End User Licence Agreement

END-USER LICENCE AGREEMENT FOR MONITORING SYSTEMS PROVIDED BY CEM (CENTRE FOR EVALUATION AND MONITORING)

THIS AGREEMENT IS MADE BETWEEN THE END USER OF THIS SOFTWARE (THE “SCHOOL”) AND THE CHANCELLOR, MASTERS AND SCHOLARS OF THE UNIVERSITY OF CAMBRIDGE ACTING THROUGH ITS DEPARTMENTS THE UNIVERSITY OF CAMBRIDGE LOCAL EXAMINATIONS SYNDICATE OF THE TRIANGLE BUILDING SHAFTESBURY ROAD CAMBRIDGE CB2 8EA, AND CAMBRIDGE UNIVERSITY PRESS OF THE UNIVERSITY PRINTING HOUSE, SHAFTESBURY ROAD CAMBRIDGE CB2 8BS (THE “CENTRE FOR EVALUATION AND MONITORING” OR “CEM”).

WHEREAS:

1. By placing an order ("Order"), the School or organisation purchasing on behalf of the school (henceforth referred to as the “School”) agrees to purchase a licence from CEM to use one or more of the assessment and monitoring systems belonging to CEM to facilitate computer based assessment including (if applicable):
1. any associated software components, media, printed materials, and "online" or electronic documentation which will be administered by the School in the form of a test that are the subject of the Order (henceforth referred to as the “Assessment”); and
2. access to online or downloadable analysis of assessment data and other data provided by the School, including additional guidance material that are the subject of the Order (henceforth referred to as the “Reports”).
2. The Assessment will include one or more of either:
1. ASPECTS, BASE, PIPs Baseline, PIPS and/or InCAS (a “Primary Product”); or
2. MidYIS, Yellis, Alis, CEM IBE (a “Secondary Product”)
3. On the terms set out in this Agreement, CEM agrees to grant a licence ("Licence") to the School to install or access online the systems that are the subject to the Order ("Systems") including the relevant Assessment and Reports.
4. In placing an Order with CEM for any of CEM’s Systems, the School understands that in doing so, the School enters into a legally binding contract with CEM in respect of the Licence.  Incorporated into this Agreement are the terms of the Order.

TERMS AND CONDITIONS OF LICENCE:

1. Where the Assessment purchased by the School is a Primary Product:

1. this Agreement shall be entered into by the Parties on the placing by the School of an Order to use one of CEM’s Systems;
2. access to the System that is the subject of the Order shall commence on 1st August 2019 ("Primary Start Date");
3. this Agreement shall remain in full force and effect for of an initial term of one (1) year following the Primary Start Date, until 31st July 2020, unless extended in accordance with Clause 1(d) or earlier terminated in accordance with the provisions of Clause 22 herein;
4. where in the course of placing the Order, the School has chosen for this Agreement to renew automatically, this Agreement shall renew automatically for additional periods of one (1) year, every year on the anniversary of the Primary Start Date unless either Party gives at least 4 weeks' notice to the other either via the website or otherwise in writing, that it wishes for this Agreement to expire on the next relevant anniversary of the Primary Start Date.

2. Where the Assessment purchased by the School is a Secondary Product:

1. this Agreement shall be entered into by the Parties on the placing by the School of an Order to use one of CEM’s Systems;
2. access to the System that is the subject of the Order shall commence on 1st June 2019 (the “Secondary Start Date”);
3. this Licence shall remain in full force and effect for of an initial term of one (1) year following the Secondary Start Date, until 31st May 2020, unless earlier extended in accordance with Clause 1(d) or terminated in accordance with the provisions of Clause 26 herein;
4. where in the course of placing the Order, the School has chosen for this Agreement to renew automatically, this Agreement shall renew automatically for additional periods of one (1) year, every year on the anniversary of the Secondary Start Date unless either Party gives at least 4 weeks' notice to the other either via the website or otherwise in writing, that it wishes for this Agreement to expire on the next relevant anniversary of the Secondary Start Date.

