Dated ______2018
Swansea University
and
Contract for Consultancy Services
Contents
1. PREAMBLE...... 3
2. DEFINITIONS & INTERPRETATION...... 3
3. CONTRACT DOCUMENTS...... 4
4. ENGAGEMENT...... 4
5. CONSULTANTS GENERAL OBLIGATIONS...... 5
6. DATA PROTECTION...... 5
7. PROJECT MATERIALS...... 5
8. UNIVERSITY’S GENERAL OBLIGATIONS...... 6
9. FEES AND EXPENSES...... 6
10. ACCESS TO UNIVERSITY PREMISES...... 7
11. STANDARDS AND LEGISLATION...... 8
12. INDEMNITY …...... 8
13. COPYRIGHT INDEMNITY...... 9
14. CONFIDENTIALITY AND PUBLICITY...... 9
15. FAILURE TO PROVIDE SERVICE...... 9
16. TERMINATION BY THE UNIVERSITY...... 10
17. TERMINATION BY THE CONSULTANT...... 11
18. MONITORING AND AUDIT...... 11
19. HEALTH AND SAFETY...... 12
20. EQUAL OPPORTUNITIES...... 12
21. GRATUITIES...... 12
22. FORCE MAJEURE...... 13
23. WAIVER...... 13
24. NOTICES...... 13
25. VARIATIONS...... 14
26. REMEDIATION PROCEDURE AND ALTERNATIVE DISPUTE RESOLUTION14
27. GENERAL...... 15
SCHEDULES
Schedule 1 – Specification including Services 17
Schedule 2 – Charges 18
THIS CONTRACT is made on the day of 2018
BETWEEN:
SWANSEA UNIVERSITY being an Institution established by Royal Charter of Singleton Park, Swansea, SA2 8PP (“the University”); and
of (“the Consultant”)
1. PREAMBLE
1.1 The University has engaged the Consultant to provide certain services (the “Services”) and the Consultant having sufficient skills and expertise, has agreed to accept such engagement or engagements as the University may from time to time require it to perform on the terms and conditions hereinafter contained.
2. DEFINITIONS & INTERPRETATION
2.1 In this Contract the following words shall have the following meanings:-
“Authorised Officer” means the Registrar and Chief Operating Officer of the University and shall include such other person or persons as may be appointed by the University to act in the name of the University for the purposes of this Contract.
“Commencement Date” means the x day of xxxxxxxxxxxx
“Consultant” means the person, firm or organisation referred to above and those employees, permitted contractors and sub-contractors and agents of the Consultant engaged from time to time in providing the Services and any employee of any such sub-contractors who are so engaged.
“Contract Documents” mean this Contract, the Specification, the schedules and any other documents provided by the University and intended by it to form a part of the Contract Documents.
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Data Protection Officer take the meaning given in the GDPR.
“Data Loss Event” means any event that results, or may result, in unauthorised access to Personal Data held by the Consultant under this Agreement, and/or actual or potential loss and/or destruction of Personal Data in breach of this Agreement, including any Personal Data Breach.
DPA 2018: Data Protection Act 2018
“Data Protection Impact Assessment” means an assessment by the Controller of the impact of the envisaged processing on the protection of Personal Data.
“Data Protection Legislation” means (i) the GDPR, the LED and any applicable national implementing Laws as amended from time to time (ii) the DPA 2018 [subject to Royal Assent] to the extent that it relates to processing of personal data and privacy; (iiii) all applicable Law about the processing of personal data and privacy;
“Data Subject Access Request” means a request made by, or on behalf of, a Data Subject in accordance with rights granted pursuant to the Data Protection Legislation to access their Personal Data.
“GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679)
“LED” means Law Enforcement Directive (Directive (EU) 2016/680)
“Project Materials” means any and all works of authorship and materials developed, written or prepared by the Consultant, its employees, agents or sub-contractors in relation to the Services including without limitation, all maps, plans photographs, drawings, tapes, statistical data, published and unpublished results and reports, whether stored electronically or otherwise on whatever media.
“Protective Measures” means appropriate technical and organisational measures which may include: pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the such measures adopted by it.
“Pro Vice Chancellor” means the Pro Vice Chancellor nominated by the University from time to time but in this first instance shall be Senior Pro Vice ChancellorProfessor Iwan Davies.
