...
Data Protection Code of Conduct For Service Providers ... with clauses that might apply to an overall contract removed for clarity./.
The RP/Service Provider agrees and warrants:
a) [Legal compliance] to only process the Attributes in accordance with the relevant provisions of the XXXX law applicable to the RP/Service Provider;
b) Purpose limitation] to only process Attributes of the End User that are necessary for enabling access to the service provided by the Service Provider;
c) [Data minimisation] to minimise the Attributes requested from a Home Organisation to those that are adequate, relevant and not excessive for enabling access to the service and, where a number of
Attributes could be used to provide access to the service, to use the least intrusive Attributes possible;
d) [Deviating purposes] not to process the Attributes for any other purpose (e.g. selling the Attributes or selling the personalisation such as search history, commercial communications, profiling) than enabling
access, unless prior consent has been given to the Service Provider by the End User;
e)[Data retention] to delete or anonymise all Attributes as soon as they are no longer necessary for the purposes of providing the service;
f) [Third parties] not to transfer Attributes to any third party (such as a collaboration partner) except 1. if mandated by the Service Provider for enabling access to its service on its behalf, or 2. if the third party is committed to the Code of Conduct or has undertaken similar duties considered sufficient under the data protection law applicable to the Service Provider or 3. if prior consent has been given by the End User;
g) [Security measures] to take appropriate technical and organisational measures to safeguard Attributes against accidental or unlawful destruction or accidental loss, alteration, unauthorized
disclosure or access. These measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected, having regard to the state of the art and the cost of their implementation.
h) [Information duty towards End User] to provide to the End User, at least at first contact, in an easily, directly and permanently accessible way a Privacy Policy, containing at least the following information:
1. the name, address and jurisdiction of the Service Provider;
2. the purpose or purposes of the processing of the Attributes;
3. a description of the Attributes being processed;
4. the third party recipients or categories of third party recipient to whom the Attributes might be disclosed, and proposed transfers of Attributes to countries outside of the XXX location/federation
5. the existence of the rights to access, rectify and delete the Attributes held about the End User;
6. the retention period of the Attributes;
7. a reference to this Code of Conduct;
i) Information duty towards XX(IDP/AP)XX to provide to the or its Agent at least the following information:. 1 machine-readable link to the Privacy Policy; 2. indication of commitment to this Code of Conduct;c. any updates or changes in the local data protection legislation, which are less strict than the principles set out in this Code of Conduct;
j) [Security Breaches] to, without undue delay, report all suspected privacy or security breaches(including unauthorized disclosure or compromise, actual or possible loss of data, documents or any device, etc.) concerning the Attributes to the Home Organisation or its Agent;
k) [Transfer to third countries] when Attributes are being transferred outside the XX Federations/legal area and countries with adequate data protection pursuant to XXXX law.. to ensure an adequate level of protection of the Personal Data by taking appropriate measures pursuant to the law of the country in which the XX IdP/AP XX is established, such as requesting End User consent or entering into agreements with the XXIdP/AP;XX
Admin and Processing Code of Conduct (informed by NZ RealMe
(a) [Payment] pay the Charges in accordance with XXXX clause 6;
(b) co [Co-operation] co-operate with IdP personnel t in connection with its operation and safe-guarding of the Service/s;
(c) comply [Standards Compliance] comply with any standards or specifications issued by the IdP XXIdP/APXX and any reporting obligations required by the IdP from time to time in accordance with any relevant legislation;
(d) provide [Audit] provide appropriate assistance, where reasonably requested by IdP, in carrying out any audit of the Client’s use of the Services or related systems or suppliers;
(e) participate [Federation Reporting] participate in progress reporting as specified in the Service Schedule;
...