Terms and Conditions

Version 1.1: Effective from 29 March 2024

For the following account types: 

• Single user 
• Project 
• Organisation 

Please read carefully before using online surveys

These terms and conditions (Terms and Conditions) form a legal agreement between the Licensee or End User, as applicable (you and your), and Jisc of 4 Portwall Lane, Bristol, BS1 6NB (Jisc, us, we and our) as the provider of online surveys. 

You are the Licensee under these Terms and Conditions if you are ordering or renewing a Licence to use online surveys. Where a Licence is ordered or renewed on behalf of an organisation, the organisation is the Licensee. 

You are an End User under these Terms and Conditions if you have been granted a User Account either by the Licensee or by an Admin User on behalf of the Licensee. 

By signing into online surveys you agree to these Terms and Conditions. These Terms and Conditions include, in particular, limitations on liability in Condition 5. 

If you do not agree to these Terms and Conditions, we will not permit you to use online surveys. 

 

Important notice to Consumers 

If you have purchased a Licence to use online surveys and you are an individual not acting for the purposes of your business or profession you have the right to withdraw from your transaction without charge and without any reason within fourteen (14) days after the commencement of your subscription to online surveys. 

This does not affect your consumer rights for any defective performance of online surveys 

 

 

Definitions used in these Terms and Conditions 

Admin User	An End User with the ability to manage other End Users and Licence renewal payments. In a Single User Account, the sole End User is an Admin User.
Billing Contact	An End User who will act as the contact point for Licence renewal payments.
Consumer	A private individual purchasing a Licence to use online surveys but who is not acting for the purposes of their business or profession.
Data Protection Legislation	Means (a) any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction which relates to the protection of individuals with regards to the Processing of Personal Data to which a Party is subject for the purposes of this Agreement, including the Data Protection Act 2018 and the General Data Protection Regulation 2016/679 (EU GDPR) as each is amended in accordance with the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (as amended by SI 2020 no. 1586) and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, as amended to be referred to as DPA 2018 and the UK GDPR respectively; and (b) any code of practice or guidance published by the ICO or European Data Protection Board from time to time;
Downgrade	The act of Jisc changing your online surveys Account type, upon request from the Primary Contact, from an Organisation Account to a Project Account or a Single User Account, or from a Project Account to a Single User Account.
End User	Any individual who has a User Account.
Fee	The annual payment made by you to Jisc in exchange for a Licence to use online surveys;
Freedom of Information Laws	means the Freedom of Information Act 2000 (and any Scottish equivalent), the Environmental Information Regulations 2004 (and any Scottish equivalent) and any subordinate legislation made under such legislation from time to time together with any guidance and/or codes of practice issued by the UK Information Commissioner or relevant Government Department in relation to such legislation;
Jisc	Jisc, the provider of online surveys with company number 05747339. Also referred to in these Terms and Conditions as us, we and our;
Licence	Your right to use online surveys for the term of one year, provided in exchange for a Fee. There are three Licence types: Single User Licence, Project Licence, and Organisation Licence;
Licensee	The individual ordering or renewing a Licence to use online surveys. Where a Licence is ordered or renewed on behalf of an organisation, the organisation is the Licensee.
online surveys	The software hosted at https://app.onlinesurveys.jisc.ac.uk, the primary function of which is the design, distribution and analysis of online surveys.
online surveys Account	The Licensee’s account (Organisation, Project or Single User) in its entirety, as opposed to User Accounts.
online surveys Website	Refers to the blog, features and support pages at https://www.onlinesurveys.jisc.ac.uk
Organisation Account/Licence	An online surveys Account/Licence that permits an unlimited number of End Users. Details of all the features of an Organisation Account are available at https://onlinesurveys.jisc.ac.uk/features/
Primary Contact	An End User who is an Admin User, but also has ultimate responsibility for the online surveys Account and acts as its Controller. The sole End User in a Single User Account is the Primary Contact.
Project Account/Licence	An online surveys Account/Licence that permits no more than ten End Users. Details of all the features of a Project Account are available at https://onlinesurveys.jisc.ac.uk/features/
Service Levels	Means the service levels set out at Schedule 1.
Single User Account/Licence	An online surveys Account/Licence that permits only one End User. Details of all the features of Single User Account are available at https://onlinesurveys.jisc.ac.uk/features/
Specification	The description of online surveys and its functionality as set out on the online surveys Website at https://onlinesurveys.jisc.ac.uk/features/
Upgrade	The act of Jisc changing your online surveys Account type, upon request of the Primary contact, from a Single User Account to a Project Account or an Organisation Account, or from a Project Account to an Organisation Account.
Use/Usage	“Use” of online surveys is defined expressly as an End User logging into an active online surveys Account for any purpose.
User Account	An account granted by the Licensee, or an Admin User on behalf of the Licensee, to an End User.

