Processors, authorised by you to process any Individual Data are subject to appropriate confidentiality obligations, will comply with their obligations as Processors under applicable Data Protection Legislation and will promptly notify you (who shall promptly notify FSA) in the event of a data breach.

10. Each party shall promptly provide the other party such reasonable cooperation, information and assistance as required from time to time to enable such other party to comply with its obligations under applicable Data Protection Legislation.

11. The parties shall not knowingly perform their obligations under these Data Sharing Terms in such a way as to cause the other party to breach any of its obligations under applicable Data Protection Legislation.

12. Each party shall at all times have in place appropriate technical and organisational security measures so that Individual Data is protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.

13. If any party is provided with anonymised Individual Data that party will not attempt to reverse-engineer recreate, combine with any other dataset, or otherwise reidentify any data subject from the anonymised Individual Data.

14. Where you are established in the United Kingdom or the European Union or are otherwise bound by the General Data Protection Regulation 2016/679 (GDPR), you will not (and will not permit your contracted Processors to) transfer or otherwise process Individual Data outside the European Economic Area (EEA) unless it complies with section 9 above, the GDPR and any other applicable Data Protection Legislation.

15. If any Individual Data transfer between FSA and you legally requires execution of the European Commission’s standard contractual clauses (SCC) in order for FSA or you to comply with applicable Data Protection Legislation, the parties will complete and execute the SCC and take all other actions required to legitimise the transfer.

16. Each party will be liable to the other party for damages it causes by any breach of these Data Sharing Terms. Liability as between the parties is limited to actual damages suffered. Indirect or consequential losses, loss of profits, loss of reputation and punitive damages are specifically excluded. Each party will be liable to data subjects for damages it causes by any breach of third-party rights under these Data Sharing Terms.

17. Without prejudice to any rights that have accrued under these Data Sharing Terms or any of its rights or remedies, either party may terminate these Data Sharing Terms with immediate effect by giving written notice to the other party if the other party commits a breach of these Data Sharing Terms.

18. These Data Sharing Terms shall otherwise continue in full force and effect until expiry or termination of any relevant Data Sharing Agreement or access to the Site or permission to use any Content pursuant to these Terms of Use is withdrawn or terminated, whichever is the latter. Termination of these Data Sharing Terms shall not affect the accrued rights, remedies, obligations or liabilities of the parties existing at termination. Any provision of these terms that expressly or by implication is intended to come into or continue in force on or after termination shall remain in full force and effect.

19. No waiver of any breach of any provision of these Data Sharing Terms or performance obligations hereunder shall be effective unless specifically made in writing.