Snapshot 97077
Normalized text
Scripts and page chrome removed; this is what change detection compares.
General Provisions on Commissioned Data Processing
Version 1.1
Valid from 01.11.2024
Disclaimer
© Arvato Systems. All rights reserved.
General Provisions on Commissioned Data Processing
Document Property Valuation
Classification PUBLIC
Status Released
Document Owner Data Protection Arvato Systems GmbH
Author Data Protection Arvato Systems GmbH
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 2 of 8
General Provisions on Commissioned Data Processing
1 Preamble
These General Provisions on Commissioned Data Processing regulate the obligations of the contracting
parties in connection with the processing of personal data on behalf of the Client by the Contractor within
the scope of the respective service agreements concluded under civil law.
2 Definitions
The terms used in these General Provisions correspond to the definitions of the GDPR, unless otherwise
specified. Client’s Data shall exclusively mean personal data that has either been provided to the Con-
tractor by the Client in connection with the Main Contract or has been collected by the Contractor exclu-
sively for the Client on its behalf. Main Contract means the service providing agreement under civil law
which may result from master agreements or individual contracts or statements of work. TOM are tech-
nical and organizational measures. Processing category means the categorization of processing op-
erations carried out by the Contractor on behalf of the Client, the definition of which is set out in the
Appendix TOM.
3 Object and Duration of the Processing; Nature, Purpose and Means of
Processing; Nature of the Personal Data and Categories of Data Sub-
jects
The respective assignment by the Client und civil law is regulated in the Main Contract itself.
Modalities (e.g. object, duration, type, purpose, means, categories of data) of the commis-
sioned processing in the context of the Main Contract are set out in the Agreement on
Commissioned Data Processing. These General Provisions on Commissioned Data Pro-
cessing including their Appendix TOM are an integral part of the Agreement on Commis-
sioned Data Processing and form a contractual unit with the underlying Main Contract. For
the sake of clarification, Parties state that the Agreement on Commissioned Data Processing
may also combine similar operations. Insofar as the processing for the Main Contract con-
stitutes a new processing within the meaning of the GDPR, a further agreement on Commis-
sioned Data Processing shall be concluded accordingly.
3.1 Within the scope of the performance of the Main Contract and in compliance with the provi-
sions of the Agreement on Commissioned Data Processing, the Contractor shall be entitled
to carry out all necessary processing steps regarding to the Client's Data (e.g. duplication of
data for loss protection, creating log files)) insofar as this does not lead to a modification of
the content of the Client's Data.
4 Obligations of the Contractor to Follow Instructions
4.1 The Contractor is a processor within the meaning of Article 4 No. 8 of the GDPR and may
only process the Client's Data within the scope of and for the purposes of the Main Contract,
including the Agreement on Commissioned Data Processing and the Client's instructions,
unless it is legally obliged to process them. In this case, the Contractor shall notify the Client
of these legal requirements in writing or by e-mail (text form), unless the relevant law prohibits
such notification due to an important public interest.
4.2 Instructions are the Client’s documented instructions of directed at a specific processing of
the Client's Data by the Contractor. They are initially defined by the Main Contract and the
Agreement on Commissioned Data Processing and may subsequently be amended, supple-
mented or replaced by the Client by means of an individual instruction (individual instruc-
tion). The Client’s instructions must always be issued in text form; in exceptional cases oral
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 3 of 8
General Provisions on Commissioned Data Processing
instructions must be confirmed by the Client in text form without delay. In deviation from this,
instructions may also be issued by the Client via the use of technical support services pro-
vided and agreed for this purpose (e.g., administration consoles, portals). Activities of the
Contractor based on instructions that go beyond the contractually agreed scope of services
of the Main Contract shall be treated as a change request.
4.3 Persons authorized to give instructions on the part of the Client and persons authorized to
receive on the part of the Contractor shall be notified to the respective other party. The re-
spective party shall immediately inform the other party in text form of a change of this person.
