Processor agreement

Personal Data Protection Agreement
Version 1.0, publication date: 08 October 2020

Parties
This Processors' Agreement is applicable to all forms of processing of personal data carried out by IT Local B.V., registered with the Chamber of Commerce under number 27188489, (hereinafter: "Processor") on behalf of an opposing party to whom it provides services (hereinafter: "Processor") and, as well as the General Terms and Conditions, forms an integral part of any agreement between IT Local B.V. and its opposing party.

considering that:
A. Processing Responsible Party has access to personal data of various data subjects;
B. Processing Responsible Party wishes to use the services of Processor for the performance of IT management;
C. Processing Responsible Party and Processor have entered into an IT Services Policy for the purposes of the foregoing;
D. Controller wishes to have data processed by Processor for the performance of the IT Services Policy;
E. Processing will only take place in the context of the IT Services Policy, pursuant to which, among other things, data of Processing Responsible Party will be hosted, or backups will be made, transported and/or stored, or (Cloud) management services will be provided to Processing Responsible Party, and those purposes reasonably related thereto or determined by further agreement;
F. The terms used in this Processor Agreement (hereinafter "Processor Agreement"), such as: 'Processor', 'Processor Responsible Party', 'processing' and 'personal data', have the sense and meaning given to them in Article 4 of the General Data Protection Regulation (hereinafter: "AVG");
G. Processor is prepared to comply with obligations concerning security and other aspects of the AVG, in so far as this is within its power;
H. The AVG imposes a duty on Processor to ensure that Processor provides sufficient safeguards regarding the technical and organisational security measures in relation to the processing to be performed and regarding the notification of a security breach;
I. The AVG additionally imposes a duty on Processor to monitor compliance with those measures;
J. The parties, also in view of the requirement in Article 28(3) of the AVG, wish to lay down their rights and obligations in writing by means of this Processor Agreement.

have agreed as follows:

Article 1: Purposes of processing
1. Processor undertakes to process personal data under the terms of this Processor Agreement on behalf of the Controller. Processing will only take place in the context of the services purchased, plus those purposes reasonably related thereto or determined by further agreement.
2. The personal data processed by Processor in the context of the activities referred to in the previous paragraph are: all personal data necessary for the purpose to be processed.
3. Processor shall not process the personal data for any purpose other than as determined by Processor. Processor shall inform Processor of the processing purposes insofar as they are not already mentioned in this Processor Agreement.
4. The personal data to be Processed on behalf of the Processor shall remain the property of the Processor and/or the relevant data subjects.

Article 2: Obligations of Processor
1. With regard to the processing mentioned in Article 1, the Processor shall ensure compliance with the applicable laws and regulations, including in any case the laws and regulations in the field of personal data protection, such as the AVG (General Data Protection Regulation).
2. The Processor shall inform the Controller, at the latter's first request, of the measures it has taken regarding its obligations under this Processor Agreement.
3. The obligations of the Processor under this Processor Agreement also apply to those who process personal data under the authority of the Processor, including but not limited to employees, in the broadest sense of the word.
4. The Processor shall immediately notify the Controller if, in its opinion, an instruction of the Controller violates the legislation referred to in paragraph 1.
5. Processor shall, to the extent within its power, reasonably assist Processor for the purpose of carrying out data protection impact assessments (PIAs). The time spent in this regard shall be charged by Processor to Processor.

Article 3: Transfer of personal data
1. Processor may process personal data in countries within the European Economic Area and in third countries with an adequate level of protection, or if the required safeguards are in place. Transfer to countries outside the European Union without an adequate level of protection is not permitted, provided Processor gives its consent or requests it.
2. Processor shall, if explicitly requested by Processor, inform Processor in which country or countries the personal data are processed.

Article 4: Division of responsibility
1. For the purposes of the processing operations, Processor shall make available, or manage on the instructions of the Processor, ICT resources to be used by the Processor for the purposes mentioned above. Processor itself processes personal data insofar as necessary to provide the purchased service or insofar as it is required to do so by law.
2. Processor is solely responsible for the processing of the personal data under this Processor Agreement, in accordance with the instructions of Processor and under the express (ultimate) responsibility of Processor. For other processing of personal data, including in any case, but not limited to, the collection of the personal data by the Controller, processing for purposes not notified to the Processor by the Controller, processing by third parties and/or for other purposes, the Processor is explicitly not responsible.
3. Processor guarantees that the content, use and commissioning of the processing of the personal data referred to in this processor agreement are not unlawful and do not infringe any right of third parties.

