Data Processing Agreement ("DPA") for Business Driver
Warning: this content has been automatically translated from the Italian language. In case of conflict between this version and the original version, the Italian version will take effect.
in compliance with art.26 of the GDPR
Effective from March 17th, 2020 (the "Effective Date")
Between the person indicated in the contract ("Customer") and Digital Solution Srl, head office in Rome, Via Archimede, 207 VAT number / Tax Code: IT13873451002 ("Digital Solution")
hereinafter individually the "Party" and jointly the "Parties".
The Customer has signed a Contract with Digital Solution for the use of Business Driver, a cloud application provided in SaaS mode. This Agreement forms an integral part of this Agreement.
Business Driver allows the Customer and its Users to insert information and IT documents into the Digital Solution Cloud Infrastructure. To the extent that this information contains Personal Data, the Parties expressly agree to the application of this DPA on Shared Responsibility, in cases where both share the roles and responsibilities of a Data Controller as follows:
- The customer (i) defines the purposes of the processing of personal data, (ii) is responsible for the accuracy of the personal data, (iii) has the responsibility to inform the interested parties about the processing of personal data and the methods for the exercise of their rights, and (iv) if necessary, is responsible for making notifications (including those for Data Protection Violation) to the data protection authorities.
- Digital Solution (i) defines the means of the Treatment and (ii) is responsible for the implementation of the security measures.
These roles and responsibilities are described in more detail in Article 4 below (Roles and responsibilities).
This DPA applies to all activities carried out by Digital Solution in the context of the Services and prevails over any other agreement for the processing of existing data or similar agreement between Digital Solution and the Customer already existing for these Services.
The Customer acknowledges having received all the information he deems necessary to establish that Digital Solution provides sufficient guarantees for the protection of Personal Data.
- Definitions
In addition to the terms defined in other parts of the General Conditions, the following definitions apply:
1.1 By " Applicable data protection law ": means the laws and regulations concerning the processing and protection of personal data applicable in the country in which Digital Solution has its headquarters. In particular, applicable law means (a) EU Regulation 2016/679 (General data protection regulation,
'GDPR') (b) the laws or regulations of the Member State in relation to the processing and protection of personal data in implementation or integration of the GDPR; and (c) any other applicable laws or regulations regarding the processing and protection of Personal Data for the purposes of this Agreement.
1.2 " Data Protection Violation " indicates a breach of security that leads to the destruction, loss, alteration or unauthorized or illegal disclosure of personal data processed for the purposes of this DPA.
1.3 " Personal Data " indicate any information concerning an identified or identifiable natural person (" Data Subject "); an identifiable person is a person who can be identified, directly or indirectly, with particular reference to an identification number or to one or more characteristic elements of his physical, physiological, psychic, economic, cultural or social identity.
With 1.4 "Treatment" or "treats" means any operation or set of operations performed on personal data, with or without automatic means, such as collection, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, diffusion or any other form of making available, alignment or combination, limitation, cancellation or destruction.
1.5 " Data Controller " means the natural or legal person who, individually or together with others, determines the purposes and means of the processing of personal data.
- Categories of Personal Data pursuant to this DPA:
The following categories of Personal Data are normally collected and processed by Digital Solution to carry out the Services pursuant to the General Conditions:
- Profile data: Personal data of Business Driver users in particular, username, password, e-mail address and access rights;
- Activity data: Personal data obtained from the use of the Business Driver by the User;
- Transient and session data: Personal data that is not stored on the Business Driver (such as presence or position information) or that is linked to a login session (e.g. IP addresses).
The following categories of personal data are excluded from this DPA:
- Personal data of third parties that Business Driver Users can enter through text posts, uploading IT documents or files.
- Categories of interested parties pursuant to this DPA:
In the context of this DPA, the processing of personal data concerns the following categories of data subjects:
- Tenancy users in Customer's Business Driver Tenancy,
- Cross-Tenancy users with access to Customer's Business Driver Tenancy (only for Activity Data kept in Customer's Cloud Services Tenancy).
- Roles and responsibilities of the Customer and Digital Solution
4 . 1 Role and responsibility of the Customer:
4.1.1 Purpose and legality of the processing : The customer will be responsible for defining the purpose of the processing of personal data, the legitimacy of the transfer of personal data to Digital Solution and the legitimacy of the data processing. The Customer will fulfill and ensure that its associated companies and collaborators fulfill all their obligations under the Data Protection Regulation during the processing of Personal Data in relation to cloud services. In this regard, the Customer will guarantee, in particular, that he has obtained and maintains all the necessary records and authorizations with the competent data protection authorities and the valid legal bases for processing Personal Data.
