AGREEMENT ON PROCESSING OF PERSONAL DATA

Parties

  1. You, the user of the Institutions module of the WEB PRODUCTION LABS platform (“Platform”), acting as a personal data controller (hereinafter referred to as “You” or “User” or “Controller“) and

GLOBAL CONSULTING WEB PRODUCTION LABS SRL CUI RO 39491248, J23/2761/2018, with registered office in Popești-Leordeni, nr. 90 Leordeni Street, Villa C7/1, Ilfov County, e-mail: office@webproductionlabs.com, (hereinafter referred to as GLOBAL CONSULTING WEB PRODUCTION LABS), the exclusive owner of the Platform, acting as the person empowered to process personal data (referred to as “GLOBAL CONSULTING WEB PRODUCTION LABS ” or “we“);

and referred to individually as the “Party” and collectively as the “Parties“.

Preamble

1. In the course of using any of our Modules, You may enter or generate various personal data (“Personal Data“) of data subjects (“Data Subjects“), as these concepts are defined in the legislation applicable, in particular, but not limited to the provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (“GDPR“);

2. GLOBAL CONSULTING WEB PRODUCTION LABS processes Personal Data entered on the Platform:

    • as the controller of personal data – i.e. contact data of users (“Personal Data processed as controller“)


and

  • as a processor of personal data – i.e. data entered or generated by Users in order to benefit from functionalities of the Modules (“Personal Data Processed as processor“)

3. With regard to Personal Data processed as a processor, it is required, under Art. 28 of the GDPR, to regulate the relationship between GLOBAL CONSULTING WEB PRODUCTION LABS, as the person processor of Personal Data, and the User, as Data Controller.

4. Taking into account the provisions of the Implementing Decision (EU) 2021/915 by the Commission of 4 June 2021 on standard contractual clauses between controllers and processors provided for in Article 28 Paragraph (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29 Paragraph (7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (“Decision 2021/915“)

The Parties have entered into this personal data processing agreement (“Agreement“).

Structure of the Agreement

  1. Part I comprises:
    • The standard contractual clauses set out in Decision 2021/915, and
    • Annex I – List of Parties;
    • Annex II – Description of the processing;
    • Annex III – Technical and organizational measures, including technical and organizational measures to ensure data security;
  2. Part II – Additional clauses

PART I – STANDARD CONTRACT TERMS

SECTION I

CLAUSE 1

Purpose and scope

  • The purpose of these Standard Contractual Clauses (“Clauses”) is to ensure compliance with Article 28 paragraphs (3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
  • The controllers and processors listed in Annex I have agreed to these clauses to ensure compliance with Article 28 paragraphs (3) and (4) of Regulation (EU) 2016/679 and Article 29 paragraphs (3) and (4) of Regulation (EU) 2018/1725.
  • These clauses shall apply to the processing of personal data as specified in Annex II.
  • Annexes I to III form an integral part of the clauses.
  • These clauses are without prejudice to the obligations of the controller under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
  • These clauses do not in themselves ensure compliance with the obligations relating to international transfers under Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

CLAUSE 2

Invariability of clauses

  • The parties undertake not to modify the clauses unless they need to supplement or update the information set out in the annexes.

  • This shall not prevent the parties from incorporating the standard contractual clauses set out in these clauses into a wider contract or from adding other additional clauses or guarantees, provided that they do not directly or indirectly contravene the clauses or affect the fundamental rights or freedoms of the persons concerned.

CLAUSE 3

Interpretation

  • Where these clauses use terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, these terms shall have the same meaning as in the Regulation.

  • These clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.

  • These clauses shall not be interpreted in a way that contravenes the rights and obligations laid down in Regulation (EU) 2016/679/Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of data subjects.

CLAUSE 4


Hierarchy

  • In the event of any inconsistency between these clauses and the provisions of related agreements between the parties that exist at the time these clauses are agreed or which are concluded subsequently, these clauses shall prevail.

CLAUSE 5

Clause on the accession of new parties

  • An entity that is not a party to these clauses may, with the agreement of all parties, accede to these clauses at any time as an operator or processor by completing the annexes and signing Annex I.

