Updated 29.01.2019
1. Introduction
This personal data processing agreement (”Annex”) is an inseparable part of the agreement entered into between Open Badge Factory Oy (”Service Provider”) and its customer (”Customer”) concerning Open Badge Factory services (”Agreement”).
The purpose of this Annex is to agree on the privacy and data protection of the personal data of the Customer in the services of the Service Provider. This Annex constitutes a written agreement in accordance with the EU General Data Protection Regulation (679/2016) concerning the processing of personal data.
If the terms concerning the processing of personal data of the Annex and the Agreement are in conflict, the parties shall primarily apply the terms of this Annex.
2. Definition
In accordance with the EU General Data Protection Regulation, the terms below are defined as follows:
“controller” shall mean the Customer, who shall define the purposes and methods of personal data processing.
“processor” shall mean the Service Provider, who shall process personal data on behalf of the controller based on the Agreement.
“processing” shall mean any operation or set of operation which is performed on personal data or sets of personal data using automated means or manually, such as data collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“personal data” shall mean any information relating to an identified or identifiable natural person, hereafter ”data subject”; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“personal data breach” shall mean means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
3. Data protection and processing personal data
3.1 Obligations of the Service Provider and the Customer
The Service Provider shall process the personal data of the Customer on behalf of, and commissioned by the Customer, on the grounds of the Agreement. The personal data that the Service Provider processes may relate to, e.g. employees or customers. The Customer shall be the controller and the Service Provider shall be the processor of the data processed in the service. The parties undertake to abide by the current and in force legislation, decrees and authority orders and guidelines concerning personal data processing, and if necessary, to amend the terms of this annex to conform to them.
As controller, the Customer shall be liable that it has the necessary rights and consents in order to process personal data pursuant to the Agreement. The customer shall be responsible for drafting a record and keeping it available as well as informing the data subjects and notifications to the data protection authorities. The Customer is responsible for the validity of the personal data is has delivered to the Service Provider.
The Customer is entitled and obligated to define the purpose and methods of personal data processing. The subject, character and purpose of processing is defined in more detail in the Agreement. The types of personal data and sets of data subjects processed in the services have been defined in the Agreement.
The Service Provider is entitled to process the personal data and other data of the Customer only on the grounds of the Agreement, this Annex and according to the written guidelines of the Customer and only to the extent and in the manner it is necessary in order to provide services. The Service Provider shall notify the Customer if any conflict with the data protection legislation of EU or Finland is detected in the guidelines and in this case, the Service Provider may immediately decline and stop the application of the guidelines of the Customer.
The Service Provider shall maintain the service description or other record of the processing operations of the service required by the EU General Data Protection Regulation. The Service Provider is entitled to collect anonymous and statistic data of the use of the services pursuant to the Agreement, that does not specify the Customer nor data subjects and uses it for analysing and developing its services.
3.2 Deletion/return of data
After the expiry of the Agreement, the Service Provider shall return or delete, according to the guidelines of the Customer, all the personal data of the Customer and delete all duplicates, unless applicable legislation requires the retention of personal data.
3.3 Subcontractors
The Service Provider may use subcontractors for processing the Customer’s personal data. The Service Provider is responsible for its subcontractor’s actions as for its own and shall draft written agreements with the subcontractors concerning the processing of personal data. If requested, the Service Provider shall inform the Customer beforehand of subcontractors the Service Provider intends to use in processing the personal data pursuant to the Agreement. The Customer is entitled to oppose the use of a new subcontractor on reasonable grounds. If the Parties are unable to reach an agreement concerning the use of a new subcontractor, the Customer is entitled to terminate the Agreement with thirty (30) days’ notice, in so far as the change of subcontractor affects the processing of personal data pursuant to the Agreement.
3.4 Service Provider’s obligation to provide assistance
The Service Provider shall immediately forward all requests to inspect, rectify, erase or deny the processing of data or other requests received from the Data Subjects, to the Customer. It is the Customer’s duty to ensure a response to such requests. Taking into account the nature of the processing, the Service Provider shall help the Customer with appropriate technical and organisational measures, in order for the Customer to fulfil its duty to respond to the Data Subject’s requests.