4.1.2 Exercise of their rights by the interested parties : the customer will be the main contact for the interested parties for the exercise of their rights as established by the applicable data protection legislation.
4.1.3 Accuracy, quality, legality and reliability of personal data : the customer will be solely responsible for the accuracy, quality, legality and reliability of personal data and the means by which it acquires personal data for processing by by Digital Solution.
4.1.4 Risk assessment : The customer will be responsible for assessing the risks arising from the processing of personal data.
4.1.5 Treatment Registers : To the extent required by applicable law, the Customer will be responsible for preparing and maintaining the Treatment Registers of the activities. Digital Solution will make the respective information available in the "Information on the processing of personal data for users".
4.1.6 Information to interested parties: the customer will be responsible for providing information to interested parties in relation to the processing of personal data based on the provisions of the applicable data protection legislation.
4.1.7 Information on the Distribution of Responsibilities to the Data Subjects : The Customer is responsible for informing the Data Subject about the division of responsibilities between the contracting parties as indicated in this DPA.
4.1.8 Notification of Data Protection Violation : The Customer is obliged to fulfill the obligations of notification of the violation of data deriving from the applicable data protection requirements. When it is the applicable data protection law that imposes it, the Customer is responsible for the notification of the violation of the protection of personal data to the Data Subjects and to the Data Protection Authorities.
4.1.9 Changes to applicable Legislation : The Customer is obliged to communicate to Digital Solution, within the terms provided, the changes to the legal provisions which may affect the contractual obligations of Digital Solution pursuant to this DPA and which may require the modification of the DPA and the agreed consideration. Digital Solution also has the right to present proposals to the Customer if it deems it necessary to introduce a specific change in order to continue acting in compliance with the applicable law.
4.1.10 Irregularities or errors in the processing of personal data : The customer is required to inform Digital Solution in a timely and comprehensive manner about any errors or irregularities, of which he should become aware, which concern the data protection legislation on the Personal data processing.
4.1.11 Notification to Recipients of Personal Data regarding the rectification, cancellation of Personal Data or limitation of Treatment: Digital Solution discloses Personal Data exclusively for the Treatment necessary for the provision of Business Drivers (see article 8) . To the extent that the Customer discloses Personal Data to a recipient e.g. by aggregating Business Driver with other cloud services for the transmission of Personal Data through programming interfaces (API), the Customer is required to inform the recipients in question about the requests of the interested parties for the rectification or cancellation of personal data disclosed or regarding a limitation of treatment.
4.1.12 Disclosure of Personal Data : Digital Solution discloses Personal Data only to the recipients for which it is required to do so for processing purposes. For more information, see the "Information on the processing of personal data for users". Some Business Driver features allow customers and users to disclose Personal Data to third parties. To the extent that the Customer or its users use these functions, the Customer has the responsibility to inform the interested parties (article 4.1.6) and to insert the use in question in the Treatment Registers (point 4.1.5).
4 . 2 Role and responsibility of Digital Solution
4.2.1 Means of Treatment : Digital Solution will be responsible for defining the means of Treatment and, with reference to points 4.1.5 and 4.1.6, to provide information on these means to the Customer, specifically to allow the Customer to complete the Treatment Registers and to inform Data Subjects as provided by the applicable data protection legislation. The "Treatment Information" is available in the "Information on the processing of personal data for users".
4.2.2 Scope of Treatment by Digital Solution : Digital Solution can collect and process Personal Data only in the context of this DPA and of the General Conditions applicable to Business Driver and to improve and upgrade these services. Substantial changes affecting the scope of data processing must be established by mutual agreement and must be documented. By virtue of this DPA, Digital Solution expressly recognizes that it will process Personal Data only to provide Business Drivers, to improve them and upgrade them.
4.2.3 Implementation of security measures : Digital Solution will be responsible for the implementation of security measures for the processing of personal data in the context of Business Driver. Digital Solution will adopt the appropriate technical and organizational measures, as indicated in the attachment of the same name, developed to protect the Customer's personal data from misuse and loss, or from any other violation of data protection in accordance with the applicable legislation on the protection of data. The Customer is aware of the fact that technical and organizational measures are subject to technical progress and further developments. In this regard, Digital Solution may use suitable alternative measures, informing customers by making available, upon request, a description of the measures in question.
4.2.4 Information to interested parties on the division of responsibilities of the Parties : Digital Solution is responsible for making the standard DPA document accessible without modification to all Business Driver Users. If the DPA contains changes with respect to the standard DPA document requested by the Customer, Digital Solution is in no way responsible for making these changes accessible to the interested parties.