  • Upon completion and signature of the annexes referred to in subparagraph (a), the acceding entity shall be deemed to be a Party to these Clauses and shall have the rights and obligations of an operator or processor in accordance with its designation set out in Annex I.

  • The acceding entity shall have no rights or obligations under these clauses for the period prior to becoming a Party.

SECTION II

OBLIGATIONS OF THE PARTIES

  • CLAUSE 6

Description of data processing(s)
The processing operations, in particular the categories of personal data and the purposes of the processing of personal data on behalf of the controller, are specified in detail in Annex II.

  • CLAUSE 7

Obligations of the parties

  • Instructions
    • The processor shall process personal data only on the basis of documented instructions from the controller, unless the processor is under an obligation to do so under Union or national law applicable to it. In this case, the processor shall inform the controller of that legal obligation prior to the processing, unless the law prohibits such information for important reasons relating to the public interest. The controller may also give further instructions throughout the processing of personal data. These instructions must always be documented.

    • The processor shall immediately inform the controller if, in his or her opinion, the instructions given by the controller violate Regulation (EU) 2016/679/Regulation (EU) 2018/1725 or the applicable provisions of Union or national data protection law.

  • Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing as set out in Annex II unless they receive further instructions from the controller.

  • Duration of processing of personal data


Processing by the processor shall only take place for the duration specified in Annex II.

  • Security of processing
    • The processor shall implement at least the technical and organizational measures specified in Annex III to ensure the security of personal data. These measures shall include the protection of data against a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal data (personal data breach). In assessing the appropriate level of security, the parties shall give due consideration to the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks to which data subjects are exposed.

    • The processor shall grant members of his staff access to personal data undergoing processing only to the extent strictly necessary for the performance, management, and monitoring of the contract.
    • The processor shall ensure that the persons authorized to process the personal data received have undertaken to respect confidentiality or have an appropriate statutory obligation of confidentiality.
  • Sensitive data


Where the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic data or biometric data uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation or data concerning criminal convictions and offenses (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards as indicated by the processor.

  • Documentation and compliance

    • Parties must be able to demonstrate compliance with these clauses.

    • The processor shall respond promptly and adequately to requests for information from the controller regarding the processing of data in accordance with these clauses.

    • The processor shall provide the controller with all information necessary to demonstrate compliance with the obligations set out in these clauses and arising directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. Furthermore, at the request of the controller, the processor must allow audits of the processing activities covered by these clauses and contribute to such audits at reasonable intervals or if there are indications of non-compliance with these clauses. In deciding whether to carry out an analysis or an audit, the controller may take into account relevant certifications held by the processor.

    • The operator may choose to carry out the audit itself or to mandate an independent auditor for this purpose. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out after reasonable notice has been given.

    • Upon request, the parties shall make available to the competent supervisory authority/authorities the information referred to in this clause, including the results of any audit.
  • Use of subcontractors

    • GENERAL WRITTEN AUTHORIZATION: The processor shall have general authorization from the operator to recruit subcontractors who are on an agreed list. The processor shall provide the operator with the information the operator needs to exercise the right to object.

    • Where the processor recruits a subcontractor to carry out specific processing activities (on behalf of the controller), he shall carry out the recruitment by means of a contract providing for substantially the same data protection obligations as those incumbent on the processor under these clauses. The processor shall ensure that the processor complies with the processor’s obligations under these clauses and Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

    • The processor shall provide the controller with a copy of this subcontract and any subsequent amendments upon request. To the extent necessary to protect business secrets or other confidential information, including personal data, the processor may mask the text of the contract before transmitting the copy.

    • The processor shall remain fully liable to the processor for the performance of the subcontractor’s obligations under its contract with the processor. The processor shall notify the controller of any failure by the subcontractor to fulfill its contractual obligations.

    • The processor shall agree with the processor on a third-party beneficiary clause, according to which – in case the processor has factually disappeared, ceased to exist or become insolvent – the controller shall have the right to terminate the contract with the processor and instruct the processor to delete or return the personal data.
  • International transfers

    • Any transfer of data to a third country or an international organization by the processor shall take place on the basis of documented instructions from the controller or to fulfill a specific requirement under Union or national law applicable to the processor and shall be carried out in accordance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.

