SHL Global Data Processing Addendum

Last Updated: 6 June 2023

This SHL Global Data Processing Addendum and its Annexes (“DPA”) reflect the parties’ agreement with respect to the Processing of Personal Data by us on behalf of you in connection with the SHL Products and Services under the SHL Terms and Conditions between you and us (also referred to in this DPA as the “Agreement”). 

This DPA is supplemental to, and forms an integral part of, the Agreement and is effective upon its incorporation into the Agreement, which may be specified in the Agreement, an Order or an executed amendment to the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency.

The term of this DPA will follow the term of the Agreement. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement. For the purposes of this DPA, Company will be referred to as “you” and SHL will be referred to as “us” or “we”.

1. Definitions

“California Personal Information” means Personal Data that is subject to the protection of the CCPA.
“CCPA" means California Civil Code Sec. 1798.100 et seq. (also known as the California Consumer Privacy Act of 2018).
"Consumer", "Business", "Sell" and "Service Provider" will have the meanings given to them in the CCPA. 
“Data Controller” means the person, entity or other body which determines the purposes and means of the Processing of Personal Data, for South Africa shall include the Responsible Party under POPIA and in the People’s Republic of China Data Controller shall mean the data handler as defined under PIPL.
“Data Processor” means the person, entity or other body (other than an employee of the Data Controller) which Processes Personal Data on behalf of the Data Controller, for South Africa shall include the Operator under POPIA and in the People’s Republic of China Data Processor shall mean the entrusted party as defined under PIPL.
“Data Protection Laws” means all applicable worldwide legislation relating to data protection and privacy which applies to the respective party in the role of Processing Personal Data in question under the Agreement, including without limitation European Data Protection Laws; in each case as amended, repealed, consolidated or replaced from time to time.
“Data Subject” means the individual to whom Personal Data relates.
"Europe" means the European Union, the European Economic Area and/or their member states, Switzerland and the United Kingdom.
“European Data” means Personal Data that is subject to the protection of European Data Protection Laws.
"European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) in respect of the United Kingdom, any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union; and (iv) Swiss Federal Data Protection Act on 19 June 1992 and its Ordinance; in each case, as may be amended, superseded or replaced. 
“Instructions” means the written, documented instructions issued by a Data Controller to a Data Processor, and directing the same to perform a specific or general action with regard to Personal Data (including, but not limited to, depersonalizing, blocking, deletion, making available).
"Permitted Affiliates" means any of your Affiliates that (i) are permitted to use the Products and/or Services pursuant to the Agreement, but have not signed their own separate agreement with us, (ii) qualify as a Data Controller of Personal Data Processed by us, and (iii) are subject to European Data Protection Laws.
“Personal Data” means any data or information provided by you to, or collected by us in the course of providing the Products and/or Services that relates to a living individual who can be identified from that data, but excludes Aggregated Research Data and Benchmarking.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by us and/or our Sub-Processors in connection with the provision of the Products and/or Services. "Personal Data Breach" will not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
"PIPL” means the People’s Republic of China Personal Information Protection Law taking effect as of 1 November 2021 and any other applicable law or regulation relating to the processing of personal information and to privacy, and as such legislation shall be amended, revised or replaced from time to time.
“PIPL Personal Information” means personal information that is subject to the protection of PIPL.
“POPIA” means the South Africa Protection of Personal Information Act, 2013 (Act 4 of 2013) and any other applicable law or regulation relating to the processing of personal information and to privacy, and as such legislation shall be amended, revised or replaced from time to time.
“POPIA Personal Information” means personal information that is subject to the protection of POPIA.
“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. The terms “Process”, “Processes” and “Processed” will be construed accordingly.
“SHL Permitted Affiliates” means the SHL Affiliates who are permitted to process Personal Data as determined by the Platform location you select when using the SHL Services. The table of SHL Permitted Affiliates is available here: https://www.shl.com/legal/shl-permitted-affiliates/
“Standard Contractual Clauses” means the standard contractual clauses for Data Processors approved pursuant to the European Commission’s decision (EU) 2021/914 of 4 June 2021, in the form set out at www.shl.com/legal/terms-and-conditions/shl-pre-signed-european-standard-contractual-clauses ; as may be amended, superseded or replaced.
“Third-Party Sub-Processor” means any Data Processor engaged by us or our Affiliates to assist in fulfilling our obligations with respect to the provision of the Products and/or Services under the Agreement.  The current list of Third-Party Sub-Processors is available here: https://www.shl.com/legal/security-and-compliance/platforms-sub-processors/