4.4 The Contractor shall not be obliged under substantive law to inspect instructions issued by
the Client. However, if the Contractor is of the opinion that an instruction of the Client violates
data protection provisions, it shall inform the Client without delay. In this respect, the Con-
tractor shall be entitled to suspend the implementation of the relevant instruction until the
Client has confirmed or amended it (at least in text form). If the Client adheres to the issued
instruction and, from the Contractor's point of view, its implementation still requires it to act
unlawfully,, the Contractor shall be entitled not to carry out the processing.
5 Duties of the Contractor
5.1 The Contractor shall meet TOM within its area of responsibility for the adequate protection
of the Client’s Data, which ensure the confidentiality, integrity, availability and resilience of
the systems and services in connection with this commissioned processing on a permanent
basis, as well as the ability to quickly restore the availability of the personal data and access
to them in the event of a physical or technical incident. The data protection concept described
in the Appendix TOM (published at www.arvato-systems.de/TOM-en) sets out in detail the
selection of technical and organizational measures by the Contractor to suit the risk it has
identified, taking into account the protection objectives in accordance with the state of the art
and with particular regard to its own IT systems and processing procedures used. The Client
has reviewed these data security measures offered by the Contractor in the Appendix TOM
and assumes responsibility that these measures are sufficient for Client’s Data at the time of
conclusion of the contract..
5.2 The Contractor reserves the right to amend the TOMs unless the level of protection laid down
therein is not met.
5.3 The Contractor has established a procedure to regularly review the effectiveness of the TOM
and to ensure the security of the processing.
5.4 The Contractor shall ensure that the employees involved in the processing of the Client’s
Data and other persons working for the Contractor process this data only in accordance with
the Client's instructions, unless they are legally obliged to process it. The Contractor shall
further ensure that the persons employed by it to process the Client’s Data have committed
themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality.
This obligation shall continue to exist after termination of the contract.
5.5 The Contractor shall inform the Client without delay if it becomes aware of any violations of
the protection of the Client’s Data. In this case, the Contractor may, on a temporary basis
and at its own discretion, take appropriate measures within its area of responsibility to protect
the Client’s Data and to mitigate any possible adverse consequences. The Contractor shall
inform the Client of any measures it has taken as soon as possible.
5.6 The contact person of the Contractor for any data protection questions that may arise is
named in the Agreement on Commissioned Data Processing..
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 4 of 8
General Provisions on Commissioned Data Processing
5.7 The Contractor shall maintain a register of processing activities pursuant to Article 30(2) of
the GDPR.
5.8 The Contractor shall assist the Client upon appropriate instruction, considering the type of
processing and the information available to it, in complying with the Client's obligations reg-
ulated in Articles 32 to 36 of the GDPR.
5.9 Should the Client’s Data at the Contractor be endangered by attachment or seizure, by in-
solvency or composition proceedings or by other events or measures of third parties, the
Contractor shall immediately inform the Client thereof, unless the relevant law prohibits such
notification due to an important public interest. The Contractor shall inform the third party
without delay that sovereignty and "ownership of the data" lie solely with the Client.
6 Duties of the Client
6.1 The Client is the controller within the meaning of the GDPR. As such, it is responsible for the
fulfilment of the obligations regulated in Articles 32 to 36 of the GDPR.
6.2 The Client shall inform the Contractor immediately and in full if it discovers errors or irregu-
larities with regard to data protection provisions when checking the results of the order.
6.3 The contact person at the Client for any data protection issues that may arise is named in
the Agreement on Commissioned Data Processing.
6.4 The Client shall, upon instruction, provide the Contractor with all information required by the
Contractor to maintain the directory pursuant to Article 30 (2) of the GDPR.
6.5 The Client shall be responsible for evaluating and assessing the effectiveness of the TOMs
taken to ensure the security of the Processing. Insofar as the TOMs are not sufficient from
his point of view to ensure the security of the processing (e.g., new risk assessment of the
Client), the Parties shall agree on corresponding changes and their commercial effects and
implement them on the basis of a corresponding written amendment agreement (insofar as
the Parties have agreed on an amendment procedure in the Main Contract, this shall apply).
