Last updated on the 19 October 2022
For the following account types:
- Single user
Please read carefully before using online surveys
These terms and conditions (Terms and Conditions) form a legal agreement between the Licensee or End User, as applicable (you and your), and Jisc of 4 Portwall Lane, Bristol, BS1 6NB (Jisc, us, we and our) as the provider of online surveys.
You are the Licensee under these Terms and Conditions if you are ordering or renewing a Licence to use online surveys. Where a Licence is ordered or renewed on behalf of an organisation, the organisation is the Licensee.
You are an End User under these Terms and Conditions if you have been granted a User Account either by the Licensee or by an Admin User on behalf of the Licensee.
By signing into online surveys you agree to these Terms and Conditions. These Terms and Conditions include, in particular, limitations on liability in Condition 5.
If you do not agree to these Terms and Conditions, we will not permit you to use online surveys.
Important notice to Consumers
If you have purchased a Licence to use online surveys and you are an individual not acting for the purposes of your business or profession you have the right to withdraw from your transaction without charge and without any reason within fourteen (14) days after the commencement of your subscription to online surveys.
This does not affect your consumer rights for any defective performance of online surveys
Definitions used in these Terms and Conditions
|Admin User||An End User with the ability to manage other End Users and Licence renewal payments. In a Single User Account, the sole End User is an Admin User.|
|Billing Contact||An End User who will act as the contact point for Licence renewal payments.|
|online surveys||The software hosted at https://app.onlinesurveys.jisc.ac.uk, the primary function of which is the design, distribution and analysis of online surveys.|
|online surveys Account||The Licensee’s account (Organisation, Project or Single User) in its entirety, as opposed to User Accounts.|
|online surveys Website||Refers to the blog, features and support pages at https://www.onlinesurveys.jisc.ac.uk|
|Consumer||A private individual purchasing a Licence to use online surveys but who is not acting for the purposes of their business or profession.|
|Controller||Has the meaning set out in the Data Protection Legislation.|
|Data Protection Legislation||Means any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction which relates to the protection of individuals privacy or with regards to the Processing of Personal Data to which a Party is subject, including the Data Protection Act 2018 (or all legislation enacted in the UK in respect of the protection of Personal Data when the UK leaves the European Union) and the GDPR.|
|Data Subject||Has the meaning set out in the Data Protection Legislation.|
|Data Subject Request||Means an actual or purported subject access request or notice or complaint from (or on behalf of) a Data Subject exercising his rights under the Data Protection Legislation;|
|Downgrade||The act of Jisc changing your online surveys Account type, upon request from the Primary Contact, from an Organisation Account to a Project Account or a Single User Account, or from a Project Account to a Single User Account.|
|End User||Any individual who has a User Account.|
|Fee||The annual payment made by you to Jisc in exchange for a Licence to use online surveys.|
|Freedom of Information Laws||means the Freedom of Information Act 2000 (and any Scottish equivalent), the Environmental Information Regulations 2004 (and any Scottish equivalent) and any subordinate legislation made under such legislation from time to time together with any guidance and/or codes of practice issued by the UK Information Commissioner or relevant Government Department in relation to such legislation;|
|Jisc||Jisc, the provider of online surveys. Also referred to in these Terms and Conditions as us, we and our.|
|Licence||Your right to use online surveys for the term of one year, provided in exchange for a Fee. There are three Licence types: Single User Licence, Project Licence, and Organisation Licence.|
|Licensee||The individual ordering or renewing a Licence to use online surveys. Where a Licence is ordered or renewed on behalf of an organisation, the organisation is the Licensee.|
|Organisation Account/Licence||An online surveys Account/Licence that permits an unlimited number of End Users. Details of all the features of an Organisation Account are available at https://onlinesurveys.jisc.ac.uk/features/|
|Primary Contact||An End User who is an Admin User, but also has ultimate responsibility for the online surveys Account and acts as its Controller. The sole End User in a Single User Account is the Primary Contact.|
|Processor||Has the meaning set out in the Data Protection Legislation.|
