Snapshot 57744
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement 1. Definitions The following capitalized terms hadve the following meanings: Agreement: means any (online) agreement and/or order form, including Appendices to it, between Solvimon and Customer; AP: the Dutch supervisory authority Autoriteit Persoonsgegevens; Customer: means a party that uses Services provided by Solvimon; DPA: this agreement (including annexes), which forms part of the Agreement; GDPR: The General Data Protection Regulation; Personal Data Breach: a breach of the security of Personal Data that inadvertently or unlawfully leads to the destruction, loss, modification or unauthorized disclosure of or unauthorized access to transmitted, stored or otherwise processed data; Personal Data: all data that can be traced directly or indirectly to a natural person as referred to in Article 4 GDPR as set out in Annex A that may be processed in the context of the Agreement and this DPA and may be processed including the personal data as referred to in Annex A, for the purposes set therein; to Process: to process Personal Data as referred to in Article 4 GDPR; Processing: the processing of Personal Data by the Data Processor for the Data Controller based on the Agreement; Services: the Services provided by Solvimon to the Customer under the Agreement. Sub-Processor: a data processor assigned by Solvimon to perform part of the Services offered by Solvimon to Customer where it involves the Processing of Personal Data for Customer, in its capacity of Controller. 2. Data Controller and Data Processor of Personal Data Solvimon shall process Personal Data on behalf of Customer in the execution of the Agreement. The provisions of Agreement shall apply in full to the DPA. Customer remains the responsible Controller for the Processing of Personal Data in accordance with the instructions to Solvimon under the Agreement, this DPA and any other (additional) instructions. Customer has instructed Solvimon, in its capacity as Processor, and will continue to instruct Solvimon, for the duration of the commissioned data processing, to only process the Personal Data for the benefit of Customer and in accordance with the GDPR, the Agreement, this DPA and the instructions of Customer. Customer is entitled and obliged to instruct Solvimon regarding the Processing of the Personal Data, both in general and in individual cases. Instructions may also relate to the rectification, deletion and blocking of Personal Data. Instructions are generally provided in writing or by email, unless the urgency or other specific circumstances require a different (for example verbal or electronic) form. Non-written or e-mailed instructions must be confirmed by Customer in writing or by e-mail without delay. Insofar as the execution of an instruction leads to costs for Solvimon, Solvimon will first inform the Customer of these costs. Only after Customer has confirmed that the costs for the execution of an instruction are for his account, will Solvimon follow and execute such instruction. Solvimon, in its capacity of Processor, shall only process Personal Data for the activities mentioned in this SPA deriving from the Agreement. Solvimon shall not make use of the Personal Data in any other way unless Customer has given explicit and written permission otherwise, or a statutory provision obliges Solvimon to do so. In that case, Solvimon shall inform Customer, before the Processing takes place, of the statutory provision, unless such a process is not permitted by this legislation. 3. General duty of care Data Processor Solvimon, in its capacity of Processor, must ensure compliance with this DPA and the statutory rules (such as the GDPR) that apply to a Processor. If Customer so requests, Solvimon shall inform Customer of the actions and measures taken by Solvimon within the framework of this general duty of care. More specifically Solvimon will Process the Personal Data exclusively in accordance with the instructions of Customer and on behalf of Customer and/or, when and where applicable, inform Customer without undue delay if Solvimon cannot comply with said instructions for any reason. 4. Technical and organizational measures Solvimon shall take appropriate technical and organizational measures to secure the Personal Data against loss or unlawful Processing. Solvimon must ensure that the security level sufficiently addresses the risks. These measures will take into account the current state of technology and the costs of the security measures. Solvimon shall in any case take measures to protect the Personal Data against destruction, against accidental and intentional loss, forgery, unauthorized distribution or access, or against any other form of unlawful Processing. Solvimon shall, upon request, provide a document which includes the technical and organizational measures taken by Solvimon. This document shall in this case form part of the current Agreement and will be included as an attachment. 5. Confidentiality Solvimon shall have all authorized individuals who are involved in the execution of the Agreement, and as such are authorized by Solvimon to Process the Personal Data for Customer sign a confidentiality agreement - whether resulting from or included in the employment contract with those individuals - which states that these individuals must observe confidentiality with regard to the Processing of the Personal Data. Solvimon shall take all necessary measures, such as screening of employees and security of data carriers, to ensure that confidentiality is maintained. 6. Data processing outside the European Economic Area (EEA) Processing of Personal Data outside the EEA shall only take place with due observance of the applicable legal obligations and/or with the prior written consent of Customer. 