Is there a commonly agreed on definition of &quot;third party&quot; or does a contractual agreement have to define the term? Does a contract have to define &quot;third party&quot; or does it have a standard meaning of &quot;any entity not a party to this agreement&quot;? If third party is not explicitly defined in an agreement between Party A and Party B, is Party B free to regard its agent, or any company it contracts with to perform services (even a company that is a competitor of Party A) to be not a third party? Does the answer to these questions vary by jurisdiction? I have seen the following explicit definition in a company's Privacy statement: Third Party: any entity that is not Acme Widgets, an Acme Widgets employee, contractor, or agent.
Third-party has a general meaning but one that can be changed by the contract Third-party means someone who is not a party to the contract nor an agent of one of the parties (such as an employee of one of them). The term came about because most contracts only have two parties and they were historically identified as the first party and the second party although that usage is now uncommon: that makes everyone else a third party, even where the contract has more than 2 parties. The definition you cite expands the definition to include contractors of one of the parties: independent contractors are third parties unless their contract amounts to an agency agreement.
GDPR defines the responsibility of Companies to ensure that Personal Data in their possession is maintained Secure ensuring Confidentiality and Privacy towards the Data Subjects to whom it pertains. Prior to the Articles themselves, there are notes and over (49) one may read that companies must have in place (where applicable) mechanisms like CERT and any other SECURITY assuring tools/ processes. (83) again is all about ensuring Security. (94) reads that if the Controller (company) find it cannot ensure Security it must stop processing activities and report to the Supervisory Authority for guidance and support. Then we have Article 3 (f) establishing that it is the company responsibility to "... ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’)..." Bottom line... T&amp;C Companies must ensure that Personal Data is processed by them (and that includes communications) are Secure while ensuring Confidentiality and Pricavy towards the Data Subjects. The wording "...commercially reasonable efforts..." is wrong, because it is not something that may be a legal requirement or not depending on "cost"; it is a Legal Obligation. Then "... the Internet is not an inherently secure environment and so we cannot guarantee the security of your Personal Information..."; this is just "poor legal advice" for GDPR does expect companies to make the Internet safe, it expects companies to maintain their IT Landscape safe... an analogy can be made about going through a group of sharks in the ocean while just swimming or on board of a big boat... the ocean is dangerous due to the sharks, yet if you are in a big boat, you won't even notice them. Then the "cherry on top"; "... e assume no liability for any disclosure of data due to errors in transmission, unauthorized third-party access or other acts of third parties, or acts or omissions beyond our reasonable control..."; now i really do not know which lawyer has written this, but it basically reads something like: "the law obliges me to ensure you are safe... however I am not able to". Now, I have seen similar "statements", but I must confess it was like 2 or 3 years ago... most companies have corrected them over time and since they become aware that penalties were for real. Just a final disclaimer It is a fact that while in transit (over the Internet) a message being delivered through a T&amp;C Company Services will travel through 3rd party infrastructure contexts, rendering it at risk ... however, if it is properly encrypted (as it should) the transition time will not be sufficient for a successful breach attempt. So, yes they are capable of ensuring all they have stated they can not.
Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this? "The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 2 This clearly states that the processor would need to make clear that they are subcontracting the services and get permission for this as part of the contract, but doesn't specify whether the subcontractors must be named and identified. Perhaps there is other prior existing subcontracting legislation that requires them to be named? Some procurement contracts as supplied by controllers may specify a list of nominated (allowed) sub-contractors or require the full identification of sub-contractors though I've not found anything in law that requires they be named other than as part of a specific contractual obligation. Q2. Is there a requirement under GDPR for data processors to disclose the country or countries where data is stored and processed? "Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ... (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. ..." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 3(h) This clearly states the data processor must make available to the data controller all details required to demonstrate compliance. It's quite likely larger organisations may choose to make this simple for data controllers by supplying this information in the form of a completed Data Privacy Impact Analysis document. "Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: ... (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; ..." -- EU General Data Protection Regulations (GDPR) Article 30 Paragraph 1(e) This clearly states the data controller must maintain a record of the country or countries involved if any of these are outside the EU, and so this information must be made available to the controller as stated above.
Does an agreement in a chat count as a valid contract? In most jurisdictions (and for most transactions): yes. Usually the only thing that matters for a valid contract is that there is a mutual agreement &ndash; whether that is in writing, orally, via chat or via sign language does not matter. Of course, having things in writing makes it easier to prove in court if there is a problem, so it's still advisable. What steps could I take if they don't send the money? You can: remind them to pay if they still don't pay, you can sue them. Some juridictions have accelerated court proceedings for simple cases like this (e.g. Gerichtliches Mahnverfahren in Germany), otherwise you will have to sue in a regular court that deals with contract disputes. But I have no names and I am unsure what they can or have to do after they received the package. This is going to be the main problem. It's no good to enter into a contract if you do not know who the other party is :-). You definitely need to find out who exactly entered into an agreement with you. If the sale is to a private person, find out their name and address. If the sale is to a business (seems to be the case here), find the official name and legal type of the business, and make sure whoever you deal with is authorized to enter into contracts. Otherwise the contract will be hard to enforce in court if things go wrong.
