If you have determined that you qualify as a data controller under the GDPR, and need a data processing agreement we want to help make it as much available and simple as possible for you.
It is considered that you have agreed with our GDPR compliant Data Processing Agreement (“DPA“), by agreeing with MP, DSP or SH Terms & Conditions.
Data Processing Agreement
Material Exchange Ventures AB (“MEV“) and the counterparty, being Brands, Buyers, Suppliers, Manufacturers and others (“User“) confirm and agree that with regard to the processing of User personal data MEV acts as a processor, while User acts as a controller based on an agreement for the Services provided by MEV which you have entered into by agreeing with the MP, DSP or SH Terms & Conditions (“Terms“).
This DPA forms part of the Terms into which it is incorporated by reference. This DPA will be effective, and will replace and supersede any previously applicable terms relating to their subject matter (including any data processing amendment, agreement or agreement relating to the Services), from the date on which User clicked to agree or the parties otherwise agreed to this DPA (“DPA Effective Date“). All of the definitions used in the Terms fully correspond to the meaning of the terms used in this DPA
If you are agreeing with this DPA on behalf of User, you warrant that:
a) you have full legal authority to bind User to this DPA;
b) you have read and understand this DPA; and
c) you agree, on behalf of User, to this DPA.
If you do not have the legal authority to bind User, please do not agree with this DPA.
1. SUBJECT MATTER OF DPA
1.1
In performance of the Terms Processor processes personal data for which User is the controller within the meaning of Art. 4 no. 7 of the General Data Protection Regulation (EU) 2016/679 (“GDPR“) (“User Data“). This DPA specifies the data protection-related rights and obligations of the parties in connection with the handling of User Data by Processor in performance of the Terms.
2. NATURE AND PURPOSE OF PROCESSING
2.1
Processor shall process User Data exclusively on behalf of and on documented instruction of the User within the meaning of Art. 28 GDPR (processing).
2.2
The details of the processing operations provided by Processor to User as a commissioned data processor (e.g., the nature and purpose of the processing, the type of personal data and categories of data subjects) are specified in Schedule 1 to this DPA. Any other or additional processing of User Data by Processor is prohibited, including any processing of User Data for Processor’s own purposes. Any changes in data processing procedures are subject to the mutual agreement of User and Processor and must be documented in writing or in a documented electronic format.
2.3
The User is obliged to ensure that the processing operations delegated to the Processor based on his instructions are not contrary to the applicable legislation.
3. RIGHTS AND OBLIGATIONS OF USER
3.1
User is responsible that the processing activities to be carried out under the Terms and this DPA, has been, and will continue to, be lawful, fair and transparent in relation to the data subjects, as set out in Schedule 1. User is also the sole party responsible for complying with rights of data subjects under Art. 12 through Art. 22 GDPR.
4. USER INSTRUCTIONS
4.1
Processor shall process User Data exclusively in compliance with the provisions of this DPA and the instructions of User, unless Processor is required to process User Data otherwise under European law or the law of any other state to which Processor is subject (e.g. in connection with investigations by criminal prosecutors or national security agencies). In such case, Processor shall inform User of such legal requirements prior to the start of processing, unless that law prohibits such information on important grounds of public interest.
4.2
The User’s instructions are provided in this DPA and the Terms. User may give specifications to such instructions provided in this DPA and the Terms as well as further instructions. Such instructions shall generally be given by User in writing, unless the urgency or other specific circumstances require another (e.g. oral, electronic) form. Instructions in another form than in writing or in electronic form shall be documented in appropriate form.
4.3
Processor shall comply with instructions of User. User shall have the right to specify a reasonable deadline for complying with instructions in a particular case and Processor may use commercially reasonable efforts to comply with such deadline.
4.4
If in the reasonable opinion of Processor an instruction of User violates the terms of this DPA or applicable data protection law, Processor shall inform User thereof. Processor may suspend the execution of the instruction until confirmation or amendment of the instruction by the User.
4.5
If an instruction by the Processor modifies or terminates any provisions in this DPA, such instruction shall be permitted only if the relevant provisions are revised in written or text form in accordance with section 2.2 of this DPA.
