Last Updated: December 6th, 2024
For the transfer of Personal Data to a TitanVox entity established in a third country which does not ensure an adequate level of data protection
The Data Exporter as defined below
And
The Data Importer as defined below
each a ‘Party’; together ‘the Parties’,
HAVE AGREED on the following Argentina Contractual Clauses (Argentina Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the Data Exporter to the Data Importer of the Personal Data specified in Appendix 1.
As used in this Agreement, the listed terms shall have the following meanings:
a) “Personal Data”, “Sensitive Data”, “Processing”, “Data Controller” and “Data Subject” shall have the same meaning provided in Law No. 25,326 and any amendments or successor legislation.
b) “Authority” or “Controlling Authority” shall mean the Agency for Access to Public Information (Agencia de Acceso a la Información Pública).
c) the “Data Exporter” shall mean the data controller which transfers Personal Data.
d) “Data Importer” or “Data Processor” shall mean the service provider, as defined in section 25 of Law No. 25,326, located outside Argentina’s jurisdiction, which receives Personal Data from the Data Exporter for processing on behalf of the Data Exporter pursuant to the terms and conditions contained herein.
e) “Personal Data protection regulations” shall mean Law No. 25,326 and its regulations.
The details and other specific terms of the transfer and the Services, such as the type of Personal Data to be transferred, the mechanism agreed by the Parties to respond to requests made by Data Subjects or by the Controlling Authority, transfers to third parties, and the jurisdiction in which the Personal Data shall be located, are specified in Appendix A, which forms an integral part of this Agreement and shall comply with applicable Personal Data protection regulations.
The Parties may, in the future, enter into additional schedules to incorporate details and characteristics of transfers that may be performed pursuant to this Agreement. Any such schedules shall comply with the terms of this Agreement and applicable Personal Data protection regulations.
a) Data Subjects, as third-party beneficiaries, may require the Data Importer to comply with the provisions of Law No. 25,326 concerning the processing of their Personal Data, including rights to access, rectification, deletion, and other rights under Chapter III, sections 13 to 20 of Law No. 25,326. To this end, Data Subjects submit to the Argentine judicial and administrative jurisdiction. If the Data Importer fails to comply, the Data Subject may request the Data Exporter to take necessary actions to address the non-compliance.
b) The Data Importer acknowledges that the Controlling Authority may exercise its powers over the processing it undertakes, within the scope and competences provided by Law No. 25,326. The Data Importer accepts the Authority’s supervisory and enforcement powers as a third-party beneficiary for these purposes.
c) If the Data Importer revokes the rights granted to third-party beneficiaries under this section, or fails to address a material non-compliance after receiving written notice from the Data Exporter and failing to remedy the issue within FIVE (5) business days, this Agreement may be terminated automatically.
d) If the Data Exporter cannot be located or ceases to legally exist without a successor assuming its legal obligations under this Agreement, Data Subjects may require the Data Importer to comply with the obligations concerning the processing of their Personal Data. If a successor entity assumes such obligations by agreement or operation of law, Data Subjects may enforce compliance against the successor.
e) Data Subjects may require subcontractors engaged in processing Personal Data to comply with the obligations of this Agreement if both the Data Exporter and Data Importer cannot be located or have ceased to legally exist, unless a successor entity has assumed such obligations by agreement or operation of law. Subcontractor liability shall be limited to its own processing activities, as defined in this Agreement and applicable law.
f) The Parties accept that the Data Subjects may be represented by associations or other entities authorized by Argentine law.
The Data Exporter agrees to and warrants the following:
a) The collection, processing, and transfer of the Personal Data have been and will be conducted in compliance with Law No. 25,326.
b) The Data Exporter has made reasonable efforts to determine if the Data Importer is able to comply with the obligations set forth in this Agreement. The Data Exporter may request evidence of the Data Importer’s capacity to comply, including, where reasonable, requiring liability insurance for potential damages caused by the processing of Personal Data, as specified in Appendix A.
c) The Data Exporter shall provide all necessary instructions to ensure that the processing of the transferred Personal Data is performed exclusively on its behalf and in compliance with Law No. 25,326 and this Agreement.
d) The Data Exporter shall inform the Data Importer of the relevant provisions of Argentine legislation regarding the processing of Personal Data, including any significant updates or changes.
e) The Data Exporter warrants that it has informed Data Subjects that their Personal Data may be transferred to a jurisdiction with lower levels of data protection than those in the Republic of Argentina, in accordance with the requirements of Law No. 25,326.
