Processor agreement

Processor agreement My Webshop
Version May 1, 2018
(Translation from the original Dutch version)

Wagenhof Model-Toys, with its registered office in Wieringerwerf and registered with the Chamber of Commerce under number 37066687, hereby represented by A.J.M. Heestermans (hereinafter: Wagenhof Model-Toys),

And

MyOnlineStore B.V., with its registered office in Oss and registered with the Chamber of Commerce under number 17149100, hereby legally represented by A. Pansier (hereinafter: Processor),
hereinafter referred to separately as “Party” and collectively referred to as “Parties”,

taking into account that:
 

• Wagenhof Model-Toys has personal data of various customers (hereinafter: parties involved);
• Wagenhof Model-Toys uses the services of Processor to manage their own webshop. Processor offers this service in the form of a website that Wagenhof Model-Toys can use to sell its products;
• Leaving data subjects by using the services of Processor, including personal details, name and address details, payment details, log details and order details, and processing them automatically;
• Have Wagenhof Model-Toys process personal data by the Processor by using the services of the Processor; whereby Wagenhof Model-Toys designates the goal and the means. This in the context of the agreement of 2018-04-29 between Parties (hereinafter referred to as: Agreement);
• Processor is prepared to fulfill the obligations regarding security and other aspects of the Personal Data Protection Act (Wbp), insofar as this is within his power;
• The parties wish to record their rights and obligations in writing by means of this processor agreement (hereinafter: the processor agreement), also in view of the requirement in Article 14 paragraph 5 of the Wbp;
• Processor can be regarded as Processor within the meaning of Article 1 sub e of the Wbp in the performance of the Agreement;
• Wagenhof Model-Toys is designated as Responsible within the meaning of Article 1 sub d of the Wbp;
• where this Processor Agreement refers to personal data, hereinafter personal data within the meaning of Article 1 sub a of the Wbp are meant;
• where in this Processor Agreement terms from the Wbp or General Data Protection Regulation (AVG) are mentioned, this refers to the corresponding terms from the Wbp or AVG;
• where in this Processor Agreement reference is made to the Wbp, from 25 May 2018 this refers to (the corresponding provisions from) the GDPR.

Agree on:

Article 1. Purposes of processing
1.1. Processor undertakes to process personal data on behalf of Wagenhof ModelToys under the conditions of this Processor Agreement. Processing will only take place in the context of this Processor Agreement and the purposes laid down in the Agreement. Wagenhof Model-Toys will inform the Processor in writing of the processing purposes insofar as these have not already been stated in this Processor Agreement.
1.2. Processor has no control over the purpose and means of processing personal data. Processor does not make independent decisions about the receipt and use of the personal data, the provision to third parties and the duration of the storage of personal data.
1.3. The personal data to be processed on behalf of Wagenhof Model-Toys remain the property of Wagenhof ModelToys and / or the parties involved.
1.4. To the extent required by law, Wagenhof Model-Toys will ensure that, from May 25, 2018, when the GDPR becomes applicable, it will keep a register of the processing operations regulated under this Processing Agreement. Wagenhof Model-Toys indemnifies Processor against all claims and claims related to the incorrect compliance with this register obligation.

Article 2. Division of responsibility
2.1. Parties will ensure compliance with applicable privacy laws and regulations.
2.2. The permitted processing operations will be carried out by Processor within a (semi-) automated environment.
2.3. The Processor is solely responsible for the processing of the personal data under this Processor Agreement, in accordance with the instructions of Wagenhof Model-Toys and under the express (final) responsibility of Wagenhof Model-Toys. For all other processing of personal data, including in any case including but not limited to the collection of personal data by Wagenhof Model-Toys, processing for purposes not reported to the Processor by Wagenhof Model-Toys, processing by third parties and / or other purposes , Processor is not responsible. Responsibility for these processing operations rests solely with Wagenhof Model-Toys.
2.4. Wagenhof Model-Toys guarantees that the content, use and order for processing personal data, as referred to in this Processor Agreement, are not unlawful and do not infringe any right of third parties.

Article 3. Processor's obligations
3.1. With regard to the processing operations referred to in Article 1, the Processor will ensure compliance with the conditions that, pursuant to the Wbp and AVG, are imposed on the processing of personal data by the Processor in its role.
3.2. The Processor will inform Wagenhof Model-Toys, at its request and within a reasonable period, of the measures it has taken with regard to its obligations under this Processor Agreement.
3.3. Processor will notify Wagenhof Model-Toys if, in his opinion, an instruction from Wagenhof ModelToys conflicts with relevant privacy laws and regulations.
3.4. The processor will provide Wagenhof Model-Toys with the necessary, and reasonably possible, cooperation if a data protection impact assessment, or prior consultation of the supervisory authority, is necessary in the context of the processing.
3.5. The Processor's obligations arising from this Processor Agreement also apply to those who process personal data under the authority of the Processor, including but not limited to employees, in the broadest sense of the word.

Article 4. Transfer of personal data
4.1. Processor processes personal data in countries within the European Union (EU). If the Processor processes personal data in countries outside the EU, this is only possible if that country guarantees an adequate level of protection and it complies with the other obligations imposed on it under this Processor Agreement and the Wbp.
4.2. Processor will, at its request, inform Wagenhof Model-Toys as soon as possible which country or countries are involved.

