Terms of Use

Capitalised words have the meanings provided in Section 11 found at the end of this document.

This Agreement is between Provider and the organisation or person accessing or using the Product. If you are accessing or using the Product on behalf of an Organisation you represent that you are authorised to accept this Agreement on behalf of that organisation. By signing up, accessing, or using the Product, Organisation indicates its acceptance of this Agreement and agrees to be bound by the terms and conditions of this Agreement. If Organisation is a Paid Subscriber, then to the extent there is any conflict between the Paid Subscription Terms and this Agreement then the Paid Subscription Terms will prevail to the extent of that inconsistency.

Contributors invited to share their personal data with the Cloud Service are not subject to these Terms of Use. Provider's obligations to these contributors is governed by their consent, the Provider's privacy notice and all Applicable Laws including the Applicable Data Protection Laws.

1. Service

1.1 Access and Use. Subject to the terms of this Agreement, Organisation may (a) access and use the Cloud Service; and (b) copy and use the included Software and Documentation only as needed to access and use the Cloud Service, in each case, for its internal business purposes.

1.2 Individual User Accounts. Organisation is responsible for all actions on Individual User accounts and for all Individual Users compliance with this Agreement. Organisation and Individual Users must protect the confidentiality of their passwords and other login credentials. Organisation will promptly notify Provider if it suspects or knows of any fraudulent activity with its accounts, passwords, or credentials, or if they become compromised.

1.3 Subject always to Provider's obligation to process Personal Data in accordance with Section 3 (Privacy & Security) and Applicable Data Protection Laws, and to keep Subscriber Content confidential in accordance with Section 8 below:

(a) Feedback and Usage Data. Organisation may, but is not required to, give Provider Feedback, in which case Organisation gives Feedback "As is". Provider may use all Feedback freely without any further restriction or obligation save as provided herein. In addition, Provider may collect and analyse Usage Data, and Provider may freely use Usage Data to maintain, improve, enhance, and promote Provider's products and services without further restriction or obligation save as provided herein.

(b) Organisation Content. Provider may copy, display, modify, and use Organisation Content only as needed to provide and maintain the Product and related offerings. Organisation is responsible for the accuracy and content of Organisation Content and for retaining any original copies and backups it requires of such content. Organisation acknowledges that the Product operates as a multi-user platform and that Organisation Content, once submitted, may through the Product's standard functionality become part of a shared data environment (whilst maintaining the confidentiality and personal data obligations set out in this Agreement). The Product may apply data integrity measures, including retention periods, to ensure the accuracy and completeness of data within the Product.

(c) Benchmark Data and Product Improvements. Usage Data and Organisation Content may be used to create and share anonymised benchmark data and to develop and improve functionality and features in Provider's products and services and Organisation authorises Provider to process its Usage Data and Organisation Content for such purposes. Nothing in this section will reduce or limit Provider's obligations regarding Personal Data that may be contained in Usage Data or Organisation Content under Applicable Data Protection Laws.

(d) Artificial Intelligence. Notwithstanding Section 1.3(c), the Product may now or in future include features that use artificial intelligence or machine learning ("AI Features"). Provider will comply with all Applicable Laws in its provision of AI Features and will not use AI Features to make decisions producing legal or similarly significant effects on Organisation or any Individual User without meaningful human involvement. Provider will never share Organisation Content or Confidential Information for the purpose of training AI models without Organisation's explicit further consent, but may use such data to develop, operate, and improve the Product and its AI Features.

1.4 Account Data. In order to create and maintain Individual User accounts and to provide product functionality, user support, service communications, and product notifications, Provider will process account registration data including Individual Users names and email addresses. Provider will use this data only for the purposes of providing, maintaining, and supporting the Product and will process it in accordance with Section 3 (Privacy & Security) and Provider's privacy notice.

