For the purposes of the Clauses:
The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
(ii) any accidental or unauthorised access, and
(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
2. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
The personal data transferred concern the following categories of data subject:
The personal data transferred concern the following categories of data:
Name, address, customer, number, contact details etc. Special categories of personal data are not a subject matter of the data processing.
The standard contractual clauses shall be interpreted in the light of the Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).
The rights and obligations set forth in this section shall be additional to those set forth in the standard contractual clauses above and shall under no circumstance lower the level of data protection stipulated standard contractual clauses. In case of contradictions the regulations set forth in the standard contractual clauses shall prevail.
Data importer shall inform data exporter without undue delay, if data importer is of the opinion that an instruction of data exporter infringes regulations pursuant to applicable data protection laws or if data importer is obligated under applicable laws to process personal data outside the scope of data exporter’s instructions.
Data importer shall ensure that only persons have access to personal data if necessary for the processing under the Standard Contractual Clauses. Furthermore, data importer ensures that such persons authorized to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality. The obligation of confidentiality survives the expiration, termination or cancellation of the Standard Contractual Clauses.
Data importer shall appoint – where required by applicable data protection law – a data protection officer who possesses the knowledge and reliability necessary for the performance of his/her duties and provide data exporter with data protection officer’s contact details. Data importer shall inform data exporter about any changes in the person of the data protection officer without undue delay and shall provide data exporter with updated contact details.
Data importer shall support data exporter at data exporter’s request with all information necessary to demonstrate compliance with GDPR in particular
Data importer shall notify data exporter immediately and in any case within five business days if it receives:
Data importer shall assist data exporter in the fulfilment of data exporter’s obligation to respond to data subject rights requests (e.g. Art. 15 – 20 GDPR), and to defend against data subject claims (Art. 82 GDPR). In particular, but not limited to, this shall include the provision of relevant information and further relevant support upon data exporter’s request without undue delay.
If data importer receives a request from a data subject, data importer shall immediately and in any case within five business days inform data exporter in writing or in electronic form (e.g. e-mail) of the details of the request.
The data importer is not allowed to make copies or duplicates of personal data of the data exporter without the prior written consent of the data exporter, unless such copies or duplicates are necessary in the course of proper data processing activities or the fulfilment of statutory data retention obligations.
In addition to Clause 12 of the Standard Contractual Clauses, the parties agree that no personal data of the data exporter that was provided under the Standard Contractual Clauses shall remain with the data importer after the duration of the data processing. At the choice of the data exporter the data importer shall return or destroy data storage media of the data exporter. The deletion of this data and – if applicable – the destruction of data storage media shall be carried out in accordance with the current state of the art and with the data protection requirements. The data importer shall confirm the deletion and – if applicable – the destruction in writing or via e-mail.
In the event that a change in applicable data protection law would make the continued transfer or processing of personal data under this Annex unlawful for Controller, then, prior to the effective dateof any such change, either (a) if commercially reasonable alternatives exist for adjusting the procedures for transfer or processing in order to avoid a violation of applicable law, then Processor and Controller, at their own respective cost and expense, shall cooperate in good faith by implementing such alternatives, or (b) if the Parties fail to reach an agreement satisfactory to both Parties within 90 days after the receipt of the request for negotiation, then Controller shall be entitled to terminate the agreement and/or any SOW, if executed with immediate effect.
The technical and organizational measures applicable to the Agreement, and which the Processor shall apply, are set out below. The general measures set out in section 1 are mandatory and applicable to all cases of data processing activities. All other measures in sections 2 and 3 apply, unless the Parties agree that they do not apply to the data processing activity. Processor represents and warrants, on a continuing basis, that the selected technical and organizational measures are, and will remain, in place for the present data processing by the Processor.
[X] IT Security policy according to common frameworks (e.g. ISO 27001, or equivalent standards)
[X] Provision of further internal controls in line with frameworks such as SOC 2 type 2 or other relevant frameworks
[X] Regular assessment of sub processors
[X] Erasure and/or controlled destruction policies and processes of all personal data (e.g. upon expiry of the retention period or on request of the data controller)
[X] Clear distinction between the Controller’s and the Processor’s areas of responsibility
[X] Identity cards or code card passes
[X] Biometric passes
[X] Security locks or electronic locks
[X] Keys
[X] Identification of the persons requesting access for facilities
[X] Visitor passes for third parties
[X] Logging of accesses
[X] Security alarm system or other appropriate security measures
[X] Constructional measures (fencing, surveillance cameras, locked doors, gates and windows, etc.)
[X] Specific safety areas with own access control (“closed shops”)
[X] Guidelines for the documentation of software and IT procedures
[X] Documentation of IT infrastructure including system interfaces
[X] Centralized procurement of hardware and software
[X] Formal release procedures for hardware, software and IT procedures
[X] Data privacy and IT security requirements are part of software release management processes
[X] Keeping all software used in connection with the processing up-to-date (e.g. by updates, patches, fixes, etc.)
[X] Execution of a risk and weak point analysis
[X] Policies and processes for remote maintenance and/or support services
[X] Automatic log-off of user IDs that have not been used for a substantial period of time
[X] Log-file of all events (e.g. audit trails of accesses and break-in attempts)
[X] Back end systems are hardened to prevent attackers from gaining unauthorized access
[X] Documentation of persons authorized to enter personal data
[X] Protective measures for the data input as well as for the reading, blocking and deletion of stored personal data
[X] Pseudonymisation of sensitive personal data
[X] Securing the areas in which data are (temporarily) located
[X] Audit trails of handling personal data (in particular usage, modification and deletion of data by whom with a time stamp)
[X] Marking of internal data as well as external data
[X] Separation of the data which have been stored under an alias (pseudonym) from the original data
[X] Storage of the personal data in separated data collectors (physical separation)
[X] Segmentation of network, at least separating the front end from back end systems
[X] Contingency plans for critical systems, including clear steps and procedures for common threats, triggers for activation, decision process for activating, steps and recovery time objectives
[X] Logging of the activation and execution of contingency plans, including decisions taken, steps followed and final recovery time
[X] Set up of the server in a separately secured server room or datacenter
[X] Fire and water protection measures
[X] Emergency power generator and/or uninterruptible power supply
[X] Regular emergency drills
[X] Generating backup copies at regular intervals
[X] Storage of backup copies outside the IT department in a safe location
[X] Data mirroring
[X] Checking restorability of backup copies at regular intervals
[X] Alternative locations for storage of backup copies in case of emergency
[X] Release of data media only to authorized persons or (external) parties
[X] Restriction of the use of external storage media (especially USB sticks, external hard drives, SD cards, CD and DVD burners) by technical means (e.g. software for interface control or complete deactivation of interfaces)
[X] Deactivation of software for which it cannot be excluded that this software transmits data to third parties (e.g. Skype, Google Chrome, Google Desktop, Google Toolbar, translation software, Social Media tools, etc.)
[X] Documentation of the remote locations / destinations to which a transmission is intended and the transmission path (logical path)
[X] Complete, correct and secured data transfer
[X] Courier services, personal pickup, confirmation of accomplishing the transport
[X] Implementation of filter measures (URL filter, filtering of email attachments, etc.)
The following subprocessors have either co-signed these Clauses or concluded a written agreement with the data importer which imposes the same obligations on the subprocessor as are imposed on the data importer under these Clauses in accordance with Sec. 11 para 1 of these Clauses:
Cookie | Duration | Description |
---|---|---|
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |