About the communication of personal data to other entities (third party subcontractors)

Within the scope of its duties, UPB may use third-party subcontractors to provide certain services. When data processing is carried out by a subcontractor or third party to whom data is transmitted, UPB checks that the subcontractor provides sufficient guarantees that appropriate technical and organisational measures are in place so that the processing meets the requirements of the legislation in force and ensures that the rights of the data subject are upheld. Processing under these terms is regulated by a contract or other legal act, which binds the processor or third party to the guidelines established by UPB, as the entity responsible for processing the data, and defines the object and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. In particular, the contract stipulates that the subcontractor or third party: a) It only processes personal data transmitted on documented instructions from the UPB, including with regard to data transfers to third countries or international organisations, unless it is required to do so by Union law or the law of the Member State to which it is subject, in which case it informs the controller of this legal requirement prior to processing, unless the law prohibits such information for important reasons of public interest; b) Ensures that persons authorised to process personal data undertake a confidentiality commitment or are subject to appropriate legal confidentiality obligations; c) Adopt the most appropriate safety measures; d) It deletes or returns to UPB all personal data after the provision of services related to the processing has been completed, deleting existing copies, unless the retention of the data is required under Union or Member State law; e) Provides the UPB with all the information necessary to demonstrate compliance with the obligations set out in this article and facilitates and contributes to audits, including inspections, conducted by the controller or by another auditor authorised by the controller; f) The subcontractor may not hire another subcontractor without the UPB’s authorisation, and the request must be sent to the data controller. In any case, UPB also remains responsible for the personal data it makes available.