The Service Provider is obligated, taking into account the nature of the processing of personal data and the data available, to assist the Customer in ensuring that the Customer complies with its legal obligations. These obligations may include data security, notifying of data breaches, data protection related effect assessments and obligations regarding prior consultations. The Service Provider is obligated to assist the Customer only to the extent that applicable legislation obligates the personal data processor. Unless otherwise agreed, the Service Provider is entitled to invoice the expenses incurred from action pursuant to this section 3.4 according to the Service Provider’s valid price list.
The Service Provider shall direct all inquiries of data protection authorities directly to the Customer, and the Service Provider shall not be authorized to represent the Customer, or act on behalf of the Customer with the data protection authorities supervising the Customer.
4. Processing outside of EU/EEA
The Service Provider and its subcontractors shall not process personal data outside the EU/EEA area without the written approval of the Customer.
The Parties shall agree in writing of all moving or processing personal data outside of the EU/EEA and that the standard contractual clauses approved by the European Union concerning the transferal of data outside of the EU/EEA shall apply.
5. Auditing
The Customer or an auditor authorized by the Customer (however, not a competitor of the Service Provider) is entitled to audit the activities pursuant to the Annex. The Parties shall agree on the time of the auditing and other details ahead of time and at latest 14 days before the inspection. The auditing shall be carried out in a way that does not harm the obligations of the Service Provider or its subcontractors in regard to third parties. The representatives of the Customer and the auditor must sign conventional non-disclosure commitments.
The Customer shall be responsible for its own and the Service Provider’s expenses caused by the auditing. If notable defects are perceived during auditing, the Service Provider shall be liable for the costs incurred from the auditing.
6. Data security
The Service Provider shall implement the appropriate technical and organisational measures to protect the personal data of the Customer, taking into account all the risks of processing, especially the unintentional or illegal destruction, loss, alteration, unauthorised disclosures or access to personal data that has been transferred, saved or otherwise processed. The technical options and their costs shall be taken into account in organising the security measures, in relation to the special risks of the processing at hand and the sensitivity of the personal data processed.
The Customer shall be obligated to ensure that the Service Provider is notified of all the circumstances concerning the personal data the Customer has delivered, such as risk assessments and the handing of special sets of data subjects that affect the technical and organisational measures pursuant to this Annex. The Service Provider shall ensure that the personnel of the Service Provider or a subcontractor of the Service Provider shall abide by the appropriate non-disclosure commitment.
7. Notifying of data breaches
The Service Provider must notify the Customer of all data breaches concerning Personal data without undue delay after receiving information of the breach or after a subcontractor of the Service Provider has received information of the breach.
If requested by the Customer, the Service Provider shall, without undue delay give the Customer all relevant information concerning the data breach. In so far as the information in question is available to the Service Provider, the Service Provider shall describe at least the following to the customer:
(a) the occurred data breach,
(b) if possible, the sets of data subjects and the number thereof, as well as the sets of personal data types and estimated numbers,
(c) a description of the likely consequences caused by the data breach, and
(d) a description of reparative measures, that the Service Provider has implemented or shall implement in order to prevent data breaches in the future, and if necessary, the measures to minimise the harmful effects of the data breach.
The Service Provider shall document and report the results of the inquiry and the implemented measures to the Customer.
The Customer shall be liable for the necessary notifications to the data protection authorities.
8. Other provisions
If any tangible or intangible damage is caused to a person due to a breach against the EU General Data Protection Regulation or the Annex, the Service Provider shall be liable for the damage only in so far that it has not explicitly abided by the obligations directed to personal data processors in the EU General Data Protection Regulation or this Annex.
Both parties are obligated to pay only the part of the damages or administrative fine that corresponds to the liability for damages confirmed in the final decision of a data protection authority or a court of law. Otherwise the liability of the parties shall be determined pursuant to the Agreement.
The Service Provider shall notify the Customer in writing of all changes that may affect its ability or chances to abide by this Annex and the written guidance of the Customer. The Parties shall agree on all additions and amendments to this Annex writing.
This Annex shall enter into force upon the Customer’s acceptance of the Agreement. The Annex shall remain in force (i) as long as the Agreement is in force or (ii) the parties have obligations concerning personal data processing activities towards one another.
Those obligation that due to their nature are meant to survive the expiry of this Annex shall remain in force after the expiry of the Annex.