Data Proceesing PTV Drive&Arrive
Total Page:16
File Type:pdf, Size:1020Kb
Data Processing Contract PTV Drive&Arrive PTV Planung Transport Verkehr AG, Hauptsitz / Headquarters: Karlsruhe, Vorstand / Executive Board: Christian U. Haas (CEO), Dr. Peter Overmann, Vorsitzender des Aufsichtsrates / Chairman of the Supervisory Board: Lutz Meschke, Handelsregister / Commercial Register (HRB-Nr): 109262, Ust-ID-Nr. / VAT ID No. DE 812 666 053, Amtsgericht / Local Court: Mannheim. Data Processing PTV Drive&Arrive Contents Contents 1 Definitions of Terms ..................................................................................... 4 2 Subject, duration and terms of reference for the order ............................. 4 3 Technical organisational protective measures put in place by the Contractor ..................................................................................................... 5 4 Authority of the Client to give instructions ................................................ 6 5 Quality assurance and other obligations of the Contractor ...................... 7 6 Use of subcontractors ................................................................................. 8 7 Control rights of the Client .......................................................................... 8 8 Notification in case of Contractor breaches ............................................... 9 9 Queries and rights of data subjects ............................................................ 9 10 Deletion and restoration of personal data ................................................ 10 11 Liability ....................................................................................................... 10 12 Final Provisions.......................................................................................... 10 Appendix 1 - General technical and organisational measures......................... 12 Appendix 2 - Persons authorised to give instructions ..................................... 15 Appendix 3 - Approved subcontractors ............................................................. 16 Shorttitle Data Processing PTV Drive&Arrive Version of contract template: 1.1.1 from 2021-08-24 PTV AG Page 2/16 Data Processing PTV Drive&Arrive Contents Contract between the Client (Controller): name - Hereinafter referred to as: address1_line1 Controller- address1_postalcode, address1_city, address1_country Contact person: Firstname lastname Tel.: telephone1 E-Mail: emailaddress1 and the Contractor (Processor): PTV Planung Transport Verkehr AG - Hereinafter: Processor - Haid-und-Neu-Straße 15 76131 Karlsruhe, Germany Contact person: Fristname Lastname Tel.: +49 721 9651- xxx Email: [email protected] PTV AG Page 3/16 This appendix provides more detail on the data protection obligations of the parties to the contract resulting from order processing as per Article 28 of the General Data Protection Regulation (GDPR). It applies to all activities connected to the contract and which involve employees of the Contractor or persons commissioned by the Contractor processing the Client's personal data ("data"). 1 Definitions of Terms (1) Under Article 4 (7) GDPR, the Controller is the role which, alone or jointly with other controllers, determines the purpose of processing personal data and the means used to do so. Under Article 4 (8) GDPR, the Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller. (2) Under Article 4 (1) GDPR, personal data is any information relating to an identified or identifiable natural person (referred to hereinafter as the "Data Subject"); an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (3) Personal data requiring particular protection is personal data under Article 9 GDPR, regarding the Data Subject's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; personal data under Article 10 GDPR regarding criminal convictions and offences or related security measures, and genetic data under Article 4 (13) GDPR, biometric data under Article 4 (14) GDPR, data concerning health under Article 4 (15) GDPR and data on the sex life or sexual orientation of a natural person. (4) Under Article 4 (2) GDPR, processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 2 Subject, duration and terms of reference for the order Subject of the order The subject of the data processing order is the performance of the following tasks by the Contractor: Use of the PTV Drive&Arrive service and associated tools (e.g. arrival board, trip optimiser) Duration of the order The duration of this order (term) corresponds to the term of the Service Level Agreement. © PTV AG Page 4/16 The data processing agreed through the contract shall be performed solely in a European Union member state or in another state which is party to the agreement on the European Economic Area. Any storage in a third-party country requires prior permission from the Client and may only occur if the particular requirements under Article 44 et seq. of the GDPR are met. Type of data The subject of the processing of personal data is the following types/categories of data (list/description of the data categories) ☒ Person master data ☒ Communications data (e.g. telephone, email) ☐ Agreement master data (contractual relationship, interest in a product and/or contract) ☐ Customer history ☐ Contractual billing and payment data ☒ Planning and control data ☐ Report data (e.g. from third parties such as credit agencies, or from public registers) ☐ ... Group of data subjects The group of data subjects whose personal data are being handled as part of this order includes (list/description of the categories of data subject): ☒ Customers ☐ Potential customers ☐ Subscribers ☒ Employees ☐ Suppliers ☐ Trade representatives ☒ Contact persons ☐ … 3 Technical organisational protective measures put in place by the Contractor Before starting processing, the Contractor must document the implementation of the requisite technical and organisational measures laid out before the order was issued, particularly with regard to specific performance of the order, and hand this over to the Client for review. When they are accepted by the Client, the documented measures form PTV AG Page 5/16 the basis of the order. If the Client's review/audit results in a need for amendments, these should be implemented by mutual agreement. The Contractor should provide security as per Article 28 (3) (c), 32 GDPR, particularly in connection with Article 5 (1) and (2) GDPR. Overall, the measures to be agreed should cover data security measures and measures to ensure a level of protection appropriate to the risk, with regard to confidentiality, integrity, availability and system robustness. In doing so, the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, as per Article 32 (1) GDPR, should be taken into account [details in appendix 1]. The technical and organisational measures are subject to technical progress and development. To this extent, the Contractor is permitted to implement adequate alternative measures. These must not fall below the level of security provided by the specified measures. Significant changes must be documented. 4 Authority of the Client to give instructions The Contractor may only collect, process or use data within the framework of this underlying contract and in accordance with the Client's instructions; this applies particularly in relation to the transfer of personal data to a third-party country or to an international organisation. If the Contractor is obliged to conduct further processing under European Union law or the law of the member state in which it is based, it must notify the Client of these legal requirements prior to processing. The Client's instructions are initially specified in this contract and can be changed, extended or replaced by the Client afterwards with individual instructions in written or text form (individual instruction). The Client shall immediately confirm oral instructions in text form, as a minimum. The Client is permitted to issue instructions accordingly at any time. Appendix 2 details persons authorised to issue instructions. If the named person changes or cannot perform the role long-term, details of the successor or representative should be provided to the contract partner in text form without delay. The Contractor may not arbitrarily correct, delete or restrict processing of the data being processed in connection with the order, but may only do so upon receipt of documented instructions from the Client. If a data subject contacts the Contractor directly in respect of this, the Contractor shall forward this query to the Client without delay. Insofar as they are covered by the scope of the service, the Contractor should