Argentina Standard Contractual Clauses

Last Modified June 25, 2020

ARGENTINA STANDARD CONTRACTUAL CLAUSES (PROCESSORS) For the transfer of personal data to a Nuance entity established in a third country which does not ensure an adequate level of data protection

Name of the data exporting organization: Company, as defined in this Agreement.
(the data exporter)
And
Name of the data importing organization: Nuance, as defined in this Agreement.
(the data importer)
each a ‘party’; together ‘the parties’,

HAVE AGREED on the following Argentina Contractual Clauses (Argentina Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Section 1

Definitions

As used in this Agreement, the listed terms shall have the following meanings:

(a) “Personal Data”, “Sensitive Data”, “treatment”, “Data Controller” and “Data Subject” shall have the same meaning provided in Law No. 25,326.

(b) “Authority” or “Controlling Authority” shall mean the AGENCY OF ACCESS TO PUBLIC INFORMATION.

(d) “Data Importer” or “Data Processor” shall mean the service provider as defined in section 25 of Law No. 25,326, which is located outside of Argentina’s jurisdiction and receives Personal Data from the Data Exporter for its treatment pursuant to the terms and conditions contained herein.

(e) “Personal Data protection regulations” shall mean Law No. 25,326 and its regulations.

Section 2

Specifications, purpose of the transfer and specific terms

The details and other specific terms of the transfer and the Services, such as the type of Personal Data to be transferred, the mechanism agreed by the Parties to respond to requests made by Data Subjects or by the Controlling Authority, transfers to third parties and the jurisdiction in which the Personal Data shall be located, are specified in Appendix A, which is part of this Agreement. The Parties may in the future enter into additional schedules to incorporate details and characteristics of those transfers that may be performed in the future pursuant to this Agreement.

Section 3

Liability and third-party beneficiaries

(a) The Data Subjects, in their capacity as third party beneficiaries, may require the Data Importer to comply with the provisions of Law No. 25,326 in connection with the treatment of their Personal Data, particularly regarding the rights to access, rectification, deletion and other rights arising out of Chapter III, sections 13 to 20 of Law No. 25,326, pursuant to the obligations and responsibilities undertaken by the Parties herein. To such end, they submit to Argentine judicial and administrative jurisdiction. In case of an alleged non-compliance by the Data Importer, the Data Subject may require the Data Exporter to take the necessary actions to terminate such non-compliance.

(b) The Data Importer accepts that the Controlling Authority may exercise its powers over the data treatment it undertakes, within the limits and competences granted by Law No. 25,326, accepting its controlling and sanctioning powers, and granting it to such purpose, as may apply, the capacity of third party beneficiary.

(c) If the Data Importer revokes the rights granted by this section to third party beneficiaries, or persists with an infringement to such rights after the Data Exporter gives notice requiring compliance within a FIVE (5) business day term, then the Agreement may be automatically terminated.

(d) The Data Subjects shall be able to require from the Data Importer compliance with the obligations undertaken in this Agreement in connection to the treatment of Personal Data received from the Data Exporter, if the Data Exporter cannot be found or ceases to legally exist, unless any successor entity has undertaken all the legal obligations of the Data Exporter or the Data Importer due to an agreement or by operation of law, in which case the Data Subject may require compliance from such entity.

(e) The Data Subjects shall be able to require from any subcontractor charged with the treatment of Personal Data compliance with this section and with all the obligations undertaken under this Agreement by the Data Exporter and the Data Importer in connection with the treatment of the Personal Data received from the Data Exporter, when both the Data Exporter and the Data Importer cannot be found or have ceased to legally exist, unless any successor entity has undertaken all the legal obligations of the Data Exporter or the Data Importer due to an agreement or by operation of law, in which case the Data Subject may require compliance from such entity. The civil liability of the data subcontractor will be limited to its own data treatment operations in accordance with the terms agreed by the Parties and with this Agreement.

(f) The Parties accept that the Data Subjects may be represented by associations or other entities authorized by Argentine law.

Section 4

Obligations of the Data Exporter

The Data Exporter agrees and warrants the following:

(a) The collection, treatment and transfer of the Personal Data have been and will be conducted in compliance with Law No. 25,326.

(b) The Data Exporter has made reasonable efforts to determine if the Data Importer is able to comply with the obligations set forth in this Agreement. To that effect, the Data Exporter shall be able to request the Data Importer to hire liability insurance for any potential damages that may be caused by the treatment of Personal Data, pursuant to the specifications contained in Appendix A.

(c) During the execution of Personal Data treatment services, the Data Exporter shall give all necessary instructions for the treatment of the transferred Personal Data to be performed exclusively on its behalf and in compliance with Law No. 25,326 and this Agreement.

(d) Shall provide the Data Importer with a copy of the Argentine legislation in force regarding the treatment of Personal Data.