3. CEM hereby grants to the School the right to install and use multiple copies of the Assessment on the School’s computers running validly licensed copies of the operating system for which the Assessment was designed.
4. CEM hereby grants to the School the right to access online or download multiple copies of the Reports for use by the School .
5. CEM agrees to provide the Assessment and Reports as detailed in the School’s Order in accordance with the terms and conditions of this Agreement. CEM will use its best endeavours to ensure that the Assessment is provided under the best care, skill and diligence and in accordance with best industry practice as outlined by the guidelines of the British Educational Research Association (BERA), and in accordance with CEM’s ethical research framework, and in accordance with all applicable laws and regulations, and in consultation with the Schools.
6. In consideration of the rights granted to the School hereunder, the School undertakes and agrees to make payment to CEM of the Licence Fee detailed in the Order, within thirty (30) days of the date of receipt of an invoice.
7. The School acknowledges and agrees that any and all Intellectual Property Rights held in the System, Assessment and Reports including but not limited to all copyright therein, shall remain the sole and exclusive property of CEM.  For the purposes of this Agreement "Intellectual Property Rights" means all patents, rights to inventions, copyright and related rights, trade marks, business names and domain names, rights in get-up, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how) and all other intellectual property rights which subsist or will subsist now or in the future in any part of the world.
8. CEM shall at its own expense obtain written permission for the inclusion of any copyright material in the Assessment or Reports, and shall be responsible for the payment of all fees charged for the use of such material subject to copyright.
9. CEM warrants to the School that the Intellectual Property Rights in the Assessment and Reports, so far as it is aware and to the best of its knowledge and belief, do not infringe the rights of any third party and that no third party has threatened or is currently threatening proceedings in respect of such infringement, and none of its Intellectual Property Rights in the Assessment or Reports is the subject of any actual or, so far as it is aware, threatened challenge, opposition or revocation proceedings.
10. The Parties agree at all times to handle personal information of the candidates strictly in accordance with the Data Protection Legislation which for the purposes of this Agreement means the Data Protection Act 2018, the Regulation EU/2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) and all applicable laws and regulations relating to processing of personal data and privacy including where applicable the guidance and codes of practice issued by the Information Commissioner. Each Party shall have the rights and obligations subscribed to it under the Data Sharing Schedule set out below.
11. Both parties will act as Data Controller in respect of any personal data entered into the System or otherwise supplied to CEM for the purpose of this Agreement and will do so in accordance with the terms of the Data Sharing Schedule. 
12. Both parties agree they are responsible for ensuring they have a lawful basis for sharing any of the personal data provided to CEM as part of the System.
13. The School hereby acknowledges to CEM that CEM is subject to the requirements of the Freedom of Information Act 2000 and the School agrees to assist and co-operate with CEM (at their own expense) to enable CEM to comply with these information disclosure requirements. Further, in the event that the School is also subject to the requirements of the Freedom of Information Act 2000, CEM agrees to assist and co-operate with the School (at their own expense) to enable the School to comply with these information disclosure requirements. Any disclosure made by either party pursuant to such party’s obligations under the provisions of the FOIA, shall not constitute a breach of this Agreement.
14. The following sets out the entire financial liability of CEM to the School in respect of any breach by CEM of this Agreement, non or incomplete performance or contemplated performance by CEM of this Agreement, negligence for which CEM is liable, and any representation or statement arising under or in connection with this Agreement or by or on behalf of CEM:

1. in respect of all other losses and claims, the aggregate liability of CEM for any breach, negligence and/or liability arising in any other way out of the subject matter of this Agreement or the performance of the Assessment will not exceed in total the amounts actually received by CEM from the School for the licence of the Assessment software under this Agreement; and
2. CEM shall in no circumstances be liable for any loss of profits, loss of business or production, depletion of goodwill, loss of or corruption to data, and/or any indirect loss.

