GDPR information requirements
Assurance in accordance with Article 28(3) of the GDPR
to the client regarding the purchase, repair and maintenance of optical and ophthalmic equipment, workshop machinery, spare parts, consumables and services provided by
Leszek Fragstein
Optic-Handel
Carlo-Schmid-Str. 13
52146 Würselen
(nachfolgend Contractor)
1. General information
(1) The Contractor shall process personal data on behalf of the Client within the meaning of Article 4(8) and Article 28 of Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR). This unilateral undertaking by the Contractor governs the rights and obligations of the parties in connection with the processing of personal data. This undertaking shall apply from the date of receipt by the Client for the duration of the relevant main contract.
(2) Wherever the term ‘data processing’ or ‘processing’ (of data) is used in this undertaking, the definition of ‘processing’ within the meaning of Article 4(2) of the GDPR shall apply.
2. Scope of the assignment
The subject matter of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects are set out in Annex 1. The client’s instructions pursuant to Article 28(3), second sentence, of the GDPR are set out in the main contract.
3. Rights and obligations of the client
(1) The client is the controller within the meaning of Article 4(7) of the GDPR for the processing of data carried out on its behalf by the contractor. Pursuant to Clause 4(5), the Contractor is entitled to notify the Client if, in the Contractor’s opinion, the contract and/or an instruction involves data processing that is legally impermissible.
(2) The client, as the data controller, is responsible for safeguarding the rights of data subjects. The contractor shall inform the client without delay if data subjects exercise their rights vis-à-vis the contractor.
(3) The client has the right to issue supplementary instructions to the contractor at any time regarding the nature, scope and procedures of data processing. Instructions must be provided in writing (e.g. by email).
(4) Provisions regarding any compensation for additional costs incurred by the contractor as a result of supplementary instructions from the client remain unaffected.
(5) The Client may designate persons authorised to issue instructions in writing. In the event that the persons authorised to issue instructions on the Client’s behalf change, the Client shall also notify the Contractor of this in writing.
(6) The client shall inform the contractor without delay if it discovers any errors or irregularities in connection with the contractor’s processing of personal data.
(7) In the event that there is a duty to provide information to third parties under Articles 33 and 34 of the GDPR or any other statutory reporting obligation applicable to the client, the client shall be responsible for ensuring compliance with such obligations.
4. General obligations of the contractor
(1) The Contractor shall process personal data exclusively within the scope of the agreements entered into and/or in compliance with any supplementary instructions issued by the Client. This does not apply to statutory provisions which may oblige the Contractor to process data in any other way. In such a case, the Contractor shall inform the Client of these legal requirements prior to processing, provided that the relevant law does not prohibit such notification on the grounds of an important public interest. Otherwise, the purpose, nature and scope of data processing shall be governed exclusively by this contract and/or the Client’s instructions. The Contractor is prohibited from processing data in any manner deviating from this, unless the Client has given its written consent.
(2) The contractor undertakes to carry out data processing on behalf of the client only in Member States of the European Union (EU) or the European Economic Area (EEA).
(3) The contractor guarantees the contractual execution of all agreed measures in relation to the processing of personal data in accordance with the terms of the contract.
(4) The Contractor is obliged to organise its business and operational processes in such a way that the data it processes on behalf of the Client is secured to the extent necessary and protected against unauthorised access by third parties. The Contractor shall consult with the Client in advance regarding any changes to the organisation of data processing under this contract that are significant for data security.
(5) The Contractor shall inform the Client without delay if, in the Contractor’s opinion, an instruction issued by the Client contravenes statutory provisions. The Contractor is entitled to suspend the execution of the instruction in question until it has been confirmed or amended by the Client. If the Contractor can demonstrate that processing in accordance with the Client’s instructions may result in the Contractor being held liable under Article 82 of the GDPR, the Contractor shall be free to suspend further processing in this respect until liability between the parties has been clarified.
(6) The processing of data on behalf of the client outside the business premises of the contractor, the client or subcontractors is only permitted with the client’s consent in writing or in text form. The processing of data on behalf of the client in private homes is only permitted on a case-by-case basis with the client’s consent in writing or in text form.
(7) The contractor shall process the data it processes on behalf of the client separately from other data. Physical separation is not strictly required.
(8) The Contractor may designate to the Client the person(s) authorised to receive instructions from the Client. Where persons authorised to receive instructions are to be designated, these shall be listed in Annex 1. In the event that there is a change to the persons authorised to receive instructions at the Contractor’s end, the Contractor shall notify the Client of this in writing.
5. The contractor’s data protection officer
(1) The Contractor confirms that it has appointed a data protection officer in accordance with Article 37 of the GDPR. The Contractor shall ensure that the data protection officer possesses the necessary qualifications and expertise.
(2) Data Protection Officer:
Ireneusz Henzel
Carlo-Schmid-Str. 13
52146 Würselen
Tel.: 02405-40997-20
Fax: 02405-40997-29
Email: Henzel@optic-handel.de
6. The contractor’s reporting obligations
(1) The Contractor is obliged to notify the Client immediately of any breach of data protection regulations or of the contractual agreements made and/or the instructions issued by the Client, which has occurred in the course of data processing by the Contractor or by other persons involved in the processing. The same applies to any breach of the protection of personal data processed by the Contractor on behalf of the Client.
