Personal Data Protection Policy – TMF Group

1. Introduction, Scope and Purpose

This Personal Data Protection Policy ("Policy") describes the privacy practices of TMF regarding processing Personal Data of Client Data Subjects and – to the extent applicable – the customers of the Client and/or the relevant Client Affiliates, as part of provision of Services to its Clients. Personal Data can be stored in TMF systems, Client systems or third-party systems to which TMF is provided access to for the purpose of providing Services. Where TMF provides Services to its Client and processes Personal Data on Client’s behalf, TMF will be acting as Processor and the Client will be acting as Controller.

The Policy applies globally to any and all Services provided by TMF to its Clients under the Service Agreements where TMF is acting as Processor, executed on or after the effective date of this Policy.

TMF processes Personal Data on behalf of the Client in accordance with Data Protection Laws. Insofar necessary, the Service Agreement will be supplemented with an addendum to set out any additional matters that are specific to the Client and cannot be regulated in this Policy.

This Policy does not apply to the processing of Personal Data for which TMF is considered a Controller of that data. Such processing is governed by the Privacy Statement of TMF Group and any other relevant privacy statement or policy presented to the Client or to other data subjects whose/which Personal Data TMF processes as Controller.

The Policy is available through the TMF Group website at the following link: https://www.tmf- group.com/en/legal/data-protection/. TMF reserves the right to update this Policy without consulting or pre-informing its Clients. 

Notwithstanding the foregoing, the version of the Policy that applies and will continue to apply to a particular Service Agreement will be the version of the Policy that is in effect at the time of the effective date of such Service Agreement, unless amendments are required to comply with Data Protection Laws in which case the most recent version of the Policy published on the website shall apply.

2. Personal data processed by TMF

Details of the Personal Data that will be processed by TMF on behalf of the Client, including the duration, purpose and types and categories of Personal Data, as well as Subprocessors, if any, will be set out on TMF Group website pages Details of Processing  and Subprocessors respectively.

Where additional authorizations or consents are required from the Client Data Subjects under applicable Data Protection Laws to process Personal Data on behalf of the Client, the Client shall collect such authorization or consent from the Client Data Subjects for the respective processing activity of the Personal Data, as required under Data Protection Laws.

3. Use of personal data

TMF shall not process, transfer, modify, amend or alter Personal Data or disclose or permit disclosure of Personal Data to any third party other than:

• as necessary to process Personal Data to provide the Services and/or otherwise in accordance with the documented instructions of Client, or
• as required to comply with Data Protection Laws or other laws which TMF is subject to, in which case TMF shall (to the extent permitted by law) inform Client of that legal requirement before processing Personal Data.

In addition, TMF is allowed to use aggregated data – to the extent this can no longer be considered Personal Data and which is, therefore, not subject to Data Protection Laws - for analysing purposes, for website and for internal operations, including troubleshooting, data analysis, testing, research, for statistical purposes, for developing and improving Services and products of TMF as well as benchmarking.

4. Subprocessing

TMF may be required to appoint certain third parties, including TMF Affiliates, to provide part of Services to Client or assist with providing technical support, such as IT service providers or other suppliers.

By signing the Service Agreement Client authorises TMF to subcontract processing Personal Data to Subprocessors in the relevant countries where Services will be rendered as listed on Subprocessors  page. Subprocessors are in each case subject to the terms between TMF and Subprocessor which are no less protective than those set out in the Policy and the Service Agreement.

TMF will inform the Client of the details of such Subprocessor(s) upon written request from the Client. TMF will inform the Client in advance of any intended changes concerning the addition or replacement of Subprocessors and thereby give the Client the opportunity to object to such changes. If the Client does not provide its contact details on the Subprocessors page or does not object in writing within fifteen (15) calendar days of receipt of the notice, the Client is deemed to have accepted the new Subprocessor. If the Client does object in writing within fifteen (15) calendar days of receipt of the notice, TMF and the Client will discuss possible resolutions within a reasonable timeframe and without detriment to the Parties and to their compliance with each of their respective obligations set forth in the Service Agreement.

