The undersigned consider the following:
- parties have entered into an agreement pursuant to which KRB provides one or more services to Customer (the “Agreement”);
- this Agreement applies to the extent services are provided that involve processing of personal data on behalf of the Customer, such as database management, web hosting, postal mailings and commercial advertising (the “Personal Data”);
- the party obligated under the Agreement to provide these services (Krb. Communications or Krb. Haaglanden) qualifies as a processor and is subject to the obligations under this processor agreement;
- if the content of this processor agreement differs from provisions in the Agreement, this processor agreement shall prevail;
and have agreed as follows:
- Processing of personal data
- KRB acts as a processor within the meaning of the General Data Protection Regulation (GDPR). The Client determines the purpose and means of processing Personal Data and therefore qualifies as a processor. The processing operations, categories of Personal Data and categories of data subjects are described in Annex 1.
- The parties will process the Personal Data in a proper and careful manner. In doing so, they will act in accordance with this processor agreement and applicable laws and regulations.
- The parties shall provide reasonable cooperation to each other in complying with the legislation referred to in Article 1.2.
- Obligations of KRB
- KRB processes Personal Data only for the purposes of the performance of the Agreement and in accordance with the Customer’s written instructions. KRB does not retain Personal Data longer than necessary for the performance of the Agreement.
- Notwithstanding Article 2.1, KRB may process Personal Data if a legal obligation so requires. In that case, KRB shall inform the Client in advance, unless the relevant legislation does not permit this.
- If KRB is of the opinion that an instruction of the Client violates the AVG or other privacy laws, KRB shall inform the Client. The parties will then enter into consultation to reach a solution.
- KRB grants access to Personal Data to employees and third parties only to the extent necessary in the context of their work, and KRB obliges them in writing to maintain the confidentiality of the Personal Data.
- KRB will only process Personal Data within the European Economic Area (EEA), except where the Customer has given its prior consent for transfer outside the EEA.
- The obligations that apply to KRB under this processor agreement also apply to those who process Personal Data under the authority of KRB.
- Distribution of responsibilities
- KRB is solely responsible for the processing of Personal Data that takes place in the context of the execution of the Agreement or any other written order of the Client. For processing operations outside this scope, including the collection of Personal Data by Customer, processing for purposes not disclosed to KRB and the processing of Personal Data by third parties, KRB shall not be liable.
- The Customer guarantees that the processing of Personal Data under this processor agreement is not unlawful and does not infringe on the rights of third parties.
- Security
- KRB shall take appropriate organizational and technical measures for the security of Personal Data that can reasonably be required of KRB, taking into account the interest to be protected, the state of the art and the cost of relevant security measures. The measures taken as of the date of signature are described in Annex 2. The Client confirms that these measures are appropriate.
- Customer acknowledges that KRB cannot guarantee that the security of Personal Data will be effective under all circumstances.
- Data breach
- The Customer is solely responsible for reporting security breaches leading to the destruction, loss, alteration or unauthorized disclosure of or access to Personal Data (“Data Breach”) to the regulator and data subjects. To enable the Client to comply with this legal obligation in a timely manner, KRB shall notify the Client as soon as possible if a data breach occurs or if KRB has a serious suspicion of a data breach. KRB aims to do so within 48 hours after the data breach has been discovered by it.
- In doing so, KRB shall provide Customer with the information reasonably necessary to make a correct and complete report. KRB shall inform the Customer of:
- the nature of the data breach, where possible indicating the categories of data subjects and personal data and, approximately, the number of data subjects and personal data records involved;
- The name and contact details of the data protection officer or other contact point where more information can be obtained;
- The likely consequences of the data breach;
- the measures taken and proposed by KRB to address the data breach, including measures to mitigate any adverse effects.
- KRB shall provide the Customer upon request with all information reasonably necessary to comply with the documentation requirement of Article 33 paragraph 5 AVG.
- Subprocessors
- The sub-processors engaged by KRB as of the date of signing this processor agreement are listed in Appendix 3. By signing this processor agreement, Client consents to the engagement of those sub-processors.
- KRB may engage other sub-processors in addition to those listed in Annex 3. KRB shall notify the Client in advance of its intention to engage any other sub-processor, giving the Client a period of five working days to object to it with reasons.
- KRB shall engage a sub-processor only after the objection period referred to in Article 6.2 has expired without the Client having objected, or after the Client has indicated not to object. In the event of an objection, the parties shall enter into consultation with the aim of meeting the Customer’s reasonable objections.
- KRB shall ensure that a sub-processor is bound in writing by obligations equivalent to those contained in this Processor Agreement.
- Duty to cooperate BRF
- KRB shall, upon request, assist the Customer in responding to complaints, questions or requests from data subjects in connection with the processing of Personal Data, in carrying out a data protection impact assessment, and in an investigation or inspection by the Personal Data Authority with respect to the processing of Personal Data.
- If KRB directly receives a request from a data subject regarding the Personal Data, KRB will inform the Client as soon as possible.
- Control Law
- KRB shall provide Customer with information necessary to demonstrate compliance with this Processor Agreement and the privacy laws applicable thereto.
- Customer shall have the right, either itself or by an independent third party, upon ten business days’ prior written notice, to conduct an audit or inspection of KRB, or to have such an audit or inspection conducted, only to the extent necessary to verify KRB’s compliance with its obligations under this Processing Agreement and the privacy laws applicable thereto.
- Audits will take place only after Customer has requested comparable audit reports from KRB and, if such reports are available, only if Customer has reasonable grounds to believe that an additional audit is necessary.
- Duration and termination
- This Processor Agreement shall take effect on the date of signature and shall remain in effect for as long as KRB processes Personal Data on behalf of the Client under the Agreement or other written order.
- Upon termination of this Agreement, KRB will destroy the Personal Data and any copies thereof, unless the Client indicates prior to termination that the Personal Data should be provided to it. Original, non-digital records will be returned to Customer. Personal Data that KRB is required to retain under applicable laws or regulations will not be destroyed.
- The obligations under this processor agreement that by their nature are intended to continue after termination shall survive termination.
- Miscellaneous
By completing and submitting its own information below, Client confirms its agreement to the terms and agreements set forth herein. A copy of the agreement is kept by KRB in its own database.