|Project Account/Licence||An online surveys Account/Licence that permits no more than ten End Users. Details of all the features of a Project Account are available at https://onlinesurveys.jisc.ac.uk/features/|
|Single User Account/Licence||An online surveys Account/Licence that permits only one End User. Details of all the features of Single User Account are available at https://onlinesurveys.jisc.ac.uk/features/|
|Specification||The description of online surveys and its functionality as set out on the online surveys Website at https://onlinesurveys.jisc.ac.uk/features/|
|Upgrade||The act of Jisc changing your online surveys Account type, upon request of the Primary contact, from a Single User Account to a Project Account or an Organisation Account, or from a Project Account to an Organisation Account.|
|Use/Usage||“Use” of online surveys is defined expressly as an End User logging into an active online surveys Account for any purpose.|
|User Account||An account granted by the Licensee, or an Admin User on behalf of the Licensee, to an End User.|
1. Grant and scope of use by you of online surveys
1.1 In consideration of payment by you of the agreed Fee and you agreeing to abide by these Terms and Conditions, we hereby grant to you a non-exclusive, non-transferrable right to use online surveys under these Terms and Conditions for a term of one year, renewable in increments of one year in accordance with these Terms and Conditions.
1.2 You may use online surveys:
- for your internal business purposes;
- for your own personal purposes (as a Consumer);
- if you have been granted a User Account by the Licensee as one of the number of permitted End Users agreed between the Licensee and Jisc.
2. Responsibilities and restrictions
2.1 Except as expressly set out in these Terms and Conditions or as permitted by any local law, you undertake:
- not to divulge your User Account password to any other person or share a User Account with any other person. Each person who has access to an online surveys Account must use a unique username and password. Multiple users must not log in using a single set of shared credentials (such as a ‘group account’).
- to notify Jisc if you become aware of any unauthorised use of online surveys through your online surveys Account;
- not to disassemble, decompile, reverse-engineer or create derivative works based on the whole or any part of online surveys, nor attempt to do any such thing except to the extent that (by virtue of section 296A of the Copyright, Designs and Patents Act 1988) such actions cannot be prohibited because they are essential for the purpose of achieving inter-operability of online surveys with another software program, and provided that the information obtained by you during such activities:
- is used only for the purpose of achieving inter-operability of online surveys with another software program with our prior written consent; and
- is not unnecessarily disclosed or communicated to any third party without our prior written consent; and
- is not used to create any software which is substantially similar to online surveys without our prior written consent;
- to ensure you provide up-to-date contact details in online surveys;
- that you will not engage in any activity that interferes with or disrupts online surveys (or the servers and networks which are connected to online surveys);
- not to use online surveys in a manner that uses a disproportionate share of online surveys’ resources. Jisc will notify any user who has designed a survey in such a manner that it uses a disproportionate share of online surveys’ resources and affects the experience of other users. Jisc reserves the right to suspend any such survey should the user choose not to take steps that Jisc recommends to address the matter.
- not to use online surveys to transmit or distribute unsolicited bulk email, also known as SPAM. All email recipients must have opted in to, or otherwise validly consented to, receiving communications from you, the sender. In the event of a dispute, you must be able to prove that the recipient validly consented. online surveys Accounts may be terminated for sending unsolicited email messages;
- not to access and use online surveys via programmatic, scripted or any other automated means without our prior written consent;
- not to use online surveys in a manner that is likely to harm the reputation of online surveys or Jisc. This includes, but is not limited to:
- misleading survey respondents about the nature of a survey and the use of their data, including claiming a survey is anonymous when it is not;
- the gratuitous inclusion of violent, pornographic or any other offensive content in a survey;
- the use of online surveys to bully, threaten or harass any person or group of people; and/or
- the use of online surveys to promote any form of violence, abuse or criminal activity;
- the use of copyrighted material, without permission, in a survey.
