Processing of personal data
The Data Processor may only act and process the Personal Data in accordance with the documented instruction from the Data Controller (the ‘Instruction’). The Instruction at the time of entering into this Data Processor Agreement is that the Data Processor may only process the Personal Data with the purpose of delivering the Main Services as described in the Main Agreement. The Data Controller guarantees that the Personal Data transferred to the Data Processor is processed by the Data Controller in accordance with the Applicable Law, including the legislative requirements regarding lawfulness of processing. The Data Processor shall give notice without undue delay if the Data Processor considers the at-the-time-being Instruction to be in conflict with the Applicable Law.
The Data Processor’s obligations
Confidentiality The Data Processor shall treat all the Personal Data as strictly confidential information. The Personal Data may not be copied, transferred or otherwise processed in conflict with the Instruction, unless the Data Controller in writing has agreed hereto. The Data Processor’s employees shall be subject to an obligation of confidentiality that ensures that the employees shall treat all the Personal Data under this Data Processor Agreement with strict confidentiality. Security The Data Processor shall implement the appropriate technical and organizational measures as set out in this Agreement and in the Applicable Law, including in accordance with GDPR, article 32. The Data Processor shall ensure that access to the Personal Data is restricted to only the employees to whom it is necessary and relevant to process the Personal Data in order for the Data Processor to perform its obligations under the Main Agreement and this Data Processor Agreement. The Data Processor shall also ensure that the Data Processor’s employees working processing the Personal Data only processes the Personal Data in accordance with the Instruction. The Data Processor shall provide documentation for the Data Processor’s security measures if requested by the Data Controller in writing. Data protection impact assessments and prior consultation If the Data Processor’s assistance is necessary and relevant, the Data Processor shall assist the Data Controller in preparing data protection impact assessments in accordance with GDPR, article 35, along with any prior consultation in accordance with GDPR, article 36. Rights of the data subjects If the Data Controller receives a request from a data subject for the exercise of the data subject’s rights under the Applicable Law and the correct and legitimate reply to such a request necessitates the Data Processor’s assistance, the Data Processor shall assist the Data Controller by providing the necessary information and documentation. The Data Processor shall be given reasonable time to assist the Data Controller with such requests in accordance with the Applicable Law. If the Data Processor receives a request from a data subject for the exercise of the data subject’s rights under the Applicable Law and such request is related to the Personal Data of the Data Controller, the Data Processor must immediately forward the request to the Data Controller. Personal Data Breaches The Data Processor shall give immediate notice to the Data Controller if a breach of the data security occurs, especially a breach that can lead to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to the personal data being transmitted, stored or otherwise processed. The Data Processor shall have and maintain a register of all Personal Data Breaches. The register shall at a minimum include the following: A description of the nature of the Personal Data Breach, including, if possible, the categories and the approximate number of affected Data Subjects and the categories and the approximate number of affected registrations of personal data. A description of the likely as well as actually occurred consequences of the Personal Data Breach. A description of the measures that the Data Processor has taken or proposes to take to address the Personal Data Breach, including, where appropriate, measures taken to mitigate its adverse effects. The register of Personal Data Breaches shall be provided to the Data Controller in copy if so requested in writing by the Data Controller or the relevant Data Protection Agency. Documentation of compliance The Data Processor shall after the Data Controller’s written request hereof provide documentation substantiating that: (i) the Data Processor complies with its obligations under this Data Processor Agreement and the Instruction; and (ii) the Data Processor complies with the Applicable Law in respect of the processing of the Data Controller’s Personal Data. The Data Processor’s documentation of compliance shall be provided upon request within reasonable time. Location of the Personal Data The Data Processor will transfer, process and store Personal Data outside of the EEA to wherever the Data Processor operates for the purpose of providing the Main Services. Any transfer of the Personal Data to any third countries or international organizations in the future shall only be done to the extent such transfer is permitted and done in accordance with the Applicable Law.