15. CEM will in no event be liable for any statement or representation about the School, their business, products or services made or communicated in or by any item, material or work approved by the Schools in writing.

16. For clarity, nothing in this Agreement limits or excludes either Party’s liability for death or personal injury caused by such Party’s negligence or any fraud or for any sort of liability that by law cannot be limited or excluded.
17. The School undertakes that under no circumstance shall the School:

1. copy, reproduce or create derivative works from the System, Assessment and/or Reports;
2. provide access to the System and/or Assessment to any a third party, other than as contemplated under this Licence, without the express written permission of CEM. 
3. provide access to or share the Reports with any third party other than as contemplated under this Licence. It is acknowledged and agreed by CEM that the School shall be allowed to share the Reports with third parties with whom it is strictly necessary in order to allow the School to make full use of the Reports as contemplated under this Agreement, which shall include, but not be limited to bodies representing parents, local authorities, the School’s parent company/trust, external inspectors and education consultants employed by the school;
4. sublicense, rent, sell or lease any portion of the System, Assessment and/or Reports;
5. alter, modify, disassemble, reverse engineer all or any part of the System, Assessment and/or Reports;
6. translate, merge, adapt or modify all or any part of the System, Assessment, and or Reports;
7. infringe CEM’s Intellectual Property Rights or those of any third party in relation to their use of the System, Assessment and/or Reports;
8. use the System, Assessment and/or Reports in a way that could damage, disable, overburden, impair or compromise CEM’s systems or security or interfere with other users; nor
9. use the System, Assessment and/or Reports in any manner not authorised by these terms.

18. The School hereby acknowledge that certain elements of the System, Assessment and Reports may at any time be in the process of being developed.  The System, Assessment and/or Reports may subsequently be substantially modified or withdrawn at the sole discretion of CEM.
19. The School’s installation and use of the System, Assessment and/or Reports is at the School’s sole discretion and risk and may produce unintended or erroneous results and may contain bugs, errors and other problems that could cause system or other failures and data loss. The School accepts that the System, Assessment and/or Reports are provided to the School "as is" without any warranty, and CEM expressly disclaims any and all warranties, including, but not limited to, warranties of merchantability, fitness for a particular purpose or error free operation.
20. CEM is not obligated to provide updates to the System, Assessment and/or Reports. However, in the event CEM elects in its sole discretion to provide updates to the System, Assessment and/or Reports, such updates shall be deemed to constitute part of the System, Assessment and/or Reports and shall therefore be subject to these terms.
21. The School warrants to CEM it shall at no point:

1. take any action which is intended, or could reasonably be expected, to harm in any way the reputation of CEM or any part of it; or
2. take any action which is intended, or could reasonably be expected to lead to any unwanted or unfavourable publicity for CEM or any part of it.

22. Following an Order, the School may terminate this Agreement for convenience at any time prior to the Primary Start Date or Secondary Start Date (as appropriate), by written notice to CEM. Where this Agreement is terminated by the School for convenience prior to such date, the School agrees to pay CEM a withdrawal fee to a total sum of FIFTY GBP (£50). Payment of said withdrawal charge shall be made within thirty (30) days of receipt by the School of an invoice.  Where the School wishes to terminate this Agreement following the Primary Start Date or Secondary Start Date (as appropriate), the School may do so by written notice to CEM, however, the School shall remain liable to CEM to pay the Licence Fee in full.
23. In the event that any Court or other competent authority decides that any provision of this Agreement is void or otherwise ineffective in whole or in part then any other part and the other terms and conditions of this Agreement shall continue in full force and effect.
24. The parties do not intend that any term of this Agreement shall be enforceable solely by virtue of the Contracts (Rights of Third Parties) Act 1999 by any person who is not a party to this Agreement.
25. CEM reserves the right to at any time assign any or all of its rights and/or obligations under this Agreement.
26. The Parties agree that CEM may at any time vary any term of this Agreement by posting the amended terms on its website and/or in a prominent position on the System. The School will be deemed to have agreed to such amended terms on the next occasion that it logs on and uses the software.
27. This Agreement constitutes the entire agreement between the parties with respect to the subject matter of this Agreement and supersedes all previous agreements, arrangements or undertakings between the parties relating to the subject matter of this Agreement and any representations or warranties previously given or made to it.
28. This Agreement is governed by and interpreted in accordance with English law. Any disputes or claims relating to this Agreement shall be subject to the exclusive jurisdiction of the English Courts.