4.2.5 Notification of Data Protection Violation : With reference to point 4.1.8, in case of Data Protection Violation, Digital Solution will assist the Customer and will make available all the necessary information to which it has access to allow the Customer to fulfill its obligations. Digital Solution will inform the Customer without undue delay in relation to any breaches of Customer's Personal Data detected by Digital Solution.
4.2.6 Retention of Personal Data / Limitations for deletion : As a general rule , Personal Data processed by Digital Solution are kept until a) they are deleted by the Customer or Business Driver Users, or b) upon expiry of the storage indicated by the Customer, or c) the termination of the agreement for the Customer's cloud services on Business Driver.
4.2.7 Cancellation of Personal Data and export upon termination of the Business Driver Agreement : Digital Solution will be responsible for deleting all data entered by the Customer and Business Driver Users ("Tenancy Data") including Personal Data at the end of the calendar month following the expiration or cessation of the use by the Customer of Business Driver or, at the Customer's request, at any time. Upon request by the Customer, Digital Solution will provide an export of Tenancy Data in a data format that can be processed by the Customer for transfer to other cloud services.
4.2.8 Exercise of their rights by the interested parties : In the event that Digital Solution receives a request from an interested party for the exercise of the rights in accordance with the provisions of the applicable data protection legislation, Digital Solution is required to forward this request to the Customer who, without undue delay, will provide you with information on how to proceed. The Customer acknowledges that in the event of a conflict between the Data Subject and the Customer, the applicable legislation may compel Digital Solution to satisfy the Data Subject's request despite opposition from the Customer. In any case, the adoption of this measure by Digital Solution would take place only after a careful evaluation of the legal situation with the Customer.
4.2.9 Effects of the Cancellation of Personal Data : With this agreement the Customer confirms and recognizes that if the Customer is asked to cancel the Personal Data or to limit its Treatment, this could make it impossible to provide the products or services subscribed or provided. Digital Solution will notify the Customer before making the request.
4.2.10 Back-up copies of Personal Data : Digital Solution will make back-up copies of Personal Data to the extent that they are necessary to guarantee the correct processing of Personal Data. Digital Solution can copy and keep the Personal Data necessary to allow the Customer and Digital Solution to fulfill the legal retention obligations of documents.
4.2.11 Data Protection Officer : Digital Solution is required to make the contact data of its Data Protection Officer (DPO) available on the Internet. On the date of entry into force of this DPA, the contact details of the DPO are [email protected]
- Mutual responsibilities and agreements
5.1 The Parties agree that any requests relating to Personal Data made by the Customer will be presented in written and explicit form. In the event that a modification of the services is required for such requests, this modification will be renegotiated in good faith by the parties, together with the relative price.
5.2 Each Party will ensure that its staff is legally bound to comply with data protection obligations and to maintain data confidentiality and that it is aware of other applicable provisions for the protection of Personal Data, in particular with reference to the secrecy of the telecommunications. The obligation to keep data confidential continues for the staff once the job or employment contract is concluded.
5.3 If Digital Solution is deemed to satisfy the customer's requests, it may result in a violation of the applicable data protection legislation, and must promptly notify the customer. Digital Solution will have the right to suspend the implementation of this request until the Customer confirms or modifies it.
5.4 By virtue of this DPA, the Parties recognize that the security measures referred to in the Annex - "Technical and Organizational Measures" provide sufficient guarantees for the Personal Data Processed. The Customer is aware that the technical and organizational measures are subject to progress technical and further developments In this regard, Digital Solution may adopt appropriate alternative measures.
5.5 In the event that the Customer's Personal Data are subject to search and seizure, an attachment order, confiscation during bankruptcy or insolvency proceedings, or to events or similar measures by third parties, if permitted by law, Digital Solution is required to inform the customer without undue delay. In turn, without undue delay, Digital Solution will communicate to all parties involved in this action that the Personal Data affected by the measures in question are the exclusive property of the Customer and it is the same that dispose of them exclusively, and that it is the Customer who be responsible in accordance with applicable data protection law.
- Requests from supervisory authorities
6.1 In the cases provided for by law, both Parties will keep the documents relating to the Personal Data processed for the purposes of this DPA, will collaborate and provide all the information necessary for the fulfillment of the aforementioned obligations and the notification obligation pursuant to the Law applicable in data protection.
6.2 In cases where Digital Solution must provide assistance to the Customer to fulfill the legal obligations of the latter in accordance with the provisions of this article 6, the Customer will reimburse Digital Solution for any further reasonable costs related to the assistance provided.