    • The controller agrees that where the processor recruits a subcontractor in accordance with clause 7. g. to carry out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the subcontractor may ensure compliance with the provisions laid down in Chapter V of Regulation (EU) 2016/679 by having recourse to the standard contractual clauses adopted by the Commission in accordance with Article 46 paragraph (2) of Regulation (EU) 2016/679, provided that the conditions for the use of those standard contractual clauses are met.

CLAUSE 8

Assistance to the operator

  • The processor shall immediately notify the controller of any request received from a data subject. The processor shall respond to such a request only if authorized to do so by the controller.

  • The processor shall assist the controller in fulfilling the controller’s obligations to respond to requests made by data subjects to exercise their rights, taking into account the nature of the processing. In fulfilling his obligations under points (a) and (b), the processor shall comply with the controller’s instructions.

  • In addition to the processor’s obligation to assist the controller under clause 8(b), the processor shall also assist the controller in ensuring compliance with the following obligations, taking into account the nature of the processing and the information available to the processor:

    • the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a “data protection impact assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

    • the obligation to consult the competent/competent supervisory authority/authorities prior to processing, if a data protection impact assessment indicates that the processing would create a high risk in the absence of measures taken by the controller to mitigate the risk;

    • the obligation to ensure that personal data are accurate and up to date by notifying the controller without delay if the processor has become aware that the personal data processed are inaccurate or out of date;

    • the obligations laid down in [OPTION 1] Article 32 of Regulation (EU) 2016/679/[OPTION 2] Article 33, Articles 36-38 of Regulation (EU) 2018/1725.

  • The parties shall set out in Annex III the appropriate technical and organizational measures through which the processor is required to assist the controller in the application of this clause, as well as the scope and extent of the assistance required.

CLAUSE 9

Notification of personal data breach

Where a personal data breach occurs, the processor shall cooperate with and assist the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679 or Articles 34 and 35 of Regulation (EU) 2018/1725, where applicable, taking into account the nature of the processing and the information available to the processor.

  • Data security breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

    • in notifying the personal data breach to the competent/competent supervisory authority/authorities without undue delay after the controller has become aware of it, if applicable/ (unless the personal data breach is not likely to result in a risk to the rights and freedoms of natural persons);

    • in obtaining the following information which, pursuant to [OPTION 1] Article 33(3) of Regulation (EU) 2016/679/[OPTION 2] Article 34(3) of Regulation (EU) 2018/1725, must be mentioned in the notification to the controller and include at least:

      • the nature of the personal data, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

      • the likely consequences of the personal data breach;

      • the measures taken or proposed to be taken by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate any adverse effects.

Where and to the extent that it is not possible to provide all this information at the same time, the initial notification shall contain the information available at the time, with additional information to be made available subsequently, without undue delay, as it becomes available.

    • in complying, pursuant to [OPTION 1] Article 34 of Regulation (EU) 2016/679/[OPTION 2] Article 35 of Regulation (EU) 2018/1725, with the obligation to inform, without undue delay, the data subject of the personal data breach where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

  • Breach of data security of data processed by the processor


Where a personal data breach occurs in relation to data processed by the processor, the processor shall, upon becoming aware of the personal data breach, notify the controller without undue delay. This notification shall contain at least:

    • a description of the nature of the data breach (including, where possible, the categories of data subjects concerned and the approximate number of data subjects and data records concerned);

    • contact details of a contact point where further information on the personal data breach can be obtained;

    • the likely consequences of the data breach and the measures taken or proposed to be taken to remedy the data breach, including the mitigation of any adverse effects.

Where and to the extent that it is not possible to provide all this information at the same time, the initial notification shall contain the information available at the time, with additional information to be made available subsequently, without undue delay, as it becomes available.

The parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller to comply with its obligations under [OPTION 1] Articles 33 and 34 of Regulation (EU) 2016/679/[OPTION 2] Articles 34 and 35 of Regulation (EU) 2018/1725.