2. Restrictions & Obligations

2.1 Restrictions on Organisation.

(a) Except as expressly permitted by this Agreement, Organisation will not (and will not allow anyone else to): (i) reverse engineer, decompile, or attempt to discover any source code or underlying ideas or algorithms of the Product (except to the extent Applicable Laws prohibit this restriction); (ii) provide, sell, transfer, sublicense, lend, distribute, rent, or otherwise allow others to access or use the Product; (iii) remove any proprietary notices or labels; (iv) copy, modify, or create derivative works of the Product; (v) conduct security or vulnerability tests on, interfere with the operation of, cause performance degradation of, or circumvent access restrictions of the Product; (vi) access accounts, information, data, or portions of the Product to which Organisation does not have explicit authorisation; (vii) use the Product to develop a competing service or product; (viii) use the Product with any High Risk Activities or with any activity prohibited by Applicable Laws; (ix) use the Product to obtain unauthorised access to anyone else's networks or equipment; (x) upload, submit, or otherwise make available to the Product any Organisation Content to which Organisation and Individual Users do not have the proper rights; (xi) attempt to identify, re-identify, or otherwise determine the identity of any individual or organisation from any report, output, benchmark, aggregated data, or other information generated by or obtained from the Product, whether alone or by matching, combining, or cross-referencing it with any other data set or source of information (including, without limitation, cast and crew lists, industry databases, or publicly available information); (xii) collect, use, or disclose Personal Data obtained through or in connection with the Product other than as expressly permitted by this Agreement and Applicable Data Protection Laws; (xiii) introduce or transmit through the Product any virus, worm, trojan horse, ransomware, or other malicious or harmful code or material, or engage in any activity that floods, overloads, or mail-bombs the Product or any part of it; (xiv) access, search, index, scrape, or create accounts on the Product by any automated means or by any means other than through the interfaces and processes provided by Provider; (xv) send unsolicited communications, promotions, advertisements, or spam to any Individual Users or other user of the Product, or send altered, deceptive, or false source-identifying information through the Product, including spoofing or phishing; (xvi) promote or advertise products or services to any Individual Users or other user of the Product; (xvii) sell, licence, publish, or otherwise commercially exploit any information, data, or reports obtained from the Product, except to the extent expressly permitted by this Agreement or Paid Subscription Terms; (xviii) harass, threaten, or abuse Provider's personnel, representatives, contractors, or agents; or (xix) download, copy, or export any information or data from the Product except as expressly authorised by the Product's functionality and this Agreement.

(b) Use of the Product must comply with all Documentation and Use Limitations.

2.2 Suspension. If Organisation: (a) breaches Section 2.1 (Restrictions on Organisation); or (b) uses the Product in violation of the Agreement or in a way that materially and negatively impacts the Product or others, then Provider may temporarily suspend Organisation's access to the Product with or without notice. However, Provider will try to inform Organisation before suspending Organisation's account when practical. Provider will reinstate Organisation's access to the Product only if Organisation resolves the underlying issue.

3. Privacy & Security

3.1 Personal Data. Personal Data is processed under the direction of Provider, who is the controller for the purposes of Applicable Data Protection Laws. By using the Product, Organisation acknowledges that Personal Data submitted to the Product will be processed in accordance with Provider's privacy notice available alongside this Agreement or directly from Provider. Organisations should refer to the privacy notice for information about how Personal Data is processed.

3.2 Contributor Control. Organisation acknowledges and agrees that Contributors retain ownership and control over their Personal Data that they provide to the Cloud Service and Organisation agrees not to assert any rights over such data.

3.3 Prohibited Data. Organisation will not (and will not allow anyone else to) submit Prohibited Data to the Product.

3.4 Security Policy. Provider will maintain annually updated reports or annual certifications of compliance with the internationally recognised security standard: ISO 27001. Provider will use all reasonable efforts to secure the Cloud Service from unauthorised access, alteration, or use and other unlawful tampering. Provider's security policies and other relevant information are available at: https://trust.theeveryoneproject.org.

4. Term & Termination

4.1 This Agreement will start on commencement of use of the Cloud Service by the Organisation and continue until such use ceases or the Agreement is terminated.

4.2 Termination. Provider may terminate this agreement following 30 days notice to Organisation.

4.3 Effect of Termination. Upon any expiration or termination:

(a) Organisation will no longer have any right to use the Product.

(b) Upon Organisation's request, Provider will delete Organisation Content that is exclusively associated with Organisation's account within 60 days, subject to Provider's data retention policies, its obligations under Applicable Laws, and its obligations to other users of the Product.

(c) Each Recipient will return or destroy Discloser's Confidential Information in its possession or control, subject to Section 4.3(b) and Section 4.4(b).