- Control rights
7.1 No more than once a year and with a written request sent at least sixty (60) days before, each Party will have the right to carry out a check to verify compliance with the provisions contained in this DPA, verifying the technical and organizational measures implemented by the part that is subject to control. Evidence to demonstrate the implementation of these measures which are not related exclusively to this specific DPA or the Agreement can also be provided by presenting a current certificate, reports or extracts from reports drawn up by independent third parties, e.g. by official auditors, by auditors, by one or more internal or external data protection officers of the Party under control, by the IT security office, by internal and external privacy auditors, by quality auditors, or by presenting an appropriate certificate issued after the verification carried out by a third party on data protection or IT security of the party under control.
7.2 Each party reserves the right to refuse to provide the other Party with industrial or business secrets, operational know-how and information whose control would constitute a risk to the security of the Party under control or its customers, or that the Party subject the control is not required to provide or disclose, being data protected by law or data of other customers.
- Sub-managers
8.1 By virtue of this DPA, the Customer acknowledges and accepts that Digital Solution may hire subcontractors for the supply of Business Drivers. These subcontractors can be companies of the Digital Solution Group "Internal subcontractors") or third party subcontractors ("External subcontractors").
8.2 In the event that Digital Solution intends to hire a new external subcontractor that is not included in the list of approved subcontractors on the date of entry into force of this DPA, points 9.2 and 9.3 will be applied. For the avoidance of doubt, it is expressly agreed that internal subcontractors are excluded from this provision and the customer is deemed not to object to the use of internal subcontractors.
8.3 Transfers of Personal Data to third countries or countries:
8.3.1 By virtue of this DPA, the Customer acknowledges and expressly accepts that Personal Data may be transferred and / or processed by external Subcontractors as indicated in the previous point 8.1 including the case in which these external Subcontractors are outside the Space European Economic (EEA).
8.3.2 In cases where Digital Solution transfers Personal Data to an external Subcontractor, outside the EEA, with this DPA, the Customer expressly grants Digital Solution a mandate to enter into any agreement to ensure that the receiving party implements a sufficient level of protection for Personal Data recognized as adequate by the competent local or European authorities.
- Changes to this DPA
9.1 The Customer acknowledges that the conditions set out in this DPA and in the "Technical and Organizational Measures" can be changed by Digital Solution. A modification requires the consent of the Customer if a) it concerns the division of responsibilities between the contracting parties, or b) limits the rights of the Customer, or c) requests consent in accordance with the provisions of the applicable Data Protection Legislation. In other cases it is only necessary that the customer is informed of the change.
9.2 In the event of a change for which the Customer's consent must be obtained, Digital Solution will notify the Customer of the change by e-mail to the Business Driver Tenant Administrator and will make the relevant information available to the Customer so that he can consult at least thirty ( 30) calendar days before the date on which the change takes effect. Digital Solution will offer the Customer the opportunity to express his consent or to object. If Digital Solution does not receive any objection from the Customer after the response period indicated in the modification communication, which must be at least ten (10) calendar days from the communication date, the Customer's consent will be considered granted. In emergency situations, a reduction in reporting and response periods is possible.
9.3 The Customer will not oppose a modification without providing Digital Solution with a detailed written explanation of the reasons for this opposition. Digital Solution will make every reasonable effort, from a commercial point of view, to provide explanations regarding the concerns expressed by the Customer. The Parties will cooperate in good faith to reach an agreement. If this is not possible, the contracted services will cease.
- Responsibility
10.1 Digital Solution and the Customer will fulfill their respective obligations as indicated in this DPA and by the applicable data protection law.
10.2 The Customer will be fully responsible in case of non-fulfillment of the obligations referred to in the previous point 4.1 and of those indicated in the previous article 5.
10.3 Digital Solution will be totally responsible in case of non-fulfillment of the obligations referred to in the previous point 4.2 and of those indicated in the previous article 5, without prejudice to any Customer's liability.
10.4 The defaulting Party will be exonerated from any liability if it proves to be totally unrelated to the circumstance that caused the damage.
10.5 In cases where the Customer and Digital Solution are responsible for any damage caused in violation of a fulfillment provided for by this DPA, each Party will be held responsible for the entire damage to guarantee the effective compensation of the interested party. The Party that has taken full responsibility for the compensation for the damage suffered will have the right to request the other party involved for the compensation that corresponds to its part of responsibility for the damage in question.
- General provisions
11.1 If a single provision of the DPA is illegal, worthless, null, voidable or unenforceable, the rest of the DPA will continue to have full validity and effectiveness. The Parties will agree on an effective provision that reflects, as far as legally possible, the intentions of the Parties as precisely as possible.