2. Company Responsibilities

a. Compliance with Laws. Within the scope of the Agreement and in your use of the Products and/or Services, you will be responsible for complying with all requirements that apply to you under applicable Data Protection Laws and the Instructions you issue to us. In particular but without prejudice to the generality of the foregoing, you acknowledge and agree that you will be solely responsible for: (i) the accuracy, quality, and legality of Company Property and the means by which you acquired Personal Data; (ii) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including obtaining any necessary consents and authorizations; (iii) ensuring you have the right to transfer, or provide access to, the Personal Data to us for Processing in accordance with the terms of the Agreement (including this DPA); (iv) ensuring that your Instructions to us regarding the Processing of Personal Data comply with applicable laws, including Data Protection Laws; and (v) complying with all applicable laws (including Data Protection Laws). You will inform us without undue delay if you are not able to comply with your responsibilities under this sub-section (a).
b. Data Controller Instructions. The parties agree that the Agreement (including this DPA), together with your use of the Products and/or Services in accordance with the Agreement, constitute your complete and final Instructions to us in relation to the Processing of Personal Data, and additional instructions outside the scope of the Instructions shall require prior written agreement between us and you.

3. SHL Obligations

a. Compliance with Instructions. We will only Process Personal Data for the purposes described in this DPA or as otherwise agreed within the scope of your lawful Instructions, except where and to the extent otherwise required by applicable law. We are not responsible for compliance with any Data Protection Laws applicable to you or your industry that are not generally applicable to us.  We shall cooperate with any request from you for Personal Data provided by or through you to us, as applicable, provided that such request does not violate the terms of the Agreement.
b. Conflict of Laws. If we become aware that we cannot Process Personal Data in accordance with your Instructions due to a legal requirement under any applicable law, we will (i) promptly notify you of that legal requirement only within the scope of, and to the extent permitted by, the applicable law; and (ii) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as you issue new Instructions with which we are able to comply. If this provision is invoked, we will not be liable to you under the Agreement for any failure to provide and/or perform the applicable Products and/or Services until such time as you issue new lawful Instructions for the Processing.
c. Security. We will implement and maintain an effective information security program that: (i) includes administrative, technical, and physical safeguards and (ii) has appropriate technical and organizational measures to protect Personal Data from Personal Data Breaches, as described under Annex 2 to this DPA ("Security Measures"). The Security Measures are adequate to ensure the security and confidentiality of Personal Data and protects against: (1) anticipated threats or hazards to the security or integrity of Personal Data, (2) unauthorised access to or use of Personal Data, (3) unlawful processing or processing otherwise than in accordance with the Agreement, and (4) accidental loss, destruction, damage, alteration or disclosure of Personal Data. The Security Measures shall include (as a minimum): (i) implementing the measures prescribed by Data Protection Legislation, and/or the Agreement; (ii) taking reasonable steps to ensure the reliability of personnel having access to the Personal Data; and (iii) implementing and maintaining reasonable disposal measures and training of personnel accessing Personal Data. Notwithstanding any provision to the contrary, we may modify or update the Security Measures at our discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures. 
d. Confidentiality. We will ensure that any personnel whom we authorize to Process Personal Data on our behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Personal Data.
e. Personal Data Breaches. We will (i) notify you without undue delay, and at the latest within 48 hours, after we become aware of any Personal Data Breach and will provide timely information relating to the Personal Data Breach as it becomes known or reasonably requested by you; and (ii) not notify any Third Parties of the involvement of Company’s Personal Data in the Personal Data Breach without Company’s prior permission, not to be unreasonably withheld. We shall immediately investigate and take appropriate remedial actions to mitigate the effects of the Personal Data Breach in accordance with applicable laws, regulations and industry standards. At your request, we will (i) promptly provide you with such reasonable assistance as necessary to enable you to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if you are required to do so under Data Protection Laws; and (ii) provide you with a summary report of our investigation and remediation activities.
f. Deletion or Return of Personal Data. We will delete or return all Company Property, including Personal Data (including copies thereof) Processed pursuant to this DPA, on your written instruction, save that this requirement shall not apply to the extent we are required by applicable law to retain some or all of the Company Property, or to Company Property we have archived on back-up systems, which data we will securely isolate and protect from any further Processing and delete in accordance with its deletion practices.