Additionally, if you are the Primary Contact of a Project Account or an Organisation Account:
- to be responsible for the use of online surveys within your organisation including timely deletion of User Accounts and data;
- to manage online surveys Account Upgrades and Downgrades and other requests on behalf of your organisation (if applicable);
Additionally, if you are an Admin User (including the Primary Contact) of a Project Account or an Organisation Account:
- to be responsible for the creation of End Users, to supervise and control use of End User access to online surveys and ensure online surveys is used by your online surveys Account’s End Users in accordance with these Terms and Conditions;
- not to provide, or otherwise make available, access to online surveys, including through any form of resale of licencing in whole or in part, in any form to any person or organisation for their own separate business purposes without prior written consent from Jisc.
If you are a Consumer:
If you are a Consumer, we only supply the use of online surveys for domestic and private use. You agree not to use online surveys for any commercial, business or re-sale purposes.
2.2 In the event that you do not comply with the above Condition 2: Responsibilities and Restrictions in these Terms and Conditions we may terminate your online surveys Licence and you will forfeit any Fees you have paid for the use of online surveys.
3. Intellectual property rights
3.1 You acknowledge that all intellectual property rights in online surveys belong to Jisc, that rights to use online surveys are licenced (not sold) to you, and that you have no rights in, or to, online surveys or any information therein other than the right to use them in accordance with these Terms and Conditions.
3.2 Any intellectual property rights in material generated by you in using online surveys shall be your property.
3.3 By agreeing to use online surveys under these Terms and Conditions you agree to provide Jisc with a non-exclusive, royalty-free licence to use, reproduce, distribute and modify your content solely for the purposes of providing the online surveys service to you.
3.4 You must not use online surveys in a manner which infringes any copyright, patent, trade mark, design or other intellectual property right. You must ensure you have the right to use any files/images that you upload or embed into a survey. Any queries from third parties (or arising from our own audits) regarding copyright, or other intellectual property right, infringement will be passed on to the Licensee. We reserve the right to temporarily disable a survey and/or User Account while any claim of infringement is investigated. If it is subsequently discovered that the survey included content without permission we reserve the right to close your account.
3.5 We may access your survey data and survey metadata for the purposes of operating and enhancing online surveys, for example, to test backward compatibility of new online surveys features.
4. Limited warranty
4.1 We warrant that online surveys, when properly used, shall perform substantially in accordance with the functions set out in the Specification during the term of your Licence to use online surveys.
4.2 If, within the term of your Licence to use online surveys, you notify Jisc in writing of any defect or fault in online surveys that results in its failure to perform substantially in accordance with the Specification, we will remedy the fault, provided that you make available all the information that may be necessary to help us remedy the defect or fault, including sufficient information to enable us to recreate the defect or fault.
4.3 The warranty does not apply:
- to any failure by you to adequately use online surveys in designing, distributing or carrying out analysis of surveys; or
- if the defect or fault results from you having used online surveys in contravention of these Terms and Conditions.
4.4 If you are a Consumer, this warranty is in addition to your legal rights in relation to services that are faulty or not as described. Advice about your legal rights is available from your local Citizens Advice Bureau or Trading Standards Office.
4.5 The service levels provided by us are further detailed in Schedule 1 to these Terms and Conditions.
4.6 Jisc offers no support or warranty for surveys edited outside of online surveys including those created in third party tools or changes made to surveys downloaded from online surveys itself.
5. Limitations of liability
5.1 You acknowledge that online surveys has not been developed to meet your individual requirements, and that it is therefore your responsibility to ensure that the facilities and functions of online surveys, as described in the Specification, meet your requirements.
5.2 We shall not, under any circumstances whatever, be liable to you, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with these Terms and Conditions, for:
- loss of profits, sales, business or revenue;
- business interruption;
- loss of anticipated savings;
- loss or corruption of data or information;
- loss of business opportunity, goodwill or reputation; or
- any indirect or consequential loss or damage.