4.4 Survival.

(a) The following sections will survive expiration or termination of the Agreement: Section 1.3(a) (Feedback and Usage Data), Section 1.3(b) (Organisation Content), Section 1.3(c) (Benchmark Data and Product Improvements), Section 2.1 (Restrictions on Organisation), Section 4.3 (Effect of Termination), Section 4.4 (Survival), Section 5 (Representations & Warranties), Section 6 (Disclaimer of Warranties), Section 7 (Limitation of Liability), Section 8 (Confidentiality), Section 9 (Reservation of Rights), Section 10 (General Terms), Section 11 (Definitions).

(b) Each Recipient may retain Discloser's Confidential Information in accordance with its standard backup or record retention policies maintained in the ordinary course of business, its obligations to other users of the Product, or as required by Applicable Laws, in which case Section 3 (Privacy & Security) and Section 8 (Confidentiality) will continue to apply to retained Confidential Information.

5. Representations & Warranties

5.1 Mutual. Each party represents and warrants to the other that: (a) it has the legal power and authority to enter into this Agreement; (b) it is duly organised, validly existing, and in good standing under the Applicable Laws of the jurisdiction of its origin; (c) it will comply with all Applicable Laws in performing its obligations or exercising its rights in this Agreement.

5.2 From Organisation. Organisation represents and warrants that it, all Individual Users, and anyone submitting Organisation Content each have and will continue to have all rights necessary to submit or make available Organisation Content to the Product and to allow the use of Organisation Content as described in the Agreement.

5.3 From Provider. Provider represents and warrants that (a) it has all rights, licences, and authorisations necessary to provide the Product; and (b) to its knowledge, the Product as provided under this Agreement does not infringe the intellectual property rights of any third party.

6. Disclaimer of Warranties

6.1 Provider makes no guarantees that the Product will always be safe, secure, or error-free, or that it will function without disruptions, delays, or imperfections. The warranties in Section 5 (Representations & Warranties) do not apply to any misuse or unauthorised modification of the Product, nor to any product or service provided by anyone other than Provider. Except for the warranties in Section 5 (Representations & Warranties), Provider and Organisation each disclaim all other warranties and conditions, whether express or implied, including the implied warranties and conditions of merchantability, fitness for a particular purpose, title, and non-infringement. These disclaimers apply to the maximum extent permitted by Applicable Laws.

7. Limitation of Liability

7.1 Liability Caps. Except as provided in Section 7.4 (Exceptions), each party's total cumulative liability for all claims arising out of or relating to this Agreement will not be more than the General Cap Amount.

7.2 Damages Waiver. Except as provided in Section 7.4 (Exceptions), under no circumstances will either party be liable to the other for lost profits or revenues (whether direct or indirect), or for consequential, special, indirect, exemplary, punitive, or incidental damages relating to this Agreement, even if the party is informed of the possibility of this type of damage in advance.

7.3 Applicability. The limitations and waivers contained in Sections 7.1 (Liability Caps) and 7.2 (Damages Waiver) apply to all liability, whether in tort (including negligence), contract, breach of statutory duty, or otherwise.

7.4 Exceptions. Nothing in this Agreement will limit, exclude, or restrict a party's liability to the extent prohibited by Applicable Laws.

8. Confidentiality

8.1 Non-Use and Non-Disclosure. Except as otherwise authorised in the Agreement or as needed to fulfil its obligations or exercise its rights under this Agreement or as otherwise agreed by Discloser in writing, Recipient will not (a) use Discloser's Confidential Information; nor (b) disclose Discloser's Confidential Information to anyone else. In addition, Recipient will protect Discloser's Confidential Information using at least the same protections Recipient uses for its own similar information but no less than a reasonable standard of care.

8.2 Exclusions. Confidential Information does not include information that (a) Recipient knew without any obligation of confidentiality before disclosure by Discloser; (b) is or becomes publicly known and generally available through no fault of Recipient; (c) Recipient receives under no obligation of confidentiality from someone else who is authorised to make the disclosure; or (d) Recipient independently developed without use of or reference to Discloser's Confidential Information.

8.3 Required Disclosures. Recipient may disclose Discloser's Confidential Information to the extent required by Applicable Laws if, unless prohibited by Applicable Laws, Recipient provides Discloser reasonable advance notice of the required disclosure and reasonably cooperates, at Discloser's expense, with Discloser's efforts to obtain confidential treatment for the Confidential Information.