(e) Warrants that it has complied with informing the Data Subjects that their Personal Data could be transferred to a third country with lower levels of data protection than those of the REPUBLIC OF ARGENTINA.

(f) Warrants that any data sub-processing of the activity will be conducted by a data subcontractor which must have the prior and express approval of the Data Exporter, which must provide at least the same level of protection and the same rights to the Data Subjects as those agreed upon herein with the Data Importer, to which end they will execute an Agreement, and which will also be under subject to the instructions of the Data Exporter.

(g) If the Data Subject – in its capacity as a third party beneficiary – exercises its rights to data access, rectification, deletion and other rights arising out of Chapter III, sections 13 to 20 of Law No. 25,326, the Data Exporter will reply within TEN (10) calendar days in case of a request for access and FIVE (5) business days in case of a request for rectification, deletion or update, and will provide the means to that end, whether the data are in its power or it has been agreed as an obligation under its charge, which is indicated in Appendix A. The Data Exporter will respond within the time frames indicated by Law No. 25,326 to the consultations made by the Data Subjects and the Controlling Authority regarding the data treatment conducted by the Data Importer, unless that the Parties have agreed that the Data Importer must respond to such consultations. Even in this case, the Data Exporter must respond, insofar as it is reasonable to require this and based on the information it may reasonably have, when the Data Importer is unable to respond or fails to respond.

(h) The Data Exporter will have at the disposal of the Data Subjects, in their capacity as third party beneficiaries as stated in section 3 and upon their request, a copy of the terms regarding their data treatment, rights and warranties, as well as a copy of the terms of other agreements necessary for the Services of data sub-processing that may be conducted according to the terms of this Agreement.

Section 5

Obligations of the Data Importer

The Data Importer represents and warrants the following:

(a) Will treat the transferred Personal Data solely on behalf of the Data Exporter, in accordance to its instructions and the terms of this Agreement. If for any reason it cannot comply with these requirements, it will immediately inform the Data Exporter, which will be entitled to suspend the data transfer or terminate the Agreement.

(b) Take necessary and effective security and confidentiality measures to avoid the tampering, loss, access or unauthorized treatment of the data, and measures which allow the detection of any intentional or unintentional deviations, whether the risks originate from human action or from the technical means used, verifying that they are not inferior to those required by the applicable regulations, so as to warrant a security level which is appropriate to the risks associated with the data treatment and nature of the data to be protected.

(c) Will have in place proceedings which guarantee that all access to the transferred data will be made by authorized personnel, including access levels and passwords, which shall comply with the duty of confidentiality and security of the data and will execute agreements to such effect.

(d) Has verified that the local regulations do not impede compliance with the obligations, warranties and principles contained herein regarding data treatment and Data Subjects, and will immediately inform the Data Exporter if it learns of the existence of any such provisions, in which case the Data Exporter may suspend the data transfers.

(e) Will treat the Personal Data as per the express instructions issued by the Data Exporter in accordance with the objectives and manner described in Appendix A.

(f) Will provide the Data Exporter with a contact within its organization which is authorized to respond to consultations regarding Personal Data treatment, and will cooperate in good faith with the Data Exporter, the Data Subject and the Controlling Authority in relation to such consultations within the terms provided by law. If the Data Exporter ceases to legally exist, or if the Parties have agreed so, the Data Importer will undertake the tasks associated with compliance as stated in section 3, subsection d).

(g) Will put at the disposal of the Data Exporter or the Controlling Authority, at their request, its data treatment facilities and all necessary documentation for the data treatment, so that it may be reviewed, audited and certified. These activities will be conducted, prior reasonable notice and within regular office hours, by an impartial and independent inspector or auditor designated by the Data Exporter or the Authority, in order to determine if the warranties and obligations undertaken under this Agreement are met.

(h) Will treat the Personal Data in compliance with Law No. 25,326.

(i) Will notify without delay the following to the Data Importer: i) all legally binding requests to provide access to Personal Data filed by an Authority charged with applying law, unless this is forbidden by applicable law (insofar as this does not exceed what is necessary in a democratic society under point 2) of the following subsection), ii) all accidental or unauthorized accesses, iii) all requests received directly from the Data Subjects which were not responded, unless it is authorized.

(j) Will not assign or transfer the Personal Data to third parties unless: 1) it is specifically provided in Appendix A of this Agreement or is necessary to fulfill the Agreement, verifying in both cases that the third party undertakes the same obligations as the Data Importer under the Agreement and always with the knowledge and prior consent of the Data Exporter; or 2) the assignment is required by law or by a competent Authority, insofar as it does not exceed what is necessary of a democratic society, for example, when it is a necessary measure to safeguard the security of the State, the defense, public safety, prevention, investigation, detection and repression of criminal or administrative infractions, or the protection of the Data Subject or the rights and liberties of a third party.

