Data Processing Agreement

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

Data Subject: the living natural person to whom Personal Data relates.

Personal Data: any information relating to an identified or identifiable natural person, which Trackbee processes or is required to process pursuant to the Agreement, as listed and specified in Annex I.

Privacy Legislation: all applicable laws and regulations relating to the Processing and protection of Personal Data, including but not limited to the GDPR and the GDPR Implementation Act.

GDPR Implementation Act: Regulations implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJEU 2016, L 119) (General Data Protection Regulation Implementation Act).

Processing: any operation or set of operations involving Personal Data or a set of Personal Data, whether or not carried out by automated means, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of personal data.

Unless Parties agree otherwise In Writing, the provisions of the Data Processing Agreement shall apply to any Processing carried out by Trackbee pursuant to the Agreement.

Parties expressly agree that Trackbee Processes Personal Data on behalf of Contractor. Trackbee shall therefore be regarded as a processor within the meaning of the GDPR and Contractor as a data controller. Trackbee shall Process Personal Data in accordance with Contractor's Written instructions and under Contractor's responsibility and in the manner set out in the Agreement.

As an extension of what is stipulated in paragraph 2 of this article, Trackbee shall process the Personal Data only on Contractor's instructions, subject to different legal obligations. Contractor instructs Trackbee in advance to process Personal Data of its customers and to Process such Personal Data in a manner consistent with the terms of the Agreement and this Data Processing Agreement.

Trackbee does not control the purposes and means of the Processing of Personal Data and does not take independent decisions on the use of Personal Data, the disclosure to third parties and the duration of the storage of Personal Data.

Trackbee shall not be obliged to comply with any instruction that, in Trackbee's reasonable opinion, violates applicable Privacy Laws.

Trackbee shall, at Contractor's request, make available any information necessary to demonstrate compliance with obligations set out in the Data Processing Agreement.

Trackbee shall ensure compliance with the conditions imposed on the Processing of Personal Data under applicable Privacy Laws.

Trackbee shall only provide access to the Personal Data to its employees to the extent necessary to perform work under the Agreement. Accordingly, Trackbee shall take all reasonable steps to ensure that access to Contractor Personal Data is limited to a need-to-know basis and that all its employee obtaining such access are subject to confidentiality obligations.

Trackbee shall not provide or make available Personal Data to any third party unless (i) expressly permitted in the Agreement and/or Data Processing Agreement, (ii) pursuant to an express Written order from Contractor or (iii) by order of a judicial or administrative authority, provided that in such case Trackbee shall notify Contractor within two (2) business days of receipt of such order in order to allow Contractor to pursue a remedy available to it thereunder.

If Trackbee considers that it must make Personal Data available to a competent authority pursuant to a legal obligation, it shall comply with such obligation. It shall notify Contractor In Writing of the legal obligation as soon as possible, providing all relevant information required by Contractor.

Trackbee may Process Personal Data outside the European Economic Area on the understanding that if the transfer is made to a country that does not ensure an adequate level of data protection within the meaning of the Privacy Laws or which transfer is not otherwise regulated by a framework approved by the European Commission, the transfer shall be subject to the use of the Standard Contractual Clauses.

Trackbee shall notify Contractor of any requests received directly from Data Subjects regarding Data Subjects' rights under applicable Privacy Laws, including but not limited to requests for access, rectification, deletion, restriction of processing or transfer of Personal Data. In doing so, Trackbee shall, to the extent and if reasonably possible, provide Contractor with all cooperation in fulfilling its duty to respond to requests to exercise the identified rights of Data Subjects.

Trackbee shall deal promptly and properly with all requests for information from Contractor regarding the Processing of Personal Data. At Contractor's request, Trackbee shall make available all available information necessary to demonstrate Contractor's compliance with its obligations set out in this Data Processing Agreement and article 28 GDPR.

At Contractor's request and expense, Trackbee shall cooperate in conducting a data protection impact assessment (DPIA) and any prior consultation under applicable Privacy Laws.

Trackbee may at its discretion engage one or more third parties in the performance of this Data Processing Agreement as well as the Agreement.

If a third party is engaged to perform specific processing activities on Trackbee's behalf (as a sub-Trackbee), Trackbee shall impose on such other third party by agreement at least the same obligations regarding the processing and protection of Personal Data as the obligations contained in the Data Processing Agreement.

Trackbee shall not be responsible or liable for the acts or omissions of any third party it engages under the Data Processing Agreement. Contractor shall indemnify Trackbee for all damages and costs caused by such third parties.

Trackbee shall keep the Personal Data and other information obtained from Contractor strictly confidential, exercising at least the same degree of care as it exercises with respect to the protection of its own information of a confidential nature.

Trackbee shall not disclose, distribute, provide, or otherwise disclose the Personal Data or other information obtained from Contractor to any person other than its employees who need to know the Personal Data or other information obtained from Contractor for the purpose of their work for the Trackbee and shall allow such employees access to the Personal Data and other information obtained from Contractor only after they have been informed of the confidential nature of the Personal Data and other information obtained from Contractor.

Trackbee shall also impose the provisions of the Data Processing Agreement on its employees.

Trackbee shall notify Contractor of any security breach (of whatever nature) that (partly) relates or may relate to the processing of Personal Data without delay and in any event no later than within two (2) business days after Trackbee becomes aware of it.

Trackbee shall provide Contractor, if a situation as described in paragraph 1 of this article occurs, to the extent available, with the following information: (i) the nature of the breach, where possible indicating the categories of Data Subjects affected and, approximately, the number of Data Subjects affected; (ii) the Personal Data (potentially) affected and, approximately, the number of Personal Data affected; (iii) the identified and expected consequences of the Breach for the processing of the Personal Data and the individuals affected thereby; and (iv) the measures that Trackbee has taken and will take, as far as reasonably practicable, to address the Breach, including, where applicable, the measures to mitigate any negative consequences of the Breach.