Where the TMF Affiliate were to appoint another TMF Affiliate to process Client Personal Data on behalf of Client, TMF Affiliate will inform the Client in advance of such appointment and thereby give the Client an opportunity to object to such change. If the Client does not object in writing within five (5) calendar days of receipt of the notice, the Client has deemed to have accepted the respective TMF Affiliate as a new Subprocessor.

5. Confidentiality and security

TMF shall keep Personal Data confidential and will ensure its staff and Subprocessors are bound by the same confidentiality obligation. TMF shall implement appropriate technical and organisational measures to ensure a level of security of Personal Data appropriate to the risk required pursuant to applicable Data Protection Laws and, shall take all measures required pursuant to Article 32 GDPR (security of processing) and any other more protective corresponding requirement under Data Protection Laws.

In assessing the appropriate level of security, TMF shall take account in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

The security measures are further described and specified in the document "Statement of Continuity", which is published on the TMF website (Insert URL). Any subsequent versions of the document Statement of Continuity shall be applicable to the Service Agreement and its content will be no less stringent than its previous version.

6. Co-operating with requests of client

TMF shall, upon request and to the extent required under Data Protection Laws, co-operate with requests of Client that relate to processing of Personal Data. In particular, TMF shall co-operate with requests that relate to Client Data Subject rights, data protection impact assessments and Data Protection Audit rights as described below.

Client Data Subject rights: TMF shall co-operate as requested by Client to enable the Client to comply with its obligations with any exercise of rights by Client Data Subject in respect of Personal Data and reasonably assist Client in its compliance with any assessment, enquiry, notice or investigation as required under Data Protection Laws. In case the assistance provided by TMF to the Client exceeds the reasonable assistance, the Client shall reimburse TMF in full for all costs (including for internal resources and any third party costs) reasonably incurred by TMF providing the assistance that exceeds the reasonable limits in performing its obligation to assist Client in its compliance under this section.

Data protection impact assessment: TMF shall provide reasonable assistance to the Client with any data protection impact assessments which are required under Data Protection Laws, including Article 35 GDPR or other corresponding obligations determined by Data Protection Laws, and with any prior consultations to any supervisory authority of the Client which are required under Data Protection Laws, including Article 36 GDPR or other corresponding obligations determined by Data Protection Laws, in each case in relation to Processing of Personal Data by TMF on behalf of the Client and taking into account the nature of the processing and information available to TMF.

Audit rights: On reasonable request and notice, TMF will co-operate in the conduct of any Data Protection Audit or inspection, reasonably necessary to demonstrate TMF's compliance with Processor’s obligations laid down in Data Protection Laws and the Policy related to the Service Agreement, provided always that this requirement will not oblige TMF to provide or permit access to information concerning: (i) TMF internal pricing information, (ii) information relating to TMF's other Clients, (iii) any of TMF non-public external reports, or (iv) any internal reports prepared by TMF's internal audit function.

The Client shall avoid causing any damage, injury or disruption to TMF's equipment, personnel and business in the course of such Data Protection Audit or inspection.

A maximum of one Data Protection Audit may be activated under this section in any twelve (12) month period at no additional cost to the Client, unless (i) the audit is following upon a Personal Data Breach caused by TMF in the same period, (ii) the Data Protection Audit request made by the Client in the same period would exceed commercially reasonable market audit standard costs and/or (iii) Data Protection Audit request made by the Client in the same period would require allocation of TMF internal resources for more than one (1) business day in order to fulfil the request. In the foregoing events, TMF will promptly notify Client of such additional expected costs in advance, for which Client and TMF will agree to such costs prior to initiating the referred Data Protection Audit request. Any further Data Protection Audit within the referred twelve (12) month period shall be at the Client’s expense.

The Client’s requests provided in this section 6 of the Policy will be fulfilled in close co-operation with and under supervision of TMF's Chief Security and Resilience Officer, TMF’s Chief Privacy Officer, or similar stakeholders of TMF local officials.