Upon receipt of the request detailed in point 2), the Data Importer must immediately: a) verify that the requesting Authority offers adequate guarantees regarding compliance with the principles of section 4 of Law No. 25,326, and the Data Subject’s rights to access, rectification, deletion and other rights arising out of Chapter III, sections 13 to 20 of Law No. 25,326, except in the following cases (as per section 17 of Law No. 25,326): i) it is provided by law or by a decision based on the defense of the Nation, order and third-party interests, ii) it is provided by a decision which has been notified to the affected party, when it could hinder ongoing judicial or administrative activities associated to an investigation on the compliance of obligations subject to state control and related to public order, such as: tax or pension matters, matters related to control over health and the environment, criminal investigations and the verification of administrative infractions; nevertheless, access to the data must be granted when the affected party has to exercise its right to defense; and b) in case the Authority does not grant or offer the guarantees indicated in point a) Argentine law will prevail, and consequently the Data Importer will suspend the data treatment in that country and will return the data to the Exporter in accordance with its instructions, and the Data Exporter will notify the Controlling Authority.

(k) Will respond to any requests received from the Data Subject in its capacity as a third party beneficiary or from the Data Exporter, which exercise the rights to access, rectification, deletion and other rights arising out of Chapter III, sections 13 to 20 of Law No. 25,326, in compliance with the terms provided by law and providing the means to such end. It will respond within the terms provided by Law No. 25,326 to consultations from the data subject and the Controlling Authority regarding the data treatment conducted by the Data Importer, notwithstanding that the Parties have agreed that someone else will respond to these consultations in Appendix A, following the instructions of the Controlling Authority.

(l) Will destroy, and certify this destruction, and/or return to the Data Exporter the transferred Personal Data, when this Agreement is terminated for any cause.

(m) In cases of data sub-processing, will inform and obtain the prior written consent of the Data Exporter.

(n) Warrants that the treatment conducted by any subcontractor will be in compliance with section 10 on this Agreement.

(o) Will send without delay to the Data Exporter a copy of the contract executed with the data subcontractor in connection with this Agreement, and in which the Data Exporter must be granted the capacity of third party beneficiary so that it will be able to impart any instructions it deems necessary and have the ability to terminate the contract.

(p) Will keep records of its compliance with the obligations established in this section and will provide a report upon request of the Data Exporter or the Authority.

Section 6

Liability

(a) The Parties agree that any Data Subjects which suffer damages as a result of an infringement of the obligations contained in the present Agreement by any party or by a subcontractor will have the right to receive a compensation for such damages from the Data Exporter.

(b) If the Data Subject cannot file against the Data Exporter the claim for damages described in point a) above for infringement by the Data Importer or the data sub- contractor of their obligations established in sections 5 and 10 of this Agreement, due to the fact that the Data Exporter cannot be found, have ceased to legally exist or have become insolvent, the Data Importer accepts that the Data Subject may action against him instead of the Data Exporter, unless any successor entity has undertaken all the legal obligations of the Data Exporter due to an Agreement or by operation of law, in which case the Data Subject will file any claim against such entity. The Data Importer cannot claim the infringement of the data subcontractor in order to decline its own responsibilities.

(c) In case the Data Subject cannot file against the Data Exporter or the Data Importer the claim described in points a) and b) above for infringement by the data subcontractor of its obligations under sections 3 and 10 of this Agreement, due to the fact that both the Data Exporter and the Data Importer cannot be found, have ceased to legally exist or have become insolvent, the data subcontractor accepts that the Data Subject may action against him regarding its own data treatment instead of against the Data Exporter or Data Importer, unless any successor entity has undertaken all the legal obligations of the Data Exporter or the Data Importer due to an Agreement or by operation of law, in which case the Data Subject will file any claim against such entity. The liability of the data subcontractor will be limited to its own data treatment operations in accordance with the terms of this Agreement.

Section 7

Applicable law and jurisdiction

This Agreement is subject to the laws of the ARGENTINE REPUBLIC, particularly to Law No. 25,326, its regulations and the decisions issued by the ARGENTINE DATA PROTECTION DIRECTORATE and/or the AGENCY OF ACCESS TO PUBLIC INFORMATION, and any conflict related to Personal Data protection will be subject to the judicial and administrative jurisdiction of the ARGENTINE REPUBLIC.

Section 8

Resolution of conflicts with data subjects

(a) The Data Importer agrees that if the Data Subject invokes its rights as third party beneficiary or claims compensation for damages in accordance with the terms of this Agreement, it will abide by the Data Subject’s decision to: i) subject the matter to mediation before and independent mediator; ii) file a complaint before the AGENCY OF ACCESS TO PUBLIC INFORMATION; and iii) bring the matter before the argentine courts.