8.4 Permitted Disclosures. Recipient may disclose Discloser's Confidential Information to Individual Users, employees, advisors, contractors, and representatives who each have a need to know the Confidential Information, but only if the person or entity is bound by confidentiality obligations at least as protective as those in this Section 8 (Confidentiality) and Recipient remains responsible for everyone's compliance with the terms of this Section 8 (Confidentiality). Recipient may disclose Discloser's Confidential Information to other Organisations with the consent of the Organisation, the consent may be implied by way of Product functionality.

9. Reservation of Rights

9.1 Except for the limited license to copy and use Software and Documentation in Section 1.1 (Access and Use), Provider retains all right, title, and interest in and to the Product. Except for the rights granted to Provider under Section 1.3(b) (Organisation Content) and 1.3(c) (Benchmark Data and Product Improvements), nothing in this Agreement transfers to Provider any right, title, or interest in Organisation Content.

10. General Terms

10.1 Entire Agreement. This Agreement is the only agreement between the parties about its subject and this Agreement supersedes all prior or contemporaneous statements (whether in writing or not) about its subject. Provider expressly rejects any terms included in Organisation's purchase order or similar document, which may only be used for accounting or administrative purposes. No terms or conditions in any Organisation documentation or online vendor portal will apply to Organisation's use of the Product unless expressly agreed to in a legally binding written agreement signed by an authorised Provider representative, regardless of what such terms may say.

10.2 Modifications, Severability, and Waiver. Any waiver, modification, or change to the Agreement must be agreed in writing or, in the case of modifications made by Provider under Section 10.17, deemed accepted in accordance with that section. If any term of this Agreement is determined to be invalid or unenforceable by a relevant court or governing body, the remaining terms of this Agreement will remain in full force and effect. The failure of a party to enforce a term or to exercise an option or right in this Agreement will not constitute a waiver by that party of the term, option, or right.

10.3 Governing Law and Chosen Courts. The Governing Law will govern all interpretations and disputes about this Agreement, without regard to its conflict of laws provisions. The parties will bring any legal suit, action, or proceeding about this Agreement in the Chosen Courts and each party irrevocably submits to the exclusive jurisdiction of the Chosen Courts.

10.4 Injunctive Relief. Despite Section 10.3 (Governing Law and Chosen Courts), a breach of Section 8 (Confidentiality) or the violation of a party's intellectual property rights may cause irreparable harm for which monetary damages cannot adequately compensate. As a result, upon the actual or threatened breach of Section 8 (Confidentiality) or violation of a party's intellectual property rights, the non-breaching or non-violating party may seek appropriate equitable relief, including an injunction, in any court of competent jurisdiction without the need to post a bond and without limiting its other rights or remedies.

10.5 Non-Exhaustive Remedies. Except where the Agreement provides for an exclusive remedy, seeking or exercising a remedy does not limit the other rights or remedies available to a party.

10.6 Assignment. Neither party may assign any rights or obligations under this Agreement without the prior written consent of the other party. However, either party may assign this Agreement upon notice if the assigning party undergoes a merger, change of control, reorganisation, or sale of all or substantially all its equity, business, or assets to which this Agreement relates. Any attempted but non-permitted assignment is void. This Agreement will be binding upon and inure to the benefit of the parties and their permitted successors and assigns.

10.7 Beta Products. If Provider gives Organisation access to a Beta Product, the Beta Product is provided "As is" and without warranty or representation. Organisation acknowledges that Beta Products are experimental in nature and may be modified or removed at Provider's discretion with or without notice.

10.8 Logo Rights. Provider may identify Organisation and use Organisation's name and logo in marketing to identify Organisation as a user of Provider's products and services. If Organisation has an existing process and policy for approving such use and provides notice to Provider of the same Provider will comply with such process and policy.

10.9 Notices. Any notice, request, or approval about the Agreement must be in writing and sent to the Notice Address. Notices will be deemed given (a) upon confirmed delivery if by email, registered or certified mail, or personal delivery; or (b) two days after mailing if by overnight commercial delivery.

10.10 Independent Contractors. The parties are independent contractors, not agents, partners, or joint venturers. Neither party is authorised to bind the other to any liability or obligation.

10.11 No Third-Party Beneficiary. There are no third-party beneficiaries of this Agreement.

10.12 Force Majeure. Neither party will be liable for a delay or failure to perform its obligations of this Agreement if caused by a Force Majeure Event.