Article 5. Engaging third parties or sub-processors
5.1. Wagenhof Model-Toys hereby grants Processor permission to engage third parties (sub-processors) for the processing. The permission granted by Wagenhof Model-Toys also relates to the appointment of new sub-processors.
5.2. An up-to-date list of the sub-processors can be found at www.mijnwebwinkel.nl/subverwerkers. Wagenhof Model-Toys periodically consults the list of sub-processors. If Wagenhof Model-Toys has reasonable grounds to object to the use of new sub-processors, the processor must be notified immediately in writing and supported by arguments.
5.3. Processor imposes the same data protection obligation as mentioned in this processor agreement on all Subprocessors. Processor guarantees correct compliance with the obligations by these sub-processors and, in the event of negligence by these sub-processors, itself is liable to Wagenhof Model-Toys for direct damage as if it had committed the error (s) itself.

Article 6. Security
6.1. Processor will endeavor to take appropriate technical and organizational measures to protect the personal data against loss or any form of unlawful processing.
6.2. Processor will endeavor to ensure that the security complies with a level that is not unreasonable in view of the state of the art, the sensitivity of the personal data and the costs associated with taking the security.
6.3. Wagenhof Model-Toys only makes personal data available to the Processor for processing if it has ensured that the required security measures have been taken.

Article 7. Obligation to report data leaks
7.1. In the event of a vulnerability and / or data breach (which means: a breach of the security of personal data that leads to a significant risk of serious consequences, or has serious adverse consequences, for the protection of personal data, as referred to in Article 34a Wbp), Processor will make every effort to inform Wagenhof Model-Toys immediately or within 36 hours at the latest, as a result of which Wagenhof Model-Toys will assess whether or not it will inform the supervisory authorities and / or data subjects. Processor makes every effort to make the information provided complete, correct and accurate. The reporting obligation only applies if the leak has actually occurred.
7.2. Wagenhof Model-Toys will ensure compliance with any (legal) reporting obligations. If required by law and / or regulations, the Processor will cooperate in informing the relevant authorities and any parties involved.
7.3. The obligation to report at least includes reporting the fact that there has been a leak, as well as: what the (alleged) cause of the data breach is; what the (as yet known and / or expected) consequence is; what the (proposed) solution is; contact details for following up the report; who has been informed (such as the person concerned, Wagenhof Model-Toys, supervisor).

Article 8. Handling requests from data subjects
8.1. In the event that a data subject makes a request about his personal data to the Processor, the Processor will forward the request to Wagenhof Model-Toys. Processor may inform the data subject thereof. The processor will provide Wagenhof Model-Toys with the cooperation that is reasonably possible and necessary in processing the request.

Article 9. Confidentiality and Confidentiality
9.1. All personal data that Processor receives from Wagenhof Model-Toys and / or collects itself in the context of this Processor Agreement is subject to a duty of confidentiality towards third parties. Processor will not use this information for any other purpose than for which it obtained it, unless it has been formulated in such a way that it cannot be traced back to data subjects.
9.2. This confidentiality obligation does not apply: insofar as Wagenhof Model-Toys has given explicit permission to provide the information to third parties; or if the provision of the information to third parties is logically necessary for the execution of the Agreement or this Processor Agreement; and if there is a legal obligation to provide the information to a third party.

Article 10. Audit
10.1. Wagenhof Model-Toys is only entitled to carry out an audit if he has a concrete suspicion that there is an attributable shortcoming on the part of the Processor for the implementation of this Processor Agreement.
10.2. The costs of the audit are borne by Wagenhof Model-Toys.

Article 11. Liability
11.1. The liability of Parties for damage as a result of an attributable shortcoming in the fulfillment of this Processor Agreement, whether through tort or otherwise, is limited to the amount of the last invoice paid by Wagenhof Model-Toys.
11.2. A condition for any right to compensation is always that Wagenhof Model-Toys reports the damage to the Processor in writing and registered as soon as possible after it has become known. Any claim for compensation by Wagenhof Model-Toys lapses due to the mere lapse of three months after Wagenhof Model-Toys becomes aware of the fact that it has suffered damage.
11.3. Processor is explicitly not liable for damage to Wagenhof Model-Toys as a result of a fine imposed by one of the national supervisory authorities, including the Dutch Data Protection Authority, including in connection with statutory reporting obligations.
11.4. Insofar as there are conflicting provisions in the General Terms and Conditions of MyOnlineStore, the provisions as included in the Processor Agreement will prevail.
11.5. The limitations of liability referred to in the previous paragraphs do not apply in cases of intent or gross negligence on the part of the Processor.

Article 12. Duration and termination
12.1. This Processor Agreement is concluded by agreement on the part of Wagenhof Model-Toys.
12.2. This Processor Agreement has been entered into for the duration as stipulated in the Agreement between Parties, and in the absence thereof, in any case for the duration of the cooperation.
12.3. As soon as the Processor Agreement has been terminated, for whatever reason and in whatever way, the Processor will grant Wagenhof Model-Toys access to the personal data for a period of one month. After the aforementioned period, the personal data of Wagenhof Model-Toys will be kept in quarantine for another two months under the supervision of the Processor without Wagenhof Model-Toys having access to it. After the end of the three months, the Processor will delete and / or destroy the personal data of Wagenhof Model-Toys and any copies thereof.
12.4. Parties may only change this Processor Agreement with mutual written consent.
 

Article 13. Applicable law and dispute resolution
13.1. The Processor Agreement and its implementation are governed by Dutch law.
13.2. All disputes that may arise between Parties in connection with the Processor Agreement will be submitted to the competent court in the district in which the Processor is located.

Agreed and approved by Wagenhof Model-Toys and MyOnlineStore on 201805-12