This agreement establishes the rights and obligations that apply when the data processor processes personal data on behalf of the data controller.
The agreement is designed to ensure compliance with Article 28(3) of the European Parliament and Council Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), which sets specific requirements for the content of a data processing agreement.
The data processor's processing of personal data is carried out for the purpose of fulfilling the parties' "main agreement" as a user of Park Rabbit, which is entered into on the user creation date.
The data controller is primarily responsible to the outside world (including the data subject) for ensuring that the processing of personal data takes place within the framework of the General Data Protection Regulation and the Data Protection Act.
The data controller therefore has both the rights and obligations to make decisions about the purposes and means of processing.
The data processor may only process personal data according to documented instructions from the data controller, unless required by EU law or the national law of the member states to which the data processor is subject. In such cases, the data processor shall inform the data controller of this legal requirement before processing, unless the law prohibits such notification for important reasons of public interest.
The data processor ensures that only persons who are currently authorized have access to the personal data processed on behalf of the data controller. Access to the information must therefore be immediately shut down if the authorization is revoked or expires.
The data processor implements all measures required under Article 32 of the General Data Protection Regulation, which states that appropriate technical and organizational measures must be implemented to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.
The data processor shall notify the data controller without undue delay after becoming aware of a personal data breach at the data processor or any sub-processor.
Upon termination of the services regarding processing, the data processor is obliged to delete or return all personal data to the data controller, and to delete existing copies, unless EU law or national law requires storage of the personal data.
The data processor shall make available to the data controller all information necessary to demonstrate compliance with Article 28 of the General Data Protection Regulation and this agreement, and shall allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.
The data processor shall not engage another processor without prior specific or general written authorization from the data controller. In the case of general written authorization, the data processor shall inform the data controller of any intended changes concerning the addition or replacement of other processors, thereby giving the data controller the opportunity to object to such changes.
Any transfer of personal data to countries outside the EU/EEA shall only take place if the specific conditions of the General Data Protection Regulation are met.
This agreement enters into force upon signature by both parties. The agreement can be renegotiated by both parties if changes in legislation or inexpediencies in the agreement give rise to this.
Download our app today and start sharing parking spots with your community.
Download Now