f) The Data Exporter warrants that any data sub-processing of the activity will be conducted by a data subcontractor which must have the prior and express approval of the Data Exporter, which must provide at least the same level of protection and the same rights to the Data Subjects as those agreed upon herein with the Data Importer, to which end they will execute an Agreement, and which will also be under subject to the instructions of the Data Exporter.
g) The Data Exporter shall respond to Data Subject requests for access, rectification, deletion, and other rights under Chapter III, sections 13 to 20 of Law No. 25,326, within the legal timeframes: TEN (10) calendar days for access requests and FIVE (5) business days for rectification, deletion, or update requests. If the Parties agree that the Data Importer is responsible for responding to such requests, the Data Exporter shall provide reasonable assistance where necessary and feasible, particularly when the Data Importer is unable to respond or fails to do so.
h) The Data Exporter will have at the disposal of the Data Subjects, in their capacity as third party beneficiaries as stated in section 3 and upon their request, a copy of the terms regarding their data treatment, rights and warranties, as well as a copy of the terms of other agreements necessary for the Services of data sub-processing that may be conducted according to the terms of this Agreement.
The Data Importer represents and warrants the following:
a) Will treat the transferred Personal Data solely on behalf of the Data Exporter, in accordance to its instructions and the terms of this Agreement. If for any reason it cannot comply with these requirements, it will promptly inform the Data Exporter, which will be entitled to suspend the data transfer or terminate the Agreement.
b) The Data Importer will implement and maintain effective security and confidentiality measures to prevent unauthorized access, tampering, loss, or processing of Personal Data. These measures shall include mechanisms to detect intentional or accidental breaches, aligned with risk assessments and the requirements of applicable regulations, ensuring a level of security appropriate to the risks and nature of the data.
c) The Data Importer will have in place proceedings which guarantee that all access to the transferred data will be made by authorized personnel, including access levels and passwords, which shall comply with the duty of confidentiality and security of the data and will execute agreements to such effect.
d) The Data Importer has verified that local regulations do not impede compliance with this Agreement. It will promptly notify the Data Exporter of any changes in local laws that may affect its ability to fulfill the obligations herein.
e) Will treat the Personal Data as per the express instructions issued by the Data Exporter in accordance with the objectives and manner described in Appendix A.
f) Will provide the Data Exporter with a contact within its organization which is authorized to respond to consultations regarding Personal Data treatment, and will cooperate in good faith with the Data Exporter, the Data Subject and the Controlling Authority in relation to such consultations within the terms provided by law. If the Data Exporter ceases to legally exist, or if the Parties have agreed so, the Data Importer will undertake the tasks associated with compliance as stated in section 3, subsection d).
g) Will put at the disposal of the Data Exporter or the Controlling Authority, at their request, its data treatment facilities and all necessary documentation for the data treatment, so that it may be reviewed, audited and certified. These activities will be conducted, prior reasonable notice and within regular office hours, by an impartial and independent inspector or auditor designated by the Data Exporter or the Authority, in order to determine if the warranties and obligations undertaken under this Agreement are met
h) The Data Importer will treat the Personal Data in compliance with Law No. 25,326.
i) The Data Importer will notify the Data Exporter without delay of:
i) legally binding requests for access to Personal Data by a competent Authority, unless prohibited by law;
ii) accidental or unauthorized access to Personal Data; and
iii) requests received directly from Data Subjects that have not been addressed, unless otherwise authorized.
j) The Data Importer will not assign or transfer the Personal Data to third parties unless: 1) it is specifically provided in Appendix A of this Agreement or is necessary to fulfill this Agreement, verifying in both cases that the third party undertakes the same obligations as the Data Importer under this Agreement and always with the knowledge and prior consent of the Data Exporter; or 2) the assignment is required by law or by a competent Authority, insofar as it does not exceed what is necessary in a democratic society, for example, when it is a necessary measure to safeguard the security of the State, the defense, public safety, prevention, investigation, detection and repression of criminal or administrative infractions, or the protection of the Data Subject or the rights and liberties of a third party.
