This agreement (the “Data Processing Agreement”) is subject to the terms of the Agreement. It is annexed as a schedule to the Agreement between the Client and Starred, and sets out the arrangements governing the processing of personal data. All of the definitions described in the Starred terms (“Terms & Conditions”) have the same meaning in this Data Processing Agreement (singular and plural).
- The Client has various personal data;
- for the purposes of this agreement, personal data shall mean personal data as referred to in Article 1 (a) of the Dutch personal Data Protection Act (Wet bescherming persoonsgegevens, “Wbp”);
- the Client requires a certain form of processing by Starred in order to execute the Agreement;
- the Client shall allocate resources in this respect and subject to the conditions set out herein;
- Starred is in a position to do this and will comply with the conditions governing safety and other aspects of the Wbp in so far it is capable of doing so;
- The Client may be deemed responsible pursuant to Article 1 (d) of the Wbp;
- Starred can be considered as a processor in accordance with Article 1 (e) of the Wbp;
- having regard to the requirements provided in Article 14, section 5 of the Wbp, the Parties wish to agree in writing their rights and obligations as set out in this Data Processing Agreement.
NOW IT IS HEREBY AGREED
Article 1. Purposes of processing
- Starred undertakes to comply with the conditions laid down in this Data Processing Agreement to process personal data on behalf of the Client. Processing shall only be done in the context of the Agreement and in the execution of the Service.
- Starred shall not use these personal data for any purpose other than as specified by the Client and as outlined in section 3. The Client shall notify Starred of the purposes of the processing if not already stated in the Agreement.
- Starred may use personal data for its own statistical and/or quality purposes and also for purposes of researching the quality of its own services. Starred may also use data in an aggregated, non-traceable form for its own purposes.
- The personal data processed by Starred on behalf of the Client will remain the property of the Client and/or the persons concerned.
- The Client confirms that the processing of personal data is covered by one of the exemptions of the Wbp and, if that is not the case, the Client will have duly notified the Data Protection Authority (“College Bescherming Persoonsgegevens”). If applicable, the Client shall make sure to be compliant with the local (privacy) regulator. The Client shall indemnify Starred in the event of any claims arising in connection with a failure or part-failure to comply with demands or notifications.
Article 2. Obligations of the processor
- In regard to the processing referred to in Article 1, Starred shall be responsible for complying with the applicable laws and regulations, including the laws and regulations governing the protection of personal data, such as the Data Protection Act (“Wet bescherming persoonsgegevens”).
- Starred shall notify the Client on request in regard to the measures taken in compliance with its obligations under this Data Processing Agreement.
- The obligations of Starred arising from this Data Processing Agreement also apply to anyone processing personal data under the authority of Starred, including but not limited to employees, in the broadest sense.
Article 3. Transfer of personal data
- Starred may process the personal data in countries within the European Union. Transfer to countries outside of the European Union is prohibited, unless appropriate measures are taken.
Article 4. Division of responsibility
- The approved processing shall be executed under the control of Starred by fully automated means.
- Starred shall only be responsible for the processing of personal data under this Data Processing Agreement in accordance with the instructions received from the Client and under the explicit (ultimate) responsibility of the Client. No liability whatsoever will attach to Starred in the case of all other personal data processing, including but not limited to the collection of personal data by the Client and processing for purposes of which Starred was not informed by the Client, processing by third parties and/or for other purposes.
- The Client warrants that the content, usage and instructions for the processing of the personal data as intended in this Data Processing Agreement are not unlawful and do not in any way infringe any third party rights.
Article 5. Subprocessors
- Some of Starred’s obligations under the Agreement may be performed by third parties in the absence of the Client’s prior consent.
- Starred shall ensure that these third parties comply unconditionally with the same duties agreed between the Client and Starred. Starred shall be responsible for demanding proper compliance with these obligations from these third parties. The Client has the right to inspect agreements entered into in this regard.
- Starred will keep the Client informed on an ongoing basis, if requested specifically, in relation to third parties involved in the execution of this Agreement.
Article 6. Security
- Starred shall make sure that adequate technical and organizational measures are in place for the processing of personal data, in order to prevent the loss thereof and to prevent any form of unlawful processing (such as unauthorized access, impairment, modification, or transfer of personal data).
- Starred does not warrant that security will be effective under all circumstances. If an explicitly described security in this Data Processing Agreement is absent, Starred shall make every effort to ensure that the protection will be at a level that is reasonably acceptable, having regard to the state of technology, the sensitivity of the personal data and the costs involved in making the security arrangements.
- The Client shall only make personal data available to Starred for processing, provided always that the Client has ensured that the necessary security measures have been taken, in so far as this is within the power of the Client.
Article 7. Reporting obligations
- In the event of a security and/or data breach, Starred shall notify the Client hereof. The Client shall determine whether or not to inform the person(s) concerned, and will be responsible for that choice.
- A notification should only be given in the case of exceptional occurrences that have a serious impact, and only when such an occurrence has actually taken place.
Article 8. Dealing with requests from an interested party
- If an interested party files an inspection request, as stated in Article 35 of the Data Protection Act (“Wbp”), or requests an improvement to the Processor or an addition, modification or blocking, as stated in Article 36 of the Data Protection Act (“Wbp”), Starred shall forward the request to the Client, whereupon the Client shall deal with the request. Starred may notify the interested party hereof.
Article 9. Confidentiality
- The personal data which Starred receives and/or collects from the Client in regard to this Data Processing Agreement must not be disclosed to third parties.
- This duty of nondisclosure will not apply if the Client gives explicit permission to pass on the information to third parties, where such disclosure of information to third parties is in fact necessary owing to the nature of the work commissioned and the execution of this Data Processing Agreement, or in case of a legal prerequisite to disclose the information to a third party.
Article 10. Duration and Termination
- This Data Processing Agreement Data Processing Agreement will be concluded upon signature by the Parties, and on the date of the last signature.
- This Data Processing Agreement is hereby concluded for an indefinite period of time. No notice period applies. Termination of the Agreement simultaneously terminates this Data Processing Agreement.
- As soon as the Data Processing Agreement is terminated, for whatsoever reason and in whatever manner, Starred shall destroy and/or delete all personal data in its possession plus any potential copies thereof. Starred has the right to charge costs for destroying/deleting the personal data.
- This Data Processing Agreement may be modified in the same way as the Agreement.
- Logs and measurements executed by Starred count as compelling evidence, unless evidence to the contrary can be offered by the Client.