Data Processing Agreement

Contract for the processing of personal data on behalf of a person responsible in accordance with Art. 28 GDPR

1. Scope, Subject of the Agreement

1.1 This data processing agreement (hereinafter "DPA") only applies if the Customer is a company within the meaning of § 14 BGB.

1.2 In accordance with this DPA, Blue Performance GmbH (hereinafter referred to as “Supplier”) processes personal data on behalf of the Customer. In the course of the provision of services in accordance with the conclusion of the contract in accordance with the above General Terms and Conditions of Use of the Supplier (hereinafter referred to as "Main Agreement"), it is necessary for the Supplier to process personal data for which the Customer is the controller in terms of data protection regulations (hereinafter referred to as ”Customer Data‟).

This DPA specifies the data protection obligations and rights of the Parties in connection with the Supplier´s use of Customer Data to render the services under the Main Agreement.

2. Scope of the Commissioning

2.1 The Supplier shall process the Customer Data on behalf and in accordance with the instructions of the Customer within the meaning of Art. 28 GDPR (Processing on Behalf). The Customer remains the controller in terms of data protection law.

2.2 The processing of Customer Data by the Supplier occurs in the manner and the scope and for the purpose determined in the Main Agreement and in Annex 1 to this DPA. The processing relates to the types of personal data and categories of data subjects specified in Annex 1. The duration of processing corresponds to the term of the Main Agreement.

2.3 The Supplier reserves the right to anonymize or aggregate the Customer Data in such a way that it is no longer possible to identify individual data subjects, and to use them in this form for the purpose of needs-based designing, developing and optimizing as well as rendering of the services agreed as per the Main Agreement. The Parties agree that anonymized and according to the above requirement aggregated Customer Data are not considered Customer Data for the purposes of this agreement.

2.4 The processing of Customer Data by the Supplier shall in principle take place inside the European Union or another contracting state of the European Economic Area (EEA). The Supplier is nevertheless permitted to process Customer Data in accordance with the provisions of this agreement outside the EEA if he informs the Customer in advance about the place of data processing and if the requirements of Art. 44 to 48 GDPR are fulfilled or if an exception according to Art. 49 GDPR applies.

3. Right of the Customer to issue Instructions

3.1 The Supplier processes the Customer Data in accordance with the instructions of the Customer, unless the Supplier is legally required to do otherwise. In the latter case, the Supplier shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 The instructions of the Customer are in principle conclusively stipulated and documented in the provisions of this DPA. Individual instructions which deviate from the stipulations of this agreement or which impose additional requirements shall require the Supplier´s consent; the Customer immediately confirms verbal instructions (at least in text form). The Customer assumes any additional costs caused by the individual instruction.

3.3 The Supplier shall ensure that the Customer Data is processed in accordance with the instructions given by the Customer. If the Supplier is of the opinion that an instruction given by the Customer infringes this DPA or applicable data protection law, he is after correspondingly informing the Customer entitled to suspend the execution of the instruction until the Customer confirms the instruction. The Parties agree that the sole responsibility for the processing of the Customer Data in accordance with the instructions lies with the Customer.

4. Legal Responsibility of the Customer

4.1 The Customer is solely responsible for the permissibility of the processing of the Customer Data and for safeguarding the rights of data subjects in the relationship between the parties. Should third parties assert claims against the Supplier based on the processing of Customer Data in accordance with this DPA, the Customer shall indemnify the Supplier from all such claims upon first request.

4.2 The Customer is responsible to provide the Supplier with the Customer Data in time for the rendering of services according to the Main Agreement and he is responsible for the quality of the Customer Data. The Customer shall inform the Supplier immediately and completely if during the examination of the of the Supplier´s results he finds errors or irregularities with regard to data protection provisions or his instructions.

4.3 On request, the Customer shall provide the Supplier with the information specified in Art. 30 para. 2 GDPR, insofar as it is not available to the Supplier himself.

4.4 If the Supplier is required to provide information to a governmental body or person on the processing of Customer Data or to cooperate with these bodies in any other way, the Customer is obliged at first request to assist the Supplier in providing such information and in fulfilling other cooperation obligations.

5. Requirements for Personnel and Systems

The Supplier shall commit all persons engaged in processing Customer Data to confidentiality with respect to the processing of Customer Data.