 

1. Grant and scope of use by you of online surveys

1.1 In consideration of payment by you of the agreed Fee and you agreeing to abide by these Terms and Conditions, we hereby grant to you a non-exclusive, non-transferrable right to use online surveys under these Terms and Conditions for a term of one year, renewable in increments of one year in accordance with these Terms and Conditions. 

1.2 You may use online surveys: 

1. for your internal business purposes; 

2. for your own personal purposes (as a Consumer); 

3. if you have been granted a User Account by the Licensee as one of the number of permitted End Users agreed between the Licensee and Jisc. 

 

3. Intellectual property rights 

3.1 You acknowledge that all intellectual property rights in online surveys belong to Jisc, that rights to use online surveys are licenced (not sold) to you, and that you have no rights in, or to, online surveys or any information therein other than the right to use them in accordance with these Terms and Conditions. 

3.2 Any intellectual property rights in material generated by you in using online surveys shall be your property. 

3.3 By agreeing to use online surveys under these Terms and Conditions you agree to provide Jisc with a non-exclusive, royalty-free licence to use, reproduce, distribute and modify your content solely for the purposes of providing the online surveys service to you. 

3.4 You must not use online surveys in a manner which infringes any copyright, patent, trade mark, design or other intellectual property right. You must ensure you have the right to use any files/images that you upload or embed into a survey. Any queries from third parties (or arising from our own audits) regarding copyright, or other intellectual property right, infringement will be passed on to the Licensee. We reserve the right to temporarily disable a survey and/or User Account while any claim of infringement is investigated. If it is subsequently discovered that the survey included content without permission we reserve the right to close your account. 

3.5 We may access your survey data and survey metadata for the purposes of operating and enhancing online surveys, for example, to test backward compatibility of new online surveys features. 

 

4. Limited warranty 

4.1 During the term of your Licence, we warrant that online surveys, when properly used, will perform substantially in accordance with the Service Levels and functions set out in the Specification. 

4.2 If, within the term of your Licence to use online surveys, you notify Jisc in writing of any defect or fault in online surveys that results in its failure to perform substantially in accordance with the Service Levels and the Specification, we will remedy the fault, provided that you make available all the information that may be necessary to help us remedy the defect or fault, including sufficient information to enable us to recreate the defect or fault. 

4.3 The warranty does not apply: 

1. to any failure by you to adequately use online surveys in designing, distributing or carrying out analysis of surveys; or 

2. if the defect or fault results from you having used online surveys in contravention of these Terms and Conditions. 

4.4 If you are a Consumer, this warranty is in addition to your legal rights in relation to services that are faulty or not as described. Advice about your legal rights is available from your local Citizens Advice Bureau or Trading Standards Office. 

4.6 Jisc offers no support or warranty for surveys edited outside of online surveys including those created in third party tools or changes made to surveys downloaded from online surveys itself. 

 

5. Limitations of liability 

5.1 You acknowledge that online surveys has not been developed to meet your individual requirements, and that it is therefore your responsibility to ensure that the facilities and functions of online surveys, as described in the Specification, meet your requirements. 