“Services” means all of the tasks to be undertaken by the Consultant as described in this Contract and in particular the Specification as specified in Schedule 1 together with any variations or additions thereto
“Specification” means the document attached in Schedule 1
“Sub-processor” means any third Party appointed to process Personal Data on behalf of the Consultant related to this Agreement
“Supplier Personnel” means all directors, officers, employees, agents, consultants and contractors of the Consultant and/or of any Sub-Contractor engaged in the performance of its obligations under this Agreement
“Term”means the period from the Commencement Date to xxxxxxxxxxxx with the provision to extend for a further period of six months or longer as agreed between the Parties.
2.2References to “Contract”shall mean this contract and include all schedules and appendices and all documents referred to herein. Unless specifically stated to the contrary, any reference to any clause, sub-clause, schedule or appendix shall be to a clause, sub-clause, schedule or appendix of this Contract.
2.3References in this Contract to statutory provisions include all subsequent enactments, amendments and regulations relating to that provision and to any subordinate legislation or regulation made thereunder
2.4References to the singular include the plural and vice versa and references to one gender include the other gender. References to a person include any individual, firm, unincorporated association or body corporate. The headings in this Contract are for ease of reference only and shall not affect the construction or interpretation of this Contract.
2.5Where the Consultant is more than one person but not a limited company, those persons shall be jointly and severally liable under the contract.
2.6References to employees, personnel, staff and managers of the Consultant shall include references to all persons engaged by the Consultant in the performance of the Service and shall, (if the context so admits) include references to employees, personnel, staff and managers of any contractor or sub-contractor of the Consultant.
3.CONTRACT DOCUMENTS
3.1The Consultant shall be deemed to have satisfied itself as to the accuracy and sufficiency of the rates and prices stated by it which shall (except in so far as it is otherwise provided in this Contract) cover all its obligations hereunder and shall be deemed to have obtained for itself all necessary information as to risks, contingencies and any other circumstances which might reasonably influence or affect its ability to comply with the provisions of this Contract.
3.2The Consultant shall not be excused from any liability under this Contract as a consequence of any misinterpretation by the Consultant of any matter or fact relating to the Contract Documents and in particular, the Specification (Schedule 1).
3.3Except as otherwise expressly provided, the documents comprising this Contract are to be taken as mutually explanatory of one another and in case of ambiguities or discrepancies, the same shall be explained and adjusted by the Authorised Officer who shall thereupon issue to the Consultant reasonable instructions in writing and the Consultant shall carry out and be bound by such instructions. Any material adjustment to this Contract shall be subject to Clause 25 (Variations).
3.4Copyright in the documents emanating from the University comprising this Contract shall vest in the University but the Consultant may obtain or make at its own expense any further copies required for use by it in performing this Contract.
4.ENGAGEMENT
4.1The University hereby agrees to engage the Consultant and the Consultant hereby agrees to act as Consultant to the University in relation to the provision of the Service.
4.2The Consultant represents and warrants to the University that by virtue of entering into this Contract it is not and shall not be in breach of any express or implied obligation to any third party binding upon it.
5.CONSULTANTS GENERAL OBLIGATIONS
5.1The Consultant shall in order to enable it to properly perform its obligations under and in connection with this Contract and in particular, the Specification;
5.1.1carry out the Services with all due reasonable skill and care, courteously, with due diligence and in an efficient, effective and safe manner;
5.1.2provide all necessary staff having sufficient abilities, qualifications, expertise and skills for the proper performance of the Services,
5.1.3if and whenever it becomes reasonably apparent that the delivery of the Services is likely to be delayed, the Consultant shall immediately give written notice to the University of the material circumstances giving rise to the delay and the anticipated consequences of such delay.
5.1.4devote to its obligations hereunder such of it’s time, attention and skills as may be necessary for the proper professional performance of those obligations and ensure availability and timely and prompt attendance at all meetings including but not limited to allprogress meetings and discussions in relation to the Services;
5.1.5make available at any time any document or work in progress relating to all or any part of the Services;
5.1.6promote and enhance the image, good name and reputation of the University;
5.1.7perform such other duties in relation to the Services as the Authorised Officer may reasonably consider appropriate for the proper performance of the Services.
5.1.8If the Consultant is unable to provide the Services due to illness or injury of its employees the Consultant shall advise the University of that fact as soon as reasonably practicable.
6.DATA PROTECTION
1.
2.
3.
4.
5.
6.
