Data Processing Addendum

Applicable Data Protection Law means privacy or data-protection law that applies to the relevant processing under this DPA.

Client Personal Data means Personal Data for which the Client determines the purposes of processing and which ICAN processes solely on the Client’s documented instructions to provide the Services.

Controller, Processor, Personal Data, Processing, Data Subject and Personal Data Breach have the meanings given by Applicable Data Protection Law or, where not defined, their ordinary equivalent under the UAE PDPL.

ICAN Controller Data means Personal Data for which ICAN independently determines purposes and essential means, including ICAN account administration, security and audit records, billing and tax records, ICAN expert-network records, expert contracting, and compliance, fraud and legal-record processing.

Subprocessor means a third party appointed by ICAN to process Client Personal Data on ICAN’s behalf.

Services means the services described in the agreement between the Client and ICAN.

The Client is Controller and ICAN is Processor only for Client Personal Data described in Annex 1.

This DPA does not convert ICAN into a Processor for ICAN Controller Data.

Where the parties independently determine separate purposes for the same or related data, each is an independent Controller for its own processing unless a written agreement expressly establishes a different role.

The parties will not describe themselves as joint Controllers unless they have specifically determined that they jointly determine the purposes and essential means of the relevant processing, and have documented the allocation of responsibilities.

ICAN will process Client Personal Data only: (a) on the Client’s documented instructions; (b) as necessary to provide the Services; or (c) where required by applicable law, in which case ICAN will inform the Client before processing unless the law prohibits that notice.

The agreement, this DPA, the Client’s configured use of the Services and written Client instructions together constitute documented instructions.

ICAN will notify the Client if, in ICAN’s reasonable view, an instruction infringes Applicable Data Protection Law. ICAN may suspend the affected processing while the parties resolve the issue.

The Client is responsible for: (a) the lawfulness, fairness and transparency of its instructions and of its collection of Client Personal Data; (b) providing required notices and obtaining any required permissions; (c) ensuring the data supplied to ICAN is adequate, relevant and limited to the Services; and (d) configuring user permissions appropriately.

The Client must not instruct ICAN to process data in a manner prohibited by applicable law or the agreement.

ICAN will ensure that personnel authorised to process Client Personal Data are subject to confidentiality obligations and receive access only where required for their role.

ICAN will not disclose Client Personal Data except as permitted by the agreement, this DPA, a Client instruction or the law.

ICAN will maintain appropriate technical and organisational measures proportionate to the nature of the Client Personal Data and the risks of processing.

Measures include, as appropriate: role-based access and least privilege; authentication controls; encryption in transit and at rest where supported and appropriate; restricted private file storage; access and activity logging; vulnerability, patch and change management; backup and recovery controls appropriate to the Service; incident response; confidentiality and security requirements for authorised personnel; and periodic review of material controls.

A description of baseline measures is set out in Annex 2. ICAN may improve or replace measures provided the overall protection is not materially reduced.

ICAN will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data and, where reasonably practicable, within 24 hours.

Initial notice may be phased and will include the information reasonably available at the time, such as the nature of the incident; the categories of data and people affected where known; likely consequences where known; containment and remediation actions; and a contact for follow-up.

ICAN will reasonably cooperate with the Client’s assessment and any legally required notifications. ICAN’s notice of an incident is not an admission of fault or liability.

Taking account of the nature of the processing, ICAN will provide reasonable assistance to the Client in responding to Data Subject rights requests relating to Client Personal Data.

If ICAN receives a request that clearly relates to Client Personal Data for which the Client is Controller, ICAN will direct the requester to the Client, or forward the request to the Client where appropriate, unless the law requires ICAN to act differently.

ICAN remains responsible for requests relating to ICAN Controller Data.

Taking account of the nature of the processing and the information available to ICAN, ICAN will provide reasonable assistance with security-of-processing obligations, breach assessments, data-protection impact assessments and regulator consultations, where required by Applicable Data Protection Law and related to ICAN’s processing of Client Personal Data.

Material work beyond normal Service support may be subject to agreed reasonable fees, unless it is required because of ICAN’s breach of this DPA.

The Client gives ICAN general authorisation to use the Subprocessors listed in the public Subprocessor Register.

ICAN will: perform proportionate due diligence; enter into a written agreement requiring confidentiality, security, deletion or return, and data-protection protections appropriate to the processing; remain responsible to the Client for the Subprocessor’s performance to the extent required by the parties’ agreement and Applicable Data Protection Law; and keep the Subprocessor Register current.