5.2 We shall not, under any circumstances whatever, be liable to you, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with these Terms and Conditions, for: 

1. loss of profits, sales, business or revenue; 

2. business interruption; 

3. loss of anticipated savings; 

4. loss or corruption of data or information; 

5. loss of business opportunity, goodwill or reputation; or 

6. any indirect or consequential loss or damage. 

5.3 Other than the losses set out in Condition 5.2 (for which we are not liable), our maximum aggregate liability under or in connection with these Terms and Conditions, whether in contract, tort (including negligence) or otherwise shall, in all circumstances, be limited to a sum equal to the annual Fee for your Licence to use online surveys. This maximum cap does not apply to Condition 5.7. 

5.4 These Terms and Conditions set out the full extent of our obligations and liabilities in respect of the supply of online surveys. Except as expressly stated in these Terms and Conditions, there are no conditions, warranties, representations or other terms, express or implied, that are binding on Jisc. Any condition, warranty, representation or other term concerning the supply of online surveys which might otherwise be implied into, or incorporated in, these Terms and Conditions whether by statute, common law or otherwise, is excluded to the fullest extent permitted by law. 

5.5 If you are Consumer, we only supply the use of online surveys for domestic and private use. You agree not to use online surveys for any commercial, business or re-sale purposes, and we have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity. 

5.6 We are only responsible for loss or damage you suffer that is a foreseeable result of our breach of these Terms and Conditions or our negligence up to the amount specified in Condition 5.3, but we are not responsible for any loss or damage that is not foreseeable. Loss or damage is foreseeable if it was an obvious consequence of our breach or if it was contemplated by you and Jisc at the time we granted you the use of online surveys under these Terms and Conditions. 

5.7 Nothing in these Terms and Conditions shall limit or exclude our liability for: 

1. death or personal injury resulting from our negligence; 

2. fraud or fraudulent misrepresentation; or 

3. any other liability that cannot be excluded or limited by English law. 

6. Termination 

6.1 We may terminate your Licence to use online surveys immediately by written notice to you if you commit a material or persistent breach of these Terms and Conditions which you fail to remedy (if remediable) within 14 days after the service of written notice requiring you to do so. 

6.2 In the event of non-renewal of your Licence your online surveys Account will be suspended and all User Accounts and survey data will be deleted 35 days after the date of suspension. Your data will be held in backups for a maximum of three months after your data is deleted. 

6.3 Upon termination for any reason: 

1. all rights granted to you for your use of online surveys under these Terms and Conditions shall cease; and 

2. you must immediately cease all activities authorised by these Terms and Conditions. 

7. Communications between us 

7.1 The Primary Contact for the online surveys Account will act as the main point of contact between you and Jisc. Should other defined points of contact fail (e.g. Billing Contact or Admin User), the Primary Contact will be ultimately responsible. 

7.2 If you wish to contact us in writing, or if any condition in these Terms and Conditions requires you to give us notice in writing, you can send this by email or pre-paid post to: 

1. For notices regarding the functioning of, or renewal of, your Licence to use online surveys: 
   help@jisc.ac.uk. We will confirm receipt of this by contacting you in writing, usually by e-mail. 

2. For legal notices: legal@jisc.ac.uk 

7.3 If we have to contact you or give you notice in writing, we will do so by e-mail or by pre-paid post to the address you have provided. 

7.4 If you are a business, please note that any notice given by you to us, or by us to you, will be deemed received and properly served immediately when posted on our website, 24 hours after an e-mail is sent, or three days after the date of posting of any letter. In proving the service of any notice, it will be sufficient to prove, in the case of a letter, that such letter was properly addressed, stamped and placed in the post and, in the case of an e-mail that such e-mail was sent to the specified e-mail address of the addressee. 

 

8. Events outside our control 

8.1 We will not be liable or responsible for any failure to perform, or delay in performance of, any of our obligations under these Terms and Conditions that is caused by an Event Outside Our Control. An Event Outside Our Control is defined below in Condition 8.2. 

8.2 An Event Outside Our Control means any act or event beyond our reasonable control including, without limitation, failure of public or private telecommunications networks. 