Article 5: Engaging third parties or subcontractors
1. Processor may use third parties in the context of this processor agreement and shall provide a list of third parties (sub-processors) to Processor upon request.
2. In any case, Processor shall ensure that these third parties assume in writing at least the same duties as agreed between Processor and Processor.
3. Processor guarantees correct compliance by these third parties with the obligations under this Processor Agreement and, in the event of errors by these third parties, is itself liable for all damage as if it had committed the error(s) itself.

Article 6: Security
1. Processor shall endeavour to take sufficient technical and organisational measures in relation to the personal data processing to be performed, against loss or against any form of unlawful processing (such as unauthorised access, impairment, modification or disclosure of the personal data).
2. Processor has in any case taken the measures mentioned in Annex 1 of this Processor Agreement.
3. Processor does not guarantee that the security is effective under all circumstances. Processor shall endeavour to ensure that the security meets a level that is not unreasonable, given the state of the art, the sensitivity of the personal data and the costs associated with implementing the security.
4. Processor shall only make personal data available to Processor for processing if it has satisfied itself that the required security measures have been taken. Processor is responsible for compliance with the measures agreed by the Parties.

Article 7: Duty to report
1. The Processing Responsible Party is at all times responsible for reporting a security breach and/or data leak (which is understood to mean: a breach of the security of personal data that leads to a chance of adverse consequences, or has adverse consequences, for the protection of personal data) to the supervisory authority and/or data subjects. To enable Processor to comply with this legal obligation, Processor shall notify Processor of the security breach and/or data leak within 48 hours after the leak has become known to it.
2. A notification must always be made, but only if the event actually occurred.
3. In any case, the duty to report includes reporting the fact that a leak has occurred. In addition, the duty to report includes:
a. the nature of the personal data breach, where possible specifying the categories of data subjects and personal data records concerned and, approximately, the number of data subjects and personal data records concerned;
b. the name and contact details of the data protection officer or other contact point where more information can be obtained;
c. the likely consequences of the personal data breach;
d. the measures proposed or taken by the Processor to address the personal data breach, including, where applicable, the measures to mitigate any adverse effects thereof.

Article 8: Dealing with requests from data subjects
1. In case a data subject makes a request to Processor to exercise his/her legal rights, Processor shall forward the request to Processor, and Processor shall further process the request. Processor may notify the data subject accordingly.

Article 9: Secrecy and confidentiality
1. All personal data that Processor receives from Processor Responsible Party and/or collects itself in the context of this Processor Agreement are subject to an obligation of confidentiality towards third parties. Processor shall not use this information for any purpose other than that for which it obtained it, even if it is put in such a form that it cannot be traced back to data subjects.
2. This duty of confidentiality does not apply insofar as Processor has given express permission to provide the information to third parties if the provision of the information to third parties is logically necessary, given the nature of the assignment given and the performance of this Processor Agreement, or if there is a legal obligation to provide the information to a third party.

Article 10: Audit
1. Processor hereby grants Processed Party the right to have an audit carried out by an independent third party bound by confidentiality to verify compliance with the provisions of this Processor Agreement or Processor shall provide Processed Party with a third-party communication, by which it can be assumed that Processed Party is acting in accordance with the provisions of this Processor Agreement. The aforementioned at the discretion of Processor.
2. This audit may take place in case of a concrete suspicion of misuse of personal data.
3. Processor shall cooperate in the audit and provide all information reasonably relevant for the audit, including supporting data such as system logs, and employees as timely as possible.
4. The findings resulting from the audit conducted will be reviewed by Processor and may, at Processor's sole discretion and in the manner determined by Processor, be implemented by Processor.
5. The cost of the audit shall be borne by Processor.

