1.1 Without prejudice to the generality Aspiration Solutions will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Personal Data for the duration and purposes of this agreement.

1.2 Without prejudice to the generality of clause 1.1, Aspiration Solutions shall, in relation to any Personal Data processed in connection with any enquiry or transaction instruction:

 (a ) Process that Personal Data only on the written instructions of the Customer unless Aspiration Solutions is required by the laws of any member of the European Union or by the laws of the European Union applicable to Aspiration Solutions to process Personal Data (Applicable Laws). Where the Host is relying on laws of a member of the European Union or European Union law as the basis for processing Personal Data,  Aspiration Solutions shall promptly notify the Customer of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit Aspiration Solutions from so notifying the Customer;

2. Aspiration Solutions ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);
3. Aspiration Solutions ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential; and not transfer any Personal Data outside of the European Economic Area unless the prior written consent of the Customer has been obtained and the following conditions are fulfilled:

(a) Aspiration Solutions will provide appropriate safeguards in relation to the transfer;

(b) Aspiration Solutions chosen host has enforceable rights and effective legal remedies;

(c) Aspiration Solutions Host complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred;

(d) Aspiration Solutions Host complies with reasonable instructions notified to it in advance by the Customer with respect to the processing of the Personal Data;

(e) Aspiration Solutions is responsible in responding to any request from its client and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(f) Aspiration Solutions will notify the Client without undue delay on becoming aware of a Personal Data breach;

(g) Aspiration Solutions, at the written direction of the Client, delete or return Personal Data and copies thereof to the Customer on termination of the agreement unless required by Applicable Law to store the Personal Data; and

(h) Aspiration Solutions will maintain complete and accurate records and information to demonstrate its compliance with this clause 9.

3. The Client consents to Aspiration Solutions appointing third party processors as a third-party processor of Personal Data under this agreement. The Aspiration Solutions confirms that it has entered or (as the case may be) will enter with the third-party processor into a written agreement [substantially on that third party’s standard terms of business OR incorporating terms which are substantially similar to those set out in this clause]