8.3 If an Event Outside Our Control takes place that affects the performance of our obligations under these Terms and Conditions: 

1. our obligations under these Terms and Conditions will be suspended and the time for performance of our obligations will be extended for the duration of the Event Outside Our Control; 

2. we will use reasonable endeavours to find a solution by which our obligations under these Terms and Conditions may be performed despite the Event Outside Our Control. 

9. Data protection requirements 

9.1 The Licensee and Jisc shall observe their obligations under the Data Protection Legislation.

9.2 The parties shall comply with the provisions of Schedule 2, Data Protection. 

9.3 In the event of any conflict between Schedule 2 and any other provision of these service terms, the relevant provision of Schedule 2 shall take precedence. 

 

10. Freedom of Information Obligations 

10.1 Jisc is not subject to the requirements of the Freedom of Information Laws and is not obliged to respond to requests for information under the Freedom of Information Laws (“Request for Information“). Without prejudice to the foregoing, and subject to the Licensee’s compliance with Condition 10.2, Jisc will endeavour to inform the Licensee within two (2) Business Days and endeavour to respond to any Request for Information in the spirit of the Freedom of Information Laws where reasonably able to do so. Jisc and the Licensee will assist and cooperate with each other if a Request for Information is received by Jisc. 

10.2 Jisc acknowledges that the Licensee may be obliged to respond to any Request for Information where it is subject to the requirements of the Freedom of Information Laws. If this is the case the Licensee shall be responsible for determining in its absolute discretion and, notwithstanding any other provision in these Terms and Conditions or any other agreement, whether any information is exempt from disclosure in accordance with the provisions of the Freedom of Information Laws. Without prejudice to the foregoing, if the Licensee receives a Request for Information and such request includes commercially sensitive information or confidential information of Jisc under the Freedom of Information laws, the Licensee shall, as soon as reasonably practicable, notify Jisc of such request and shall consult with Jisc and consider any representations which Jisc may make in relation to the requested disclosure prior to deciding whether to comply with or to refuse the request (in whole or in part). 

 

11. Other important terms 

11.1 We may transfer our rights and obligations under these Terms and Conditions to another organisation, but this will not affect your rights or obligations under these Terms and Conditions. 

11.2 You may only transfer your obligations under these Terms and Conditions to another person if we agree in writing. 

11.3 These Terms and Conditions constitute the entire agreement between you and us. You acknowledge that you have not relied on any statement, promise or representation made or given by, or on behalf of, us which is not set out in these Terms and Conditions or any document expressly referred to in it. 

11.4 If we fail to insist you perform any of your obligations under these Terms and Conditions, or if we do not enforce our rights against you, or if we delay in doing so, that will not mean that we have waived our rights against you and will not mean that you do not have to comply with those obligations. If we do waive a default by you, we will only do so in writing, and that will not mean that we will automatically waive any later default by you. 

11.5 We may be required to review content to determine if it is appropriate or if it is violating any terms of service such as our receipt of a report of unlawful content, however we have no obligation to monitor or review content. 

11.6 Any price changes will become effective upon Licence renewal or immediately upon our agreement to provide additional services. 

11.7 If you wish to downgrade your online surveys Account this can only be done at renewal time. No refunds will be available during the term of your Licence. 

11.8 If you wish to upgrade your online surveys Account during your existing Licence term, we will calculate the cost of the upgrade on a daily rate for the remainder of that term. The additional functionality will be added on payment of the additional fee as notified to you. 

11.9 Each of the conditions of these Terms and Conditions operates separately. If any court or competent authority decides that any of them are unlawful or unenforceable, the remaining conditions will remain in full force and effect. 