The Data Controller obligations
The Data Controller agrees that: it shall comply with its obligations as a Data Controller under the Data Protection Laws in respect of its processing of Personal Data and any processing instructions it issues to the Data Processor; and it has provided notice and obtained (or shall obtain) all consents and rights necessary under the Data Protection Laws for the Data Processor to process Personal Data and provide the Main Services pursuant to the Agreement and this DPA.
The Data Processor is given general authorization to engage third-parties to process the Personal Data (‘Sub-Processors’) without obtaining any further written, specific authorization from the Data Controller. The Data Processor shall conclude a written sub-processor agreement with any Sub-Processors. Such an agreement shall at minimum provide the same data protection obligations as the ones applicable to the Data Processor, including the obligations under this Data Processor Agreement. The Data Processor shall on an ongoing basis monitor and control its Sub-Processors’ compliance with the Applicable Law.
Remuneration and costs
The Data Processor is entitled to remuneration for any time and material used to adapt and change the processing activities in order to comply with any changes to the Data Controller’s Instruction, including implementation costs and additional costs required to deliver the Main Services due to the change in the Instruction. The Data Processor is exempted from liability for non-performance with the Main Agreement if the performance of the obligations under the Main Agreement would be in conflict with any changed Instruction or if contractual delivery in accordance with the changed Instruction is impossible. This could for instance be the case; if the changes to the Instruction cannot technically, practically or legally be implemented; where the Data Controller explicitly requires that the changes to the Instruction shall be applicable before the changes can be implemented; and in the period of time until the Main Agreements is changed to reflect the new Instruction and commercial terms hereof. If changes to the Applicable Law, including new guidance or courts practice, result in additional costs to the Data Processor, the Data Controller shall indemnify the Data Processor of such documented costs.
Breach and liability
In the event of a security leak and/or the leaking of data, the Data Processor shall, to the best of its ability, notify the Data Controller thereof without undue delay, after which the Data Controller shall determine whether or not to inform the data subjects and/or the relevant regulatory authority(ies). This duty to report applies irrespective of the impact of the leak. The Data Processor will endeavour that the furnished information is complete, correct and accurate. If required by law and/or regulation, the Data Processor shall cooperate by notifying the relevant authorities and/or data subjects. The Data Controller remains the responsible party for any statutory obligations in respect thereof. The duty to report includes in any event the duty to report the fact that a leak has occurred, including details regarding: the (suspected) cause of the leak; the (currently known and/or anticipated) consequences thereof; the (proposed) solution; the measures that have already been taken. The limitation of liability does not apply to the following: Losses as a consequence of the other party’s gross negligence or willful misconduct. A party’s expenses and resources used to perform the other party’s obligations, including payment obligations, towards a relevant data protection agency or any other authority.
The Data processor Agreement shall remain in force until the Main Agreement is terminated.
The Data Processor processes the following types of Personal Data in connection with its delivery of the Main Services: Ordinary contact information on relevant employees from the Data Controller. Users of the Main Services: names, telephone numbers, emails, addresses and IPs. Personal data provided by the users in connection with their use of the Main Services.
Categories of data subjects
The Data Processor processes Personal Data about the following categories of data subjects on behalf of the Data Controller: Customers End-users
We reserve the right to disclose your personally identifiable information as required by law and when we believe that disclosure is necessary to protect our rights and/or to comply with a judicial proceeding, court order, or legal process served on our Web site.
The security of your personal information is important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however we have taken every step possible to make your information safe. This website is protected by Secure Sockets Layer (SSL) to protect your information. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
The Data Processor’s authorization to process Personal Data on behalf of the Data Controller shall be annulled at the termination of this Data Processor Agreement. The Data Processor shall continue to process the Personal Data after the termination of the Data Processor Agreement to the extent it is necessary and required under the Applicable Law. In the same period, the Data Processor is entitled to include the Personal Data in the Data Processor’s backup. At the termination of this Data Processor Agreement, the Data Processor and its Sub-Processors shall return the Personal Data processed under this Data Processor Agreement to the Data Controller, provided that the Data Controller is not already in possession of the Personal Data.
Changes To This Privacy Statement