Data Processing Agreement

1. 1.1

   These terms (hereinafter also "appointment" or simply "agreement") establish the rights and obligations of the data controller and the data processor in the context of processing operations carried out by the Processor on behalf of the Data Controller.

2. 1.2

   Users affected by the processing of their data under this appointment include visitors to the Controller's websites. For further information on the processing of data belonging to visitors and the categories of data that the Processor collects and processes on behalf of the Controller, please refer to the privacy policy, available here: Data policy

3. 1.3

   The parties have entered into a contract for an analytics service that allows the Controller to monitor the number of views and actions of users on its website (hereinafter the "Contract"). The performance of the services under the Contract involves the processing of personal data by the Data Processor, for the purposes and with the tools determined by the Controller and indicated in the Contract itself and in this appointment.

4. 1.4

   This agreement has been drafted to ensure compliance with Article 28(3) of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR").

5. 1.5

   Within the scope of the services provided under the Contract, the Data Processor shall process personal data on behalf of the Controller in accordance with this appointment.

6. 1.6

   The three annexes to this appointment form an integral part of the appointment.

7. 1.7

   Annex A contains details on the processing of personal data, including the purposes and types of processing, the nature of the personal data, and the categories of data subjects.

8. 1.8

   Annex B contains the conditions for the use by the Data Processor of sub-processors and a list of sub-processors authorized by the Controller.

9. 1.9

   Annex C contains the Controller's instructions regarding the processing of personal data and the security measures to be implemented by the Data Processor.

10. 1.10

    The clauses and annexes shall be retained by both parties, in electronic or paper form.

11. 1.11

    The clauses of this agreement do not exempt the Data Controller from the obligations to which it is subject under the General Data Protection Regulation (GDPR) or other regulations.

1. 2.1

   The Data Processor must ensure that the processing of personal data complies with the GDPR (see Article 24 GDPR), the applicable data protection provisions of the EU or the EEA (European Economic Area) Member States, and the clauses set forth herein.

2. 2.2

   The Data Controller is responsible for deciding on the purposes and means of the processing of personal data.

3. 2.3

   Among other things, the Data Controller must ensure that the processing of personal data assigned to the Processor has a legal basis and that users have been adequately informed about the use of the services offered by the Processor.

4. 2.4

   The Controller undertakes never to insert unique identifiers of its users that may allow the re-identification of a specific user through the Processor's script, as this would also constitute a violation of the settings implemented to protect users' privacy by the Processor. In case of violations due to unauthorized use of the script, the responsibility for the breach of privacy rules shall rest solely with the Controller, who shall also indemnify and hold harmless the Processor from any claims for damages or penalties.

1. 3.1

   The Data Processor shall process personal data only following documented instructions from the Data Controller, unless required to process it by a provision of EU law or the law of the Member State in which it is located. Such instructions shall be specified in Annexes A and C. Any further instructions may be issued by the Data Controller and evaluated by the Processor, and must always be documented and retained in writing, including electronically.

2. 3.2

   The Data Processor shall promptly inform the Data Controller if the instructions provided by the latter, in the Processor's opinion, violate the GDPR or the applicable data protection provisions of the EU or the Member States.

1. 5.1

   Pursuant to Article 32 of the GDPR, taking into account the state of the art and the costs of implementation, as well as the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Controller and the Data Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, where appropriate:

   1. a)

      Pseudonymization and encryption of personal data;

   2. b)

      The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

   3. c)

      The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

   4. d)

      A process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures to ensure the security of processing.

2. 5.2

   The Data Processor shall assist the Data Controller in ensuring compliance with the Controller's obligations under Article 32 of the GDPR, providing, among other things, information to the Controller regarding the technical and organizational measures already implemented, along with any other information necessary for the Controller to fulfill its obligations under Article 32 GDPR.

3. 5.3

   The parties have assessed the adequacy of the security measures implemented by the Processor to address the risks inherent in the processing required by the provision of the Services as identified in Annex C.

1. 6.1

   In order to engage another subprocessor for processing activities on behalf of the Controller, the Processor must meet the requirements of Article 28(2) and (4) of the GDPR.

2. 6.2

   The Data Processor shall not appoint another data processor (subprocessor) for the performance of the obligations set out in this appointment without the prior general written authorization of the Data Controller, which shall not be refused except for reasons related to the protection of personal data, such as a clear risk to the data protection of data subjects, violation of GDPR principles, or the subprocessor's failure to implement adequate security measures to ensure the privacy and security of data subjects in accordance with GDPR.

3. 6.3

   The Data Processor has the general authorization of the Data Controller to use subprocessorss

4. 6.4

   The Data Processor shall provide written notice to the data controller at least 15 days in advance if it intends to make changes to the list of subprocessors by adding new ones or replacing them, thereby giving the Controller the opportunity to object to such changes before engaging other subprocessors. In the absence of reasoned objection, the appointment shall be deemed automatically accepted. Longer notice periods for specific processing operations may be indicated in Annex B. The list of subprocessors authorized by the Data Controller is available in Annex B.

5. 6.5

   If the Data Processor engages a subprocessor to perform specific processing activities on behalf of the Controller, data protection obligations equivalent to those set out in these clauses are imposed on such subprocessor through a contract or other legal act under EU law or the laws of the Member States, so that the subprocessor provides sufficient guarantees to implement appropriate technical and organizational measures to meet the requirements of this appointment and the GDPR.

