Data Processing Agreement | VTON B.V.
This data processing agreement is an integral and inseparable part of the Cooperation Agreement. Therefore, this data processing agreement also applies the general terms and conditions and the Privacy Statement of VTON B.V. The User is given the opportunity to enter into the agreement below regarding the processing of personal data with VTON BV at the start of the cooperation. In the case of already ongoing partnerships, we assume that you agree with the data processing agreement. If this is not the case, we would like to hear from you by no later than July 1, 2018 by email: info@vton.nl
THE PARTIES
- User, the natural or legal person, acting in the exercise of a profession or business, with whom VTON BV has entered into an Agreement (Data Controller),
and
- VTON BV, with its statutory seat in Heerenveen and registered at the Chamber of Commerce under number 67155693 (Processor), hereinafter separately referred to as Party and jointly referred to as Parties,
CONSIDERING THAT:
- Processor provides services a digital football methodology (the Services);
- Data Controller wishes to use the services of Processor, whereby
Processor will process certain personal data on behalf of Data Controller;
- Data Controller is designated as data controller within the meaning of privacy legislation, or where applicable, as processor within the meaning of privacy legislation, in which case Processor acts as a sub-processor;
- Parties, also considering the requirements of privacy legislation, wish to document their rights and obligations in writing in this data processing agreement;
- where terms from the General Data Protection Regulation (GDPR) are mentioned in this data processing agreement, they refer to the corresponding terms in the GDPR;
AGREE AS FOLLOWS:
Article 1. General
- Processor undertakes, under the terms of this data processing agreement, to process personal data on behalf of the Data Controller. The processing will only take place within the framework of the execution of the Agreement, plus those purposes that are reasonably related to it or that are determined with further consent, and only on the basis of instructions from Data Controller. Data Controller will inform Processor in writing of the processing purposes to the extent that these are not already mentioned in the Agreement, Privacy Statement or this data processing agreement.
- As part of the Agreement, Processor will process all personal data that may be stored when using the Services. The types of personal data include: i) First and last name; ii) Email address; iii) Telephone number(s) of the User; iv) IP Address; v) (Bank) account number; vi) name of the football club; vii) age.
- Processor has no control over the purpose and means of processing personal data. Processor does not make independent decisions regarding the receipt and use of personal data, disclosure to third parties, and the duration of storage.
Article 2. Division of responsibility
2.1 The permitted processing will be carried out under the control of Processor within a (semi)automated environment.
2.2 Processor is solely responsible for processing personal data under this data processing agreement, in accordance with the written instructions of the Data Controller and under the explicit (final) responsibility of the Data Controller.
2.3 Processor is expressly not responsible for the other processing of personal data, including but not limited to collecting personal data by the Data Controller, processing for purposes not notified to Processor by Data Controller, and processing by third parties engaged by Data Controller. The responsibility for these processing activities lies with the Data Controller.
2.4 Data Controller guarantees that the content, use, and assignment of the personal data processing activities as referred to in this data processing agreement are not unlawful and do not infringe the rights of third parties, and indemnifies Processor against all claims and demands related thereto.
2.5 In cases where a data protection impact assessment or prior consultation of the supervisory authority
is mandatory for a new processing activity under this data processing agreement, Processor shall, as far as within its power, cooperate. Processor may charge reasonable costs to the Data Controller for this.
2.6 If required and necessary by law, Processor will cooperate with any audits carried out by the Data Protection Authority concerning a processing activity under this data processing agreement. Processor may charge reasonable costs to the Data Controller for this.
2.7 The obligations of Processor arising from this data processing agreement also apply to those processing personal data under the authority of Processor, including in any case the employees of Processor.
Article 3. Security
3.1 Processor will make efforts to take appropriate technical and organizational measures regarding the processing of personal data, to prevent loss or any form of unlawful processing (such as unauthorized access, alteration, disclosure, or destruction of personal data). The measures taken by Processor are published in the Privacy Statement on Processor's website. Both Parties consider these measures adequate and agree that they guarantee an adequate level of protection.
3.2 Due to the nature of the internet and technology, Processor does not guarantee that the security measures are always effective under all circumstances.