DATA SHARING
SCHEDULE
Data Controller to Data Controller

1. DEFINITIONS AND INTERPRETATION

1.1 In this Schedule, the following words have the following meanings:

Agreed Purposes: the purposes set out in the Annex to this Schedule;

Data Subject Request: means a request made by a Data Subject to exercise any rights of Data Subjects under Data Protection Legislation; Data Protection Legislation: (as applicable) the Data Protection Act 2018; Regulation (EU) 2016/679 (the “GDPR”); and any laws, regulations and/or secondary legislation transposing the GDPR into English law or with similar subject matter, including any successor legislation to the Data Protection Act 2018;

Data Sharing: the transfer of the Shared Personal Data;

Shared Data Breach: any security breach or other action or inaction leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to Shared Personal Data;

Shared Personal Data: any personal data shared between the Parties in connection with the Agreement.

1.2 Where used in this Schedule, the terms Data Controller, Data Processor, Data Subject, Personal Data and processing and Special Category Data all have the meanings given to those terms in the Data Protection Legislation.

1.3 This Schedule is intended to be legally binding and shall prevail over all other agreements, arrangements and understandings between the Parties relating to the Data Sharing, whether made before or after the date of this Schedule and notwithstanding any wording to the contrary in such agreements, arrangements and understandings between the Parties.

1.4 In case of any conflict or inconsistency between the provisions of this Schedule and the main terms of the Agreement, the provisions contained in this Schedule shall prevail.

1.5 A reference to a statute or statutory provision includes all subordinate legislation made under it from time to time, and is a reference to it as amended, extended or re-enacted from time to time (“Replacement Law”). References to terms defined in a statute or statutory provision shall be replaced with or incorporate (as the case may be) references to the equivalent terms defined in any Replacement Laws, once in force and applicable.

1.6 To the extent that a term of this Schedule requires the performance by a party of an obligation “in accordance with Data Protection Legislation” (or similar), unless otherwise expressly agreed in this Schedule, this requires performance in accordance with the relevant requirements of such Data Protection Legislation as is in force and applicable at the time of performance (if any).

2. PURPOSE

2.1 In relation to the Shared Personal Data, each of the Parties agrees that it is a Data Controller.

2.2 During the term of this Agreement, the Parties shall share with each other certain Personal Data as detailed in the Privacy Notice. The Data Sharing is necessary to support the Agreed Purposes of both Parties.

2.3 The parties shall only use the Shared Personal Data for lawful purposes in connection with the Agreed Purpose and not process the Shared Personal Data in a way that is incompatible with the Agreed Purpose or Data Protection Legislation.

3. DATA PROTECTION COMPLIANCE

3.1 Each Party shall comply with all the obligations imposed on a controller under the Data Protection Legislation. Any material breach of the Data Protection Legislation by a Party in connection with the Data Sharing shall constitute a material breach of this Schedule.

3.2 Each Party shall:

1. process the Shared Personal Data fairly and lawfully, each of them as a Data Controller;
2. for each Agreed Purpose, ensure that it processes the Shared Personal Data on the basis of one of the legal grounds set out in Article 6 of the GDPR (Lawfulness of Processing) or Article 9 of the GDPR (Processing of special categories of personal data) (as applicable);
3. inform, or otherwise make information available to the Data Subjects of the purposes for which it will process Personal Data and provide or make available all information that it must provide in accordance with its own applicable law to ensure that Data Subjects understand how their Personal Data will be processed by that Party;
4. ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data;
5. not transfer any personal data outside the European Economic Area otherwise than in compliance with the Data Protection Legislation.