7. Deletion or return of client personal data

TMF will, at the choice of Client, delete or return Personal Data at the end of the provision of the Services involving processing, unless (i) Data Protection Laws, (ii) any law, statute, order, regulation, rule, requirement, practice and guidelines of any government, regulatory authority or self-regulating organization that applies to the Services in the country where those Services are being provided, or (iii) competent court, supervisory or regulatory body, require the retention of such Personal Data by TMF.

8. Incident management

TMF shall notify Client without undue delay after becoming aware of a Personal Data Breach, providing the Client with sufficient information which allows the Client to meet any obligations to report a Personal Data Breach under Data Protection Laws.

Upon request by the Client, TMF shall fully co-operate with the Client and take such reasonable steps as are directed by the Client to assist in the investigation, mitigation and remediation of each Personal Data Breach, in order to enable the Client to (i) perform a thorough investigation into the Personal Data Breach and provide incident details as required under Data Protection Laws such as Article 33(3) GDPR or other corresponding obligations determined by Data Protection Laws, (ii) formulate a correct response and (iii) take suitable further steps in respect of the Personal Data breach in order to meet any requirement under the Data Protection Laws (“Remediation Measures”).

If TMF caused the Personal Data Breach, TMF shall bear the reasonable costs of Remediation Measures taken by TMF.

If and to the extent costs incurred by TMF related to Remediation Measures as directed by the Client are related to the Personal Data Breach caused by the Client, the Client shall compensate reasonable costs of the Remediation Measures taken by TMF. Any costs borne by TMF that exceed those reasonable costs for Remediation Measures shall be mutually agreed by parties to Service Agreement in advance.

Remediation Measures shall: (i) start without undue delay, (ii) be completed within a reasonable period after TMF has become aware of a Personal Data Breach, and (iii) be carried out within the regular business hours of TMF where Remediation Measures are required to be taken.

9. International transfers of personal data

Always subject to section 3 and section 4 of this Policy and in the event the Services require international transfers of Personal Data between TMF, TMF Affiliate(s) and/or any Subprocessor(s), the following shall apply (insofar relevant):

a. Transfer to TMF Affiliates in or from EU. Personal Data may be transferred to:

(i) one or more of TMF Affiliates in either one or more member states of the European Economic Area ("EEA"), Switzerland or the UK on the basis of Data Protection Laws; or

(ii) one or more of the TMF's Affiliates in one or more third countries on the basis of the Binding Corporate Rules, which are published on the website of TMF Group (Insert URL).

The Client or the relevant TMF Affiliate shall upon request of the Client Data Subject provide the Client Data Subject with a copy of such Binding Corporate Rules and this Policy (without any business sensitive or confidential information).

Where permitted by Data Protection Laws, TMF shall obtain all relevant authorizations or permits for such transfer of Personal Data based on such Binding Corporate Rules. Where Data Protection Laws do not allow TMF to obtain such authorization or permit for itself, the Client shall in a timely manner issue a required authorisation to TMF and any other relevant TMF Affiliate.

In the event the Binding Corporate Rules were not recognized or applicable under Data Protection Laws of a specific jurisdiction, TMF and the relevant TMF Affiliate(s) will undertake the necessary actions to satisfy the cross-border transfer requirements applicable to Personal Data under the Data Protection Laws of that jurisdiction.

b. Transfer to Subprocessors in or from EU. The Personal Data may be transferred to:

(i) one or more Subprocessors (other than TMF Affiliates) in one or more member states of the EEA, Switzerland or the UK on the basis of Data Protection Laws pursuant to the Clients authorisation under section 4 of this Policy; or

(ii) to one or more such Subprocessors in one or more third countries on the basis of an exception under Data Protection Laws; or

