Security Measures
1. Data Transfer.
(i) Licensee is the data owner (controller) of the database(s) containing personal identifiable information ("PII") to be processed by Company as data processor, under the Agreement solely for the purpose of the license and services under the Agreement ("Purpose(s)"). Company hereby undertakes, to take commercially reasonable measures to ensure the privacy of data subjects of the PII in accordance with applicable measures set forth in the Israeli Protection of Privacy Law, 5741–1981 and the Israel Privacy Protection Regulations (Data Security), 2017 ("Privacy Law" and "Regulations", respectively).
2. Processing Obligations.
(i) Authorized Personnel. Company shall ensure that the PII is accessed only by Authorized Personnel (hereinafter defined) and is used and accessed on a strict need-to-know basis solely for the Purpose and solely during the term of the Agreement. "Authorized Personnel" shall mean Company employees; and the contractors (sub processors).
(ii) Confidentiality. Without derogating from the foregoing, Company will ensure that its Authorized Personnel are bound by a confidentiality undertaking no less restrictive than industry standard.
(iii) Monitoring and Enforcement. Company shall: ensure that the precautions hereunder will be enforced including monitoring and enforcement on a regular basis; and ensure that the database systems are managed and operate properly, as commonly acceptable in the operation of such systems; all in accordance with Sections 8 of the Regulations.
(iv) Security Incident.
- (a) Documentation. Company shall document any suspected breach of the integrity of the PII processed by Company or deviation from Company's authorised use thereof ("Security Incident"), and shall ensure that Company's security policy includes procedures for managing such incidents, in accordance with the levels of severity and sensitivity of the PII. Company shall hold a discussion regarding any Security Incidents in accordance with Section 11(c) of the Regulations.
- (b) Form of Action. In the event of a Security Incident, Company will make reasonable efforts take remedial measures to restore the PII and the security thereof.
(v) Documentation. Company shall maintain reasonable documentation regarding compliance with the requirements of this Schedule, including without limitation investigation of any complaints or investigation of possible breaches of these data security obligations.
(vi) Physical and Logical Protection. Company shall maintain the PII and its systems that are used to operate and manage the PII that Company processes in a protected physical and logical environment that will suit the nature of the database and the PII included therein.
(vii) Database Separation. In the event that Company provides database services to other data controllers and/or processors, Company shall ensure that there is a physical and/or logical separation between the PII and information of such other controllers and/or processors.
(viii) Retention. Company shall maintain and keep the PII only for the period required for the fulfilment of the Purposes following which Company shall permanently delete all PII unless there is a requirement by law obligating Company to keep and maintain the PII, in which case this Schedule shall remain in effect with respect to the protection of the PII.
(ix) Risk Assessment/Penetration Testing. Company shall conduct a comprehensive risk assessment and penetration testing of its applicable databases, at least once every eighteen (18) months, and remediate any vulnerability and/or faults discovered with respect to internal and external threats. Company shall discuss the findings of the risk assessment and update its security policy according to such risk assessments; all in accordance with Section 5 (c) and (d) of the Regulations.
(x) Notice and Consent. Licensee shall obtain all consents and provide all notices in connection with the PII, as required under the Privacy Law, including in respect of processing as set forth in Company's Privacy Policy.