4. COOPERATION BETWEEN THE PARTIES

4.1 Each Party shall assist the other in complying with all applicable requirements of the Data Protection Legislation. In particular, in connection with the Shared Personal Data, each Party shall:

1. ensure that any notices given to Data Subjects in relation to the Shared Personal Data is provided in a manner and according to timing that is compliant with Data Protection Legislation;
2. inform the other Party if any Personal Data has been transferred to the other Party in error or otherwise in breach of the Data Protection Legislation, requesting the immediate deletion of such inappropriately transferred Personal Data;
3. if legally required, inform the other Party about the receipt of a complaint or Data Subject Request from any Data Subject regarding the Shared Personal Data;
4. deal at its discretion with all Data Subject Requests and complaints that it receives directly from a Data Subject or the person making the complaint. For the avoidance of doubt, a Data Subject Request made to one Party in its capacity as Data Controller shall not oblige the other Party to disclose any Personal Data it holds independently in its capacity as a Data Controller;
5. if legally required, inform the other Party without delay if a Data Subject requests the erasure of any Shared Personal Data. For the avoidance of doubt, where one Party is obliged to erase any Shared Personal Data, the other Party shall not be obliged to erase the same Shared Personal Data if that other Party may lawfully continue to hold and process such Shared Personal Data;
6. provide reasonable and prompt assistance to the other Party as is necessary to enable it to comply with a Data Subject Request and/or to respond to any other queries or complaints received from Data Subjects or supervisory authorities or regulators and, in each case related to the Shared Personal Data;
7. provide the other Party with such information as the other Party reasonably requires for maintaining the records it is required to maintain by the Data Protection Legislation; and
8. provide the other Party with contact details of at least one employee as point of contact and responsible manager for all issues arising out of the Data Protection Legislation, including the procedures to be followed in the event of a Shared Data Breach.

5. DATA BREACHES

5.1 In respect of each Shared Data Breach, each Party shall:

1. promptly notify the other Party of the Shared Data Breach;
2. provide the other Party without undue delay (wherever possible, no later than 48 hours after becoming aware of the Shared Data Breach) with such details as the other Party reasonably requires regarding the Shared Personal Data.

5.2 To the extent permitted by applicable laws, neither Party shall:

1. notify a supervisory or regulatory authority of any Shared Data Breach;
2. issue a public statement or otherwise notify any Data Subject of such Shared Data Breach,

without first consulting with, and obtaining the consent (not to be unreasonably withheld or delayed) of, the other Party.

6. DELETION OR RETURN OF SHARED DATA

6.1 Neither Party shall retain or process the Shared Personal Data for longer than is necessary in connection with carrying out the Agreed Purpose.

6.2 Notwithstanding clause 6.1, the Parties shall continue to retain Shared Personal Data in accordance with any statutory or professional retention periods applicable in their respective countries and/or industry.

Annex

1. AGREED PURPOSES

For the purposes of this agreement, Agreed Purposes refer to the following purposes:

1. CEM to provide the services under this Agreement to the School;
2. without prejudice to paragraph (a) above, CEM to (i) develop assessments and other CEM services and improve on their quality and integrity, including the collection of statistics and other information relating to such assessments and other services for CEM’s future use and (ii) carry out marketing and market research, and provide training in order to improve on the delivery of assessments and other services;
3. the School to benefit from the services provided to it under this Agreement:
4. without prejudice to paragraph (c) above, the School to offer, and enable pupils, to take CEM’s assessments; and
5. the Parties to comply with their legal and regulatory obligations and to assist each other in relation to any exercise by a pupil of their rights as a data subject.