(b) The Parties agree that the Data Subject’s options will not hinder the Data Subject’s substantive or procedural rights to obtain compensation in accordance with any other national or international regulations.

Section 9

Cooperation with the controlling authorities

(a) The Parties agree that the Controlling Authority is entitled to audit the Data Importer or any data subcontractor, to the same extent and under the same conditions that it could audit the Data Exporter under Law No. 25,326, and must put their data treatment facilities at its disposal. The audit may be conducted by personnel from the Controlling Authority, by qualified third parties designated by the Controlling Authority or by local authorities with similar responsibilities in collaboration with the Controlling Authority.

(b) The Data Importer will immediately inform the Data Exporter if the legislation that applies to it or to any subcontractor does not allow audits to be conducted on the Data Importer or the subcontractors.

Section 10

Data sub-processing

(a) The Data Importer will not subcontract any data processing conducted on behalf of the Data Exporter without the Data Exporter’s prior written consent. If the Data Importer subcontracts its obligations it must execute a written Agreement with the subcontractor in which the subcontractor undertakes the same obligations as the Data Importer, insofar as they are compatible, in connection with the Data Exporter, the Data Subject, the Controlling Authority or third party beneficiaries. If the subcontractor cannot comply with its data protection obligations under such a written Agreement, the Data Importer will still be liable before the Data Exporter for the compliance of the data subcontractor’s obligations under such Agreement.

(b) The prior written Agreement between the Data Importer and the subcontractor will contain a third party beneficiary provision that will include the case in which the Data Subject cannot file a claim for compensation as described in point a) of section 6 against the Data Exporter or the Data Importer because both cannot be found, have ceased to legally exist or have become insolvent, and no successor entity has undertaken all the legal obligations of the Data Exporter or the Data Importer due to an Agreement by operation of law. The civil liability of the data subcontractor will be limited to its own data treatment operations in accordance with the terms of this Agreement.

(c) The provisions regarding data protection in case of data sub-processing will be subject to Argentine law. This requirement may be met by a contract between the Data Importer and the data subcontractor in which the data subcontractor cosigns the present Agreement.

(d) The Data Exporter will keep a list of any data sub-processing Agreements executed by the Data Importer, which it will update at least once a year. The list will be at the disposal of the Controlling Authority.

Section 11

Termination of the Agreement

(a) If the Data Importer infringes its obligations under the provisions of this Agreement, the Data Exporter must temporarily suspend the transfer of Personal Data to the Data Importer until the infringement is corrected within the time frame provided by the Data Exporter taking into account the severity of the situation, and notifying such situation to the Controlling Authority.

(b) The Agreement shall be terminated, and must be declared terminated by the Data Exporter with the prior intervention of the Controlling Authority, if: i) the Personal Data transfer to the Data Importer has been temporarily suspended by the Data Exporter for more than THIRTY (30) calendar days as provided by point a); ii) compliance by the Data Importer of the terms of this Agreement and the applicable law are contrary to the legal or regulatory provisions of the country of import; iii) the Data Importer substantially or persistently infringes any guarantee or undertaking contained in this Agreement; iv) there is a firm and definite decision, which cannot be appealed before any Argentine court or before the AGENCY OF ACCESS TO PUBLIC INFORMATION, which establishes that the Data Importer or the Data Exporter have infringed this Agreement; or v) the Data Exporter, notwithstanding the exercise of any other right that it may have against the Data Importer, may terminate this Agreement when: the judicial administration or liquidation of the Data Importer is requested and such request is not dismissed within the period established by the applicable law; the liquidation or bankruptcy of the Data Importer is declared; an administrator is named for any of the Data Importer’s assets; the Data Importer files for a judicial reorganization procedure; or the Data Importer is in any equivalent situation in any jurisdiction. In the cases foreseen by points i), ii) or iv) the Data Importer may also terminate the Agreement, without the prior intervention of the Controlling Authority.

(c) The Parties agree that the termination of this Agreement for any reason will not exempt them from complying with the obligations and conditions regarding the transferred Personal Data.

Section 12

Obligations upon conclusion of the Personal Data processing services

The Parties agree that, once the Personal Data processing services conclude for any reason, the Data Importer and the data subcontractor must, at the Data Exporter’s discretion, either return all the transferred Personal Data and any copies, or destroy them completely and certify this destruction before the Data Exporter, unless the legislation which applies to the Data Importer prevents the return or total or partial destruction of the transferred Personal Data, in which case it must verify that such conservation term does not violate the applicable data protection principles, and notify the Controlling Authority if it does.

Appendix A

to the Argentina Standard Contractual Clauses

This Appendix forms part of the Argentina Clauses.

The details of the transfer and in particular the Data Exporter, Data Importer, Data Subjects, Data Characteristics, and Treatment and Purpose are described at https://www.nuance.com/about-us/company-policies/terms/data-processing-terms/details.