Subject matter and duration of the Order or Contract

1.1 The contractor (WISOLUTION Ltd.) stores and processes within the scope of this contract the operational data collected by the client.

The Subject matter of the Order or Contract results from the Service Agreement (General terms and conditions and Terms of use), which is referred to here (hereinafter referred to as Service Agreement).

1.2 The duration of this Order or Contract corresponds to the duration of the Service Agreement.

2. Scope, nature and purpose of the envisaged collection, processing or use of data, the nature of the data and the circle of data subjects

2.1 The nature and purpose of the processing of personal data by the contractor for the client are specifically described in the service agreement.

2.2 The contractor assumes the task of technical operation of the software.

The collection and use of the data as well as the processing on a professional level is carried out exclusively by the client.

2.3 The circle of data subjects, the nature and extent of the collected data are determined by the client himself, by collecting the data.

3. Technical and Organisational Measures

3.1 Before the commencement of processing, the Supplier shall document the execution of the necessary Technical and Organisational Measures, set out in advance of the awarding of the Order or Contract, specifically with regard to the detailed execution of the contract, and shall present these documented measures to the Client for inspection. Upon acceptance by the Client, the documented measures become the foundation of the contract. Insofar as the inspection/audit by the Client shows the need for amendments, such amendments shall be implemented by mutual agreement.

3.2 The Supplier shall establish the security in accordance with Article 28 Paragraph 3 Point c, and Article 32 GDPR in particular in conjunction with Article 5 Paragraph 1, and Paragraph 2 GDPR. The measures to be taken are measures of data security and measures that guarantee a protection level appropriate to the risk concerning confidentiality, integrity, availability and resilience of the systems. The state of the art, implementation costs, the nature, scope and purposes of processing as well as the probability of occurrence and the severity of the risk to the rights and freedoms of natural persons within the meaning of Article 32 Paragraph 1 GDPR must be taken into account. (Details in Appendix 1)

3.3 The Technical and Organisational Measures are subject to technical progress and further development. In this respect, it is permissible for the Supplier to implement alternative adequate measures. In so doing, the security level of the defined measures must not be reduced. Substantial changes must be documented.

4. Quality assurance and other duties of the Supplier

In addition to complying with the rules set out in this Order or Contract, the Supplier shall comply with the statutory requirements referred to in Articles 28 to 33 GDPR; accordingly, the Supplier ensures, in particular, compliance with the following requirements:

4.1 The contractor shall inform the client of the contact details of the company data protection officer with or, if there is no obligation to appoint a company data protection officer, the contact details of the employee responsible for the data processing.

4.2 Confidentiality in accordance with Article 28 Paragraph 3 Sentence 2 Point b, Articles 29 and 32 Paragraph 4 GDPR. The Supplier entrusts only such employees with the data processing outlined in this contract who have been bound to confidentiality and have previously been familiarised with the data protection provisions relevant to their work. The Supplier and any person acting under its authority who has access to personal data, shall not process that data unless on instructions from the Client, which includes the powers granted in this contract, unless required to do so by law.

4.3 Implementation of and compliance with all Technical and Organisational Measures necessary for this Order or Contract in accordance with Article 28 Paragraph 3 Sentence 2 Point c, Article 32 GDPR (details in Appendix 1).

4.4 The Client and the Supplier shall cooperate, on request, with the supervisory authority in performance of its tasks.

4.5 The Client shall be informed immediately of any inspections and measures conducted by the supervisory authority, insofar as they relate to this Order or Contract. This also applies insofar as the Supplier is under investigation or is party to an investigation by a competent authority in connection with infringements to any Civil or Criminal Law, or Administrative Rule or Regulation regarding the processing of personal data in connection with the processing of this Order or Contract.

4.6 Insofar as the Client is subject to an inspection by the supervisory authority, an administrative or summary offence or criminal procedure, a liability claim by a Data Subject or by a third party or any other claim in connection with the Order or Contract data processing by the Supplier, the Supplier shall make every effort to support the Client.

4.7 The Supplier shall periodically monitor the internal processes and the Technical and Organizational Measures to ensure that processing within his area of responsibility is in accordance with the requirements of applicable data protection law and the protection of the rights of the data subject.

4.8 Verifiability of the Technical and Organisational Measures conducted by the Client as part of the Client’s supervisory powers referred to in item 7 of this contract.

5. Subcontracting

5.1 Subcontracting for the purpose of this Agreement is to be understood as meaning services which relate directly to the provision of the principal service. This does not include ancillary services, such as telecommunication services, postal / transport services, maintenance and user support services or the disposal of data carriers, as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing equipment. The Supplier shall, however, be obliged to make appropriate and legally binding contractual arrangements and take appropriate inspection measures to ensure the data protection and the data security of the Client's data, even in the case of outsourced ancillary services.

5.2 The Supplier may commission subcontractors (additional contract processors) only after prior explicit written or documented consent from the Client.