10.13 Export Controls. Organisation may not remove or allow the export or re-export of the Product or any related technology or materials in violation of any restrictions, laws, or regulations of any country. Organisation represents and warrants that it is not (a) a resident or national of an embargoed country; (b) an entity organised under the laws of an embargoed country; (c) designated on any list of prohibited, restricted, or sanctioned parties maintained by applicable governments or agencies, including the UN Security Council Consolidated List; nor (d) 50% or more owned by any party designated on any of the above lists. Provider may terminate this Agreement immediately without notice or liability to comply, as determined in Provider's sole discretion, with applicable export controls and sanctions laws and regulations.

10.14 Government and Public Sector Rights. The Cloud Service, Software, and Documentation are provided as commercial items for standard commercial use. Any use, modification, reproduction, release, performance, display, or disclosure by any government, governmental authority, public sector entity, or similar body (including their contractors or agents) shall be governed solely by the terms of this Agreement, and all other use is prohibited.

10.15 Anti-Bribery. Neither party will take any action that would be a violation of any Applicable Laws that prohibit the offering, giving, promising to offer or give, or receiving, directly or indirectly, money or anything of value to any third party to assist Provider or Organisation in retaining or obtaining business.

10.16 Titles and Interpretation. Section titles are for convenience and reference only. All uses of "including" and similar phrases are non-exhaustive and without limitation. The United Nations Convention for the International Sale of Goods and the Uniform Computer Information Transaction Act do not apply to this Agreement.

10.17 Acceptance. This Agreement is made binding on acceptance of its terms on creation of an account with the Cloud Service by the Organisation and upon any continued use of it by the Organisation or Individual Users on its behalf. Continued use of the Cloud Service by Organisation after being given 30 days notification of a modification or change to this Agreement will be deemed acceptance of such modification or change.

10.18 Territory-Specific Terms. The terms applicable to Organisation are supplemented and, to the extent of any inconsistency, modified by any territory-specific terms (the "Territory-Specific Terms") included in Schedule 1 below. In the event of any conflict between the Territory-Specific Terms and the remainder of this Agreement, the Territory-Specific Terms prevail to the extent of that conflict. This Section does not limit any mandatory rights or protections available to Organisation or any Individual User under the Applicable Laws of their own jurisdiction.

11. Definitions.

11.1 Capitalised words have the meanings given below.

11.2 "Agreement" means these Terms of Use.

11.3 "Applicable Data Protection Laws" means the Applicable Laws that govern how the Cloud Service may process or use an individual's personal information, personal data, personally identifiable information, or other similar term.

11.4 "Applicable Laws" means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern Provider or Organisation.

11.5 "Beta Product" means an early or prerelease feature or version of the Product that is identified as beta or similar, or a version of the Product that is not generally available.

11.6 "Chosen Courts": means the courts identified as the Chosen Courts in the Territory-Specific Terms, or, where no Territory-Specific Terms apply, the Courts of England.

11.7 "Cloud Service" means the cloud-based software-as-a-service tool made available by Provider for measuring and reporting on workforce diversity and inclusion, which Provider may make available under the brand "The Everyone Project" or such other name as Provider utilises from time to time.

11.8 "Confidential Information" means information in any form disclosed by or on behalf of a Discloser, including before this Agreement commenced, to a Recipient in connection with this Agreement that (a) the Discloser identifies as "confidential", "proprietary", or the like; or (b) should be reasonably understood as confidential or proprietary due to its nature and the circumstances of its disclosure. Organisation's Confidential Information includes non-public Organisation Content and Provider's Confidential Information includes non-public information about the Product.

11.9 "Contributor(s)" means individuals invited to share their personal data with the Cloud Service (separate to any role they may have as an Individual User using the Product).

11.10 "Discloser" means a party to this Agreement when the party is providing or disclosing Confidential Information to the other party.

11.11 "Documentation" means any usage guidance, communications and support materials for the Cloud Service or Software that are made available by Provider.

11.12 "Feedback" means suggestions, feedback, or comments about the Product or related offerings.

11.13 "Force Majeure Event" means an unforeseen event outside a party's reasonable control where the affected party took reasonable measures to avoid or mitigate the impacts of the event. Examples of these kinds of events include unpredicted natural disasters like a major earthquake, war, pandemic, riot, act of terrorism, or public utility or internet failure.

11.14 "General Cap Amount" means 1.5 times the amount of subscription fees paid by Organisation to Provider in the 12 months prior to the event that gave rise to the liability.