5.3 Other than the losses set out in Condition 5.2 (for which we are not liable), our maximum aggregate liability under or in connection with these Terms and Conditions, whether in contract, tort (including negligence) or otherwise shall, in all circumstances, be limited to a sum equal to the annual Fee for your Licence to use online surveys. This maximum cap does not apply to Condition 5.7.
5.4 These Terms and Conditions set out the full extent of our obligations and liabilities in respect of the supply of online surveys. Except as expressly stated in these Terms and Conditions, there are no conditions, warranties, representations or other terms, express or implied, that are binding on Jisc. Any condition, warranty, representation or other term concerning the supply of online surveys which might otherwise be implied into, or incorporated in, these Terms and Conditions whether by statute, common law or otherwise, is excluded to the fullest extent permitted by law.
5.5 If you are Consumer, we only supply the use of online surveys for domestic and private use. You agree not to use online surveys for any commercial, business or re-sale purposes, and we have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity.
5.6 We are only responsible for loss or damage you suffer that is a foreseeable result of our breach of these Terms and Conditions or our negligence up to the amount specified in Condition 5.3, but we are not responsible for any loss or damage that is not foreseeable. Loss or damage is foreseeable if it was an obvious consequence of our breach or if it was contemplated by you and Jisc at the time we granted you the use of online surveys under these Terms and Conditions.
5.7 Nothing in these Terms and Conditions shall limit or exclude our liability for:
- death or personal injury resulting from our negligence;
- fraud or fraudulent misrepresentation; or
- any other liability that cannot be excluded or limited by English law.
6.1 We may terminate your Licence to use online surveys immediately by written notice to you if you commit a material or persistent breach of these Terms and Conditions which you fail to remedy (if remediable) within 14 days after the service of written notice requiring you to do so.
6.2 In the event of non-renewal of your Licence your online surveys Account will be suspended and all User Accounts and survey data will be deleted 35 days after the date of suspension. Your data will be held in backups for a maximum of three months after your data is deleted.
6.3 Upon termination for any reason:
- all rights granted to you for your use of online surveys under these Terms and Conditions shall cease; and
- you must immediately cease all activities authorised by these Terms and Conditions.
7. Communications between us
7.1 The Primary Contact for the online surveys Account will act as the main point of contact between you and Jisc. Should other defined points of contact fail (e.g. Billing Contact or Admin User), the Primary Contact will be ultimately responsible.
7.2 If you wish to contact us in writing, or if any condition in these Terms and Conditions requires you to give us notice in writing, you can send this by email or pre-paid post to:
- For notices regarding the functioning of, or renewal of, your Licence to use online surveys:
email@example.com. We will confirm receipt of this by contacting you in writing, usually by e-mail.
- For legal notices: firstname.lastname@example.org
7.3 If we have to contact you or give you notice in writing, we will do so by e-mail or by pre-paid post to the address you have provided.
7.4 If you are a business, please note that any notice given by you to us, or by us to you, will be deemed received and properly served immediately when posted on our website, 24 hours after an e-mail is sent, or three days after the date of posting of any letter. In proving the service of any notice, it will be sufficient to prove, in the case of a letter, that such letter was properly addressed, stamped and placed in the post and, in the case of an e-mail that such e-mail was sent to the specified e-mail address of the addressee.
8. Events outside our control
8.1 We will not be liable or responsible for any failure to perform, or delay in performance of, any of our obligations under these Terms and Conditions that is caused by an Event Outside Our Control. An Event Outside Our Control is defined below in Condition 8.2.
8.2 An Event Outside Our Control means any act or event beyond our reasonable control including, without limitation, failure of public or private telecommunications networks.
8.3 If an Event Outside Our Control takes place that affects the performance of our obligations under these Terms and Conditions:
- our obligations under these Terms and Conditions will be suspended and the time for performance of our obligations will be extended for the duration of the Event Outside Our Control;
- we will use reasonable endeavours to find a solution by which our obligations under these Terms and Conditions may be performed despite the Event Outside Our Control.