Yes Unless your business is a sole proprietorship it operates as a legal entity seperate from its owners. It owns its assets an acrues its own liabilities. It can be sued and it can sue others. It can also agree to its own contracts. Typically the only thing a legal entity that is not a natural person cannot do is sign a marriage contract. Depending on the industry there may be no need to sue. There exist many mandatory workplace insurance to cover accidents in the workplace. You may have to share details of the injury with them but they may be uninterested in whos at fault.
&quot;This policy&quot; is referring to the Mozilla Community Participation Guidelines as amended (basically a Terms of Service (TOS) agreement). If so, does it mean adherence to Guidlines is fixed to version current at the moment of commencement of employment? Not really. It means that Mozilla Community Participation Guidelines are primarily guidelines for members of the general public who are not employees, and that different unstated policies delivered to employees are what govern employees instead. There are consequences for Mozilla employees failing to honor the current version of the Mozilla Community Participation Guidelines, but those consequences are set forth in an employment contract with the employees rather than being limited to the consequences and procedures set forth in the Mozilla Community Participation Guidelines for members of the general public who aren't employees.
There is ample reason to conclude that "non-commercial" would include a church, as well as advocating a political cause or candidate. The hard part of "personal". In the context of (Canadian) bankruptcy law, it can mean "non-business use"; in the context of "personal use property", it can be "A type of property that an individual does not use for business purposes or hold as an investment. In other words, property that an individual owns for personal enjoyment". US tax law takes "personal purposes" to refer to non-business purposes. But in the context of copyright (especially music downloading / copying), it is taken to refer to the use of or by an individual. Distributing free copies of a protected work does not get legally sanctioned due to the copying being non-commercial. The alternative term "private" is much clearer, in identifying "just you", but is probably avoided in this kind of context so as to avoid the wrong inference that you can only play Pokemon in the privacy of your own home. So the slightly less clear term "personal" is used instead of "private" especially in copyright-related contexts. "Personal" and "private" are not exactly the same, but when it's about use, I don't see any difference, and I think there is no question that use to attract to a church or political candidate is not "private", it is public. Since the license does not define "your own personal purposes" and there is not an existing crystal-clear definition of "personal purposes", the phrase could be given its "ordinary (plain) meaning". Of course, plain meaning has to give way to contractual intent, so we have to figure out what the parties intended. Except, you don't have a contract with Niantic, but still, plain meaning surely has some place in the law of licenses. At this point, in a lawsuit, both sides would hire an expert witness like a linguist or English teacher to make the case that a church or other non-commercial non-private use is / is not included in the meaning of "personal purpose". A silly argument could be made to the effect that if you personally have an interest in doing something then it is a personal purpose (if specifically commercial, it would be precluded by the term "noncommercial"). What makes this silly is that everybody does things for personal purposes (even acting in a way that benefits others, since you do so for the personal reason that you should do so), and thus "personal" would not mean anything. That is, "personal purposes" does not mean "whatever motivation or interest you personally have". You can also gain a certain understanding of what "personal purposes" means by looking at similar licenses. In the context of academic publishing, authors are typically granted license to copy "for personal, professional, or teaching purposes". Professional purposes and teaching purposes are things that the person has an interest in, so by mentioning these things separately, we must conclude that "teaching" is not a "personal purpose". And so: I would conclude that a court could find that using a product to support a political campaign, philosophy, or religion, is a "public" purpose, not a "personal" purpose. At the same time, at least as I understand it, a lure module is a thing that others besides yourself personally can see (I admit, I don't go), which implies that the purpose of the thing is not entirely private. In addition, there is a fair amount of buzz out there about how a lure could be good for business, which is (1) clearly in contradiction of the license terms and (2) clearly a golden opportunity for Niantic, perhaps in a few weeks after everybody gets hooked and then they will offer non-personal licenses. Their license terms also say that you will not "use the Services or Content, or any portion thereof, for any commercial purpose or for the benefit of any third party or in a manner not permitted by these Terms". I would say that that definitively says "No don't do it", and it also means that you can't be nice to a neighbor. So what they literally say and what they really intend are probably completely different things.
The internal organizational documents and practices of the company would determine this in terms of actual authority and would vary from company to company even within the same jurisdiction of organization and entity type. For example, one company might give that authority to the general counsel, another to the corporate secretary, a third to the Vice President for Information Technology, and a fourth to their Chief Innovation Officer, yet another might allow any officer of the company to do so, or might allow any employee of the company to do so. Usually, the more often a company does something and the more routine it is to do that, the lower down in the organization the authority is allocated. Anyone who appeared to have the authority to do so to a reasonably third-party, however, could bind the company even if they didn't actually have the authority to do so.