6.1ThePartiesacknowledgethatforthepurposesoftheDataProtectionLegislation,the UniversityistheControllerandtheConsultantistheProcessor.Theonlyprocessing thattheConsultantisauthorisedtodoislistedinScheduleA bytheUniversityandmaynotbedeterminedbytheConsultant.
6.2TheConsultantshallnotifytheUniversityimmediatelyifitconsidersthatanyofthe University'sinstructionsinfringetheDataProtectionLegislation.
6.3TheConsultantshallprovideallreasonableassistanceto theUniversity in the preparationofanyDataProtectionImpactAssessmentpriortocommencingany processing.Suchassistancemay,atthediscretionoftheUniversity,include:
(a)asystematicdescriptionofthe envisaged processing operations and the purposeoftheprocessing;
(b)anassessmentofthenecessityandproportionalityofthe processing operationsinrelationtotheServices;
(c)anassessmentoftheriskstotherightsandfreedomsofDataSubjects;and
(d)themeasuresenvisagedtoaddresstherisks,includingsafeguards,security measuresandmechanismstoensuretheprotectionofPersonalData.
6.4TheConsultantshall,inrelationtoanyPersonalDataprocessedinconnectionwithits obligationsunderthisAgreement:
(a)processthatPersonalDataonlyinaccordancewithScheduleA,unlessthe Consultant isrequiredtodootherwisebyLaw. If it is so required the ConsultantshallpromptlynotifytheUniversitybeforeprocessingthePersonal DataunlessprohibitedbyLaw;
(b)ensurethatithasinplaceProtectiveMeasures,whichhavebeenreviewedandapprovedbytheUniversityasappropriatetoprotectagainstaDataLoss Eventhavingtakenaccountofthe:
(i)natureofthedatatobeprotected;
(ii)harmthatmightresultfromaDataLossEvent;
(iii)stateoftechnologicaldevelopment;and
(iv)costofimplementinganymeasures;
(c)ensurethat:
(i)theSupplierPersonneldonotprocessPersonalDataexceptin accordancewiththisAgreement(andinparticularScheduleA);
(ii)ittakesallreasonablestepstoensurethereliabilityandintegrityofany SupplierPersonnelwhohaveaccesstothePersonalDataand ensurethatthey:
(a) areawareofandcomplywiththeConsultant’sdutiesunderthis clause;
(b) aresubjecttoappropriateconfidentialityundertakingswiththe ConsultantoranySub-processor;
(c) areinformedoftheconfidentialnatureofthePersonalDataanddonotpublish,discloseordivulgeanyofthePersonalDatatoany thirdPartyunlessdirectedinwritingtodosobytheUniversityor asotherwisepermittedbythisAgreement;and
(d) haveundergoneadequatetrainingintheuse,care,protectionand handlingofPersonalData;and
(d)nottransferPersonalDataoutsideoftheEUunlessthepriorwrittenconsentof theUniversityhasbeenobtainedandthefollowingconditionsarefulfilled:
(i)theUniversityortheConsultanthasprovidedappropriatesafeguardsin relationtothetransfer(whetherinaccordancewithGDPRArticle46or LEDArticle37)asdeterminedbytheUniversity;
(ii)theDataSubjecthasenforceablerightsandeffectivelegalremedies;
(iii)theConsultantcomplieswithitsobligationsundertheDataProtection LegislationbyprovidinganadequatelevelofprotectiontoanyPersonal Datathatistransferred(or,ifitisnotsobound,usesitsbest endeavourstoassisttheUniversity inmeetingitsobligations);and
(iv)theConsultantcomplieswithanyreasonableinstructionsnotifiedtoitin advancebytheUniversity withrespecttotheprocessingofthe PersonalData;
(e)atthewrittendirectionoftheUniversity ,deleteorreturnPersonalData(and anycopiesofit)totheUniversityonterminationoftheAgreementunlessthe ConsultantisrequiredbyLawtoretainthePersonalData.
6.5Subjecttoclause6.6,theConsultantshallnotifytheUniversityimmediatelyifit:
(a)receivesaDataSubjectAccessRequest(orpurportedDataSubjectAccess Request);
(b)receivesarequesttorectify,blockoreraseanyPersonalData;
(c)receivesanyotherrequest,complaintorcommunicationrelatingtoeither Party'sobligationsundertheDataProtectionLegislation;
(d)receivesanycommunicationfromtheInformationCommissioneroranyother regulatoryauthorityinconnectionwithPersonalDataprocessedunderthis Agreement;
(e)receivesarequestfromanythirdPartyfordisclosureofPersonalDatawhere compliancewithsuchrequestisrequiredorpurportedtoberequiredbyLaw; or
(f)becomesawareofaDataLossEvent.