4. Data Subject Requests

Upon your written request we will provide reasonable assistance to you for you to respond to any Data Subject Requests or requests from data protection authorities relating to the Processing of Personal Data under the Agreement. You shall reimburse us for the commercially reasonable costs arising from this assistance. If a Data Subject Request or other communication regarding the Processing of Personal Data under the Agreement is made directly to us, we will provide our standard responses to Data Subject which will advise the Data Subject to submit their request to you. You will be solely responsible for responding substantively to any such Data Subject Requests or communications involving Personal Data.

5. Sub-Processors

You agree that we may engage Third-Party Sub-Processors and SHL Permitted Affiliates (together the “Sub-Processors”) to Process Personal Data on your behalf. We will notify you if we add or remove Sub-Processors prior to any such changes, if you opt-in to receive such email notifications by completing the form available at https://www.shl.com/legal/security-and-compliance/. Where we engage Sub-Processors, we will impose data protection terms that provide at least the same level of protection for Personal Data as those in this DPA (including, where appropriate, the Standard Contractual Clauses), to the extent applicable to the nature of the services provided by such Sub-Processors. We will remain responsible for each Sub-Processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause us to breach any of its obligations under this DPA.

6. Data Transfers

You acknowledge and agree that we may access and Process Personal Data on a global basis as necessary to provide the Products and/or Services in accordance with the Agreement, and in particular that Personal Data will be transferred to, and Processed by SHL in other jurisdictions where Sub-Processors have operations. We will ensure such transfers are made in compliance with the requirements of Data Protection Laws.

7. Additional Provisions for European Data

a. Scope of Section 7. This 'Additional Provisions for European Data' section shall apply only with respect to European Data.
b. Roles of the Parties. When Processing European Data in accordance with your Instructions, the parties acknowledge and agree that you are the Data Controller of European Data and we are the Data Processor.
c. Instructions. If we believe that your Instruction infringes European Data Protection Laws (where applicable), we will, only within the scope of, and to the extent permitted by, the European Data Protection Laws, inform you without delay.
d. Notification and Objection to New Sub-Processors. We will notify you of any changes to Sub-processors by way of the notification mechanism set out under section 5 of the DPA and will give you the opportunity to object to the engagement of the new Sub-Processor on reasonable grounds relating to the protection of Personal Data within 30 days after providing such notification. If you do notify us of such an objection, the parties will discuss your concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, we will, at our sole discretion, either not appoint the new Sub-Processor, or permit you to suspend or terminate the affected Products and/or Service in accordance with the termination provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by you prior to suspension or termination).
e. Data Protection Impact Assessments and Consultation with Supervisory Authorities. To the extent that the required information is reasonably available to us, and you do not otherwise have access to the required information, we will provide reasonable assistance to you, and within timescales reasonably requested by you, with any data protection impact assessments, and prior consultations with supervisory authorities or other competent data privacy authorities to the extent required by European Data Protection Laws.
f. Transfer Mechanisms for Data Transfers. 
(A) SHL shall not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer complies with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws.
(B) The parties acknowledge and agree the following:

(i) Standard Contractual Clauses: SHL agrees to abide by and process European Data in compliance with the Standard Contractual Clauses. SHL Group have entered into an Intragroup Agreement which includes the Standard Contractual Clauses for the processing of Personal Data outside the EEA. At Company’s request, SHL and SHL Permitted Affiliates will enter into Standard Contractual Clauses as agent on behalf of Company for transferring Personal Data outside the EEA.

