Binding Corporate Rules

Binding Corporate Rules14. Relationships between Controllers and Processors that are DSV Group Members 14.1 When a DSV Group Member (DSV Group Member Processor) processes Personal Data on behalf of another DSV Group Member (DSV Group Member Controller), the following safeguards shall be followed and complied with: 14.1.1 By signing the Agreement regarding P rocessing and transfer of Personal Data under DSV’s BCR (cf. Annex 2, Appendix 2), the DSV Group Member Controller and the DSV Group Member Processor(s) undertake to comply with the obligations set out in these BCRs in relation to the Processing of Personal Data in question. Covering the general Processing activities carried out on behalf of DSV Group Members by DSV A/S as the parent company, including intragroup shared services, the DSV Group Member Controller and DSV A/S enter into a contract as an integrated part of the Agreement regarding Processing and transfer of Personal Data (cf. Annex 2, Appendix 2). 14.1.2 The DSV Group Member Processor must provide adequate measures in order to secure the confidentiality and security of the Personal Data processed. 14.1.3 The DSV Group Member Processor must provide the DSV Group Member Controller with sufficient guarantees in respect of inter alia the technical security measures and organisational measures governing the Processing to be carried out and must ensure compliance with those measures in accordance with the requirements in section 13. 14.1.4 The DSV Group Member Processor must process Personal Data only on documented instructions from the DSV Group Member Controller, including with regard to transfers of Personal Data to a third country, unless the DSV Group Member Processor is required to do so by Union or Member State Law (e.g. requests by intelligence agencies or other authorities), in which case the DSV Group Member Processor shall promptly notify the DSV Group Member Controller and the GPR unless the law prohibits such information on important grounds of public interests. The DSV Group Member Processor shall immediately notify the DSV Group Member Controller if in the DSV Group Member Processor’s opinion, an instruction infringes the Regulation or other Union or Member State Law. 14.1.5 According to the contract cf. section 14.1.1 between the DSV Group Member Controller and the DSV Group Member Processor, the latter specifically undertakes to: i. implement appropriate technical and organisational measures to sufficiently protect the Personal Data against any accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access; ii. only process and use the Personal Data as necessary to carry out the performance of services as instructed by the DSV Group Member Controller; iii. ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; iv. not transfer or otherwise disclose Personal Data to other DSV Group Members without the prior explicit Consent of the DSV Group Member Controller except as set out in section 14.1.4; 20Page 1Page 3