6.6TheConsultant’sobligationtonotifyunderclause 6.5shallincludetheprovisionoffurtherinformationtotheUniversityinphases,asdetailsbecomeavailable.
6.7Takingintoaccountthenatureoftheprocessing,theConsultantshallprovidethe Universitywithfullassistanceinrelation to either Party's obligationsunderData Protection Legislation and any complaint, communication or requestmadeunder clause6.5(andinsofaraspossiblewithinthetimescalesreasonablyrequiredbythe University)includingbypromptlyproviding:
(a)theUniversitywithfulldetailsandcopiesofthecomplaint,communicationor request;
(b)suchassistanceasisreasonablyrequestedbytheUniversitytoenablethe UniversitytocomplywithaDataSubjectAccessRequestwithintherelevant timescalessetoutintheDataProtectionLegislation;
(c)theUniversity,atitsrequest,withanyPersonalDataitholdsinrelationtoa Data Subject;
(d)assistanceasrequestedbytheUniversityfollowinganyDataLossEvent;
(e)assistanceasrequestedbytheUniversity withrespecttoanyrequestfromthe InformationCommissioner’sOffice,oranyconsultationbytheUniversitywith theInformationCommissioner'sOffice.
6.8TheConsultantshallmaintaincompleteandaccuraterecordsandinformationtodemonstrateitscompliancewiththisclause.Thisrequirementdoesnotapplywhere theConsultantemploysfewerthan250staff,unless:
(a)the University determinesthattheprocessingisnotoccasional;
(b)theUniversitydeterminestheprocessingincludesspecialcategoriesofdata asreferredtoinArticle9(1)oftheGDPRorPersonalDatarelatingtocriminal convictionsandoffencesreferredtoinArticle10oftheGDPR;and
(c)theUniversity determinesthattheprocessingislikelytoresultinarisktothe rightsandfreedomsofDataSubjects.
6.9TheConsultantshallallowforauditsofitsDataProcessingactivitybytheUniversityor theUniversity’sdesignatedauditor.
6.10TheConsultantshalldesignateaData Protection Officerif required by theData ProtectionLegislation.
6.11BeforeallowinganySub-processortoprocessanyPersonalDatarelatedtothis Agreement,theConsultantmust:
(a)notifytheUniversityinwritingoftheintendedSub-processorandprocessing;
(b)obtainthewrittenconsentoftheUniversity;
(c)enterintoawrittenagreementwiththeSub-processor where the contract is on terms no less onerous than the terms setout within this contract; and
(d)providetheUniversity withsuchinformationregardingtheSub-processoras theUniversity mayreasonablyrequire.
6.12TheConsultantshallremainfullyliableforallactsoromissionsofanySub-processor.
6.13TheUniversitymay,atanytimeonnotlessthan30WorkingDays’notice,revisethis clausebyreplacingitwithanyapplicablecontrollertoprocessorstandardclausesor similartermsformingpartofanapplicablecertificationscheme(whichshallapply whenincorporatedbyattachmenttothisAgreement).
6.14ThePartiesagreetotakeaccountofanyguidanceissuedbytheInformation Commissioner’sOffice.TheUniversitymayonnotlessthan30WorkingDays’notice totheConsultantamendthisagreementtoensurethatitcomplieswithanyguidanceissuedbytheInformationCommissioner’sOffice.
Schedule A - Schedule of Processing, Personal Data and DataSubjects
1. The Consultant shall comply with any further written instructions with respect to processing by the University.
2. Any such further instructions shall be incorporated into this Schedule.
Description / DetailsSubject matter of the
processing / [This should be a high level, short description of what the
processing is about i.e. its subject matter]
Duration of the
processing / [Clearly set out the duration of the processing including
dates]
Nature and purposes of
the processing / Please be as specific as possible, but make sure that you cover all intended purposes.
The nature of the processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc.
The purpose might include: employment processing, statutory obligation, recruitment assessment etc]
Type of Personal Data / [Examples here include: name, address, date of birth, NI
number, telephone number, pay, images, biometric data etc]
Categories of Data
Subject / [Examples include: Staff (including volunteers, agents, and
temporary workers), customers/ clients, suppliers, patients, students / pupils, members of the public, users of a particular website etc]
Plan for return and
destruction of the data once the processing is complete UNLESS requirement under union or member state law to preserve that type of data
/ [Describe how long the data will be retained for, how it bereturned or destroyed]
.7.PROJECT MATERIALS
7.1The Consultant shall afford the University access to the Services or the Project Materials or any part thereof including all preparatory matters and work in progress and to all documents, (including, in particular, documents, recordings, methodology and results, field observations and analysis of data produced in connection with the Services.