6. 6.6

   It is the responsibility of the Data Processor to ensure that the subprocessor complies with at least the obligations to which the Data Processor is subject under these clauses and the GDPR.

7. 6.7

   A copy of such subprocessor appointment agreement and any subsequent amendments must, upon request of the Controller, be shown to the Controller, to verify that equivalent data protection obligations to those provided in this agreement have been imposed on the subprocessor.

8. 6.8

   If the subprocessor fails to fulfill its data protection obligations, the Data Processor remains liable to the Controller for the fulfillment of the subprocessor's obligations. This does not affect the rights of data subjects under the GDPR - in particular those provided for in Articles 79 and 82 of the GDPR - against the Controller, the Data Processor, including the subprocessor.

1. 7.1

   Any transfer of personal data to third countries or international organizations by the Data Processor shall be carried out only on the basis of documented instructions from the Controller and always in compliance with Chapter V of the GDPR and Annex C3.

2. 7.2

   In case of transfers not authorized by the Controller but required by law under EU law or the law of the Member State in which the Processor is located, the Processor shall inform the Controller of the legal requirement that requires the transfer before proceeding with the transfer, unless prohibited by law for important reasons of public interest.

3. 7.3

   Without documented instructions from the Controller, the Data Processor shall not:

   1. a)

      Transfer personal data to a different controller or processor located in a third country or international organization;

   2. b)

      Assign the processing of personal data to a subprocessor located in a third country;

   3. c)

      Have personal data processed by another data processor located in a third country.

4. 7.4

   The clauses of this agreement should not be confused with the standard data protection clauses pursuant to Article 46(2)(c) and (d) of the GDPR and cannot be invoked by the parties as a transfer tool under Chapter V of the GDPR.

1. 8.1

   Considering the nature of the processing, the Processor assists the Data Controller with appropriate technical and organizational measures, to the extent possible, in fulfilling the obligation of the Data Controller to respond to requests to exercise data subject rights. This implies that the Processor, as much as possible, assists the Data Controller in fulfilling the following:

   1. a)

      The data subject's right to be informed when their personal data is collected;

   2. b)

      The data subject's right to be informed when personal data has not been obtained from them;

   3. c)

      The data subject's right to access;

   4. d)

      The right to rectification;

   5. e)

      The right to erasure ("right to be forgotten");

   6. f)

      The right to restriction of processing;

   7. g)

      The obligation to notify in the event of rectification, erasure of personal data, or restriction of processing;

   8. h)

      The right to data portability;

   9. i)

      The right to object;

   10. j)

       The right not to be subject to a decision based solely on automated processing, including profiling.

2. 8.2

   In addition to the obligation to assist the Controller under clause 8.1, the Processor must also, taking into account the nature of the processing and the information available to it, assist the Data Controller in ensuring compliance with:

   1. a)

      The obligation of the Data Controller to notify the personal data breach to the competent supervisory authority, without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

   2. b)

      The obligation of the Data Controller to communicate without undue delay the personal data breach to the data subject when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

   3. c)

      The obligation of the Data Controller to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment).

   4. d)

      The obligation of the Data Controller to consult the competent supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the Data Controller to mitigate the risk.

1. 9.1

   In the event of a personal data breach, the Processor shall, without undue delay after becoming aware of it, notify the Data Controller of the personal data breach.

2. 9.2

   The notification by the Processor to the Controller shall, if possible, be made within 48 hours from the moment the Processor becomes aware of it to enable the Controller to meet the obligation to notify the personal data breach to the competent supervisory authority (Article 33 GDPR).

3. 9.3

   As provided for in clause 8, paragraph 2, letter a), the Processor shall assist the Data Controller in the notification to the competent supervisory authority, which means that the Processor shall provide assistance to obtain the information listed below that, pursuant to Article 33, paragraph 3, of the GDPR, must be included in the notification by the Controller to the competent supervisory authority:

   1. a)

      The nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

   2. b)

      The likely consequences of the personal data breach;

   3. c)

      The measures taken or proposed to be taken to address the personal data breach including, where appropriate, measures to mitigate its possible adverse effects.

1. 13.1

   This appointment agreement shall enter into force on the date of acceptance by the Data Controller.

2. 13.2

   Both parties shall have the right to request renegotiation of the clauses in the event of changes to the applicable law or if the clauses are deemed inadequate by the parties.

3. 13.3

   These provisions apply for the duration of the processing activities envisaged under the Contract.

4. 13.4

   If the processing of personal data is terminated and the personal data is deleted or returned to the Data Controller pursuant to clause 10, this appointment agreement may be considered terminated following written notification by one of the parties.

Attachment B: List of Authorized Sub-Processors

B.1. Pre-approved Sub-Processors List

• Hosting - Hetzner
  • Hetzner Online GmbH
  • Industriestr. 25
  • 91710 Gunzenhausen, Deutschland
• Certifications: Hetzner Certifications

If the Controller refuses to appoint additional sub-processors, and if such non-appointment could jeopardize the performance of the services, the Processor shall have the right to terminate the service contract, without the Processor having anything to claim as a result of the termination.