Article 11: Liability
1. The liability of Processor for damages resulting from an attributable failure in the performance of the Processor Agreement, or in tort or otherwise, shall be limited per event (a series of consecutive events counts as one event) to compensation for direct damages, up to a maximum of the amount of the fees received by Processor for the work under this Processor Agreement for the month preceding the event causing the damages. The liability of Processor for direct damage shall never exceed in total an amount equal to the fees paid by Processor for the services provided in the last three (3) months.
2. Direct damage means exclusively all damage consisting of:
a. reasonable and demonstrable costs to compel the Processor to (again) properly comply with the Processing Agreement;
b. reasonable costs to determine the cause and scope of the damage insofar as pertaining to the direct damage referred to here;
c. reasonable and demonstrable costs incurred by the Processor to prevent or limit the direct damage as referred to here.
3. Processor's liability for indirect damage is excluded. Indirect damage is understood to mean all damage that is not direct damage and therefore in any case, but not limited to, consequential damage, loss of profit, missed savings, reduced goodwill, damage due to business stagnation, damage due to the failure to determine marketing purposes, damage related to the use of data or data files prescribed by the Processor, or loss, mutilation or destruction of data or data files.
4. The exclusions and limitations referred to in this article shall lapse if and insofar as the damage is the result of intent or conscious recklessness on the part of Processor's management.
5. Unless fulfilment by Processor is permanently impossible, Processor's liability for attributable failure to fulfil the IT Services Policy only arises if Processor immediately gives Processor written notice of default, setting a reasonable deadline for remedying the failure, and Processor continues to fail imputably in the fulfilment of its obligations even after that deadline. The notice of default must contain as complete and detailed a description of the failure as possible, so that Processor is given the opportunity to respond adequately.
6. Any claim for damages by Processor against Processor that has not been specified and explicitly reported shall lapse by the mere expiry of twelve (12) months from receipt of the claim by Processor.

Article 12: Duration and termination
1. This Processor Agreement is entered into for the duration as stipulated in the IT Services Policy and, failing that, for the duration of the cooperation.
2. Processor is entitled to revise this Processor Agreement from time to time. It shall give at least one month's notice of the amendments to Processor.
3. As soon as the Processor Agreement is terminated, for whatever reason and in whatever manner, Processor shall immediately destroy the personal data received from the Processing Responsible Party, unless the parties agree otherwise.
4. Processor may terminate by the end of this month if it cannot agree to the changes. Otherwise, the changes shall be deemed to be approved by Processor.

Article 13: Retention periods and erasure
1. Processor is responsible for determining the retention periods in relation to personal data. To the extent personal data are under the control of the Processing Responsible Party (e.g. in the case of hosting services), it shall delete them itself in a timely manner.
2. Processor shall erase the personal data within thirty days after the end of the IT Services Policy or, at Processor's option, transfer the personal data to the Processor, unless the personal data must be kept longer, such as in the context of (legal) obligations of Processor, or if Processor requests to keep personal data longer and Processor and Processor agree on the costs and other conditions of such longer storage, the latter without prejudice to Processor's responsibility to comply with the statutory retention periods. Any transfer to the Processor shall take place at the expense of the Processor.
3. At the request of the Processing Responsible Party, the Processor shall declare that the erasure referred to in the previous paragraph has taken place.
The Processing Responsible Party may, at its own expense, have a check carried out as to whether this has indeed taken place.

Article 14: Applicable law and dispute resolution
1. The Processor Agreement and its performance shall be governed by Dutch law.
2. All disputes that may arise between the Parties in connection with the Processor Agreement will be submitted to the competent court for the district in which the Processor has its registered office.

Annex I: Measures
The measures to be complied with as a minimum:
1. The Processor maintains strict procedures that explicitly address the measures taken by the Processor to secure data processing, as well as to ensure privacy. These procedures are based on commonly used security standards.
2. Responsibilities, both at management and executive levels, are clearly defined and assigned.
3. The Processor's employees involved in processing personal data are bound by a duty of confidentiality and, if applicable, a pre-employment screening has taken place and a job-related VOG statement is present.
4. Employees of the organisation and, where applicable, hired staff and external users shall receive appropriate training and regular in-service training on the organisation's information security policy and information security procedures, to the extent relevant to their position. Within the training and in-service training, explicit attention shall be paid to the handling of (special categories of, or otherwise sensitive) personal data.
5. IT facilities and equipment used by Processor to provide the Services are protected against unauthorised access.
6. Procedures are in place to give authorised users access to the information systems and services they need for the performance of their duties and to prevent unauthorised access to information systems.
7. When transporting confidential information explicitly designated as such by the Controller over networks, adequate encryption shall always be applied.
8. Procedures are in place for the acquisition, maintenance and destruction of data and information systems.
9. Employees of Processor use 2-factor authentication to access the closed automated management framework (KASEYA VSA). Through this management framework, Processor employees have access to the IT systems through an additional username-password combination. Employees of Processor, when directly connected to the managed network, have access through username-password combination to which strict password policies apply.
10. The Processor timely installs solutions released by suppliers for security leaks. All this exclusively if and insofar as the software in question is supplied, used or maintained by the Processor on behalf of the Controller.
11. Procedures are in place for the timely and effective handling of information security incidents, once reported.
12. The Controller shall report data breaches that are subject to a statutory reporting obligation to the relevant regulator (usually the Personal Data Authority).