1. Application
1.1 This Agreement applies where MAITS holds or processes personal information on the Customer's behalf in providing the services (Customer Personal Information). It forms part of the Master Services Agreement.
2. Roles
2.1 For Customer Personal Information, MAITS acts as the Customer's agent for the purposes of section 11 of the Privacy Act 2020 (New Zealand), and as a service provider to the Customer for the purposes of other applicable privacy laws. The Customer remains responsible for:
- the lawful collection of Customer Personal Information;
- notices to individuals; and
- the instructions it gives MAITS.
3. Processing
3.1 MAITS processes Customer Personal Information only to provide the services, on the Customer's documented instructions (the Contract being the main instruction), or as required by law.
3.2 MAITS ensures that personnel with access to Customer Personal Information are bound by confidentiality obligations.
4. Security
4.1 MAITS maintains reasonable security safeguards appropriate to the information, as described in the Hosting and Managed Services Schedule.
5. Sub-processors
5.1 The Customer authorises MAITS to use the providers listed in the Hosting and Data Residency Schedule. MAITS will update that Schedule before adding or replacing a provider that processes Customer Personal Information.
5.2 If the Customer reasonably objects to a new provider on data protection grounds, it may, as its sole remedy, cancel the affected subscription before the change takes effect, without charge.
6. Cross-border processing
6.1 The Customer acknowledges that some providers process information outside New Zealand, as described in the Hosting and Data Residency Schedule, and agrees to that processing.
6.2 Where the Customer is subject to laws such as the EU or UK General Data Protection Regulation, it must tell MAITS before sharing personal information that is subject to those laws. Any additional measures required will be agreed in an Order.
7. Privacy breaches
7.1 MAITS will notify the Customer without undue delay after becoming aware of a privacy breach affecting Customer Personal Information. MAITS will provide the information it reasonably can, to help the Customer assess and meet its notification obligations.
7.2 The Customer is responsible for notifying the Privacy Commissioner, affected individuals and any other regulator, except where the law requires MAITS to notify.
8. Requests and assistance
8.1 MAITS will refer access and correction requests it receives about Customer Personal Information to the Customer, and will provide reasonable assistance. Assistance beyond the normal operation of the services is charged at MAITS's rates.
9. Return and deletion
9.1 At the end of the services, MAITS returns or deletes Customer Personal Information as set out in the applicable Service Schedule, except where the law requires it to be kept.
10. Audit
10.1 On reasonable notice, and no more than once a year, MAITS will provide information reasonably needed to demonstrate its compliance with this Agreement. On-site audits are by agreement, and at the Customer's cost.