Harmonic Group Disclosure Notice Regarding Compliance With Data Protection Law 2017 Of The Cayman Islands – Vendors

 

INTRODUCTION AND DEFINITIONS

We are providing you with this Disclosure Notice because you are retained by Harmonic (as defined below) as vendor (“Vendor Relationship”) pursuant to a vendor agreement (howsoever called) between Harmonic and you (“Vendor Contract”).

In this Disclosure Notice certain other defined terms appear, whose meaning is as follows:

  • “AML/ATF/APF” means anti-money laundering, anti-terrorism financing and anti-proliferation financing;
  • “Data Subject” means the living individual to whom the Personal Data relates;
  • “DPL” means the Cayman Islands Data Protection Law, 2017, as amended;
  • “Harmonic” means the relevant Harmonic Cayman operating entity which has the Vendor Relationship with you;
  • “Harmonic Cayman” means any of Harmonic Fund Services, Wavelength Financial Technology Ltd., Harmonic Corporate Services Limited or Ancova Limited;
  • “Personal Data” means data relating to a living individual who can be identified and includes data such as (a) the living individual’s location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the living individual; (b) an expression of opinion about the living individual; or (c) any indication of the intentions of the data controller or any other person in respect of the living individual;
  • “processing”, in relation to data, means obtaining, recording or holding data, or carrying out any operation or set of operations on Personal Data, including –
    • organizing, adapting or altering the Personal Data;
    • retrieving, consulting or using the Personal Data;
    • disclosing the Personal Data by transmission, dissemination or otherwise making it available; or
    • aligning, combining, blocking, erasing or destroying the Personal Data;
  • “Sensitive Personal Data” means, in relation to a Data Subject, Personal Data consisting of any types of data specified in the DPL, of which those types most relevant (and only in the context of a Vendor Relationship) are any criminal history of the Data Subject (which may be obtained as part of background and screening checks).

THE DATA PROTECTION LAW, 2017 OF THE CAYMAN ISLANDS AND EFFECT ON HARMONIC GROUP

The DPL will enter into effect from 30 September 2019. The DPL will affect any operating entity of Harmonic Cayman which controls or processes Personal Data in the course of its business.

In the course of its business activities Harmonic is required to receive and handle a wide range of data and information. Some of that data and information will be Personal Data and accordingly the DPL will apply to the collection, use and retention of that Personal Data. In certain limited circumstances that Personal Data may also be Sensitive Personal Data as defined above. This Disclosure Notice outlines Harmonic Group’s policy statement as to its data protection obligations and your data protection rights as they relate to your Vendor Relationship with Harmonic under the DPL.

THE DATA PROTECTION PRINCIPLES

Harmonic is committed to complying with the data protection principles enshrined in the DPL, summarised as follows:

  • Personal Data shall be processed fairly and only if the conditions specified in the DPL are met.
  • Personal Data shall be obtained only for one or more specified lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
  • Personal Data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which it is collected or processed.
  • Personal Data shall be accurate and, where necessary, kept up to date.
  • Personal Data processed for any purpose shall not be kept for longer than is necessary for that purpose.
  • Personal Data shall be processed in accordance with the rights of Data Subjects under the DPL
  • Appropriate technical and organizational measures shall be taken against unauthorized or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data.
  • Personal Data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of Data Subjects in relation to the processing of Personal Data. Certain exceptions to this principle apply, as set out in the DPL.

ROLE OF HARMONIC

In Harmonic’s use of Personal Data provided in the Vendor Relationship, Harmonic will be characterised as a “data controller” (meaning the person who, alone or jointly with others determines the purposes, conditions and manner in which Personal Data is, or is to be, processed) under the DPL.

HARMONIC AS DATA CONTROLLER

You understand that by virtue of your Vendor Relationship with Harmonic and your associated interactions with Harmonic (including the recording of electronic communications or phone calls where applicable) or by virtue of you otherwise providing Harmonic with personal information on individuals connected with you, for AML/ATF/APF or other reasons, you will provide Harmonic with certain personal information which constitutes Personal Data. This includes, but is not restricted to, data such as name, residential address, email address, telephone number, place of birth, date of birth, passport number, social security number, tax ID number, bank account details, personal details required to complete background checks and personal details required to complete AML/ATF/APF checks (including but not limited to identification verification information).

Harmonic processes this Personal Data for the following purposes: (i) the performance of the Vendor Contract; (ii) compliance with legal obligations to which Harmonic is subject (such as AML/ATF/APF obligations); and (iii) exercising or performing a right, or obligation, conferred or imposed by law on Harmonic in connection with the Data Subject’s retention.

Harmonic may from time to time provide you with information on products and services that may be of interest. Personal Data is also processed by Harmonic for quality control, business and statistical analysis, tracking fees and costs, training and related purposes. It should be noted that any such use of your Personal Data in either of these two ways would of course be subject to any relevant overriding prohibitions or restrictions in such use by Harmonic in the Vendor Contract.

Accordingly, you understand and consent that Harmonic may use your Personal Data for such purposes as described above, provided that Harmonic is acting fairly and in accordance with the conditions under the DPL and also noting your right to withdraw your consent at any time, as discussed below.

Your continuation of the Vendor Relationship with Harmonic shall constitute signification of your agreement to Harmonic’s processing of your Personal Data as indicated above. Should Harmonic wish to use your Personal Data for other specific purposes that require your consent, Harmonic will of course contact you to request this.