(ii) The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, SHL will be deemed the "data importer" and Company will be deemed the "data exporter" (notwithstanding that you may yourself be located outside Europe and/or be acting as a processor on behalf of third party controllers); and (ii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict.

g. Demonstration of Compliance. We will make all information reasonably necessary to demonstrate compliance with the obligations in Article 29 (Processor) of the GDPR. You acknowledge and agree that our then-current ISO 27001 certification will be used to satisfy any audit or inspection requests by or on behalf of you, and we shall make such reports available to you on request. Further, at your written request, we will provide written responses (on a confidential basis) to all reasonable requests for information made by you necessary to confirm our compliance with this DPA, provided that you will not exercise this right more than once per calendar year.

8. Additional Provisions for California Personal Information

a. Scope of Section 8. The 'Additional Provisions for California Personal Information' section of the DPA will apply only with respect to California Personal Information.
b. Roles of the Parties. When processing California Personal Information in accordance with your Instructions, the parties acknowledge and agree that you are a Business and we are a Service Provider for the purposes of the CCPA.
c. Responsibilities. The parties agree that we will Process California Personal Information as a Service Provider strictly for the purpose of performing the Products and/or Services under the Agreement (the "Business Purpose") or as otherwise permitted by the CCPA. 

9. Additional Provisions for POPIA Personal Information

a. Scope of Section 9. The 'Additional Provisions for POPIA Personal Information' section of the DPA will apply only with respect to POPIA Personal Information.
b. Roles of the Parties. When processing POPIA Personal Information in accordance with your Instructions, the parties acknowledge and agree that you are the Responsible Party and SHL is the Operator for the purposes of POPIA.
c. Responsibilities. The parties agree that SHL will Process POPIA Personal Information as the Operator strictly for the purpose of providing the Products and/or Services under the Agreement (the "Business Purpose") or as otherwise permitted by POPIA. 

10. Additional Provisions for PIPL Personal Information

a. Scope of Section 10. The 'Additional Provisions for PIPL Personal Information' section of the DPA will apply only with respect to PIPL Personal Information.
b. Roles of the Parties. When processing PIPL Personal Information in accordance with your Instructions, the parties acknowledge and agree that you are the data handler and SHL is the entrusted party for the purposes of PIPL.
c. Responsibilities. The parties agree that SHL will Process PIPL Personal Information as the entrusted party strictly for the purpose of providing the Products and/or Services under the Agreement (the "Business Purpose") or as otherwise permitted by PIPL. 

11. General Provisions

a. Amendments. Notwithstanding anything else to the contrary in the Agreement and without prejudice to the ‘Compliance with Instructions’ or ‘Security’ sections of this DPA, we reserve the right to make any updates and changes to this DPA.
b. Severability. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.
c. Limitation of Liability. Subject to the Agreement, SHL’s total aggregate liability arising out of its breach of its obligations as a Data Processor under this DPA will be limited to the amount directly attributed to SHL’s actions or failure to comply with this DPA in providing the Products and/or performing the Services. The following shall be considered direct damages recoverable under the Agreement to the extent they result directly from SHL’s breach of this DPA: (i) any costs and expenses incurred by you to investigate and repair damage to Personal Data; (ii) any costs incurred by you in connection with legally-mandated notices; (iii) fines, penalties and interest assessed against you due to the breach; and (iv) reasonable attorneys’ fees.
d. Governing Law. This DPA will be governed by and construed in accordance with the laws and jurisdiction set out in the Agreement unless required otherwise by Data Protection Laws.