9. Data protection requirements
9.1 The Licensee and Jisc shall observe their obligations under the Data Protection Legislation.9.1 The parties shall comply with the provisions of Schedule 2, Data Protection.
9.2 In the event of any conflict between Schedule 2 and any other provision of these service terms, the relevant provision of Schedule 2 shall take precedence.
10. Freedom of Information Obligations
10.1 Jisc is not subject to the requirements of the Freedom of Information Laws and is not obliged to respond to requests for information under the Freedom of Information Laws (“Request for Information“). Without prejudice to the foregoing, and subject to the Licensee’s compliance with Condition 10.2, Jisc will endeavour to inform the Licensee within two (2) Business Days and endeavour to respond to any Request for Information in the spirit of the Freedom of Information Laws where reasonably able to do so. Jisc and the Licensee will assist and cooperate with each other if a Request for Information is received by Jisc.
10.2 Jisc acknowledges that the Licensee may be obliged to respond to any Request for Information where it is subject to the requirements of the Freedom of Information Laws. If this is the case the Licensee shall be responsible for determining in its absolute discretion and, notwithstanding any other provision in these Terms and Conditions or any other agreement, whether any information is exempt from disclosure in accordance with the provisions of the Freedom of Information Laws. Without prejudice to the foregoing, if the Licensee receives a Request for Information and such request includes commercially sensitive information or confidential information of Jisc under the Freedom of Information laws, the Licensee shall, as soon as reasonably practicable, notify Jisc of such request and shall consult with Jisc and consider any representations which Jisc may make in relation to the requested disclosure prior to deciding whether to comply with or to refuse the request (in whole or in part).
11. Other important terms
11.1 We may transfer our rights and obligations under these Terms and Conditions to another organisation, but this will not affect your rights or obligations under these Terms and Conditions.
11.2 You may only transfer your obligations under these Terms and Conditions to another person if we agree in writing.
11.3 These Terms and Conditions constitute the entire agreement between you and us. You acknowledge that you have not relied on any statement, promise or representation made or given by, or on behalf of, us which is not set out in these Terms and Conditions or any document expressly referred to in it.
11.4 If we fail to insist you perform any of your obligations under these Terms and Conditions, or if we do not enforce our rights against you, or if we delay in doing so, that will not mean that we have waived our rights against you and will not mean that you do not have to comply with those obligations. If we do waive a default by you, we will only do so in writing, and that will not mean that we will automatically waive any later default by you.
11.5 We may be required to review content to determine if it is appropriate or if it is violating any terms of service such as our receipt of a report of unlawful content, however we have no obligation to monitor or review content.
11.6 Any price changes will become effective upon Licence renewal or immediately upon our agreement to provide additional services.
11.7 If you wish to downgrade your online surveys Account this can only be done at renewal time. No refunds will be available during the term of your Licence.
11.8 If you wish to upgrade your online surveys Account during your existing Licence term, we will calculate the cost of the upgrade on a daily rate for the remainder of that term. The additional functionality will be added on payment of the additional fee as notified to you.
11.9 Each of the conditions of these Terms and Conditions operates separately. If any court or competent authority decides that any of them are unlawful or unenforceable, the remaining conditions will remain in full force and effect.
11.10 We reserve the right to alter these Terms and Conditions during the term of your Licence.
11.11 Please note that these Terms and Conditions, their subject matter and their formation are governed by English law. You and we both agree that the courts of England and Wales will have exclusive jurisdiction.
Schedule 1 – Online Surveys Service Levels
1.1 This Service Level Agreement sets out the levels of availability and support the Licensee can expect from Jisc.
2.1 Support materials are available for all users at https://onlinesurveys.jisc.ac.uk/category/helpandsupport/
3. Support hours
3.1 Support hours are 09:00 – 17:00, Monday to Friday, excluding Bank Holidays and Jisc closure days.
4.1 The Licensee acknowledges that, from time to time during the term of their Licence, Jisc may apply enhancements to online surveys, and that such enhancements may, subject to paragraph 4.2, result in changes to the appearance and/or functionality of online surveys.