6.6 In the event of a claim against the Contractor by a data subject or a body referred to in Art.
80 GDPR with regard to any claims pursuant to Art. 79 or 82 GDPR, the Client undertakes
to support the Contractor in defending the claims. In this context, the Contractor shall be
entitled to disclose details of the Agreement on Commissioned Data Processing, the data
processing and instructions of the Client to third parties for the purpose of defending these
claims or for exculpation pursuant to Art. 82 (3) of theGDPR.
7 Protection of Data Subject’s Rights
7.1 With regard to this Agreement on Commissioned Data Processing, the Client shall be re-
sponsible for safeguarding the data subject rights provided for under Chapter III of the GDPR.
Insofar as the cooperation of the Contractor is necessary for the protection of data subject
rights by the Client, the Contractor shall support the Client upon instruction within the scope
of the existing and economically reasonable possibilities.
7.2 If a data subject contacts the Contractor with the assertion of data subject rights regulated in
the GDPR, the Contractor shall, if it is possible for it to allocate the request to the Client by
economically justifiable means, forward the request to the Client or refer the data subject to
the assertion of its data subject rights against the Controller.
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 5 of 8
General Provisions on Commissioned Data Processing
8 Subcontractors
8.1 The Client agrees that the Contractor may engage third parties ("subcontractors") for the
provision of its contractually agreed services for the Client and the processing of data in
connection therewith, insofar as the requirements set out in Para. 8.2 and 8.3 are guaran-
teed.
The subcontractors engaged for the Client at the time of the conclusion of the contract are
named in the Agreement of Commissioned Data Processing and are approved as further
subcontractors with the conclusion of the contract.
The Contractor shall inform the Client about further subcontractors as wee as intended com-
missioning of further subcontractors. Information about subcontractors engaged by the Con-
tractor shall be provided to the person authorized to issue instructions of the Client (see
Agreement of Commissioned Data Processing") or via publication on the website listed in
the Agreement of Commissioned Data Processing. The Contractor shall provide the Client
with a registration option to be informed about changes to the listed website.
The Client may object to changes of the subcontractors for important data protection reasons
to the person authorized to receive instructions (at least in text form). If no objection is raised
within a reasonable period of time, the consent to the change shall be deemed granted.. If
there is an important reason under data protection law and if it is not possible for the parties
to find a mutually agreeable solution, the Contractor may terminate the Main Contract and
the associated Agreement of Commissioned Data Processing for an important reason.
8.2 The Contractor shall subject the subcontractors engaged by it to the same contractual data
protection obligations to which it itself is subject under the Agreement of Commissioned Data
Processing.
8.3 If the Contractor uses further subcontractors outside the EU or the EEA, this shall be done
in consideration of Art. 44 et seq. of the GDPR, in particular on the basis of adequacy deci-
sions and EU standard contractual clauses (e.g. in the form of Processor-to-Processor EU
standard contracts). .
8.4 If the subcontractor fails to comply with its data protection obligations, the Contractor shall
be liable to the Client for compliance with the obligations of that subcontractor as for its own
fault.
9 Evidence of the Contractor, Inspections
9.1 The Contractor shall provide the Client with evidence of compliance with the obligations set
out in this General Provisions on Data Processing by submitting corresponding certificates
(e.g. in accordance with ISO/IEC 27001) or submitting/carrying out a self-audit or self-as-
sessment.
9.2 If, in individual cases, inspections or reviews by the Client or an independent external auditor
commissioned by the Client are required in accordance with data protection law (e.g. in the
event of justified doubts about a self-audit submitted by the Contractor or the violation of the
protection of personal data), these shall be carried out in the presence of an employee of the
Contractor during normal business hours and without disrupting business operations at the
Contractor's premises following notification and taking into account a reasonable lead time
(which is usually 4 weeks). The Contractor may make these inspections or reviews depend-
ent on the signing of an appropriate nondisclosure agreement with regard to the data of other
customers and the technical and organizational measures put in place. If the auditor com-
missioned by the Client is in a competitive relationship with the Contractor or its subcontrac-
tor, the Contractor may refuse an inspection by the auditor.