12. Parties to this DPA

a. Permitted Affiliates. By signing the Agreement, you enter into this DPA on behalf of yourself and, to the extent required under applicable Data Protection Laws, in the name and on behalf of your Permitted Affiliates, thereby establishing a separate DPA between us and each such Permitted Affiliate subject to the Agreement and the ‘General Provisions’ and ‘Parties to this DPA’ sections of this DPA. Each Permitted Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. For the purposes of this DPA only, and except where indicated otherwise, the terms “Company”, “you” and “your” will include you and such Permitted Affiliates.
b. Authorization. The legal entity agreeing to this DPA as the Company represents that it is authorized to agree to and enter into this DPA for and on behalf of itself and, as applicable, each of its Permitted Affiliates.
c. Remedies. Except where applicable Data Protection Laws require a Permitted Affiliate to exercise a right or seek any remedy under this DPA against us directly by itself, the parties agree that (i) solely the Company entity that is the contracting party to the Agreement will exercise any right or seek any remedy any Permitted Affiliate may have under this DPA on behalf of its Affiliates, and (ii) the Company entity that is the contracting party to the Agreement will exercise any such rights under this DPA not separately for each Permitted Affiliate individually but in a combined manner for itself and all of its Permitted Affiliates together. The Company entity that is the contracting entity is responsible for coordinating all communication with us under the DPA and will be entitled to make and receive any communication related to this DPA on behalf of its Permitted Affiliates.  
d. Other rights. The parties agree that you will, when reviewing our compliance with this DPA pursuant to the ‘Demonstration of Compliance’ section, take all reasonable measures to limit any impact on us and our Affiliates by combining several audit requests carried out on behalf of the Company entity that is the contracting party to the Agreement and all of its Permitted Affiliates in one single audit.

Annex 1 to DPA - Details of Processing

This Annex forms part of the DPA. 

A: Subject Matter of Processing

SHL Products and Services, namely talent assessment services.

B: Nature and Purpose of Processing

We will Process Personal Data as necessary to provide the Products and/or Services pursuant to the Agreement, as further specified in the Order Form, and as further instructed by you in your use of the Products and/or Services.

The Data Subject will take the assessment using SHL’s online assessment systems.  Assessment responses will be evaluated to produce an assessment report with results, which SHL will provide to Company. SHL may perform surveys or other processing operations at Company’s request. Company will have access to candidate data, including assessment results, and the platform interface.

C.  Duration of Processing 

Subject to the 'Deletion or Return of Personal Data' section of this DPA, we will Process Personal Data for the duration of the Agreement, unless otherwise agreed in writing.  

D: Categories of Data Subjects

You and your end users may submit Personal Data while using the Products and/or Services, the extent of which is determined and controlled by you/them in your/their sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of Data Subjects:

Company employment candidates and/or employees

E: Categories of Personal Data

You and your end users may submit Personal Data while using the Products and/or Services, the extent of which is determined and controlled by you/them in your/their sole discretion, and which may include but is not limited to the following categories of Personal Data: 

• Name, Email Address, Gender, Language, Company ID, employee demographic information, responses to assessments or surveys, audio recordings, visual images 
  
  
• Any other Personal Data request by, submitted by, sent to, or received by you, or your end users, while using the Products and/or Services.

F: Special categories of data (if appropriate)

The parties do not anticipate the transfer of special categories of data.

G: Processing operations

Personal Data will be Processed in accordance with the Agreement (including this DPA) and may be subject to the following Processing activities: 

a. Storage and other Processing necessary to provide, maintain and improve the Products and/or Services provided to you; and/or

b. Disclosure in accordance with the Agreement (including this DPA) and/or as compelled by applicable laws.

Annex 2 to DPA - Security Measures

We currently observe the Security Measures described in SHL’s Information Security Policy available here: https://www.shl.com/legal/security-and-compliance/information-security/