6. Security of Processing

6.1 The Supplier takes according to Art. 32 GDPR necessary, appropriate technical and organizational measures, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the Customer Data, as well as the different likelihood and severity of the risk to the rights and freedoms of the data subjects, in order to ensure a level of protection of Customer Data appropriate to the risk.

6.2 The Supplier shall have the right to modify technical and organizational measures during the term of the DPA, as long as they continue to comply with the statutory requirements.

7. Engagement of further Processors

7.1 The Customer grants the Supplier the general authorization to engage further processors with regard to the processing of Customer Data. Further processors consulted at the time of conclusion of the DPA result from Annex 2. In general, no authorization is required for contractual relationships with service providers that are concerned with the examination or maintenance of data processing procedures or systems by third parties or that involve other additional services, even if access to Customer Data cannot be excluded, as long as the Supplier takes reasonable steps to protect the confidentiality of the Customer Data.

7.2 The Supplier shall notify the Customer of any intended changes in relation to the consultation or replacement of further processors. In individual cases, the Customer has the right to object to the engagement of a potential further processor. An objection may only be raised by the Customer for important reasons which have to be proven to the Supplier. Insofar as the Customer does not object within 14 days after receipt of the notification, his right to object to the corresponding engagement lapses. If the Customer objects, the Supplier is entitled to terminate the Main Agreement and this DPA with a notice period of 3 months.

7.3 The agreement between the Supplier and the further processor must impose the same obligations on the latter as those incumbents upon the Supplier under this DPA. The Parties agree that this requirement is fulfilled if the contract has a level of protection corresponding to this DPA, respectively if the obligations laid down in Art. 28 para. 3 GDPR are imposed on the further processor.

7.4 Subject to compliance with the requirements of Section 2.5 of this DPA, the provisions of this Section 7 shall also apply if a further processor in a third country is involved. The Customer hereby authorizes the Supplier to conclude an agreement with another processor on behalf of the Customer based on the standard contractual clauses for the transfer of personal data to processors in third countries pursuant to the decision of the European Commission of February 5th in 2010. The Customer declares his willingness to cooperate in fulfilling the requirements of Art. 49 GDPR to the extent necessary.

8. Data Subjects´ Rights

8.1 The Supplier shall support the Customer with technical and organizational measures within the scope of what is reasonable and against reimbursement of the expenses and costs incurred to be proven by the Supplier in fulfilling the Supplier’s obligation to respond to requests for exercising data subjects´ rights.

8.2 As far as a data subject submits a request for the exercise of his rights directly to the Supplier, the Supplier will forward this request to the Customer in a timely manner.

8.3 The Supplier shall inform the Customer of any information relating to the stored Customer Data, about the recipients of Customer Data to which the Supplier shall disclose it in accordance with the instruction and about the purpose of storage, as far as the Customer does not have this information at his disposal and as far as he is not able to collect it himself.

8.4 The Supplier shall, within the bounds of what is reasonable and necessary, against reimbursement of the expenses and costs incurred by the Supplier as a result of this and to be proven, enable the Customer to correct, delete or restrict the further processing of Customer Data, or at the instruction of the Customer correct, block or restrict further processing himself, if and to the extent that this is impossible for the Customer.

8.5 Insofar as the data subject has a right of data portability vis-à-vis the Customer in respect of the Customer Data pursuant to Art. 20 GDPR, the Supplier shall support the Customer within the bounds of what is reasonable and necessary in return for reimbursement of the expenses and costs incurred by the Supplier as a result of this and to be proven in handing over the Customer Data in a structured, commonly used and machine-readable format, if the Customer is unable to obtain the data elsewhere.

9. Notification and Support Obligations of the Supplier

9.1 Insofar as the Customer is subject to a statutory notification obligation due to a breach of the security of Customer Data (in particular pursuant to Art. 33, 34 GDPR), the Supplier shall inform the Customer in a timely manner of any reportable events in his area of responsibility. The Supplier shall assist the Customer in fulfilling the notification obligations at the latter´s request to the extent reasonable and necessary in return for reimbursement of the expenses and costs incurred by the Supplier as a result thereof and to be proven.

9.2 The Supplier shall assist the Customer to the extent reasonable and necessary in return for reimbursement of the expenses and costs incurred by the Supplier as a result thereof and to be proven with data protection impact assessments to be carried out by the Customer and, if necessary, subsequent consultations with the supervisory authority pursuant to Art. 35, 36 GDPR.

