Data Protection Notice

Information relating to a prospective customer or current customer (“Data Subject”) is being provided to you. By using the information provided you agree to comply with the following obligations. If you cannot comply or become unable to comply with these obligations you may not use the Data Subject’s information and must notify Vuzix immediately.

Data Protection Obligations: I will comply with all applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR), and shall take all necessary technical and organizational measures to ensure the security and confidentiality of personal data processed on behalf of Vuzix and/or the Data Subject.

Processing of Personal Data: I will only process personal data on behalf of Vuzix and in accordance with Vuzix’ instructions. I will not process personal data for any other purposes unless required by law.

Subprocessing: I will not engage any subprocessors without the prior written consent of Vuzix and/or the Data Subject. If Vuzix and/or the Data Subject consent to the use of subprocessors, I will ensure that the subprocessors provide sufficient guarantees to implement appropriate technical and organizational measures in such a way that the processing meets the requirements of the GDPR.

Security Measures: I will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk involved in the processing of personal data. I will take into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

Data Breach Notification: I will notify Vuzix without undue delay after becoming aware of a personal data breach and shall provide Vuzix with sufficient information to allow Vuzix to meet its obligations to report the breach to the relevant supervisory authority and data subjects.

Data Subject Rights: I will assist Vuzix in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under the GDPR, including but not limited to the right to access, rectification, erasure, restriction of processing, data portability and objection.

Data Protection Impact Assessment: If required by the GDPR, I will assist Vuzix in carrying out a data protection impact assessment (DPIA) and in consulting with the relevant supervisory authority prior to processing, as required by the GDPR.

Audits and Inspections: I will allow Vuzix to audit or inspect my data processing activities to ensure compliance with the GDPR, and I shall provide Vuzix with all necessary information to demonstrate compliance with the GDPR.