5. RIGHTS AND OBLIGATIONS OF PROCESSOR
5.1
Processor shall process User Data in compliance with the provisions of this DPA and User’s instructions in accordance with section 2.1, of this DPA unless an exception with the meaning of Art. 28 (3) lit. a) GDPR applies.
5.2
Processor shall make no copies or duplicates of User Data except with the knowledge of User, to the extent that and as long as such copies or duplicates are not necessary to ensure proper data processing, proper performance of services under the Terms (including data backup), or compliance with statutory retention obligations.
5.3
User shall ensure compliance with the technical and organizational measures set forth in section 9 of this DPA.
5.4
Processor shall cooperate on and reasonably assist User with keeping records of processing activities and performing any required data protection impact assessments to the extent necessary (Art. 28 (3) 2 lit. e) and f) GDPR). User shall refund all costs which exceed those for 5 hours per year arising for Processor from such assistance.
5.5
If User is obliged to provide any government agency, data subject, or other person with information about User Data or their collection or use, Processor shall assist User with providing such information. User shall refund all costs which exceed those for 5 hours per year arising for Processor from such assistance.
5.6
Processor may use information obtained from the contractual relationship together with information from other Users for Processor’s own analysis purposes. When doing so, Processor shall process no personal User Data obtained from User within the scope of the contractual relationship. The analyses do not allow the identification of individual Users or User Data.
6. CONFIDENTIALITY
6.1
Processor agrees to maintain confidentiality when processing User Data on behalf of User and shall in particular not disclose the User Data processed to any third parties unless authorized by User. The only exceptions are data transfers to authorized subprocessors. This duty of confidentiality shall survive and continue in effect after termination of the DPA to the extent required by the GDPR.
6.2
Processor shall ensure that persons authorized by the Processor to process the User Data on behalf of the User have committed themselves to confidentiality beyond the term of this DPA or are under a statutory obligation of confidentiality and that such persons process such User Data in compliance with the User’s instructions. The Processor will further instruct such persons regarding the applicable statutory provisions on data protection. The Processor shall ensure that access to the User Data is limited to those persons who need access to such data to meet the Processor’s obligations under this Agreement and only to such part or parts of the data as is necessary for performance of that person’s duties.
7. SUBPROCESSING
7.1
Processor can engage subprocessors for processing User Data with the general written authorisation of User given by this DPA.
7.2
Processor shall inform the User of any new subprocessing agreement executed before the new subprocessor gains access to User Data. User may object to the involvement of a new subprocessor in writing within fifteen (15) days after being informed.
7.3
User acknowledges that an objection against a new subprocessor may lead to delay or non-performance of services under this DPA. Additionally, increased costs may occur for Processor due to an objection. These shall be compensated for with an increased remuneration from User.
7.4
If Processor intends to engage a subprocessor in a third country, the subprocessor must fulfil the requirements of Art. 44 et seq. GDPR (e.g., adequacy decision of the European Commission, Privacy Shield certification, standard data protection clauses, approved code of conduct).
7.5
The rights and obligations of User and Processor under this DPA shall be agreed accordingly in the DPA between the Processor and any subprocessor.
7.6
Processor shall in particular have derived control obligations towards the subprocessors and may exercise the rights of the User described in this DPA. Processor shall audit compliance with the subprocessor’s contractual obligations on a regular basis in appropriate form, document the results of the audit, and make the audit report available to User upon demand.
8. RIGHTS OF DATA SUBJECTS
8.1
User is responsible for handling and responding to requests or claims of data subjects for information, rectification, restricted processing, or erasure of User Data or for processing any other claims brought under chapter III or VIII of the GDPR (“Data Subject Requests“). If a data subject contacts the Processor directly for purposes of information, rectification, erasure, or restricted processing of User Data related to the subject, Processor shall forward such request to User and shall make no contact with the data subject (except for the reply that the request is forward to User) unless specifically instructed to do so by User. Processor shall provide no information to any data subjects except on prior instruction from or with the prior consent of User.
8.2
Processor shall provide User with reasonable assistance for processing Data Subject Requests.
8.3
User shall refund Processor all reasonable costs which exceed those for 5 hours per year arising from or related to the assistance pursuant to sections 11.1 and 11.2.