7. Sub-processors Solvimon is permitted to make use of Sub-Processers in the framework of the Agreement, including this DPA. In such an event Solvimon shall inform Customer of this instigation. If the Customer has reasonable grounds to object to this instigation of a Sub- Processor, Customer must oppose in writing, within 14 days following receipt of said notification. In such an event Solvimon will undertake reasonable efforts to propose a suitable alternative, unless the severity of a Data Breach urges and obliges Solvimon to relocate and transfer the Personal Data immediately and, thus within a 14-day period, to a different Sub-Processor. Solvimon shall obligate each Sub-Processor to fulfill the confidentiality obligations, notification obligations and security measures in relation to the Processing of Personal Data, which obligations and measures must at least comply with the provisions of this DPA. 8. Liability All liability arising from or in connection with this DPA follows and is exclusively governed by, the liability provisions set out in, or otherwise applicable to, the Agreement. 9. Infringement in connection with Personal Data (Data Breach) If Solvimon is informed of a Data Breach, Solvimon shall (i) inform the Controller without undue delay of the existence of the Data Breach and (ii) take all reasonable measures to limit or prevent (further) violation of the GDPR. When taking the aforementioned measures, Solvimon shall, where possible, refrain from taking measures that are irreversible and/or seriously impede an investigation into the causes of the Data Breach. Solvimon shall offer cooperation and support to Customer in the performance of its legal obligations with respect to the identified incident. Solvimon shall offer technical support to Customer with regards to the reporting obligation with respect to the Personal Data Breach with the AP and/or the person concerned, as referred to in Article 33 paragraph 3 and 34 paragraph 1 GDPR. Solvimon shall refrain from independently submitting a notification of infringement related to Personal Data to the AP and/or the Data Subject. 10. Use of Production and Personal Data The Customer is solely responsible for determining the nature and classification of the data it submits to the Services, including whether such data constitutes personal data under applicable data protection laws. The Customer shall ensure that only personal and/or production data is used in the Solvimon live environment of the Services. Solvimon shall have no obligation to validate the appropriateness, accuracy, or classification of the data provided by the Customer. Solvimon disclaims any liability resulting from the use of production or personal, data in the environment other than the live environment. 11. Assistance to Data Controller Solvimon will inform the Controller without undue delay: of its intention to appoint and use different and/or additional Sub-Processors in the framework of the Agreement and the DPA, of any legally binding request for the provision of the Personal Data by a law enforcement agency, unless this notification is otherwise prohibited, such as in case of a criminal or tax law prohibition to preserve the confidentiality of a law enforcement investigation; of complaints and requests received directly from the Data Subjects (such as complaints and requests for access, rectification, removal, limitation of processing, data transferability, objection to processing of data, automated decision-making) without going into that request, unless he otherwise authorized to do so; Solvimon shall support Customer, as far as reasonably possible, in fulfilling its duty under the GDPR to carry out a Data Protection Impact Assessment (articles 35 and 36 GDPR). Solvimon shall provide the Customer with all information necessary to demonstrate that Solvimon complies with its obligations under the GDPR. In addition, at the request of Customer, Solvimon will make and contribute to audits, including inspections, by Customer or a party authorized by Customer. The Customer shall inform Solvimon in time if, and when, he will make use of this audit right. The number of audits is limited to a maximum of one per year. Solvimon may charge any reasonable costs for the assistance referred to in this article to Customer. 12. Termination & Miscellaneous Regarding the termination of this DPA, the specific provisions of the Agreement apply. Without prejudice to the specific provisions of the Agreement, Solvimon will delete or return all Personal Data at the first request of Customer, and delete existing copies, unless Solvimon is otherwise legally obliged to store Personal Data. The Customer will be responsible to adequately inform Solvimon about (legal) retention periods that apply to the Processing of the Personal Data for Processors. Solvimon will not Process the Personal Data for longer than to the predefined retention periods. The obligations arising from this DPA which by their nature are intended to survive termination shall also remain in force after termination of this DPA. This DPA is governed by the laws of the Netherlands. All disputes arising from the performance of this DPA shall be submitted to the competent judge or arbitrator as agreed upon in the Agreement. Annex A: Sub-Processors The Sub-Processors currently engaged by Service Provider for the processing of Personal Data are as follows: Name Contact Details Description Place of Processing Google Google cloud.google.com Cloud computing services Belgium Paragon Paragon useparagon.com Embedded integrations Germany Adyen Adyen adyen.com Payment processing Netherlands Mailgun Mailgun mailgun.com Email distribution Germany Ready to grow your revenue? Start now. First $3M free for AI startups. See pricing details Quick start - sandbox Ready to grow your revenue? Start now. First $3M free for AI startups. See pricing details Quick start - sandbox