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 6 of 8
General Provisions on Commissioned Data Processing
The Client may request the performance of an audit in accordance with this clause even
without a specific data protection reason. The Client may audit once within a 12-month pe-
riod, unless mandatory data protection law requires more frequent audits. If further regula-
tions on the performance of audits have been agreed between the parties (audit guideline),
these shall also be taken into account.
9.3 The Client shall provide the Contractor with a copy of the complete audit report in digital
form.
10 Return and Deletion of Data upon Termination of the Contract
10.1 After termination of the Main Contract, the Contractor shall, if technically possible and in-
structed by the Client, hand over the Client's Data. Electronically stored data shall be handed
over upon request and instruction in a format customary in the market on data carriers,
whereby the Client shall bear the shipping risk, or shall be transmitted to the Client online in
encrypted form, whereby the Client shall bear the transmission risk.
10.2 The Contractor shall delete all electronically stored data of the Client or, in the case of back-
ups or log files, ensure a restriction of data processing until the time of deletion. The Con-
tractor shall confirm the deletion to the Client in text form at the Client's request.
10.3 Data of the Client which is not stored in electronic form (e.g. data on CDs, paper documents)
and which the Client does not wish to be handed over shall be destroyed by the Contractor
in accordance with data protection regulations.
10.4 The obligation to hand over or delete does not exist if the Contractor is legally obliged to
retain or otherwise store this data.
10.5 At the latest by the termination of the relevant Main Contract, the Client shall request the
Contractor to delete or hand over the associated data at least in text form. If this does not
happen, the Contractor shall delete all data of the Client after termination of the Main Con-
tract, insofar as no legal obligations of the Contractor to retain this data exist.
10.6 Insofar as the Client wishes the Client’s Data to be stored beyond the end of the contract,
this shall require a separate agreement between the parties. The parties shall coordinate the
corresponding services and commercial effects and set them out in a corresponding written
amendment agreement (insofar as the parties have agreed an amendment procedure in the
Main Contract, this shall apply). Any regulations on the handling of the Client’s Data under
the Main Contract (e.g. exit regulations) shall take precedence over the regulations under
this clause.
11 Control Rights of Supervisory Authorities or other Sovereign Supervi-
sory Authorities of the Client; Cooperation with Supervisory Authori-
ties; Legal Disputes
11.1 The Parties shall inform each other without undue delay of all official inquiries/orders and
proceedings, all measures taken by any of the bodies referred to in Art. 80 GDPR (such as
complaints, warnings, assertion of claims) as well as all threatened or ongoing legal pro-
ceedings which have as their subject matter the cooperation governed by this Agreement on
Commissioned Data Processing, shall cooperate closely in connection with such enquiries,
orders, measures or proceedings and shall provide each other with all necessary documents
and information. In this context, each Party shall be entitled to disclose all information and
documents relating to this Agreement on Commissioned on Data Processing to the supervi-
sory authority responsible for it or other third parties involved in the proceedings, to the extent
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 7 of 8
General Provisions on Commissioned Data Processing
that this is necessary from the Party's point of view (including the details of the data pro-
cessing).
12 Final Provisions
12.1 Insofar as the Contractor is required to perform support activities under this Agreement or
incurs expenses which are not attributable to any misconduct on the part of the Contractor
(e.g., individual instructions, expenses within the scope of data subject rights, audits), these
shall be treated as change requests in accordance with the provisions of the Main Contract.
12.2 Unless otherwises agreed in the Agreement on Commissioned Data Processing, the agree-
ments made between the parties in the Main Contract shall apply. Should individual parts of
the Agreement on Commissioned Data Processing be invalid, this shall not affect the validity
of the rest of the Agreement on Commissioned Data Processing.
12.3 The parties agree that this Agreement on Commissioned Data Processing shall be governed
by German law to the exclusion of the provisions of international private law. The exclusive
place of jurisdiction shall be determined by that of the Main Contract with which the Agree-
ment on Commissioned Data Processing forms a legal unit.
13 Appendices
The following Appendix is part of these General Provisions on Commissioned Data Processing
Appendix TOM published at www.arvato-systems.com/TOM-en
Document version 3.3 | 1.2 2024/11 CONFIDENTIAL Page 8 of 8