You warrant and represent that:

  • You are entitled to post the Comments on our website and have all necessary licenses and consents to do so;
  • The Comments do not invade any intellectual property right, including without limitation copyright, patent or trademark of any third party;
  • The Comments do not contain any defamatory, libelous, offensive, indecent or otherwise unlawful material which is an invasion of privacy
  • The Comments will not be used to solicit or promote business or custom or present commercial activities or unlawful activity.

You hereby grant The Seven a non-exclusive license to use, reproduce, edit and authorize others to use, reproduce and edit any of your Comments in any and all forms, formats or media.

SECTION III

FINAL PROVISIONS

CLAUSE 10

Non-compliance and termination

  • Without prejudice to the provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, where the processor does not comply with its obligations under these clauses, the controller may instruct the processor to suspend the processing of personal data until the processor complies with these clauses or the contract is terminated. The processor shall promptly inform the controller if it is unable to comply with these clauses, for whatever reason.

  • The controller shall have the right to terminate the contract insofar as it relates to the processing of personal data in accordance with these clauses, if:

    • the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these clauses is not restored within a reasonable time and in any event within one month of the suspension;

    • the processor has substantially or repeatedly breached these clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;

    • the Processor fails to comply with a binding decision of a competent court or issued by the competent/competent supervisory authority(ies) in relation to its obligations under these clauses or under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

  • The processor shall have the right to terminate the contract insofar as it relates to the processing of personal data under these clauses, if, after having informed the controller that its instructions breach the applicable legal obligations under clause 7.1(b), the controller insists on compliance with the instructions.

  • following termination of the contract, at the choice of the controller, the processor shall either delete all personal data processed on behalf of the controller and provide the controller with proof that he has done so or return all personal data to the controller and delete existing copies, unless Union or national law provides for the obligation to store personal data. Until the data are deleted or returned, the controller must continue to ensure compliance with these clauses.

ANNEX I

List of parties

  • Controller(s)
  • Users of the WEB PRODUCTION LABS Platform
  • Processor(s) of the operator:

  1. GLOBAL CONSULTING WEB PRODUCTION LABS SRL CUI RO 39491248, J23/2761/2018, with registered office in Popești-Leordeni, nr. 90 Leordeni street, Villa C7/1, Ilfov County, e-mail: office@webproductionlabs.com, (hereinafter referred to as GLOBAL CONSULTING WEB PRODUCTION LABS “)

ANNEX II

Description of processing


Categories of data subjects whose personal data are processed

  • Users of the WEB PRODUCTION LABS Platform or their representatives;

  • Persons addressing the Operator.


Categories of personal data processed

  • In the case of natural persons: name, surname, personal numerical code, identity card data, home address, telephone number, email address, function;
  • In the case of legal persons: identification data of the representative of the legal person.
  • In addition to the above data, a series of information and data, including personal data, will be added to allow you to use our Modules.

Sensitive data processed (if applicable) and restrictions or safeguards applied that take full account of the nature of the data and the risks involved, such as, for example, strict purpose limitation, access restrictions (including allowing access only to staff members who have undergone specialized training), record keeping of access to data, restrictions applicable to onward transfers or additional security measures.

(Not the case)

Nature of processing

The processing concerns Personal Data that Users enter or make accessible on the Platform in order to benefit from its functionalities.

As a rule, only Users have access and control over this data (e.g. Users can choose to enter, delete, modify, limit access etc. at any time).

Data may also be accessible to third parties selected by Users and at their express request.

Data may also be accessed incidentally in the case of technical maintenance activities of the WEB PRODUCTION LABS Platform carried out by the Company.

Purpose(s) for which personal data are processed on behalf of the controller

Use of the Platform by Users in order to benefit from the Platform’s functionalities.

Processing time

The data will be processed by GLOBAL CONSULTING WEB PRODUCTION LABS directly or through sub-processors and remain stored electronically or physically for a maximum of 3 years after the operations ordered by the data subject through the applications developed by the Company.