HARMONIC’S DISCLOSURE/TRANSFER AND STORAGE OF PERSONAL DATA

It may be necessary for Harmonic to transfer Personal Data for processing, back-up or storage to an agent, delegate, subcontractor or other representative of Harmonic appointed by Harmonic (pursuant to authority in the terms of the Vendor Contract, if applicable) to carry out sub-processing activities on behalf of Harmonic (each a “Permitted Processor”) under an appropriate written agreement between the Permitted Processor and Harmonic. Such Permitted Processors may be in the Cayman Islands or outside the Cayman Islands and may be Harmonic Group affiliates or unaffiliated with Harmonic Group. The current list of Permitted Processors for Harmonic Cayman is attached as Appendix 1 and such list may be revised from time to time and will be posted on Harmonic’s website.

Harmonic may only transmit Personal Data (a) to Permitted Processors with the prior written consent of the counterparty to the Vendor Contract (“Counterparty”); or (b) where required to do so under applicable law.

In addition, it may be necessary for Harmonic to transfer Personal Data to certain third parties, upon the instruction of the Counterparty, whose involvement is necessary to carry out all or part of Harmonic’s duties and obligations contemplated under the Vendor Contract and in accordance with Harmonic’s internal written procedures. In such instances any such third party will not be a Permitted Processor of Harmonic and will instead be engaged directly by the Counterparty as a processor. Finally, where Harmonic is required to transfer Personal Data to a legal, regulatory or taxation authority under applicable law any such transfer shall not constitute the engagement of a Permitted Processor by Harmonic.

You understand that in certain circumstances and at all times in compliance with applicable law Harmonic and/or Permitted Processors may be legally obliged to share your Personal Data and other financial information with respect to your Vendor Contract with their local authorities including regulatory, law enforcement or other governmental authorities (including tax authorities) or courts (collectively “Government Bodies”) and the local Government Bodies, in turn, may exchange this information with foreign Government Bodies including Government Bodies located in the Cayman Islands or elsewhere through automatic reporting, information exchange or otherwise.

As is evident from Appendix 1, certain Harmonic Group operating entities (including of course Harmonic Cayman) and Permitted Processors are located in the Cayman Islands and so Personal Data will be stored on servers in the Cayman Islands, and certain Harmonic Group operating entities and certain Permitted Processors are located outside the Cayman Islands and in that case Personal Data will be stored on servers outside the Cayman Islands.

Subject to applicable provisions of the DPL, the Personal Data shall not be shared other than as described herein. In this context then, it is important for you to note that Personal Data may be transmitted, stored and processed on systems located outside of the Cayman Islands, which systems are or may be operated by a Permitted Processor (and therefore authorities including regulatory or governmental authorities or courts in a jurisdiction (including jurisdictions where these parties are established or hold or process Personal Data) may obtain access to Personal Data which may be held or processed in such a jurisdiction or accessed through automatic reporting, information exchange or otherwise in accordance with the laws and regulations applicable in such jurisdiction).

THE DATA PROTECTION MEASURES HARMONIC TAKES

Any transmission of Personal Data by Harmonic to a Permitted Processor shall be in accordance with the conditions in the DPL.

Harmonic applies and contractually obligates Permitted Processors to apply appropriate information security measures designed to protect Personal Data in Harmonic’s/Permitted Processors’ possession from unauthorized or unlawful processing and against accidental loss, destruction, or damage.

YOUR DATA PROTECTION RIGHTS

You understand that you have certain rights regarding Harmonic’s use of Personal Data such as:

  • the right to access your Personal Data;
  • the right to request to cease processing, or to not begin processing, or to cease processing for a specified purpose or in a specified manner, your Personal Data;
  • the right to request to cease, or to not begin processing for the purposes of direct marketing, your Personal Data;
  • the right to receive information regarding any entities to which Harmonic discloses your Personal Data; and
  • the right to lodge a complaint with the Cayman Islands Ombudsman in accordance with the procedure set out in the DPL.

Please note that the right to request that your Personal Data cease being processed, not begin to be processed or cease being processed for a specified purpose or in a specified manner is not likely to be applicable to most, if not all, of the Personal Data provided to Harmonic, given the specific nature of the purposes for which Harmonic uses the Personal Data, as described above.

Harmonic shall notify you of any Personal Data breach affecting you, meaning a breach of security leading to the accidental or unlawful destruction, loss, alternation, unauthorized disclosure of or access to, Personal Data transmitted, stored or otherwise processed. The DPL sets out the procedure to be followed for such notification.

HARMONIC’S RETENTION OF YOUR PERSONAL DATA

Harmonic or Permitted Processors may retain your Personal Data following the conclusion of your Vendor Relationship with Harmonic for such minimum period as may be required by applicable laws.

GETTING IN TOUCH

A member of staff has been designated as Responsible Person Group-wide for each of (i) the receipt of any queries relating to data protection under the DPL or in the event a Data Subject wishes to discuss his/her data protection rights under the DPL with Harmonic (“General Queries”), and (ii) communicating with the Cayman Islands Ombudsman. As at the date of this Disclosure Notice the following is the email address for General Queries: GDPR@harmonic.ky

 
 

APPENDIX 1

Harmonic Fund Services:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Wavelength Financial Technology Ltd. Cayman Islands
Harmonic Corporate Services Limited. Cayman Islands
Ancova Limited. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2)Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com

 
 

Harmonic Corporate Services Limited:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Wavelength Financial Technology Ltd. Cayman Islands
Harmonic Fund Services. Cayman Islands
Ancova Limited. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2) Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com

 
 

Ancova Limited:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Wavelength Financial Technology Ltd. Cayman Islands
Harmonic Corporate Services Limited. Cayman Islands
Harmonic Fund Services. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2) Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com

 
 

Wavelength Financial Technology Ltd:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Harmonic Fund Services. Cayman Islands
Harmonic Corporate Services Limited. Cayman Islands
Ancova Limited. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2) Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com