9. TECHNICAL AND ORGANIZATIONAL MEASURES
9.1
Processor is obliged to implement the technical and organizational measures as specified in Schedule 2 before processing the User Data on behalf of the User notably to ensure the security of the User Data. Processor shall maintain the level of security of those measures in effect during the term of this DPA. The protective objectives of Art. 32 (1) GDPR, such as confidentiality, integrity, availability of systems and services, and their resilience taking into account the nature, scope, context, and purpose of data processing, shall be taken into consideration in such a way that risks are mitigated by appropriate technical and organizational measures on a sustained basis.
9.2
User has examined and confirmed that the measures set forth in Schedule 2 for the processing of User Data are appropriate and in accordance with User’s duties arising from the applicable data protection laws.
9.3
Processor is entitled to implement alternative adequate technical and organizational measures, provided that they do not undercut the level of security of the technical and organizational measures specified in Schedule 2.
9.4
Processor shall follow the procedure described in Schedule 2 for the regular review, assessment, and evaluation of the effectiveness of technical and organizational measures to ensure that User Data is processed in conformity with data protection law.
10. PROCESSOR NOTIFICATION AND SUPPORT OBLIGATIONS IN THE EVENT OF DATA BREACHES
10.1
Processor shall notify User without undue delay if Processor becomes aware of a violation of the protection of personal data (“Data Breach“).
10.2
In the event of a Data Breach, Processor shall support User and to a reasonable extent in investigating the matter, taking remedial action, and notifying the appropriate parties, including measures required for compliance with legal obligations (e.g., Art. 33, 34 GDPR). In particular, Processor shall take all reasonable steps without undue delay to minimize or eliminate any risks for the integrity or confidentiality of User Data, to secure User Data, and to prevent or mitigate as much as possible any adverse consequences for data subjects. Processor shall provide no notifications in accordance with Art. 33 or 34 of the GDPR for User except upon prior written instruction by the User.
11. AUDIT RIGHTS OF USER
11.1
The Processor shall provide the User with appropriate information (e.g. certificates, audit reports and other results of inspections) to demonstrate compliance with the obligations set out in this DPA.
11.2
If the User has reasonable grounds to suspect that this information is insufficient to demonstrate compliance with the obligations set out in these DPA, the Processor shall facilitate, and support audits carried out by the User or another auditor commissioned by the User. Audits may be carried out by appointment (generally thirty days in advance) during normal business hours without disruption to the business of the Processor and in accordance with the safety rules of the Processor. Costs of any such audit shall be borne by User.
12. OBLIGATIONS OF PROCESSOR AFTER TERMINATION OF DPA
12.1
Processor is prohibited from actively processing User Data after this DPA has terminated unless it has a legal basis for processing. Processor will erase or hand over User Data to User after the termination of the DPA as requested by User, to the extent this is possible without infringing the Processor’s own statutory obligations or state law require storage of the Personal Data. Processor may decide to delete or anonymize the Personal Data to the extent possible, without violating its own legal obligations that require the storage of Personal Data. On the other hand, data that has been anonymized shall not be considered as personal data in the sense of the GDPR and the Processor can retain this data.
12.2
The provisions of sections 12.1 of this DPA shall also apply to copies of User Data (including, archiving and backup copies) in any systems of Processor, including test data and discarded data.
12.3
For each deletion and destruction of User data, the processor must prepare a written protocol, which must be presented to the User immediately upon request.
13. LIABILITY AND INDEMNIFICATION
13.1
The Party is responsible for all damages resulting from or related to its failure to fulfil its obligations under this DPA and/or the failure of persons/entities engaged/hired by that Party, including but not limited to employees and/or sub-processors.
13.2
The Party is obliged to compensate the other Party for damages in case of demands, fines and/or measures submitted against or imposed on the Party by third parties, including Data Subjects and the Commissioner due to violations of this DPA committed by the other Party, as well as by entities/persons engaged/hired by the other Party, including, but not limited to employees and/or sub-processors.