ANNEX III

Technical and organizational measures, including technical and organizational measures designed to ensure data security

EXPLANATORY NOTE:

Technical and organizational measures should be described in concrete, not generic terms. Description of the technical and organizational security measures implemented by the processor(s) (including any relevant certifications) to ensure an adequate level of security, taking into account the nature, scope, context, and purpose of the processing and the risks to the rights and freedoms of natural persons:

  • encryption measures for personal data;
  • measures to ensure the confidentiality, integrity, availability, and ongoing resilience of processing systems and services;
  • measures to ensure the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;
  • processes for regularly testing, evaluating, and assessing the effectiveness of technical and organizational measures to ensure the security of processing;
  • user identification and authorization measures;
  • measures to ensure the protection of personal data during transmission;
  • measures to ensure the protection of personal data during storage;
  • measures to ensure the physical security of places where personal data are processed;
  • measures to ensure system configuration, including default configuration;
  • measures on governance and management of internal IT systems and IT security;
  • measures to ensure data minimization;
  • measures to ensure data quality;
  • implementation of a training program for employees;
  • measures to enable data portability and ensure data deletion.

PART II

  • INTERPRETATION OF THE AGREEMENT

    • This Agreement is supplemented by the provisions of our Modules Terms and Conditions of Use.

    • Any existing provisions relating to the processing of personal data by the Parties shall be superseded by the provisions of this Agreement from the date of its entry into force.

    • Unless otherwise expressly defined herein or unless the context otherwise requires, capitalized terms shall have the meaning given to them in the applicable law.

    • With respect to the following items in the standard clauses (Part I) the following clarifications are made:

      • References to Regulation (EU) 2018/1725 are not applicable in relation to the subject matter of the Agreement.

      • Art. 7.a. – In this case, the operator’s documented instructions are the orders entered within the Platform.

      • Art. 7.e. – No sensitive data are processed.

      • Art. 7.f. – Audits of the operator shall be carried out mainly by analyzing documents and information made available to the operator by the processor. Any inspection of the processor’s physical facilities must be duly justified and may not prejudice the confidentiality of sensitive information belonging to the processor, nor unduly disrupt the processor’s activities.


  • NOTIFICATIONS

    • Any communications between the Parties (including notifications, complaints, requests, or replies) shall be sent in writing by post with acknowledgment of receipt, by fax, or by email with acknowledgment of receipt, using the contact details given in the letterhead of the Agreement.

    • Notices sent by post shall be deemed to have been received on the date stated on the acknowledgment of receipt.

    • Notifications sent by fax or email shall be deemed to have been received on the day following their transmission.

    • Any change of contact details shall be notified to the other Party in writing, failing which it shall not be taken into account.

  • CLOSURE, AMENDMENT AND TERMINATION OF THE AGREEMENT

    • By using the Platform you become a party to this Agreement, as a personal data controller, with the rights provided for herein and by applicable law.

    • From time to time, depending on changes in legislation or changes in our practices, we may decide to amend this Agreement, subject to the following minimum requirements required by law. Any such notice will be notified to you by email 5 days before it comes into force. In the event that you do not agree to the modification of this Agreement, you may terminate this Agreement within 5 days of receiving notice of modification from us.

    • The Agreement shall terminate on the date of termination of the contractual relationship between you and us, in accordance with the Terms and Conditions of Use of the Platform.

  • RESPONSIBILITY
    • Each Party bears full responsibility for the manner in which it obtains and transmits to the other Party the Personal Data set out in this Agreement.

  • MISCELLANEOUS

    • The Agreement shall enter into force from the date you begin using the WEB PRODUCTION LABS Platform, as it stands at that time.

    • The Agreement may be amended from time to time for operational reasons or as a result of legislative changes. GLOBAL CONSULTING WEB PRODUCTION LABS will use reasonable endeavors to notify Users of any such changes by email sent to the relevant contact addresses.

    • The Agreement is governed by Romanian law. Any dispute between the Parties regarding the Agreement shall be settled by the competent courts of GLOBAL CONSULTING WEB PRODUCTION LABS.

    • In the event of a transfer of the rights on the WEB PRODUCTION LABS Platform, the assignee/successor of GLOBAL CONSULTING WEB PRODUCTION LABS shall subrogate to the rights of GLOBAL CONSULTING WEB PRODUCTION LABS, without any other formality. For purposes of enforceability, the transfer shall be notified to the Users by GLOBAL CONSULTING WEB PRODUCTION LABS, in accordance herewith.