Data Protection Laws

Adonexus ensures compliance with the following data protection regulations:

• Regulation (EU) 2016/679: The General Data Protection Regulation (GDPR), which governs the processing and transfer of personal data within and outside the EU.
• UK GDPR & Data Protection Act 2018: Applies to data transfers involving the United Kingdom, as referenced in the UK International Data Transfer Addendum.
• Local Data Protection Laws: Includes provisions to assess the impact of local laws in the third country where the data is processed, ensuring that they do not conflict with GDPR principles.

Subprocessors and Their Rules for Handling Data

• Adonexus engages sub-processors to facilitate the provision of its services. The complete and up-to-date list of sub-processors is available at: Adonexus Subprocessors.
• Rules Governing Subprocessors Interactions with Data:
  1. Authorization:
     • The data importer (Adonexus) has the general authorization from the data exporter (Customer) to engage sub-processors from an agreed list.
     • Adonexus must inform the Customer in writing of any intended changes (new or replacement subprocessors) at least 30 days in advance, allowing the Customer to object.
  2. Contractual Obligations:
     • Subprocessors must enter into a written contract with Adonexus that imposes the same data protection obligations as those binding Adonexus under the Standard Contractual Clauses (SCCs).
     • This contract must include third-party beneficiary rights for data subjects.
  3. Liability:
     • Adonexus remains fully responsible for ensuring that subprocessors comply with data protection obligations.
     • If a sub-processor fails to fulfill its obligations, Adonexus must notify the Customer and take necessary actions.
  4. Third-Party Beneficiary Clause:
     • If Adonexus ceases to exist or becomes insolvent, the Customer has the right to terminate the subprocessor agreement and instruct the subprocessor to erase or return the personal data.