THIS AGREEMENT is dated                        05 June           2018

Parties

(1)             URBAN STAY LIMITED (trading as Urban Stay Limited) incorporated and registered in England and Wales with company number 8964797 whose registered office is at 122 Middlesex Street, London, E1 7HY (Urban Stay Limited); and

(2)             All trading partners

Background

• Urban Stay Limited provides serviced accommodation to the Company and/or its customers from time to time in accordance with Urban Stay Limited’s terms and conditions.
• Under the terms of the arrangement between the parties, personal information may be passed between the parties. In light of the new laws of data protection, the parties intend that the clauses in this agreement apply to all bookings made by the Company.

Agreed Terms

1. Interpretation

The following definitions and rules of interpretation apply in this agreement.

1.1             Definitions:

2. DATA PROTECTION

2.1             Shared Personal Data. Each party acknowledges that one party (the Data Discloser) will regularly disclose to the other party (the Data Recipient) Shared Personal Data collected by the Data Discloser for the Agreed Purposes.

2.2             Effect of non-compliance with Data Protection Legislation. Each party shall comply with all the obligations imposed on a controller under the Data Protection Legislation, and any material breach of the Data Protection Legislation by one party shall, if not remedied within 30 days of written notice from the other party, give grounds to the other party to terminate this agreement with immediate effect.

2.3             Particular obligations relating to data sharing. Each party shall:

(a)       ensure that it has all necessary notices and consents in place to enable lawful transfer of the Shared Personal Data to the Permitted Recipients for the Agreed Purposes;

(b)       give full information to any data subject whose personal data may be processed under this agreement of the nature such processing. This includes giving notice that, on the termination of this agreement, personal data relating to them may be retained by or, as the case may be, transferred to one or more of the Permitted Recipients, their successors and assignees;

(c)       process the Shared Personal Data only for the Agreed Purposes;

(d)       not disclose or allow access to the Shared Personal Data to anyone other than the Permitted Recipients;

(e)       ensure that all Permitted Recipients are subject to written contractual obligations concerning the Shared Personal Data (including obligations of confidentiality) which are no less onerous than those imposed by this agreement;

(f)        ensure that it has in place appropriate technical and organisational measures, reviewed and approved by the other party, to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data;

(g)       not transfer any personal data received from the Data Discloser outside the EEA unless the transferor:

(i)        complies with the provisions of Articles 26 of the GDPR (in the event the third party is a joint controller); and

(ii)       ensures that (i) the transfer is to a country approved by the European Commission as providing adequate protection pursuant to Article 45 GDPR; (ii) there are appropriate safeguards in place pursuant to Article 46 GDPR; or (iii) one of the derogations for specific situations in Article 49 GDPR applies to the transfer.

2.4             Mutual assistance. Each party shall assist the other in complying with all applicable requirements of the Data Protection Legislation. In particular, each party shall:

(a)       consult with the other party about any notices given to data subjects in relation to the Shared Personal Data;

(b)       promptly inform the other party about the receipt of any data subject access request;

(c)       provide the other party with reasonable assistance in complying with any data subject access request;

(d)       not disclose or release any Shared Personal Data in response to a data subject access request without first consulting the other party wherever possible;

(e)       assist the other party, at the cost of the other party, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(f)        notify the other party without undue delay on becoming aware of any breach of the Data Protection Legislation;

(g)       at the written direction of the Data Discloser, delete or return Shared Personal Data and copies thereof to the Data Discloser on termination of this agreement unless required by law to store the personal data;

(h)       use compatible technology for the processing of Shared Personal Data to ensure that there is no lack of accuracy resulting from personal data transfers;

(i)         maintain complete and accurate records and information to demonstrate its compliance with this agreement and allow for audits by the other party or the other party’s designated auditor; and

(j)         provide the other party with contact details of at least one employee as point of contact and responsible manager for all issues arising out of the Data Protection Legislation, including the joint training of relevant staff, the procedures to be followed in the event of a data security breach, and the regular review of the parties’ compliance with the Data Protection Legislation.

2.5             Indemnity. Each party shall indemnify the other against all liabilities, costs, expenses, damages and losses (including but not limited to any direct, indirect or consequential losses, loss of profit, loss of reputation and all interest, penalties and legal costs (calculated on a full indemnity basis) and all other reasonable professional costs and expenses) suffered or incurred by the indemnified party arising out of or in connection with the breach of the Data Protection Legislation by the indemnifying party, its employees or agents, provided that the indemnified party gives to the indemnifier prompt notice of such claim, full information about the circumstances giving rise to it, reasonable assistance in dealing with the claim and sole authority to manage, defend and/or settle it. The liability of the indemnifying party under this clause shall be subject to the limits set out in Urban Stay Limited’s terms and conditions.

3. Conflicts

3.1             Unless otherwise expressly stated in this agreement:

(a)       nothing in this agreement relieves either party of any responsibilities or liabilities under any Data Protection Legislation; and

(b)       the terms of this agreement shall prevail over any other provision of the Urban Stay Limited’s terms and conditions in the event of any conflict.

4. Counterparts

4.1             This agreement may be executed in any number of counterparts, each of which when executed shall constitute a duplicate original, but all the counterparts shall together constitute the one agreement.

5. Governing law and jurisdiction

5.1             This agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the law of England and Wales.

5.2             The parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this agreement or its subject matter or formation.