4.2 No enhancement shall disable, delete or (significantly) impair the main functionality of online surveys as set out in the Specification.
4.3 Details of planned enhancements will be published on the online surveys Website..
5. Scheduled maintenance
5.1 Any scheduled maintenance will be publicised on the online surveys Website prior to being carried out. Jisc will do everything possible to minimize and avoid downtime during such maintenance.
6. Backup and restoration
6.1 Online surveys is hosted on a fully backed up infrastructure. In the event of machine failure we will make all reasonable efforts to restore service as quickly as possible.
Schedule 2 – Data Protection
1.1. The following definitions apply to this Data Protection Schedule
|Agreement||means the agreement between Jisc and the Licensee for the provision of the Service;|
|Applicable EU Law||any law of the European Union (or the law of one of the Member States of the European Union);|
|Controller, Processor and Data Subject||Shall have the meaning given to those terms in the GDPR;|
|Data Protection Legislation||means any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction which relates to the protection of individuals privacy or with regards to the Processing of Personal Data to which a Party is subject, including the Data Protection Act 2018 (or all legislation enacted in the UK in respect of the protection of Personal Data when the UK leaves the European Union) and the GDPR;|
|Data Protection Particulars||means, in relation to any Processing under this Agreement: (a) the subject matter and duration of the Processing; (b) the nature and purpose of the Processing; (c) the type of Personal Data being Processed; and (d) the categories of Data Subjects.|
|Data Subject Request||means an actual or purported subject access request or notice or complaint from (or on behalf of) a Data Subject exercising his rights under the Data Protection Legislation;|
|Data Transfer||means transferring the Personal Data to, and/or accessing the Personal Data from and/or Processing the Personal Data within, a jurisdiction or territory that is a Restricted Country;|
|GDPR||means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119/1, 4.5.2016;|
|Permitted Purpose||means the purpose of the Processing as specified in the Data Processing Particulars;|
|Personal Data||has the meaning given to it in the GDPR and for the purposes of this Agreement includes Sensitive Personal Data;|
|Personal Data Breach||has the meaning given to it in the GDPR and, for the avoidance of doubt, includes a breach of Clause 4.1.3;|
|Personnel||means all persons engaged or employed from time to time by Jisc in connection with this Agreement, including employees, consultants, contractors and permitted agents;|
|Processing||has the meaning given to it in the GDPR (and “Process” and “Processed” shall be construed accordingly);|
|Regulator||means the UK Information Commissioner’s Office (including any successor or replacement body);|
|Regulator Correspondence||means any correspondence or communication (whether written or verbal) from the Regulator in relation to the Processing of the Personal Data;|
|Restricted Country||means a country, territory or jurisdiction outside of the European Economic Area which the EU Commission has not deemed to provide adequate protection in accordance with Article 25(2) of the DP Directive and/ or Article 45(1) of the GDPR (as applicable);|
|Security Requirements||means the requirements regarding the security of the Personal Data, as set out in the Data Protection Legislation (including, in particular, the measures set out in Article 32(1) of the GDPR (taking due account of the matters described in Article 32(2) of the GDPR));|
|Sensitive Personal Data||means Personal Data that incorporates such categories of data as are listed in Article 9(1) of the GDPR;|
|Service||means the Online Surveys service provided by Jisc;|
|Schedule||means this schedule which forms part of the Agreement.|
|Third Party Request||means a written request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by law or regulation;|
2. Arrangement between the parties
2.1. The Parties shall each Process the Personal Data in accordance with the terms of this Schedule. The Parties acknowledge that the factual arrangement between them dictates the classification of each Party in respect of the Data Protection Legislation. Notwithstanding the foregoing, the Parties anticipate and agree that the Licensee shall act as Controller and Jisc shall act as Processor, as follows:
2.1.1 The Licensee shall be a Controller where it is Processing the Personal Data in relation to the services being supplied by Jisc; and
2.1.2 Jisc shall be a Processor where it is Processing the Personal Data in relation to the Permitted Purpose in connection with the performance of its obligations under these service terms.