Upon receipt of the request detailed in point 2), the Data Importer must immediately: a) verify that the requesting Authority offers adequate guarantees regarding compliance with the principles of section 4 of Law No. 25,326, and the Data Subject’s rights to access, rectification, deletion and other rights arising out of Chapter III, sections 13 to 20 of Law No. 25,326, except in the following cases (as per section 17 of Law No. 25,326): i) it is provided by law or by a decision based on the defense of the Nation, order and third-party interests, ii) it is provided by a decision which has been notified to the affected party, when it could hinder ongoing judicial or administrative activities associated to an investigation on the compliance of obligations subject to state control and related to public order, such as: tax or pension matters, matters related to control over health and the environment, criminal investigations and the verification of administrative infractions; nevertheless, access to the data must be granted when the affected party has to exercise its right to defense; and b) in case the Authority does not grant or offer the guarantees indicated in point a) Argentine law will prevail, and consequently the Data Importer will suspend the data treatment in that country and will return the data to the Exporter in accordance with its instructions, and the Data Exporter will notify the Controlling Authority.
k) The Data Importer will respond to any requests received from the Data Subject in its capacity as a third party beneficiary or from the Data Exporter, which exercise the rights to access, rectification, deletion and other rights arising out of Chapter III, sections 13 to 20 of Law No. 25,326, in compliance with the terms provided by law and providing the means to such end. It will respond within the terms provided by Law No. 25,326 to consultations from the data subject and the Controlling Authority regarding the data treatment conducted by the Data Importer, notwithstanding that the Parties have agreed that someone else will respond to these consultations in Appendix A, following the instructions of the Controlling Authority.
l) The Data Importer will destroy, and certify this destruction, and/or return to the Data Exporter the transferred Personal Data, when this Agreement is terminated for any cause.
m) In cases of data sub-processing, the Data Importer will inform and obtain the prior written consent of the Data Exporter.
n) The Data Importer warrants that the treatment conducted by any subcontractor will be in compliance with section 10 of this Agreement.
o) The Data Importer will provide the Data Exporter with a copy of the contract executed with any subcontractor engaged in data processing under this Agreement. The subcontractor must recognize the Data Exporter’s ability to provide oversight and instructions as necessary.
p) Will keep records of its compliance with the obligations established in this section and will provide a report upon request of the Data Exporter or the Authority.
a) The Parties agree that any Data Subject suffering damages as a result of a breach of the obligations contained in this Agreement by the Data Exporter or by a subcontractor acting under its direct instructions will have the right to seek compensation from the Data Exporter.
b) If a Data Subject cannot seek compensation from the Data Exporter due to the Data Exporter’s inability to be located, insolvency, or cessation of legal existence, the Data Importer agrees that the Data Subject may seek compensation for damages caused by the Data Importer’s breach of its obligations under sections 5 and 10 of this Agreement or by the breach of any subcontractor under its control. If a successor entity has assumed the obligations of the Data Exporter by agreement or operation of law, the claim shall be directed against such successor. The Data Importer cannot decline its own responsibilities based on the actions or omissions of a subcontractor under its control.
c) In case the Data Subject cannot file against the Data Exporter or the Data Importer the claim described in points a) and b) above for infringement by the data subcontractor of its obligations under sections 3 and 10 of this Agreement, due to the fact that both the Data Exporter and the Data Importer cannot be found, have ceased to legally exist or have become insolvent, the data subcontractor accepts that the Data Subject may action against him regarding its own data treatment instead of against the Data Exporter or Data Importer, unless any successor entity has undertaken all the legal obligations of the Data Exporter or the Data Importer due to an agreement or by operation of law, in which case the Data Subject will file any claim against such entity. The liability of the data subcontractor will be limited to its own data treatment operations in accordance with the terms of this Agreement.
This Agreement is subject to the laws of the ARGENTINE REPUBLIC, particularly to Law No. 25,326, its regulations and the decisions issued by the ARGENTINE DATA PROTECTION DIRECTORATE and/or the AGENCY OF ACCESS TO PUBLIC INFORMATION, and any conflict related to Personal Data protection will be subject to the judicial and administrative jurisdiction of the ARGENTINE REPUBLIC.
a) The Data Importer agrees that if the Data Subject invokes its rights as third party beneficiary or claims compensation for damages in accordance with the terms of this Agreement, it will abide by the Data Subject’s decision to: i) subject the matter to mediation before an independent mediator; ii) file a complaint before the AGENCY OF ACCESS TO PUBLIC INFORMATION; and iii) bring the matter before the Argentine courts.
b) The Parties agree that the Data Subject’s options will not hinder the Data Subject’s substantive or procedural rights to obtain compensation in accordance with any other national or international regulations.