(2) Furthermore, the Contractor shall inform the Client without delay if a supervisory authority takes action against the Contractor pursuant to Article 58 of the GDPR and this may also relate to an audit of the processing carried out by the Contractor on behalf of the Client.
(3) The Contractor is aware that the Client may be subject to a duty to report under Articles 33 and 34 of the GDPR, which requires notification to the supervisory authority within 72 hours of becoming aware of the incident. The Contractor shall assist the Client in fulfilling these reporting obligations. In particular, the Contractor shall immediately notify the Client of any unauthorised access to personal data processed on the Client’s behalf, and at the latest within 48 hours Notify the client as soon as the access is known. The contractor’s notification to the client must, in particular, contain the following information:
• a description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned, the categories of personal data concerned and the approximate number of personal data records concerned;
• a description of the measures taken or proposed by the contractor to remedy the personal data breach and, where appropriate, measures to mitigate its possible adverse effects.
7. Obligations of the contractor to cooperate
(1) The Contractor shall assist the Client in fulfilling its obligation to respond to requests for the exercise of data subjects’ rights pursuant to Articles 12–23 of the GDPR. The provisions of Clause 11 of this undertaking shall apply.
(2) The contractor shall assist the client in drawing up the records of processing activities. The contractor shall provide the client with the necessary information in this regard in an appropriate manner.
(3) The contractor shall assist the client, taking into account the nature of the processing and the information available to them, in complying with the obligations set out in Articles 32–36 of the GDPR.
8. Supervisory powers
(1) The client shall have the right, at any time and to the extent necessary, to verify the contractor’s compliance with statutory data protection regulations and/or with the contractual provisions agreed between the parties and/or with the client’s instructions.
(2) The contractor is obliged to provide the client with information to the extent that this is necessary for the performance of the inspection within the meaning of paragraph 1.
(3) The client may request access to the data processed by the contractor on the client’s behalf, as well as to the data processing systems and programmes used.
(4) The client may, following prior notice given with reasonable notice, carry out the inspection referred to in paragraph 1 at the contractor’s premises during normal business hours. In doing so, the Client shall ensure that the inspections are carried out only to the extent necessary so as not to disproportionately disrupt the Contractor’s business operations.
(5) In the event of measures taken by the supervisory authority against the client within the meaning of Article 58 of the GDPR, the contractor is obliged, in particular with regard to obligations to provide information and allow inspections, to provide the Client with the necessary information and to enable the relevant supervisory authority to carry out an on-site inspection. The Client must be informed by the Contractor of any such planned measures.
9. Subcontracting arrangements
(1) The contractor may only engage subcontractors with the client’s prior written consent.
(2) The contractor must select the subcontractor with due care and verify, prior to awarding the contract, that the subcontractor is able to comply with the agreements made between the client and the contractor. In particular, the Contractor must verify, in advance and at regular intervals during the term of the contract, that the subcontractor has implemented the technical and organisational measures required under Article 32 of the GDPR for the protection of personal data. The Contractor must document the results of this verification and provide them to the Client upon request.
(3) The contractor is obliged to obtain confirmation from the subcontractor that the latter has appointed a data protection officer in accordance with Article 37 of the GDPR. In the event that no data protection officer has been appointed by the sub-contractor, the contractor must inform the client of this and provide information demonstrating that the sub-contractor is not legally obliged to appoint a data protection officer.
(4) The contractor must ensure that the provisions agreed in this undertaking and, where applicable, any supplementary instructions from the client also apply to the subcontractor.
(5) The contractor must enter into a data processing agreement with the sub-contractor that complies with the requirements of Article 28 of the GDPR. Furthermore, the Contractor must impose on the Sub-contractor the same obligations regarding the protection of personal data as those agreed between the Client and the Contractor. A copy of the data processing agreement must be provided to the Client upon request.
(6) The contractor is, in particular, obliged to ensure, through contractual provisions, that the powers of supervision (Clause 8 of this contract) of the client and of supervisory authorities also apply to the subcontractor, and that corresponding rights of supervision on the part of the client and supervisory authorities are agreed. It must also be stipulated in the contract that the subcontractor must tolerate these control measures and any on-site inspections.
(7) Services which the contractor obtains from third parties purely as ancillary services in order to carry out its business activities shall not be regarded as subcontracting relationships within the meaning of paragraphs 1 to 6. These include, for example, cleaning services, telecommunications services without any specific connection to the services the contractor provides for the client, postal and courier services, transport services and security services. The Contractor is nevertheless obliged, even in the case of ancillary services provided by third parties, to ensure that appropriate precautions and technical and organisational measures have been taken to guarantee the protection of personal data.
10. Confidentiality undertaking
(1) When processing data on behalf of the client, the contractor is obliged to maintain confidentiality regarding any data received or otherwise obtained in connection with the contract. The Contractor undertakes to observe the same confidentiality rules as those applicable to the Client. The Client is obliged to inform the Contractor of any specific confidentiality rules.
