Data Processing Agreement

Updated: June 3rd, 2021

1. Table of Contents

Preamble
The rights and obligations of the data controller
The data processor acts according to instructions
Confidentiality
Security of processing
Use of sub-processors
Transfer of data to third countries or international organisations
Assistance to the data controller
Notification of personal data breach
Erasure and return of data
Audit and inspection
The parties' agreement on other terms
Commencement and termination
Data controller and data processor contacts/contact points

Appendix A - Information about the processing
Appendix B - Authorised sub-processors
Appendix C - Instruction pertaining to the use of personal data
Appendix D - The parties' terms of agreement on other subjects

2. Preamble

These Contractual Clauses (the Clauses) set out the rights and obligations of the data controller and the data processor, when processing personal data on behalf of the data controller.
The Clauses have been designed to ensure the parties' compliance with Article 28(3) of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
In the context of the provision of the Personalisation Platform, the data processor will process personal data on behalf of the data controller in accordance with the Clauses.
The Clauses shall take priority over any similar provisions contained in other agreements between the parties.
Four appendices are attached to the Clauses and form an integral part of the Clauses.
Appendix A contains details about the processing of personal data, including the purpose and nature of the processing, type of personal data, categories of data subject and duration of the processing.
Appendix B contains the data controller's conditions for the data processor's use of sub-processors and a list of sub-processors authorised by the data controller.
Appendix C contains the data controller's instructions with regards to the processing of personal data, the minimum security measures to be implemented by the data processor and how audits of the data processor and any sub-processors are to be performed.
Appendix D contains provisions for other activities which are not covered by the Clauses.
The Clauses along with appendices shall be retained in writing, including electronically, by both parties.
The Clauses shall not exempt the data processor from obligations to which the data processor is subject pursuant to the General Data Protection Regulation (the GDPR) or other legislation.

3. The rights and obligations of the data controller

The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State data protection provisions and the Clauses.
The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.
The data controller shall be responsible, among other, for ensuring that the processing of personal data, which the data processor is instructed to perform, has a legal basis.

4. The data processor acts according to instructions

The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A and C. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses.
The data processor shall immediately inform the data controller if instructions given by the data controller, in the opinion of the data processor, contravene the GDPR or the applicable EU or Member State data protection provisions.

5. Confidentiality

The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under the data processor's authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, such access to personal data can be withdrawn, if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons.
The data processor shall at the request of the data controller demonstrate that the concerned persons under the data processor's authority are subject to the above mentioned confidentiality.

6. Security of processing

Article 32 GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

The data controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, the measures may include the following:

Pseudonymisation and encryption of personal data;
the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services;
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

Appendix A - Information about the processing

The Data Processor will process personal data for as long as the agreed "ToS" is in effect and for as long as the Data Controller uses the Data Processor's Personalisation Platform.

Appendix B - Authorised sub-processors

B.1. Approved sub-processors

On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors: Please refer to this page for the personal data processed in the Data controllers specific Store. The data controller shall on the commencement of the Clauses authorise the use of the above mentioned sub-processors for the processing described for that party. The data processor shall not be entitled - without the data controller's explicit written authorisation - to engage a sub-processor for a 'different' processing than the one which has been agreed upon or have another sub-processor perform the described processing.

B.2. Prior notice for the authorisation of sub-processors

The Data Processor has the Data Controller's general authorisation for the engagement of sub-processors. Please see paragraph 7.3 of this Data Processing Agreement for information on notice before changes concerning the addition or replacement of sub-processors.

Appendix C - Instruction pertaining to the use of personal data

C.1. The subject of/instruction for the processing

The data processor's processing of personal data on behalf of the data controller shall be carried out by the data processor performing the following:

Analysing data input from the Data Controller in order to predict the Data Controller's costumers' interests and intents through machine learning. The outcome of the Data Processor's processing will enable the Data Controller to deliver intelligent searches, relevant recommendations and personalized product offers by e-mail to the Data Controllers' customers, and to enable the Data Controller to target new relevant customers.