2.2. Each of the Parties acknowledges and agrees that the following table sets out an accurate description of the Data Protection Particulars:
|The subject matter and duration of the Processing||Online Surveys provides tools and functionality to create, deliver, and analyse surveys. The End User, managed by the Licensee, has the capacity to run surveys which may capture a range of information about a Data Subject (which may include Personal Data)The duration of the Processing will be for the term of the Service agreement between the Licensee and Jisc.|
|The nature and purpose of the Processing||The Personal Data will be Processed in order to provide the Service ordered by the Licensee.|
|The type of Personal Data being Processed||End Users have the capacity to collect any type of Personal Data, this may include (but is not limited to) users first name, last name, email address, phone number, date of birth and university ID.|
|The categories of Data Subjects||End Users of an Online Surveys account. Individuals that have responded to a survey created by End Users|
3. Controller Obligations
3.1. As the Controller in respect of the Processing of the Personal Data, the Licensee shall ensure that:
3.1.1 it is not subject to any prohibition or restriction which would prevent or restrict it from disclosing or transferring the Personal Data to Jisc in accordance with the terms of this Schedule; and
3.1.2 all fair processing notices have been given (and/ or, as applicable, consents obtained) and are sufficient in scope to allow the Licensee to disclose the Personal Data (including any Sensitive Personal Data) to Jisc for the delivery of the Service in accordance with the Data Protection Legislation.
4. Processor Obligations
4.1. Jisc (as a Processor in relation to any Personal Data Processed by (or on behalf of) the Licensee pursuant to the Agreement) undertakes to the Licensee that it shall:
4.1.1 Process the Personal Data for and on behalf of the Licensee in connection with the performance of the Service only and for no other purpose in accordance with the terms of this Agreement and any instructions from the Licensee;
4.1.2 unless prohibited by law, promptly notify the Licensee (and in any event within forty-eight (48) hours of becoming aware of the same) if it considers, in its opinion (acting reasonably) that it is required by Applicable EU Law to act other than in accordance with the instructions of the Licensee, including where it believes that any of the Licensee’s instructions under Clause 4.1.1 infringes any of the Data Protection Legislation;
4.1.3 implement and maintain appropriate technical and organisational security measures to comply with at least the obligations imposed on a Controller by the Security Requirements. If requested by the Licensee, Jisc will provide a description of the technical and organisational security measures that Jisc will implement and maintain;
4.1.4 take all reasonable steps to ensure the reliability and integrity of any of the Personnel who shall have access to the Personal Data, and ensure that each member of Personnel shall have entered into appropriate contractually-binding confidentiality undertakings;
4.1.5 notify the Customer promptly, and in any event within forty-eight (48) hours, upon becoming aware of any actual or suspected, threatened or ‘near miss’ Personal Data Breach, and:
- implement any measures necessary to restore the security of compromised Personal Data;
- assist the Licensee to make any notifications to the Regulator and affected Data Subjects;
4.1.6 notify the Customer promptly (and in any event within ninety-six (96) hours) following its receipt of any Data Subject Request or Regulator Correspondence and shall:
- not disclose any Personal Data in response to any Data Subject Request or Regulator Correspondence without the Licensee’s prior written consent; and
- provide the Licensee with all reasonable co-operation and assistance required by the Licensee in relation to any such Data Subject Request or Regulator Correspondence;
4.1.7 not disclose Personal Data to a third party in any circumstances without the Licensee’s prior written consent, other than:
- in relation to Third Party Requests where Jisc is required by law to make such a disclosure, in which case it shall use reasonable endeavours to advise the Licensee in advance of such disclosure and in any event as soon as practicable thereafter, unless prohibited by law or regulation from notifying the Licensee;
- to Jisc’s employees, officers and advisers who need to know such information for the purposes of Jisc performing its obligations under this Agreement and in this respect Jisc shall ensure that its employees, officers and advisers to whom it discloses the Personal Data are made aware of their obligations with regard to the use and security of Personal Data under this Agreement; and
- to a sub-contractor appointed in accordance with Clause 5.
