Data Processing Agreement
Last updated: November 15, 2022
This Data Processing Agreement (“DPA”) forms part of the terms of use, subscription agreement or other agreement for Osmosis services (“Agreement”) by and between the university customer or other institutional subscriber (“Subscriber”) and Elsevier Inc., successor to Knowledge Diffusion Inc. (“Elsevier”), and in which this DPA is referenced
1. Definitions
1.1. “Data Protection Laws” means all privacy and data protection laws, rules, regulations, decrees, orders and other government requirements applicable to the processing of personal data under the Agreement.
1.2. The terms “controller,” “data subject,” “personal data,” and “processing” will have the meanings ascribed to them in the Data Protection Laws, and where the Data Protection Laws use equivalent or corresponding terms, such as ‘personal information’ instead of ‘personal data,’ they will be read herein as the same.
2. Scope
2.1 This DPA applies to the processing of personal data that Elsevier receives from the Subscriber under the Agreement, excluding any personal data that Elsevier is processing on behalf of the Subscriber.
2.2 The Elsevier Data Processing Addendum applies to any personal data that Elsevier is processing on behalf of the Subscriber under the Agreement.
3. Restrictions
3.1 The parties will each comply with their respective obligations under the Data Protection Laws.
3.2 The parties acknowledge and agree that each is acting as an independent controller of the personal data and that they are not joint controllers as defined in the Data Protection Laws.
3.3 The Subscriber acknowledges and agrees that the personal data has been collected, transferred and otherwise processed in accordance with the Data Protection Laws.
3.4 The Subscriber acknowledges and agrees that Elsevier is processing account data, authentication details, usage data, service logs and other personal data as necessary to provide, manage or secure the services subject to the Elsevier Privacy Policy.
4. Assistance
Each party will cooperate with and assist the other as reasonably required to enable the other party to comply with its obligations under the Data Protection Laws, taking into account the nature of the processing and the information available to the party.
5. Transfers
5.1 To the extent that the Subscriber transfers personal data from the European Economic Area (“EEA”) or Switzerland to Elsevier, unless the parties may rely on an alternative transfer mechanism or basis under the Data Protection Laws, the parties will be deemed to have entered into the standard contractual clauses approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 available at http://data.europa.eu/eli/dec_impl/2021/914/oj (“2021 EU SCCs”) in respect of such transfer, whereby the Subscriber is the “data exporter,” Elsevier is the “data importer,” Module One applies, Modules Two, Three and Four, the footnotes, Clause 11(a) Option and Clause 17 Option 1 are omitted, the “competent supervisory authority” is that in the country where the data exporter is established, and the content of the applicable annexes corresponds to the respective content of the Agreement. The 2021 EU SCCs are governed by the law of the country where the data exporter is established. Any dispute arising from the 2021 EU SCCs shall be resolved by the courts of the country where the data exporter is established. To the extent there is any conflict between the terms of the Agreement and the 2021 EU SCCs, the 2021 EU SCCs will prevail.
5.2 To the extent that the Subscriber transfers personal data from the United Kingdom (“UK”) to Elsevier, unless the parties may rely on an alternative transfer mechanism or basis under the Data Protection Laws, the parties will be deemed to have entered into the standard contractual clauses approved by the European Commission Decision 2004/915/EC of 27 December 2004 available at http://data.europa.eu/eli/dec/2004/915/oj (“Clauses”) in respect of such transfer, whereby the Subscriber is the “data exporter,” Elsevier is the “data importer,” any optional clauses are omitted, and the content of the appendices corresponds to the respective content of the Agreement. The Clauses are governed by the laws of England and Wales. All references in the Clauses to “Union,” “EU,” “Member State” and their laws are replaced with “UK” and the equivalent UK laws. Any dispute arising from the Clauses shall be resolved by the courts of England and Wales. To the extent there is any conflict between the terms of the Agreement and the Clauses, the Clauses will prevail.
5.3 To the extent that the Subscriber transfers personal information from Brazil to Elsevier, Elsevier will comply with the principles and the rights of the data subject and the regime of data protection provided under the Brazilian General Data Protection Law, nº 13.709 of 2018 (Lei Geral de Proteção de Dados Pessoais) (LGPD).