13.3
None of the Parties shall be liable for damages in any form (including penalties and fines, costs or other losses) suffered by the other Party, its employees or a third party to whom the other Party is liable in accordance with any legal relationship, unless the other Party proves that the damage is a direct consequence of gross negligence on the part of the first Party. In no event shall either Party be liable for any damages or lost profits arising in any way from this DPA. Therefore, lost profits or other damages based on lost future profits or lost benefits/savings will not be subject to compensation by either of the Parties. The Parties expressly release each other from all accusations or claims for damages from the above causes. If, for any reason, the liability of any of the Parties is declared by a final court decision, its liability will be limited by the amount of compensation that is equal to the paid fee. This limitation of liability shall not apply if either of the Parties proves that the damage is a direct consequence of the intent or gross negligence of the other Party.
14.TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
14.1
The Processor agrees that the potential transfer of the Personal Data to third countries may only be carried out to the countries which have been recognized by the European Union to ensure an adequate level of protection.
14.2
If the Processor wishes to transfer Personal Data to a country that is not covered in Article 14.1 of this DPA, data transfer is also free in this case, but the Processor is obliged to first fulfil the conditions for such a transfer in accordance with the GDPR, i.e ensure the implementation of adequate legal mechanisms for the transfer of data to countries that are not covered by Art. 14.1.
15. CONTRACT TERM, DURATION OF PROCESSING, AND TERMINATION
15.1
The term of this DPA shall correspond to the term of the Terms. If in doubt, any termination of the Terms shall also result in termination of this DPA, and any termination of this DPA shall also result in termination of the Terms.
16. FINAL PROVISION
16.1
Any modification, amendment, or termination of this DPA, including any modification or termination of this clause requiring written form, must be in written form.
16.2
Each of the parties will comply with the data protection laws applicable to its respective activities under this DPA, including the guidance (e.g., working papers) published by the EU Data Protection Board. Should any binding decision or order by a privacy regulator or court of competent jurisdiction or guidance by the EU Data Protection Board (or its successor) require changes to this DPA and/or the way in which Processor handles Personal Data hereunder, then the parties shall mutually implement such changes.
16.3
In the event of any conflicts between this DPA and other agreements between the parties, including, without limitation, the Terms, the provisions of this DPA shall prevail.
Schedule 1:
PURPOSE OF DATA PROCESSING, TYPE OF DATA AND CATEGORIES OF DATA SUBJECTS
Purpose of data processing, type of data and categories of data subjects are governed by the provisions of the Terms. They include inter alia the following:
- Categories of data subjects
- Individuals within the User being Brands, Buyers, Material Suppliers, Manufacturers, Sales Representatives, and others.
- Purpose of data processing
- Registration on the OM and the usage of the OM.
- Registration on the DSP and the usage of the DSP.
- Registration on the SH and the usage of the SH.
- Type of personal data
- Name;
- Last name;
- E-Mail adress;
- Phone number;
- Company;
- Company role;
- Country;
- City;
- Post code;
- Photo;
- Username;
- If necessary your personal e-mail address and your mobile phone number;
- Details of transactions you carry out and of the fulfilment of your orders, including licensing of software.
- Communication.
Schedule 2:
TECHNICAL AND ORGANIZATIONAL MEASURES
1. CONFIDENTIALITY
Physical access management
MEV is taking the following measures to prevent unauthorised persons from gaining access to the data processing equipment used to process personal data:
- Use of electronic access security system;
- Logging of each access via electronic access security system;
- Multilevel authorization concept: employees receive access rights individually based on their responsibilities;
- Cancellation of lost staff IDs as quickly as possible;
- Remote data wipe of lost staff endpoints (laptops) as quickly as possible;
- Keycards and two factor authentications;
- Special protection for IT system rooms;
- Visitor rules: visitors may access entire facility, including data processing facilities only in the company of authorized staff;
- Alarm system and security service;
- Video monitoring.
Access control
MEV is taking the following measures to prevent unauthorized parties from using data processing systems and procedures:
- Special, personalized authorization concept;
- Logging of each system access;
- Password protection, password storage using encrypted vault solutions, including password policy and enforcing a strong password and routine audit of passwords;
- Automatic screensaver mode during inactivity and timeout rules;
- All computers have the automatic screen lock function set to automatically activate upon fifteen (15) minutes of inactivity. Employees are not allowed to take any action which would override this setting.