11.10 We may change these Terms and Conditions at any time for a variety of reasons, such as to reflect changes in applicable law or updates to the Service, and to account for new functionality, for security or to prevent abuse or harm. The most current version will always be posted on the online surveys Website. If an amendment is material, we may update these Terms and Conditions. If the updates are significant, we will notify you in writing that changes are coming and when those changes will become effective. If you continue to use the Service after we give you that notification, then you are agreeing to the updated Terms and Conditions. Jisc will notify you in advance by email to provide you the opportunity to review the changes. Notice of amendments may also be posted upon your login to your account. Except as otherwise specified by us, changes will be effective no sooner than the day they are publicly posted on the online surveys Website. Once our new terms are effective, if you continue to use the Service, you indicate your agreement to be bound by the updated Terms and Conditions. If, acting reasonably) you may terminate the Agreement by giving Jisc written notice prior to the date when the changes would become effective. In such case you will be entitled to a pro-rata rebate of fees already paid for the Service that would have been supplied subsequent to the date of termination.

11.11 Please note that these Terms and Conditions, their subject matter and their formation are governed by English law. You and we both agree that the courts of England and Wales will have exclusive jurisdiction. 

Schedule 1 – Online Surveys Service Levels 

1. Introduction 

1.1 This Service Level Agreement sets out the levels of availability and support the Licensee can expect from Jisc. 

 

2. Helpdesk 

2.1 Support materials are available for all users at https://onlinesurveys.jisc.ac.uk/category/helpandsupport/ 

 

3. Support hours 

3.1 Support hours are 09:00 – 17:00, Monday to Friday, excluding Bank Holidays and Jisc closure days.  

 

4. Enhancements 

4.1 The Licensee acknowledges that, from time to time during the term of their Licence, Jisc may apply enhancements to online surveys, and that such enhancements may, subject to paragraph 4.2, result in changes to the appearance and/or functionality of online surveys. 

4.2 No enhancement shall disable, delete or (significantly) impair the main functionality of online surveys as set out in the Specification. 

4.3 Details of planned enhancements will be published on the online surveys Website.. 

 

5. Scheduled maintenance 

5.1 Any scheduled maintenance will be publicised on the online surveys Website prior to being carried out. Jisc will do everything possible to minimise and avoid downtime during such maintenance. 

 

6. Backup and restoration 

6.1 Online surveys is hosted on a fully backed up infrastructure. In the event of machine failure we will make all reasonable efforts to restore service as quickly as possible. 

 

7. Bulk email and Survey responses

7.1 If your online surveys Account permits the bulk sending of emails to potential survey respondents then rates of email sending and size and number of emails will be restricted. Details of the restrictions can be found on the on the online surveys Website at and may be changed without warning.

7.2 Unless otherwise agreed with Jisc in writing, there is a cap on the number of responses for any single survey of 20,000 – see the relevant help and support pages. 

 

Schedule 2 – Data Protection 

 