C.2. Security of processing

The level of security shall take into account:

That the Data Processor is, whenever possible, using pseudonymisation when processing personal data

The Data Processor shall hereafter be entitled and under obligation to make decisions about the technical and organisational security measures that are to be applied to create the necessary (and agreed) level of data security. The Data Processor shall however - in any event and at a minimum - implement the following measures that have been agreed with the Data Controller (on the basis of the risk assessment that the Data Controller has performed):

The Data Processor shall inform the Data Controller without undue delay and comprehensively about any errors or irregularities related to statutory provisions on the Processing of Personal Data detected during a verification of the results of such Processing.
The Data Controller shall, upon termination or expiration of the ToS and by way of issuing an Instruction, stipulate, within a period of time set by the Data Processor, the reasonable measures to return data carrier media or to delete stored data.
Any additional cost arising in connection with the return or deletion of Personal Data after the termination or expiration of the ToS shall be borne by the Data Controller.

C.3. Assistance to the data controller

The data processor shall insofar as this is possible - within the scope and the extent of the assistance specified below - assist the data controller in accordance with Clause 9.1. and 9.2. by implementing the following technical and organisational measures: The Data Controller has 24/7 access to all personal data via the Personalisation Platform. The Data Processor can assist and support the Data Processor every working day within the normal working hours.

C.4. Storage period/erasure procedures

For as long as the ToS is in force and for as long as the Data Controller is using the Data Processor's Personalisation Platform, personal data is stored with the Data Processor until the Data Controller requests that the data are erased or returned. In the event of termination of the ToS, personal data is erased within 30 days after expiry of the agreement unless legal grounds call for maintenance of this personal data on the company server.

C.5. Processing location

Processing of the personal data under the Clauses cannot be performed at other locations than the following without the data controller's prior written authorisation: Please refer here for the personal data processed in the Data controllers specific Store.

C.6. Instruction on the transfer of personal data to third countries

The Data Processor is entitled to transfer personal data to the approved sub-processors in third countries listed in C.5. The legal basis for this transfer is the European Commission's Standard Contractual Clauses. If personal data is to be transferred to third countries in other cases, the Data Processor is obliged to duly notify and ask for the Data Controller's consent pertaining to the transfer of personal data to a third country. The transfer of personal data to a third country can only take place following the rules in the General Data Protection Regulation and the Data Processor is obliged to secure a legal basis for the transfer.

C.7. Procedures for the data controller's audits, including inspections, of the processing of personal data being performed by the data processor

The Parties have agreed that the following types of inspection report may be used:

The Data Controller has access to and can control all personal data at any time via the Personalisation Platform.
Once a year the Data Controller can require that the Data Processor answers questions in a written questionnaire regarding the Data Processor's compliance with the Clauses, and
Once a year, the Data Controller or the Data Controller's representative shall have the possibility to perform a physical inspection of the places, where the processing of personal data is carried out by the data processor, including physical facilities as well as systems used for and related to the processing to ascertain the data processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses.

The Data Controller's costs, if applicable, relating to physical inspection shall be defrayed by the Data Controller. The Data Processor shall, however, be under obligation to set aside the resources (mainly time) required for the Data Controller to be able to perform the inspection.

C.8. Procedures for audits, including inspections, of the processing of personal data being performed by sub-processors

The Parties have agreed that the following types of inspection report may be used:

The Data Controller has access to and can control all personal data at any time via the Personalisation Platform.
Once a year the Data Controller can require that the Data Processor answers questions in a written questionnaire regarding the Data Processor's compliance with the Clauses, and
Once a year, the Data Controller or the Data Controller's representative shall have the possibility to perform a physical inspection of the places, where the processing of personal data is carried out by the data processor, including physical facilities as well as systems used for and related to the processing to ascertain the data processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses.

Appendix D - The parties' terms of agreement on other subjects

No content