The notification referred to in paragraph 1 of this article shall be addressed by Trackbee to a contact person or data protection officer to be designated by Contractor.

The notification referred to in paragraph 1 of this article shall be made In Writing. Upon receipt of the notification, Contractor shall inform Trackbee how Contractor shall, if necessary, report any data breach to the Personal Data Authority.

Where possible, Trackbee shall take measures necessary to limit the (potential) damage of a security breach and shall support Contractor in notifications to Data Subjects and/or authorities where possible.

Trackbee shall not Process Personal Data for longer than necessary and in any event not longer than twenty (20) years, unless Contractor has expressly instructed in Writing to do so. If, in the opinion of Contractor, certain Personal Data should no longer be retained, Trackbee shall, upon Contractor's Written request, destroy the relevant Personal Data specified by Contractor to the extent and if permitted by law.

Trackbee shall, in accordance with article 32 of the GDPR, take appropriate technical and organisational measures to secure Personal Data against loss or any form of unlawful processing. These measures will provide an appropriate level of security having regard to the state of the art, implementation costs, as well as the nature, scope, context and purposes of processing and the risks, varying in terms of likelihood and severity, that processing Personal Data processed by Trackbee poses to the rights and freedoms of Data Subjects.

Trackbee will inform Contractor if any of the security measures change.

Trackbee shall only allow Contractor to inspect Trackbee's compliance with the security measures or, at Contractor's request, to have Trackbee's data processing facilities inspected by an investigative body to be appointed by Contractor in connection with the processing activities covered by the Data Processing Agreement if this is necessary and only if Trackbee has given its prior consent and always subject to the condition that the associated costs (including stagnation costs) will be reimbursed by Contractor. Without any demonstration of necessity and/or consent, the above mentioned intention(s) of Contractor shall be unlawful. If necessity is demonstrated and if Trackbee has given permission to Contractor for inspection, the inspection may be carried out by an investigative body, which in the reasonable opinion of Trackbee is neutral and competent.

Contractor shall ensure that the investigative body is obliged to keep its findings confidential from third parties.

Contractor shall pay or reimburse Trackbee for all expenses plus damages (including stagnation damages) in connection with the inspection.

Contractor shall provide Trackbee with a copy of the report of the inspection.

Contractor is, with respect to the Processing of Personal Data pursuant to the Data Processing Agreement, the "Controller" as defined in article 4 paragraph 7 of the GDPR.

Contractor agrees and warrants that the Processing of Personal Data pursuant to the Data Processing Agreement complies with applicable Privacy Laws.

Contractor agrees and warrant that the Personal Data it makes available to Trackbee will at all times comply with all laws and regulations, expressly including but not limited to Privacy Law. Contractor shall be solely responsible for the legality of the Personal Data and for ensuring that it has an appropriate legal basis for collecting and Processing Personal Data in accordance with the terms of the Agreement and this Data Processing Agreement.

Trackbee shall not be liable for any damage arising from or related to failure to comply with the Data Processing Agreement and/or act in breach of applicable Privacy Laws, Contractor shall indemnify Trackbee in this regard.

Contractor shall indemnify Trackbee against all claims by third parties, including but not limited to Data Subjects and regulators, in connection with Trackbee's attributable failure to comply with the Data Processing Agreement or breach by Trackbee of applicable Privacy Laws, and shall not be entitled to any related and consequential costs (including but not limited to costs of legal assistance) and damages.

The Data Processing Agreement is inextricably linked to the Agreement, which entails that if the Agreement ends, the Data Processing Agreement also ends.

Notwithstanding Contractor's Written instructions to the contrary, in the event of termination of the Data Processing Agreement, Trackbee shall, if the Software permits, return to Contractor all Personal Data made available to it and destroy all digital copies of Personal Data and certify to Contractor that it has done so. If destruction of the Personal Data is not technically possible, Trackbee shall anonymise the Personal Data.

If, in Trackbee's reasonable opinion, an independent legal obligation of Trackbee prohibits or restricts the return or destruction of all or part of the Personal Data by Trackbee, it shall notify Contractor in Writing of the legal obligation as soon as possible, providing all relevant information that Contractor reasonably requires to determine whether destruction can take place and, if so, under what conditions. If in Contractor's reasonable opinion the legal obligation permits (partial) destruction of the Personal Data by Trackbee, Trackbee shall promptly do so upon Contractor's request. If Contractor considers that destruction may not take place, it shall inform Trackbee thereof In Writing. In such event, Trackbee shall not Process the Personal Data except in fulfilment of its aforementioned legal obligation or upon Contractor's instructions In Writing.

This Data Processing Agreement is inseparable from the Agreement, the Terms of Use and the Privacy Policy and therefore forms an inseparable whole. The Agreement is attached to this Data Processing Agreement as Annex II, the Terms of Use as Annex III and the Privacy Policy as Annex IV.

The Contractor hereby confirms that the aforementioned Agreement, Terms of Use and Privacy Policy have been made available to it, that it has taken cognisance thereof and has accepted their content and validity over this Data Processing Agreement and all further conditions.

Between this Data Processing Agreement and the Annexes, the following order of precedence shall apply In case of conflict: (i) Agreement, thereafter (ii) Terms of Use, thereafter (iii) Data Processing Agreement, including Annex I: Personal Data Overview and thereafter (iv) Privacy Policy.