1. Definitions 

1.1. The following definitions apply to this Data Protection Schedule 

Agreement	means the agreement between Jisc and the Licensee for the provision of the Service;
Applicable Law	means all applicable laws, statutes, regulations, decree directives, legislative enactments, orders, binding decisions of a competent Court or Tribunal, rule, regulatory policies, guidelines, codes, other binding restriction, regulatory permits and licences applicable under law which are in force from time to time during the term of this Agreement to which a party and/or any Processing of Personal Data is subject from time to time;
Controller, Processor and Data Subject	have the meanings given to those terms in the UK GDPR;
Data Protection Legislation	means (a) any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction which relates to the protection of individuals privacy or with regards to the Processing of Personal Data to which a Party is subject for the purposes of this Agreement, including the Data Protection Act 2018 and the General Data Protection Regulation 2016/679 (EU GDPR) as each is amended in accordance with the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (as amended by SI 2020 no. 1586) and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, as amended to be referred to as DPA 2018 and the UK GDPR respectively; and (b) any code of practice or guidance published by the ICO or European Data Protection Board from time to time;
Data Protection Particulars	means, in relation to any Processing under this Agreement:  (a) the subject matter and duration of the Processing;  (b) the nature and purpose of the Processing;  (c) the type of Personal Data being Processed; and (d) the categories of Data Subjects.
Data Subject Request	means an actual or purported subject access request or notice or complaint from (or on behalf of) a Data Subject exercising their rights under the Data Protection Legislation;
Data Transfer	means transferring the Personal Data to, and/or accessing the Personal Data from and/or Processing the Personal Data within, a jurisdiction or territory that is not a Permitted Country;
ICO	means the UK Information Commissioner (including any successor or replacement);
Permitted Country	means any country, territory or jurisdiction that is outside of the UK which is the subject of an adequacy determination by the UK Secretary of State or which is contained in Schedule 21, Part 3, Paragraph 5 of the Data Protection Act 2018;
Permitted Purpose	means the purpose of the Processing as specified in the Data Processing Particulars;
Personal Data	has the meaning given to it in the UK GDPR and for the purposes of this Agreement includes Sensitive Personal Data;
Personal Data Breach	has the meaning given to it in the UK GDPR and, for the avoidance of doubt, includes a breach of Clause 4.1.3;
Personnel	means all persons engaged or employed from time to time by Jisc in connection with this Agreement, including employees, consultants, contractors and permitted agents;
Processing	has the meaning given to it in the GDPR (and “Process” and “Processed” shall be construed accordingly);
Processor	has the meaning given to it in the UK GDPR;
Regulator	means the ICO and any other independent public authority which has jurisdiction over a Party, including any regulator or supervisory authority which is responsible for the monitoring and application of the Data Protection Legislation;
Regulator Correspondence	means any correspondence or communication (whether written or verbal) from the Regulator in relation to the Processing of the Personal Data under or in relation to this Agreement;
Security Requirements	means the requirements regarding the security of the Personal Data, as set out in the Data Protection Legislation (including, in particular, the measures set out in Article 32(1) of the UK GDPR (taking due account of the matters described in Article 32(2) of the UK GDPR)) as applicable;
Sensitive Personal Data	means Personal Data that incorporates such categories of data as are listed in Article 9(1) of the UK GDPR and Personal Data relating to criminal convictions and offences;
Service	means the online surveys service provided by Jisc;
Schedule	means this schedule which forms part of the Agreement.
Third Party Request	means a written request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by law or regulation;

 

 

2. Arrangement between the parties 

2.1. The Parties shall each Process the Personal Data in accordance with the terms of this Schedule. The Parties acknowledge that the factual arrangement between them dictates the classification of each Party in respect of the Data Protection Legislation.  Notwithstanding the foregoing, the Parties anticipate and agree that the Licensee shall act as Controller and Jisc shall act as Processor, as follows: 

2.1.1 The Licensee shall be a Controller where it is Processing the Personal Data in relation to the Services being supplied by Jisc; and 

2.1.2 Jisc shall be a Processor where it is Processing the Personal Data in relation to the Permitted Purpose in connection with the performance of its obligations under these Service terms. 

2.2. Each of the Parties acknowledges and agrees that the following table sets out an accurate description of the Data Protection Particulars: 

The subject matter and duration of the Processing	Online Surveys provides tools and functionality to create, deliver, and analyse surveys. The End User, managed by the Licensee, has the capacity to run surveys which may capture a range of information about a Data Subject (which may include Personal Data)The duration of the Processing will be for the term of the Service agreement between the Licensee and Jisc.
The nature and purpose of the Processing	The Personal Data will be Processed in order to provide the Service ordered by the Licensee.
The type of Personal Data being Processed	End Users have the capacity to collect any type of Personal Data, this may include (but is not limited to) users first name, last name, email address, phone number, date of birth and university ID.
The categories of Data Subjects	End Users of an Online Surveys account. Individuals that have responded to a survey created by End Users

 

 

3. Controller Obligations 

3.1. As the Controller in respect of the Processing of the Personal Data, the Licensee shall ensure that: 

3.1.1 it is not subject to any prohibition or restriction which would prevent or restrict it from disclosing or transferring the Personal Data to Jisc in accordance with the terms of this Schedule; and 

3.1.2 all fair processing notices have been given (and/ or, as applicable, consents obtained) and are sufficient in scope to allow the Licensee to disclose the Personal Data (including any Sensitive Personal Data) to Jisc for the delivery of the Service in accordance with the Data Protection Legislation. 