4.1.8 not make (nor instruct or permit a third party to make) a Data Transfer without putting in place measures to ensure the Licensee’s compliance with Data Protection Legislation;
4.1.9 on the written request of the Customer, and with reasonable notice, allow representatives of the Customer to audit Jisc in order to ascertain compliance with the terms of this Clause 4 and/ or to provide the Customer with reasonable information to demonstrate compliance with the requirements of this Clause 4, provided that:
the Licensee shall only be permitted to exercise its rights under this Clause 1.9 no more frequently than once per year (other than where an audit is being undertaken by a Licensee in connection with an actual or ‘near miss’ Personal Data Breach, in which case, an additional audit may be undertaken each year by the Licensee within thirty (30) days of the Licensee having been notified of actual or ‘near miss’ Personal Data Breach);
- each such audit shall be performed at the sole expense of the Licensee;
- the Licensee shall not, in its performance of each such audit, unreasonably disrupt the business operations of Jisc;
- the Licensee shall comply with Jisc’s health and safety, security, conduct and other rules, procedures and requirements in relation to Jisc’s property and systems which have been notified by Jisc to the Licensee in advance; and
- in no case shall the Licensee be permitted to access any data, information or records relating to any other customer of Jisc.
4.1.10 except to the extent required by Applicable EU Law, on the date of termination or expiry of the Agreement (as applicable), cease Processing any of the Personal Data and, within sixty (60) days of the date being applicable under this Clause 4.1.10, return or destroy (as directed, in writing, by the Licensee) the Personal Data belonging to, or under the control of, the Licensee and ensure that all such data is securely and permanently deleted from its systems, provided that Jisc shall be entitled to retain copies of the Personal Data for evidential purposes and to comply with legal and/or regulatory requirements;
4.1.11 comply with the obligations imposed upon a Processor under the Data Protection Legislation; and
4.1.12 assist the Licensee in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of Processing and the information available to Jisc, provided that Jisc shall be entitled to charge a fee to the Licensee (on a time and materials basis and at such rate notified by Jisc to the Licensee from time to time) in respect of providing any such assistance to the Licensee.
4.2. Notwithstanding anything in this Agreement to the contrary, this Clause 4 shall continue in full force and effect for so long as Jisc Processes any Personal Data on behalf of the Licensee.
5.1 Jisc may from time to time use sub-contractors to perform all or any part of its obligations under this schedule. Jisc shall notify the Licensee prior to appointing a sub-contractor. The Licensee may object to the appointment of any sub-contractor and Jisc shall reasonably take into account the views of the Licensee in appointing any such sub-contractor, but for the avoidance of doubt the appointment of any sub-contractor shall be at Jisc’s absolute discretion and Jisc shall have no obligation to act in accordance with any objection raised by the Licensee. Information regarding the sub-contractors Jisc uses from time to time in connection with the performance of the Service can be found on the Service website.
5.2 Jisc may from time to time disclose Personal Data to its sub-contractors (or allow its sub-contractors to access Personal Data) for Processing solely in connection with the fulfilment of the Permitted Purpose.
5.3 Where Jisc uses a sub-contractor to Process Personal Data for or on its behalf, it will ensure that the sub-contractor contract (as it relates to the Processing of Personal Data) is on terms which are substantially the same as, and in any case no less onerous than, the terms set out in Clause 4 of this schedule.
5.4 Jisc shall remain liable to the Licensee for the acts, errors and omissions of any of its sub-contractors to whom it discloses Personal Data, and shall be responsible to the Licensee for the acts, errors and omissions of such sub-contractor as if they were Jisc’s own acts, errors and omissions to the extent that Jisc would be liable to the Licensee under this Agreement for those acts and omissions.