Snapshot 74936
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Attachment: Order Processing Contract
or replaced by the client in written form or in an
electronic format (text form). Instructions that
1 Preamble are not present in the contract are treated as a
request for a change in performance. Oral in-
This Annex specifies the obligations of the structions must be followed up immediately in
contracting parties to data protection resulting writing or in text form by the client.
from the contract concluded between the par-
ties (General Terms and Conditions). It applies
to all activities in connection with the contract 4 Purpose of data collection
in which employees of wallee or personal data
(hereinafter referred to as "data") of the con- wallee provides the client with a payment ser-
tractual partner are processed. In the following vice with which he can receive, manage and
appendix we understand under the term client send transaction-related data received via his e-
the customer or contractual partner of wallee. commerce site or other manual or automatic
Partially also referenced as customer or con- selling systems (terminals / virtual terminals) to
tractual partner in the General Terms and Con- the financial service providers he has selected
ditions. to process the payments (transactions).
The purpose of the processing of personal data
is the processing of transaction-related data
2 Subject matter, duration and (such as but not limited to requests for authori-
specification of order pro- zation of a payment) and all supplementary or
related activities that are necessary for the pro-
cessing cessing of transaction-related data.
Details regarding the service of wallee are reg- Processing consists of collecting, consolidating,
ulated in the respective contract between wallee comparing, encrypting, decrypting, organising,
and the contract partner (hereinafter "contract"). checking, analysing, checking, registering, cal-
culating, extending, copying, duplicating and
The subject matter and duration of the order as transferring personal data to subcontractors, fi-
well as the type and purpose of the processing nancial service providers or other (legal or nat-
result from the contract, unless otherwise stated ural) persons using the e-commerce platform or
in this Annex. other manual or automatic selling systems (ter-
minals, virtual terminals) used by the integrator
The term of this Annex is based on the term of and the tools connected to it via network con-
the contract, provided that the provisions of this nections and standard protocols that are in-
Annex do not give rise to obligations in excess volved in the processing of the transactions.
thereof.
The personal data which are the subject of such
processing are data which have been transmit-
3 Scope and responsibility ted in encrypted form by the system of the client
to the system of the contractor and which have
wallee processes the data mentioned in appen- been recorded and processed during the pro-
dix A on behalf of the client for the purpose men- cessing of the transactions. In addition, per-
tioned in the contract. This includes activities sonal data of the client’s employees are also
which are specified in the contract and in this processed in the course of order processing.
Annex.
Within the framework of this contract, the client 5 Place of data processing
is responsible for compliance with the statutory
provisions of data protection laws, in particular The provision of the contractually agreed data
for the legality of the transfer of data to wallee processing takes place exclusively in a member
as well as for the legality of data processing state of the European Union or in Switzerland.
("responsible person" in the sense of Art. 4 No.
Any transfer to a third country may only take
7 GDPR).
place if the special requirements of Art 44 ff.
GDPR are fulfilled. Information on the location
The instructions are initially defined by the con-
of data processing at subcontractors can be
tract and can then be changed, supplemented found in the corresponding list.
Version 1.0 1
data outside the instructions. Further-
more, wallee guarantees that the per-
sons authorised to process the per-
6 Duties of wallee sonal data have committed themselves
to confidentiality or are subject to an ap-
1. wallee may collect data from data sub- propriate statutory duty of confidential-
jects for the aforementioned purposes, ity.
unless there is an exceptional case
within the meaning of Article 28 para. 3 6. wallee informs the client immediately if
a) GDPR. wallee informs the client im- it becomes aware of violations of the
mediately if we believe that an instruc- protection of the client's personal data.
tion violates applicable laws. wallee wallee takes the necessary measures
may suspend the implementation of the to secure the data and to reduce possi-
instruction until it has been confirmed or ble adverse consequences of the af-
amended by the client. fected persons and agrees immediately
with the client.
2. wallee will design the internal organiza-
tion in his area of responsibility in such 7. wallee names the following contact per-
a way that it meets the special require- son for data protection questions aris-
ments of data protection. Cus-tomweb ing in the context of the contract to the
will take technical and organizational client: Inquiries are to be directed to
measures for the adequate protection info@wallee.com
of the client's data that meet the re-
quirements of the Basic Data Protection 8. wallee guarantees to comply with its
Ordinance (Art. 32 GDPR). wallee must obligations under Art. 32 para. 1 lit. d)
take technical and organisational GDPR to establish a procedure for reg-
measures to ensure the long-term con- ularly checking the effectiveness of
fidentiality, integrity, availability and re- technical and organisational measures
silience of the systems and services in to ensure the security of processing.