11.15 "Governing Law" mean the law identified as the Governing Law in the Territory-Specific Terms, or, where no Territory-Specific Terms apply, the laws of England.

11.16 "High Risk Activity" means any situation where the use or failure of the Product could be reasonably expected to lead to death, bodily injury, or environmental damage. Examples include full or partial autonomous vehicle technology, medical life-support technology, emergency response services, nuclear facilities operation, and air traffic control.

11.17 "Individual User" means any individual who uses the Product on Organisation's behalf or through Organisation's account.

11.18 "Notice Address" means for Provider: [email protected] and [email protected] and for Organisation means: a primary or admin email address on Organisation's account.

11.19 "Organisation" means the organisational entity that accesses or uses the Product. Organisations can, without limitation, include companies, partnerships, trusts, sole traders, foundations, and associations.

11.20 "Organisation Content" means data, information, or materials submitted by or on behalf of Organisation or Individual Users to the Product but excludes Feedback.

11.21 "Paid Subscriber" means a Organisation who has, directly or indirectly, paid Provider to use the Product.

11.22 "Paid Subscription Terms" means any terms agreed in writing by Provider for Paid Subscriber's use of the Product pursuant to a subscription or other similar agreement in addition to this Agreement.

11.23 "Personal Data" will have the meaning(s) set forth in the Applicable Data Protection Laws for personal information, personal data, personally identifiable information, or other similar term.

11.24 "Product" means the Cloud Service, Software, and Documentation.

11.25 "Prohibited Data" means any data Organisation does not have the necessary rights to utilise in the manner used in accordance with Applicable Data Protection Laws or other Applicable Laws and/or agreements they have entered into.

11.26 "Provider" means Every1data Limited trading as The Everyone Project.

11.27 "Recipient" means a party to this Agreement when the party receives Confidential Information from the other party.

11.28 "Software" means the client-side software or applications made available by Provider for Organisation to install, download (whether onto a machine or in a browser), or execute as part of the Product.

11.29 "Usage Data" means data and information about the provision, use, and performance of the Product and related offerings based on Organisation's or Individual Users use of the Product.

11.30 "Use Limitations" means use of the Cloud Service is limited to use for measuring on-screen and crew workforce diversity on scripted and unscripted television and film productions primarily produced in the territory the Cloud Service is deployed for and which are funded and/or produced by Organisation or on which Organisation has supplied workforce services and any other permitted use notified by Provider in accordance with an Organisation's Paid Subscription Terms or otherwise in writing from time to time.

Schedule 1 — Territory-Specific Terms

B1 Application. These Territory-Specific Terms apply to the New Zealand deployment of the Product. They apply to Organisation and all Individual Users accessing the Product through that deployment and modify this Agreement accordingly.

B2 Governing Law and Jurisdiction. The Governing Law is the law of New Zealand, and the Chosen Courts are the courts of New Zealand.

B3 Mandatory Consumer and Contract Law. Nothing in this Agreement excludes, restricts, or modifies any right or remedy that cannot lawfully be excluded, including under the Consumer Guarantees Act 1993 (CGA) and the Fair Trading Act 1986 (FTA). Where Organisation acquires the Product for the purposes of a business and both parties are in trade, the parties agree that the guarantees in the CGA and sections 9, 12A, and 13 of the FTA do not apply, and that it is fair and reasonable to be bound by this exclusion, to the maximum extent permitted by section 43 of the CGA and sections 5D and 5E of the FTA. Where Organisation deals as a consumer, the CGA guarantees are not excluded. Consistent with the FTA unfair contract terms regime for standard form consumer contracts: (a) Organisation may reject a variation made under Section 10.17 by terminating before it takes effect, without penalty; (b) Organisation may terminate this Agreement on notice to Provider, equivalent to Provider's right under Section 4.2; and (c) Provider will give notice and a reasonable opportunity to remedy before suspending under Section 2.2 where reasonably practicable, except where immediate action is needed to prevent material harm.

B4 Privacy and Data Protection. Applicable Data Protection Laws include the Privacy Act 2020 and the Information Privacy Principles (IPPs). Provider will handle Personal Data in accordance with that Act, including the cross-border disclosure requirements in IPP 12 and the notifiable privacy breach requirements (notifying the Office of the Privacy Commissioner and affected individuals where required). References in Section 3 to a "controller" are read, for New Zealand, as references to the "agency" that holds and determines the handling of Personal Data.