5.2.1 The Client agrees to the commissioning of the following subcontractors on the condition of a contractual agreement in accordance with Article 28 paragraphs 2-4 GDPR:

5.2.2 Outsourcing to subcontractors or changing the existing subcontractor are permissible when:

- The Supplier submits such an outsourcing to a subcontractor to the Client in writing or in text form with appropriate advance notice; and

- The Client has not objected to the planned outsourcing in writing or in text form by the date of handing over the data to the Supplier; and

- The subcontracting is based on a contractual agreement in accordance with Article 28 paragraphs 2-4 GDPR.

5.3 The transfer of personal data from the Client to the subcontractor and the subcontractors commencement of the data processing shall only be undertaken after compliance with all requirements has been achieved.

5.4 If the subcontractor provides the agreed service outside the EU/EEA, the Supplier shall ensure compliance with EU Data Protection Regulations by appropriate measures. The same applies if service providers are to be used within the meaning of Paragraph 1 Sentence 2.

5.5 Further outsourcing by the subcontractor is not permitted. All contractual provisions in the contract chain shall be communicated to and agreed with each and every additional subcontractor.

6. Supervisory powers of the Client

6.1 Within the framework of this contract, the client is solely responsible for compliance with the statutory provisions of the data protection laws, in particular for the lawfulness of the data transfer to the contractor as well as for the lawfulness of the data processing.

6.2 The client alone is responsible for the assessment of the admissibility of the commissioned processing as well as for the protection of the rights of those concerned.

6.3 The Client has the right, after consultation with the Supplier, to carry out inspections or to have them carried out by an auditor to be designated in each individual case. It has the right to convince itself of the compliance with this agreement by the Supplier in his business operations by means of random checks, which are ordinarily to be announced in good time.

6.4 The Supplier shall ensure that the Client is able to verify compliance with the obligations of the Supplier in accordance with Article 28 GDPR. The Supplier undertakes to give the Client the necessary information on request and, in particular, to demonstrate the execution of the Technical and Organizational Measures.

6.5 Evidence of such measures, which concern not only the specific Order or Contract, may be provided by

- Compliance with approved Codes of Conduct pursuant to Article 40 GDPR;

- Certification according to an approved certification procedure in accordance with Article 42 GDPR;

- Current auditor’s certificates, reports or excerpts from reports provided by independent bodies (e.g. auditor, Data Protection Officer, IT security department, data privacy auditor, quality auditor)

- A suitable certification by IT security or data protection auditing (e.g. according to BSI-Grundschutz (IT Baseline Protection certification developed by the German Federal Office for Security in Information Technology (BSI)) or ISO/IEC 27001).

6.6 The Supplier may claim remuneration for enabling Client inspections.

7. Rights of data subjects

7.1 The rights of the persons affected by the order data processing in particular to correction, deletion and blocking of the data are to be asserted against the client. He alone is responsible for safeguarding these rights.

7.2 Where a data subject asserts claims for rectification, erasure or access against Supplier, and where Supplier is able to correlate the data subject to Company, based on the information provided by the data subject, Supplier shall refer such data subject to Company. Supplier shall forward the data subject’s claim to Company without undue delay. Supplier shall support Company, where possible, and based upon Company’s instruction insofar as agreed upon. Supplier shall not be liable in cases where Company fails to respond to the data subject’s request in total, correctly, or in a timely manner.

8. Authority of the Client to issue instructions

8.1 The Supplier shall assist the Client in complying with the obligations concerning the security of personal data, reporting requirements for data breaches, data protection impact assessments and prior consultations, referred to in Articles 32 to 36 of the GDPR. These include:

8.1.1 Ensuring an appropriate level of protection through Technical and Organizational Measures that take into account the circumstances and purposes of the processing as well as the projected probability and severity of a possible infringement of the law as a result of security vulnerabilities and that enable an immediate detection of relevant infringement events.

8.1.2 The obligation to report a personal data breach immediately to the Client

8.1.3 The duty to assist the Client with regard to the Client’s obligation to provide information to the Data Subject concerned and to immediately provide the Client with all relevant information in this regard.

8.1.4 Supporting the Client with its data protection impact assessment.

8.1.5 Supporting the Client with regard to prior consultation of the supervisory authority.

8.2 The Supplier may claim compensation for support services which are not included in the description of the services and which are not attributable to failures on the part of the Supplier.

9. Authority of the Client to issue instructions

9.1 The contractor undertakes to follow the instructions of the client. The contractor may request that instructions be given in a specific form. The written form is valid in every case.

9.2 The Client shall immediately confirm oral instructions (at the minimum in text form).

9.3 The Supplier shall inform the Client immediately if he considers that an instruction violates Data Protection Regulations. The Supplier shall then be entitled to suspend the execution of the relevant instructions until the Client confirms or changes them.

10. Severability clause

Should one or more provisions of this contract be invalid, this does not affect the validity of the remaining agreement.