connection with the processing. The cli- wallee corrects or deletes the contrac-
ent is aware of these technical and or- tual data, if the client instructs this and
ganisational measures and is responsi- this is included in the instruction frame-
ble for ensuring that they offer an ap- work. If a deletion in conformity with
propriate level of protection for the risks data protection or a corresponding re-
of the data to be processed. striction of data processing is not possi-
ble, wallee takes over the destruction of
3. The measures taken by wallee are de- data carriers and other materials in con-
scribed in appendix B. The technical formity with data protection on the basis
and organisational measures are sub- of an individual order by the client.
ject to technical progress and further
development. In this respect, wallee is 9. wallee will automatically delete per-
allowed to implement alternative ade- sonal data after termination of the con-
quate measures. The safety level of the tract and achievement of the purpose of
defined measures must not be under- this contract. At the request of the cli-
shot. Significant changes must be doc- ent, personal data must be deleted after
umented. the end of the contract. If additional
costs arise due to deviating specifica-
4. To the extent agreed, wallee supports tions in the surrender or deletion of the
the client within the scope of its possi- data, these shall be borne by the client.
bilities in fulfilling the requests and
claims of the persons concerned pursu- 10. wallee undertakes to support the client
ant to Chapter III of the GDPR and in in the defence of the claim within the
complying with the obligations set out in scope of the available and reasonable
Articles 33 to 36 GDPR. possibilities in the case of a claim
against the client by a person con-
5. wallee guarantees that employees in- cerned with regard to possible claims
volved in the processing of the client's according to Art. 82 GDPR.
data and other persons working for wal-
lee are prohibited from processing the
Version 1.0 2
11. services in this section are to be paid to wallee is not liable if the request of the person
wallee according to the current hourly concerned is not answered by the client, not
rates or external expenses. correctly or not on time.
12. The client is granted the right of inspec-
tion and control of the data processing 9 Audit
facilities with regard to the processing
of the data provided by him, including wallee proves to the client compliance with the
third parties commissioned by him. The obligations laid down in this Annex by suitable
contractor undertakes to provide the means. This is done through a self-audit and/or
principal with the information necessary certification according to PCI DSS.
to monitor compliance with the obliga-
tions set out in this agreement. Should inspections be necessary in individual
cases by the client or an auditor commissioned
by the client, they shall be carried out during
normal business hours without disrupting oper-
7 Obligations of the client ations after notification, taking into account an
appropriate lead time. wallee may make this
The client is fully responsible for the legality of conditional on prior notification with a reasona-
his instructions to wallee. In particular, it is the ble lead time and on the signing of a non-disclo-
responsibility of the client to check whether the sure agreement regarding the data of other cli-
integration of a service / service / product, which ents and the technical and organisational
wallee provides, does not violate data protec- measures set up. If the examiner commissioned
tion regulations. In addition, the client has the by the client is in a competitive relationship with
following obligations: wallee, wallee has a right of objection against
him.
1. The client has to inform wallee immedi-
ately and completely if he detects errors Should a data protection supervisory authority
or irregularities regarding data protec- or another sovereign supervisory authority of
tion regulations in the order results. the contracting authority carry out an inspection,
paragraph 2 shall apply mutatis mutandis. The
2. In the event of a claim against the prin- signing of a confidentiality obligation is not re-
cipal by a data subject with regard to quired if this supervisory authority is subject to
any claims under Art. 82 GDPR, para- professional or legal secrecy, in which a viola-
graph 6 (10) shall apply mutatis mutan- tion is punishable under the Criminal Code.
dis.
For the possibility of controls by the client wallee
3. The client names wallee the contact can assert a remuneration claim.
person for data protection questions
arising in the context of the contract, if
this deviates from the contact persons 10 Subcontractor
already named by the client.
The assignment of subcontractors by wallee is
permitted, as far as they fulfil the requirements
of this appendix within the scope of the subcon-
8 Inquiries of persons concerned tract. A list of the current subcontractors is avail-
able here: https://wallee.com/subcontrac-
If a person concerned contacts wallee with tor.html
claims for correction, deletion or information,
wallee will refer the person concerned to the cli- Excluded are additional services, which wallee
ent, provided that an assignment to the client is uses e.g. as telecommunication services,
possible according to information of the person postal/transport services, maintenance and
concerned. user services as well as other measures to en-
sure the confidentiality, availability, integrity and
wallee forwards the request of the person con- resilience of the hardware and software of data
cerned immediately to the client. wallee sup- processing systems.
ports the client within the scope of his possibili-
ties on instruction as far as agreed. The client agrees that wallee consults subcon-
tractors. wallee informs the client before calling
Version 1.0 3
in or replacing the subcontractors. wallee is
obliged to inform the client about the assign-
ment of a subcontractor by updating the above
overview. The overview must be updated at
least 14 days in advance. The client will regu-
larly inspect the overview. The client can object
to the change - within 14 days - for an important
reason - to wallee. If there is no objection within
this period, consent to the change shall be
deemed given. If there is an important reason
under data protection law and if an amicable so-
lution cannot be found between the parties, wal-
lee is granted a special right of termination.