 

4. Processor Obligations 

4.1. Jisc (as a Processor in relation to any Personal Data Processed by (or on behalf of) the Licensee pursuant to the Agreement) undertakes to the Licensee that it shall: 

4.1.1 Process the Personal Data for and on behalf of the Licensee in connection with the performance of the Service only and for no other purpose in accordance with the terms of this Agreement and any instructions from the Licensee; 

4.1.2 unless prohibited by law, promptly notify the Licensee (and in any event within forty-eight (48) hours of becoming aware of the same) if it considers, in its opinion (acting reasonably) that it is required by Applicable Law to act other than in accordance with the instructions of the Licensee, including where it believes that any of the Licensee’s instructions under Clause 4.1.1 infringes any of the Data Protection Legislation; 

4.1.3 implement and maintain appropriate technical and organisational security measures to comply with at least the obligations imposed on a Controller by the Security Requirements. If requested by the Licensee, Jisc will provide a description of the technical and organisational security measures that Jisc will implement and maintain; 

4.1.4 take all reasonable steps to ensure the reliability and integrity of any of the Personnel who shall have access to the Personal Data, and ensure that each member of Personnel shall have entered into appropriate contractually-binding confidentiality undertakings; 

4.1.5 notify the Customer promptly, and in any event within forty-eight (48) hours, upon becoming aware of any actual or suspected, threatened or ‘near miss’ Personal Data Breach, and: 

1. implement any measures necessary to restore the security of compromised Personal Data; 

2. assist the Licensee to make any notifications to the Regulator and affected Data Subjects; 

4.1.6 notify the Customer promptly (and in any event within ninety-six (96) hours) following its receipt of any Data Subject Request or Regulator Correspondence and shall: 

1. not disclose any Personal Data in response to any Data Subject Request or Regulator Correspondence without the Licensee’s prior written consent; and 

2. provide the Licensee with all reasonable co-operation and assistance required by the Licensee in relation to any such Data Subject Request or Regulator Correspondence; 

4.1.7 not disclose Personal Data to a third party in any circumstances without the Licensee’s prior written consent, other than: 

1. in relation to Third Party Requests where Jisc is required by law to make such a disclosure, in which case it shall use reasonable endeavours to advise the Licensee in advance of such disclosure and in any event as soon as practicable thereafter, unless prohibited by law or regulation from notifying the Licensee; 

2. to Jisc’s employees, officers and advisers who need to know such information for the purposes of Jisc performing its obligations under this Agreement and in this respect Jisc shall ensure that its employees, officers and advisers to whom it discloses the Personal Data are made aware of their obligations with regard to the use and security of Personal Data under this Agreement; and 

3. to a sub-contractor appointed in accordance with Clause 5. 

4.1.8 not make (nor instruct or permit a third party to make) a Data Transfer without putting in place measures to ensure the Licensee’s compliance with Data Protection Legislation; 

4.1.9 on the written request of the Customer, and with reasonable notice, allow representatives of the Customer to audit Jisc in order to ascertain compliance with the terms of this Clause 4 and/ or to provide the Customer with reasonable information to demonstrate compliance with the requirements of this Clause 4, provided that: 

1. the Licensee shall only be permitted to exercise its rights under this Clause 4.1.9 no more frequently than once per year (other than where an audit is being undertaken by a Licensee in connection with an actual or ‘near miss’ Personal Data Breach, in which case, an additional audit may be undertaken each year by the Licensee within thirty (30) days of the Licensee having been notified of actual or ‘near miss’ Personal Data Breach); 
2. each such audit shall be performed at the sole expense of the Licensee; 
3. the Licensee shall not, in its performance of each such audit, unreasonably disrupt the business operations of Jisc; 
4. the Licensee shall comply with Jisc’s health and safety, security, conduct and other rules, procedures and requirements in relation to Jisc’s property and systems which have been notified by Jisc to the Licensee in advance; and 
5. in no case shall the Licensee be permitted to access any data, information or records relating to any other customer of Jisc.