10. Deletion and Return of Customer Data

10.1 The Supplier shall delete the Customer Data upon termination of this DPA, unless the Supplier is obligated by law to further store the Customer Data.

10.2 The Supplier may keep documentations, which serve as evidence of the orderly and accurate processing of Customer Data, also after the termination of the DPA.

11. Evidence and Audits

11.1 The Supplier shall provide the Customer, at the latter´s request, with all information required and available to the Supplier to prove compliance with his obligations under this DPA.

11.2 The Customer shall be entitled to audit the Supplier with regard to compliance with the provisions of this DPA, in particular the implementation of the technical and organizational measures; including inspections.

11.3 In order to carry out inspections in accordance with Section 11.2., the Customer is entitled to access the business premises of the Supplier in which Customer Data is processed within the usual business hours (Mondays to Fridays from 10 a.m. to 6 p.m.) after timely advance notification in accordance with Section 11.5 at his own expense, without disruption of the course of business and under strict secrecy of the Supplier´s business and trade secrets.

11.4 The Supplier is entitled, at his own discretion and taking into account the legal obligations of the Customer, not to disclose information which is sensitive with regard to the Supplier´s business or if the Supplier would be in breach of statutory or other contractual provisions as a result of its disclosure. The Customer is not entitled to get access to data or information about the Supplier´s other customers, cost information, quality control and contract management reports, or any other confidential data of the Supplier that is not directly relevant for the agreed audit purposes.

11.5 The Customer shall inform the Supplier in good time (usually at least four weeks in advance) of all circumstances relating to the performance of the audit. The Customer may carry out one audit per calendar year. Further audits are carried out after consultation with the Supplier. The Supplier can assert a remuneration claim for enabling controls by the Customer. The amount of the remuneration must be agreed in advance and is based on the hourly rate of the employee of the Supplier or subcontractor assigned to the inspection.

11.6 If the Customer commissions a third party that shall not be a competitor to the Supplier to carry out the audit, the Customer shall obligate the third party in writing the same way as the Customer is obliged vis-à-vis the Supplier according to this Section 11 of this DPA. In addition, the Customer shall obligate the third party to maintain secrecy and confidentiality, unless the third party is subject to a professional obligation of secrecy. At the request of the Supplier, the Customer shall immediately submit to him the commitment agreements with the third party.

11.7 At the discretion of the Supplier, proof of compliance with the obligations under this DPA may be provided, instead of an inspection, by submitting an appropriate, current opinion or report from an independent authority (e.g. auditor, audit department, data protection officer, IT security department, data protection auditors or quality auditors) or a suitable certification by IT security or data protection audit – e.g. according to BSI-Grundschutz – (”audit report‟), if the audit report makes it possible for the Customer in an appropriate manner to convince himself of compliance with the contractual obligations.

12. Contract Term and Termination

12.1 The term and termination of this DPA shall be governed by the term and termination provisions of the Main Agreement. A termination of the Main Agreement automatically results in a cancellation of this DPA. An isolated termination of this DPA is excluded.

13. Liability

13.1 The Supplier´s liability under this DPA shall be governed by the disclaimers and limitations of liability provided for in the Main Agreement. As far as third parties assert claims against the Supplier which are caused by the Customer´s culpable breach of this DPA or one of his obligations as the controller in terms of data protection law affecting him, the Customer shall upon first request indemnify and hold the Supplier harmless from these claims.

13.2 The Customer undertakes to indemnify the Supplier upon first request against all possible fines imposed on the Supplier corresponding to the Customer´s part of responsibility for the infringement sanctioned by the fine.

14. Final Provisions

14.1 In case individual provisions of this DPA are ineffective or become ineffective or contain a gap, the remaining provisions shall remain unaffected. The Parties undertake to replace the ineffective provision by a legally permissible provision which comes closest to the purpose of the ineffective provision and that thereby satisfies the requirements of Art. 28 GDPR.

14.2 In case of conflicts between this DPA and other arrangements between the Parties, in particular the Main Agreement, the provisions of this DPA shall prevail.

Annexes:
Annex 1: Types of Personal Data and Categories of Data Subjects
Annex 2: Further Processors

Annex 1: Types of Personal Data and Categories of Data Subjects

Annex 2: Further Processors

Blue Performance GmbH
Brienner Street 45d
80333 Munich
Phone: +49 (89) 6931471-80
E-Mail: hi@cardeleine.com
www.cardeleine.com