a) The Parties agree that the Controlling Authority is entitled to audit the Data Importer or any data subcontractor, to the same extent and under the same conditions that it could audit the Data Exporter under Law No. 25,326, and must put their data treatment facilities at its disposal. The audit may be conducted by personnel from the Controlling Authority, by qualified third parties designated by the Controlling Authority or by local authorities with similar responsibilities in collaboration with the Controlling Authority.
b) The Data Importer will immediately inform the Data Exporter if the legislation that applies to it or to any subcontractor does not allow audits to be conducted on the Data Importer or the subcontractors.
a) The Data Importer will not subcontract any data processing conducted on behalf of the Data Exporter without the Data Exporter’s prior written consent. If the Data Importer subcontracts its obligations it must execute a written agreement with the subcontractor in which the subcontractor undertakes the same obligations as the Data Importer, insofar as they are compatible, in connection with the Data Exporter, the Data Subject, the Controlling Authority or third party beneficiaries. If the subcontractor cannot comply with its data protection obligations under such a written agreement, the Data Importer will still be liable before the Data Exporter for the compliance of the data subcontractor’s obligations under such agreement.
b) The prior written agreement between the Data Importer and the subcontractor will contain a third party beneficiary provision that will include the case in which the Data Subject cannot file a claim for compensation as described in point a) of section 6 against the Data Exporter or the Data Importer because both cannot be found, have ceased to legally exist or have become insolvent, and no successor entity has undertaken all the legal obligations of the Data Exporter or the Data Importer due to an agreement by operation of law. The civil liability of the data subcontractor will be limited to its own data treatment operations in accordance with the terms of this Agreement.
c) The provisions regarding data protection in case of data sub-processing will be subject to Argentine law. This requirement may be met by a contract between the Data Importer and the data subcontractor in which the data subcontractor cosigns this Agreement.
d) The Data Exporter will maintain an updated list of all sub-processing agreements executed by the Data Importer, which will be reviewed and updated at least annually. This list will be made available to the Controlling Authority upon request.
a) If the Data Importer infringes its obligations under the provisions of this Agreement, the Data Exporter must temporarily suspend the transfer of Personal Data to the Data Importer until the infringement is corrected within the time frame provided by the Data Exporter taking into account the severity of the situation. Where required by applicable law, the Data Exporter will notify the Controlling Authority of the suspension.
b) This Agreement shall be terminated, and must be declared terminated by the Data Exporter with the prior intervention of the Controlling Authority, if: i) the Personal Data transfer to the Data Importer has been temporarily suspended by the Data Exporter for more than THIRTY (30) calendar days as provided by point a); ii) compliance by the Data Importer of the terms of this Agreement and the applicable law are contrary to the legal or regulatory provisions of the country of import; iii) the Data Importer substantially or persistently infringes any guarantee or undertaking contained in this Agreement; iv) there is a firm and definite decision, which cannot be appealed before any Argentine court or before the AGENCY OF ACCESS TO PUBLIC INFORMATION, which establishes that the Data Importer or the Data Exporter have infringed this Agreement; or v) the Data Exporter, notwithstanding the exercise of any other right that it may have against the Data Importer, may terminate this Agreement when: the judicial administration or liquidation of the Data Importer is requested and such request is not dismissed within the period established by the applicable law; the liquidation or bankruptcy of the Data Importer is declared; an administrator is named for any of the Data Importer’s assets; the Data Importer files for a judicial reorganization procedure; or the Data Importer is in any equivalent situation in any jurisdiction. In the cases foreseen by points i), ii) or iv) the Data Importer may also terminate this Agreement, without the prior intervention of the Controlling Authority.
c) The Parties agree that the termination of this Agreement for any reason will not exempt them from complying with the obligations and conditions regarding the transferred Personal Data.
The Parties agree that, once the Personal Data processing services conclude for any reason, the Data Importer and the data subcontractor must, at the Data Exporter’s discretion, either return all the transferred Personal Data and any copies, or destroy them completely and certify this destruction before the Data Exporter, unless the legislation which applies to the Data Importer prevents the return or total or partial destruction of the transferred Personal Data, in which case it must verify that such conservation term does not violate the applicable data protection principles, and notify the Controlling Authority if it does.
to the Argentina Standard Contractual ClausesThis Appendix forms part of the Argentina Clauses.The details of the transfer and in particular the Data Exporter, Data Importer, Data Subjects, Data Characteristics, and Treatment and Purpose are described in the Data Processing Details document located here: www.titan-vox.com/data-processing-details