- External access only via secure and encrypted VPN connections;
- Block all external removables (e.g. USB drives).
Data access management
MEV is taking the following measures to ensure that the persons authorised to use the data processing procedures have exclusive access to the personal data subject to their access authorisation and that unauthorised reading, copying, alteration or removal is excluded:
- Special, personalized authorization concept (“need-to-know basis”);
- Logging of each access (databases, file and customer systems);
- Areas with personal data to be encrypted on external media using defined software;
- Single-sign on;
- Only company-owned devices used;
- All data encrypted in transit (via Virtual Private Networks “VPN”) and at rest (O/S encryption such as Microsoft Windows bitlocker);
- No external drives allowed.
Data separation management
MEV is taking the following measures to ensure that data collected for different purposes will be processed separately:
- Functional separation: separation between testing systems and production systems;
- Access is granted based on roles and sensitivity;
- Compliance with recordkeeping obligations/periods and subsequent erasure of data that have been made available;
Pseudonymisation
The processing of personal data is carried out in such a way that the data can no longer be attributed to a specific data subject without the need for additional information, provided that this additional information is kept separately and is subject to appropriate technical and organisational measures.
Other measures include zero knowledge encryption.
2. INTEGRITY
Data transfer management
ME is taking the following measures to ensure that during electronic transfer, migration, or storage on data carriers personal data cannot be read, copied, modified or removed without authorization either in transit or at rest:
- Encryption of files and emails;
- Use of electronic signatures;
- Use of firewall;
- Use of secure connections by using virtual private network (VPN);
- Content filter;
- Antivirus protection (server and clients);
- Antispam protection.
Data input management
ME is taking the following measures to ensure that it can be reviewed and determined later on who inputed, modified, or removed data:
- Log files and logging (tracking, modification and removal of data);
- Audit capabilities established for the purpose of determinining unautorized access to systems or data repositories;
- Document management.
3. AVAILABILITY AND RESILIENCE
Availability management
ME is taking the following measures to ensure that personal data are protected against accidental destruction or loss:
- Regular data backup (daily backup of all relevant data);
- Constant use of virus scanners and firewalls with continuous updates (or servers and clients);
- Advanced Endpoint Anti Malware detection system with machine learning functionality deployed on all workstations and servers to provide continuous monitoring with real-time detection against all attack types, including zero-day attacks;
- Uninterrupted power supply;
- Fire safety measures;
- Adequate protection of server rooms (for example search protectors, air conditioning).
Fast recovery of data
ME is taking measures to ensure the fast recovery of systems after downtimes, so as to allow availability of personal data and access to personal data to be restored quickly after a physical or technical incident. There must be an emergency plan for fast recovery measures.
4. PROCEDURES FOR REGULAR TESTING, ASSESSMENT AND EVALUATION
Regular review, assessment and evaluation
ME is taking the following measures to verify on a regular basis that its technical and organizational measures for secure data processing are effective:
- Data protection management;
- Incident response management;
- Privacy by design;
- Privacy by default;
- Security once twice a year;
- Security testing twice a year;
- OWASP ZAP plugin with Jenkins;
- Applying OWASP reports re ME technology stack.
Contract compliance management
ME is taking measures to ensure that data will be processed only in accordance with Client’s instructions:
- Contract terms in compliance with data protection law;
- Data processing services rendered based on written contracts;
- Documentation of all contracts;
- Clear contract terms;
- Strict procedures for third party management;
- Careful selection of contract partners;
- Regular audits of contract partners.
5. RETENTION PERIOD/ERASURE PROCEDURE
The personal data is deleted after the execution of the services by the Processor for the specified processing operations.
If ME in the function of Processor and/or Sub-Processor carries out any action of processing of any personal data for its personal purposes intentionally or negligently, departing from the range of instructions received from the Controller, it is obliged to stop these actions and delete said personal data immediately. If ME still uses personal data for its own purpose, then it automatically becomes a controller in accordance with GDPR (General Data Protection regulation).
6. PERSONNEL AND ORGANIZATIONAL MEASURES
- Education of employees who have the possibility of insight in personal data; including cyber security awareness training to mitigate data loss risk.
- Third party management.