7.2The University as commissioner of the Services shall be deemed to be the copyright owner of and shall be entitled to all Project Materials produced as a result of or in connection with this Contract and title to the same shall vest in the University.
7.3The University may use any aspect of the Services and/or the Project Materials and may publish any aspect of the Services and/or the Project Materials and/or exploit commercially the same.
7.4The Consultant shall waive all moral rights it may have to the Project Materials and/or the Services and shall at its own expense do all such things and sign or execute all such documents or instruments and/or take all steps required to ensure that any copyright or other intellectual property rights (including the right to defend or enforce the same), in relation to the Services, shall vest exclusively in the University.
7.5Upon the request of the University and in any event upon the termination of this Contract for whatever reason, the Consultant shall at its own expense promptly deliver to the University all property original documentation and copies of all Project Materials then in the Consultants custody, control or possession.
7.6The provisions of this Clause 7 shall survive the expiration or termination of this Contract.
8.UNIVERSITY’S GENERAL OBLIGATIONS
8.1The University shall;
8.1.1ensure its employees co-operate fully with the Consultant in relation to the provision of the Services; and
8.1.2promptly furnish the Consultant with such information and documentation as it may reasonably request and be entitled to sight of for the proper performance of its obligations under this Contract.
9.FEES AND EXPENSES
9.1The University shall pay the Consultant the Charges set out in Schedule 2 for undertaking the Services. No variation of this fee shall be made unless prior written approval has been provided by the Authorised Officer.
9.2The Consultant shall maintain full and accurate records of all time actually spent in providing the Services and shall produce such records to the University for inspection at all reasonable times on request.
9.3The Consultant shall render an itemised invoice and each invoice shall be accompanied by a statement specifying the time spent by the Consultant in providing the Services during the period covered by the invoice.
9.4The charges shall be inclusive of VAT which shall, if properly chargeable by the Consultant, be shown separately on such tax invoice and which shall be paid by the University at the then prevailing rates.
9.5In the event of any expenses arising which could not have been reasonably foreseen by a reasonably competent person providing similar services, the University shall only be obliged to pay the same if expressly approved in writing by the Authorised Officer and if appropriate evidence of the expenditure is produced, most usually a tax receipt.
9.6Responsibility by the University of any expenses of the Consultant, including without limitation travel, petrol, accommodation or other subsistence, all such expenses must be previously approved by the University, the expenditure must be reasonable and properly incurred by the Consultant in the performance of the Services., the internal policies in force at the time of signing this Contract relating to expenses must be adhered to and observed, evidence of all such expenditure must be obtained by the Consultant and produced to the University and any claims for expenditure must be made in accordance with the policies of the University current at the date of signing this Contract.
9.7All charges properly payable by the University shall, subject as aforesaid, be paid within thirty (30) days of the date of receipt of the Consultants invoice.
10.ACCESS TO UNIVERSITY PREMISES AND EQUIPMENT
10.1If the Consultant requires access to the University’s premises for the particular purposes set out in this Contract, the University shall allow the Consultant (and its employees, contractors and sub-contractors) reasonable access to the premises of the University during normal working hours and with the prior consent of the Authorised Officer.
10.2The Consultant shall ensure that its employees and contractors and sub-contractors observe University rules and policies when working at the University's premises.
10.3Without relieving the Consultant of its obligations under this Contract the Authorised Officer may require the Consultant to remove any of its employees, contractors or sub-contractors from the premises of the University and the Consultant shall forthwith comply with such instructions. Any such requirement on the part of the Authorised Officer shall be confirmed in writing to the Consultant. The University shall not in any event be liable to the Consultant or its employees, contractors or sub-contractors in relation to any such removal and the Consultant shall fully and promptly indemnify the University in respect of any claims arising therefrom.
10.4The University shall be under no obligation to provide any premises or equipment to the Consultant other than those expressly referred to in this Contract.
10.5The Consultant shall provide its own equipment where necessary for the delivery of the Services but for reasons of security and interoperability, only IT equipment owned by the University may be used to access the University's network.