If wallee places orders with subcontractors, it is
incumbent upon wallee to data protection obli-
gations from this system to the subcontractor.
Subcontractors who have no access to cus-
tomer data or do not process customer data are
excluded from this chapter and will therefore not
appear in this list.
11 Information Duties
Should the client's data be endangered by sei-
zure or confiscation, by insolvency or composi-
tion proceedings or by other events or
measures of third parties, wallee has to inform
the client immediately. wallee will immediately
inform all persons responsible in this context
that the sovereignty and ownership of the data
lies exclusively with the client as "responsible
person" in the sense of the basic data protection
regulation.
12 Liability
Liability is governed by the contract.
13 Miscellaneous
In all other respects, the provisions of the con-
tract shall apply. In the event of contradictions
between
The provisions of this Annex and the provisions
of the contract shall take precedence over this
Annex. Should individual parts of this Annex be
ineffective, this shall not affect the effectiveness
of the contract and the rest of the Annex.
The Annexes are an integral part of this Agree-
ment.
Version 1.0 4
Appendix A to the order processing contract
Subject of the order Processing of personal data of the client within the scope of his
use of the services of wallee as Software as a Service.
Nature and purpose of the in- The personal data processed by the client are transferred to
tended processing of data wallee within the scope of the Software as a Service services.
wallee processes this data exclusively according to the agree-
ment made or the selected product.
Depending on the selected service / product wallee transmits
further data to this service provider (e.g. Scheme / Processor /
Acquirier / etc). The client is responsible for ensuring that this
transfer does not infringe any rights of his customers.
Type of personal data The supplementary agreement covers the following data types
and categories:
• Person master data
• Communication data (e.g. telephone, e-mail)
• Online identification (IP address, cookie)
• Payment data (details of orders placed and payments
made)
• Contract master data (contractual relationship, order
data, product or contractual interest)
• information (e.g. credit assessment of payment provid-
ers)
• user behaviour
Categories of persons concerned The group of persons concerned by this Supplementary Agree-
ment:
• customers and interested parties of the client
• employees and suppliers of the client
Deletion, blocking and correction Requests for deletion, blocking and correction are to be ad-
of data dressed to the client; otherwise the provisions of the contract
apply.
Version 1.0 5
Annex B to the order processing contract
Technical and organisational measures pursuant to Art. 30 para. 1 lit. g in conjunction with Art. 32 para.
1 GDPR
1 Physical access control
Access control (no unauthorized access to data processing systems) takes place. This includes the
following measures:
• Key / allocation of keys
• door protection (electric door opener, etc.)
• Access to the processing servers and computers is protected in accordance with PCI DSS re-
quirements (chapter 9) see also https://aws.amazon.com/de/compliance/data-center/controls.
• logging of access
2 System Access Control
Access control (no unauthorized system use) takes place. This includes the following measures:
• Password procedures (including special characters, minimum length, regular password
changes)
• Two-factor authentication is used
• Automatic blocking (e.g. pause switching)
• Secure transmission of authentication secrets (credentials) in the network
3 Data access control
Access control takes place. This includes the following measures:
• Creation of an authorization concept
• Implementing access restrictions
• Assignment of minimum authorizations
• Administration and documentation of personal access rights
• Logging of data access
4 Transport / transfer control
A transport and transfer control takes place. This includes the following measures:
• Secure data transfer between server and client
• Securing the transfer in the backend
• Securing the transfer to external systems
• Implementation of security gateways at the network transfer points
• Hardening of the backend systems
• Description of all interfaces and the transmitted personal data fields
• Machine2Machine Authentication
• Data carrier management (procedure)
• Collection and disposal process
• Data protection-compatible erasure/destruction procedure
Version 1.0 6
5 Input control
An input check takes place. This includes the following measures:
• Documentation of input authorizations
• Logging of the entries
6 Order control
An order control takes place. This includes the following measures:
• Documentation of input authorizations
• Logging of the entries
7 Availability control:
Availability control takes place. This includes the following measures:
• Backup concept
• Emergency plan
• Storage of backups
• Testing of emergency facilities
• Virus protection / firewall
8 Separation rule
Separation control / purpose of use control (separate processing of data collected for different purposes)
takes place. This includes the following measures:
• Make sure that data is processed alongside the purpose of data collection.
• Separation of functions: production, staging, testing
Version 1.0 7