(2) The Contractor warrants that it is aware of the applicable data protection regulations and is familiar with their application. The Contractor further warrants that it has familiarised its employees with the data protection provisions applicable to them and has bound them to confidentiality. The Contractor further warrants that it has, in particular, bound the employees involved in carrying out the work to confidentiality and has informed them of the Client’s instructions.
(3) Evidence of the employees’ obligations under paragraph 2 must be provided to the client upon request.
11. Protection of data subjects’ rights
(1) The Client is solely responsible for safeguarding the rights of data subjects. The Contractor is obliged to assist the Client in fulfilling its duty to process requests from data subjects in accordance with Articles 12–23 of the GDPR. In particular, the Contractor must ensure that the necessary information in this regard is provided to the Client without delay, so that the Client can, in particular, fulfil its obligations under Article 12(3) of the GDPR.
(2) Insofar as the Contractor’s cooperation is required by the Client to safeguard the rights of data subjects – in particular the rights to access, rectification, restriction of processing or erasure – the Contractor shall take the necessary measures in accordance with the Client’s instructions. The Contractor shall, where possible, support the Client with appropriate technical and organisational measures in fulfilling its obligation to respond to requests for the exercise of data subjects’ rights.
(3) Provisions regarding any compensation for additional costs incurred by the contractor as a result of assisting the client in exercising data subjects’ rights remain unaffected.
12. Confidentiality obligations
(1) The Contractor undertakes to treat all information received in connection with the performance of the data processing as confidential for an indefinite period and to use it solely for the performance of the main contract. Neither party is authorised to use this information, in whole or in part, for purposes other than those specified above, or to make this information available to third parties.
(2) The above obligation shall not apply to information which either party can prove to have received from third parties without being bound by a duty of confidentiality, or which is in the public domain.
13. Remuneration
The contractor’s remuneration is generally determined by the main contract. Should any additional costs arise as a result of the obligations undertaken here, these shall be borne by the client.
14. Technical and organisational measures for data security
(1) The Contractor undertakes to the Client to comply with the technical and organisational measures necessary to ensure compliance with the applicable data protection regulations. This includes, in particular, the requirements set out in Article 32 of the GDPR.
(2) The parties agree that changes to the technical and organisational measures may be necessary to adapt to technical and legal circumstances. The Contractor shall consult with the Client in advance regarding any significant changes that could compromise the integrity, confidentiality or availability of personal data. Measures that entail only minor technical or organisational changes and do not adversely affect the integrity, confidentiality or availability of personal data may be implemented by the Contractor without consultation with the Client. The Client may at any time request an up-to-date version of the technical and organisational measures implemented by the Contractor.
(3) The Contractor shall regularly, and also as and when necessary, monitor the effectiveness of the technical and organisational measures it has implemented. Should there be a need for optimisation and/or changes, the Contractor shall inform the Client.
15. Duration of the contract
The duration of the contract is determined by the main contract. The client may terminate the contract at any time without notice if the contractor commits a serious breach of the applicable data protection regulations or of obligations arising from this undertaking, the contractor is unable or unwilling to comply with a data protection instruction from the client, or the contractor refuses access to the client or the competent supervisory authority in breach of the contract.
16. Termination
(1) Upon termination of the main contract, the contractor shall, at the client’s discretion, either return to the client or delete all documents, data and results of processing or use that have come into the contractor’s possession and are related to the contractual relationship. The deletion must be documented in an appropriate manner. Any statutory retention obligations or other obligations to store the data remain unaffected. In the case of data storage media, these must be destroyed if the Client requests their deletion, whereby at least security level 3 of DIN 66399 must be complied with; proof of destruction must be provided to the Client, specifying the security level in accordance with DIN 66399. Any costs arising from this shall be borne by the client.
(2) The client has the right to verify that the contractor has returned and deleted the data in full and in accordance with the contract. This may also be carried out by inspecting the data processing facilities at the contractor’s premises. The Client shall give reasonable notice of any on-site inspection.
(3) Should the Client’s property held by the Contractor be jeopardised by actions of third parties (such as attachment or seizure), by insolvency proceedings or by other events, the Contractor must inform the Client without delay. The contractor shall immediately inform the creditors that the data in question is being processed on behalf of the client.
Appendix 1 – Scope of the contract
1. Subject matter and purpose of the processing
The client’s commission to the contractor comprises the following work and/or services:
• Supply of optical and ophthalmic instruments, workshop machinery, spare parts and consumables
• On-site and telephone repair, maintenance and customer service
2. Type(s) of personal data
The following categories of data are regularly processed or may be subject to processing where applicable:
• IP addresses
• Client’s user, supplier and customer data
o Name, addresses,
o Bank details,
o Email addresses,
o Telephone numbers
• System data (log data)
3. Categories of data subjects
Group of data subjects affected by the data processing:
• Employees of the client
• The client’s customers and their contact persons
• Other service providers for the client
• Other third parties