Article 4. Sub-processors
4.1 Data Controller hereby gives Processor permission to use subcontractors (sub-processors) in processing personal data under this data processing agreement, in compliance with the applicable privacy legislation. Processor will inform Data Controller upon request of the subcontractors he engages.
4.2 In the event that Processor intends to engage new sub-processors for the processing of personal data, Processor will, if reasonably possible, inform Data Controller in advance.
4.3 Processor ensures that sub-processors undertake similar obligations in writing as agreed between Data Controller and Processor.
Article 5. Transfer
5.1 Processor may process personal data in countries within the European Economic Area (EEA). In addition, Processor may transfer personal data to countries outside the EEA, provided that the relevant legal requirements are met.
5.2 Upon request, Processor will inform Data Controller to which country or countries the personal data will be transferred.
Article 6. Audit
6.1 Data Controller has the right to have audits conducted by an independent expert third party bound by confidentiality, to verify compliance with the agreements of this data processing agreement and all direct related matters.
6.2 The audit will only take place after Data Controller has requested, reviewed the relevant reports available to Processor, and provides reasonable arguments justifying an audit initiated by Data Controller. Such an audit is justified when the reports available to Processor do not provide sufficient clarity on compliance with this data processing agreement.
6.3 The audit initiated by Data Controller will take place no earlier than four weeks after prior announcement and no more than once per calendar year.
6.4 Processor will cooperate with the audit and provide all information reasonably relevant to the audit.
6.5 The findings resulting from the audit will be reviewed by the Parties in consultation. Changes will or will not be implemented based on the results of this review, either by one of the Parties or jointly by both Parties.
6.6 All audit costs, including those incurred by Processor, will be the responsibility of Data Controller.
Article 7. Notification obligation
7.1 In the event of a personal data breach as referred to in article 33 of the GDPR, Processor shall inform Data Controller thereof within 48 hours. Processor shall make best efforts to ensure that the information provided is complete, correct, and accurate.
7.2 If required by law and/or regulations, Processor will cooperate in informing the relevant authorities and/or concerned individuals. Data Controller will decide whether to inform the supervisory authorities and/or concerned individuals. Data Controller remains responsible for complying with any (legal) reporting obligations.
7.3 The notification obligation includes, at least, reporting the fact that there has been a breach, as well as, if available: i) the (alleged) cause of the breach; ii) contact details for follow-up on the notification; iii) approximate: the number of data subjects and records of personal data; iv) what is the (known and/or expected) consequence; v) what is the (proposed) solution; and vi) what measures have been taken so far.
Article 8. Data subjects' requests
8.1 In the event that a data subject addresses a request regarding his personal data to Processor, Processor will forward this request to Data Controller and Data Controller will further handle the request. If Processor's cooperation is necessary to handle such a request, Processor will provide reasonable assistance. Data Controller will reimburse Processor for the reasonable costs incurred or to be incurred in connection with this assistance.
Article 9. Confidentiality
9.1 All personal data that Processor receives from Data Controller and/or collects itself in the context of this data processing agreement is subject to a duty of confidentiality towards third parties.
9.2 This duty of confidentiality does not apply if Data Controller has expressly permitted the provision of information to third parties, if providing the information to third parties is logically necessary given the nature of the assignment and the performance of this data processing agreement, or if there is a legal obligation to provide the information to a third party.
Article 10. Duration and termination
10.1 This data processing agreement is established by signing of the Parties or approval via the website and will remain in force for the duration of the Agreement and in the absence thereof for the duration of the (further) cooperation.
10.2 Parties will cooperate fully to, if necessary, adjust this data processing agreement and make it suitable for any new or amended privacy legislation.
10.3 In the event of termination of the Agreement, this data processing agreement will also terminate automatically.
10.4 Prior to the end of the Agreement, or within 30 days after the end of the Agreement, Data Controller may make further agreements with Processor on what should happen with the personal data of the Controller that Processor may still have. Upon request of Data Controller, Processor will destroy the processed personal data or return it (in original or copy form) to Data Controller. Processor may charge Data Controller for this based on Processor's standard rates.
10.5 If within 90 days of the end of the Main Agreement, Data Controller has not indicated a desire to make further agreements with Processor regarding the
return or destruction of the personal data, Processor is entitled to destroy the personal data as of the 91st day after the Agreement has ended.
Executed on behalf of VTON BV
