WorkDay_-_MSA_-_ERP_453086 - Laserfiche WebLink

Home

Confidential ©2022 Workday (UDPE Global v22.3) Page 3 City of San Leandro 3.2 Notification of New Subprocessors. Workday shall make available to Customer a Subprocessor List and provide Customer with a mechanism to obtain notice of any updates to the Subprocessor List. At least thirty (30) days prior to authorizing any new Subprocessor to Process Personal Data, Workday shall provide notice to Customer by updating the Subprocessor List. 3.3 Subprocessor Objection Right. This Section 3.3 shall apply only where and to the extent that Customer is established within the EEA, the UK or Switzerland or where otherwise required by Data Protection Laws applicable to new Subprocessor t to Section 3.2 above, provide written notice of such objection to Workday. Should Workday choose to retain the objected- to Subprocessor, Workday will notify Customer at least fourteen (14) days before authorizing the Subprocessor to Process Personal Data and Customer may terminate the relevant portion(s) of the Covered Service within thirty (30) days. Upon any termination by Customer pursuant to this Section, Workday shall refund Customer any prepaid fees for the terminated portion(s) of the Covered Service that were to be provided after the effective date of termination. 4. Data Subject Rights 4.1 Assistance with Data Subject Requests. Workday will, in a manner consistent with the functionality of the to respond to Data Subject requests to exercise their rights under applicable Data Protection Laws Data Subject Requests 4.2 Handling of Data Subject Requests.For the avoidance of doubt, Customer is responsible for responding to Data Subject Requests. If Workday receives a Data Subject Request or other complaint from a Data Subject regarding the Processing of Personal Data, Workday will promptly forward such request or complaint to Customer, provided the Data Subject has given sufficient information for Workday to identify Customer. 5. Workday Personnel Workday shall require screening of its personnel who may have access to Personal Data and shall require such personnel (i)to receive appropriate training on their responsibilities regarding the handling and safeguarding of Personal Data; and (iii) to be subject to confidentiality obligations which shall survive the termination of employment. 6. Personal Data Breach If Workday becomes aware of a Personal Data Breach, it shall without undue delay notify Customer in accordance with the Security Breach provisions of the MSA. Workday shall take appropriate measures to address and mitigate the adverse effects of the Personal Data Breach. To the extent Customer requires additional information from Workday to meet its Personal Data Breach notification obligations under applicable Data Protection Laws, Workday shall provide reasonable assistance to provide such information to Customer taking into account the nature of Processing and the information available to Workday. 7. Security of Processing Workday shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as described in the Universal Security Exhibit. 8. Audit -current SOC 1 and SOC 2 audit reports (or comparable industry-certifications will be used to satisfy any audit or inspection requests by or on behalf of Customer, and Workday shall make such reports available to Customer. If Customer requires additional information, including information necessary to demonstrate compliance with this DPE, or an audit related to the Program. Docusign Envelope ID: B7B2CF4A-C414-47B2-BF08-2BCDA4573B8E