ICAN will provide reasonable prior notice of a new or replacement material Subprocessor that will process Client Personal Data.

The Client may object on reasonable data-protection grounds within the notice period stated in the notice. The parties will work in good faith towards a commercially reasonable solution. If no solution is reasonably available, either party may terminate only the affected Service or component in accordance with the main agreement.

The Client acknowledges that ICAN is established in the UAE and that the portal infrastructure described in the Subprocessor Register may be located outside the UAE.

ICAN will implement safeguards required by Applicable Data Protection Law for cross-border processing within its responsibility.

If the Client is subject to GDPR and a restricted transfer to ICAN in the UAE requires EU Standard Contractual Clauses, the parties will incorporate the then-applicable clauses in the appropriate controller-to-processor module, together with the required annexes and supplementary measures.

If the Client is subject to UK GDPR and a restricted transfer requires a UK transfer mechanism, the parties will implement the applicable UK International Data Transfer Agreement, UK Addendum or successor mechanism.

The parties will reasonably cooperate to update a transfer mechanism if law or regulator guidance requires it.

ICAN will make available the information reasonably necessary to demonstrate compliance with this DPA.

The Client may request a reasonable audit no more than once per twelve months, unless required by a regulator, following a material Personal Data Breach, or where the Client has reasonable grounds to suspect a material breach.

Audits must protect ICAN, other clients and third-party confidentiality; avoid unnecessary disruption; use existing independent assurance or documentary evidence first where sufficient; and be conducted during normal business hours on reasonable notice.

The Client bears reasonable audit costs unless the audit identifies a material ICAN breach.

During the Services, ICAN will provide the access and return mechanisms agreed for Client Personal Data.

On termination of the relevant Services, ICAN will delete or return Client Personal Data according to the Client’s instruction and the main agreement, unless applicable law requires retention.

Deletion from active systems may be followed by routine backup expiry. Backups retained solely for disaster recovery remain protected and are not restored for ordinary business use except as necessary for recovery.

This clause does not require deletion of ICAN Controller Data, or of records ICAN must independently retain by law.

ICAN will maintain records of its processor activities to the extent required by Applicable Data Protection Law.

Each party will provide reasonable contact information for privacy and security matters, and keep it current. ICAN’s is privacy@icanmena.com.

Liability arising under this DPA is subject to the liability allocation in the main agreement, except where Applicable Data Protection Law requires otherwise.

If this DPA conflicts with the main agreement on the processing of Client Personal Data, this DPA prevails for that processing.

If mandatory Standard Contractual Clauses conflict with this DPA, those clauses prevail to the extent of the conflict for the relevant transfer.

This DPA begins when ICAN first processes Client Personal Data as Processor under the relevant agreement.

It continues until ICAN no longer processes Client Personal Data, subject to the provisions that survive by their nature.

Processor: I C A N Management Consultancy LLC.
Controller: the Client under the main agreement.

Subject matter: processing required to provide the contracted ICAN services and the portal functions designated by the Client.

Duration: the term of the Services, plus the agreed return or deletion and backup-expiry periods.

Nature of processing: hosting, storage, organisation, retrieval, display, transmission, access control, support, reporting and other operations documented in the applicable Service or Client instruction.

Purpose: delivering the Services on the Client’s documented instructions.

Categories of Data Subjects: as applicable to the Service — for example Client personnel, candidates, experts, Client contacts, or other individuals whose data the Client supplies or controls.

Types of Client Personal Data: as documented for the Service. The Client must not supply special or sensitive categories unless the Service expressly supports them and the parties have agreed appropriate controls.

Frequency: continuous, or as initiated by the Client’s use of the Service.

Deletion and return: as set out in “Return and deletion” above and in the main agreement.

Role-based and least-privilege access; unique user accounts and authentication controls; private storage for non-public documents; encryption in transit and at rest where supported and appropriate; access and security event logging; secure software-development and change practices appropriate to the portal; vulnerability and patch management; backup and recovery controls appropriate to service criticality.

Confidentiality obligations and security requirements for authorised personnel; an incident-response process; vendor and subprocessor assessment and contracting; logical separation and access controls between Client contexts where applicable; retention and deletion controls; and periodic security and control review.

The current register is published at /subprocessorsand is incorporated by reference, as updated under “Subprocessors” above.