(iii) on the basis of adequate safeguards added either, insofar as allowed under Data Protection Laws, by TMF to ensure the protection of the Personal Data, or by the Client, in which case TMF shall cooperate with the Client to seek an adequate basis for the cross-border transfer of Personal Data to such Subprocessor. At the Client's request, TMF shall inform the Client of the applicable basis for the cross-transfer of the Personal Data.

c. Transfer between Client and TMF. Where the Services provided by TMF would require an international transfer of Personal Data from one of the parties, either Client or TMF, located in a member state of the EEA to another party, respectively Client or TMF, located in a country not supported by an adequacy decision from the EU Commission for the cross-border transfer of Personal Data, the Client and TMF will duly execute the relevant EU Standard Contractual Clauses for such specific transfer, pursuant to the requirements set forth under the GDPR.

d. Other transfers. Pursuant to the Data Protection Laws outside the EEA, Switzerland or the UK applicable to the Personal Data Processed to render the Services, the Client – acting as Controller – shall ensure that any cross-border transfer of Personal Data from TMF to a Subprocessor shall be allowed, by implementing additional safeguards as required under those Data Protection Laws. If such Data Protection Laws would require further information to be provided to the Client Data Subjects or further consents to be obtained by the Controller, the Client shall take these additional steps before the transfer to TMF and or TMF Affiliates is taking place.

10. Liability

Client warrants that Personal Data processed by TMF on behalf of the Client has been and shall be processed by the Client in accordance with Data Protection Laws, including without limitation:

a. ensuring that all notifications to and approvals from regulators which are required by Data Protection Laws are made and maintained by the Client; and

b. ensuring that all Personal Data is processed fairly and lawfully, is accurate and up to date and that a fair notice is provided by the Client to Client Data Subjects which described processing to be undertaken by TMF or its Subprocessors pursuant to the Services agreed upon in the Service Agreement.

TMF shall be liable for the damage caused by processing only where it has not complied with obligations of Data Protection Laws specifically directed to Processor or where it has acted outside or contrary to lawful instructions of the Client as indicated in the Service Agreement. Client shall be liable for the damage caused by processing by Client which infringes Data Protection Laws. TMF shall be exempt from liability under this section 10 of the Policy if it proves that it is not in any way responsible for the event giving rise to the damage.

Where more than one Controller or Processor, or both Controller and Processor, are involved in the same processing and where they are, under the Service Agreement, responsible for any damage caused to Client Data Subject by processing, each Controller or Processor shall be held liable for the entire damage in order to ensure effective compensation of Client Data Subject(s). Where Controller or Processor has paid full compensation for the damage suffered, that Controller or Processor shall be entitled to claim back from the other Controller(s) or Processor(s) involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in the previous paragraph.

Save for this section 10 third paragraph of the Policy, the indemnities, liabilities and exclusions or limitations thereof set out in the Service Agreement, shall also apply to the obligations of the parties pursuant to the Policy and the Service Agreement, and in case of any conflict will prevail.

11. Contact us

If you have any queries about the Policy or about the privacy practices of TMF Group, please send an email to dataprotection@tmf-group.com and be sure to indicate the nature of your query.

Information about rights of Clients or data subjects whose/which Personal Data TMF processes as Controller, including with regard to details of processing activities regarding their Personal Data, transfers of their Personal Data within TMF Group, and principles related to processing their Personal Data that TMF Group applies, are included in the Privacy Statement of TMF Group, available on TMF Group website 

Definitions and Abbreviations

The capitalized terms and abbreviations listed below, have the follow meaning in this Policy:

 Downloads

Personal Data Protection Policy – TMF Group | version 1.0 | 1 March 2018

Personal Data Protection Policy – TMF Group | version 2.0 | 5 July 2019

Personal Data Protection Policy – TMF Group | version 2.1 | 30 January 2020

Personal Data Protection Policy – TMF Group | version 2.2 | 15 June 2021

Personal Data Protection Policy – TMF Group | version 3.0 | May 2022

Personal Data Protection Policy – TMF Group | version 3.1 | September 2022

Personal Data Protection Policy – TMF Group | version 3.2 | April 2023