Allgemeine Geschäftsbedingungen und Datenschutz

Subject matter of the contract and contents of the order

1. The object of the contract results from the agreement concluded between the parties on the provision of a service by the Contractor to the Client, to which reference is made here (hereinafter referred to as “performance agreement”). This contract for processing (the “Contract”) specifies the data protection obligations of the contracting parties. This contract shall apply to all activities related to the pro- cessing where the Contractor or his employees may come into contact with personal data provided to the Contractor by the Client.
2. The type of data processed, the categories of data subjects, and the type and purpose of the collection, processing and use of personal data by the Contractor for the Client are specified in detail in Appendix 1 to this contract.
3. Unless otherwise expressly stipulated in this contract, the contractually agreed data pro- cessing shall be performed exclusively in Germany, a member state of the European Union or another state party to the Agreement on the European Economic Area (EEA). Any relocation to a third country may take place only if the special conditions of Art. 44 et seq. of the GDPR are fulfilled.

Technical and organisational measures

The Contractor shall provide the security pursuant to Art. 28 para. 3 lit. c, 32 GDPR in particular in conjunc- tion with Art. 5 para. 1, para. 2 GDPR. Overall, the measures to be taken are data security measures and mea- sures to ensure a level of security appropriate to the risk in terms of confidentiality, integrity, availability and resilience of the systems. The state of the art, the implementation costs and the type, scope and purpose of the processing as well as the variable probability and severity of the risk to the rights and freedoms of natural persons within the meaning of Art. 32 para. 1 GDPR must be taken into account. The Contractor shall document the individual measures in a measure concept in Appendix 2.

1. The technical and organisational measures are subject to technical progress and ongoing development. In this respect, the Contractor is permitted to implement alternative adequate measures. In doing so, the safety level of the defined measures must not be undercut. Any significant changes must be documented.
2. The Contractor shall regularly monitor the internal processes as well as the technical and organisational measures to ensure that the processing in his sphere of responsibility is carried out in accor- dance with the requirements of the applicable data protection law and that the rights of the data subject are protected.

Rectification, limitation and erasure of data

1. The Contractor may not rectify, delete or restrict the processing of the data processed on behalf of the Client without authorisation, but only in accordance with documented instructions from the Cli- ent. If a person concerned directly addresses the Contractor in this respect, the Contractor shall immediately forward this request to the Client.
2. The Contractor shall support the Client with suitable technical and organisational measures to ensure the rights of affected parties to be forgotten, to rectification, to data portability and to access to information. For support services which are not owed according to the performance agreement, the Contrac- tor can claim remuneration.

Quality assurance and other duties of the Contractor

1. The Contractor shall only employ personnel for the performance of the work who are under an obligation of confidentiality and who have been familiarised beforehand with the data protection provi- sions relevant to them. The Contractor and any person subordinated to the Contractor who has access to personal data may process such data only in accordance with the instructions of the Client, including the powers granted in this contract and in the performance agreement, unless they are legally obliged to pro- cess them.
2. The Contractor shall support the Client in complying with the obligations set out in Articles 32-36 GDPR regarding the security of personal data, reporting obligations in the event of data breakdowns, data protection impact assessments and prior consultations. These include, among others:
   1. the obligation to immediately report violations of personal data to the client,
   2. the obligation to support the client within the scope of his duty to inform the affected parties and to make all information relevant in this context immediately available to him,
   3. assisting the Client in his data protection impact assessment,
   4. the support of the client within the framework of prior consultation with the regulatory authority.
3. For support services which are not included in the performance agreement or which are due to misconduct on the part of the Client, the Contractor may claim remuneration.

Subcontracting relationships

1. For the purposes of this provision, subcontracting is defined as services which relate directly to the provision of the principal service. This does not include auxiliary services which the contrac- tor uses like, for example, telecommunications services, postal/transport services, maintenance and user services or the disposal of data storage media as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. The Contrac- tor is, however, obliged, even in the case of outsourced ancillary services, to make appropriate contractual agreements in accordance with the law and to take control measures in order to guarantee data protection and the security of the Client’s data.
2. The Customer agrees to the contracting of subcontractors under the condition of a contractual agreement between the Contractor and the subcontractor in accordance with Art. 28 para. 4 GBPR. The consent expressly includes, proviso of the aforementioned conditions, the use of the subcon- tractors named below.
3. The Contractor makes use of infrastructure and platform services of the Amazon Web Services platform operated by Amazon Web Services, Inc. for the provision of the software solution in accordance with the performance agreement. The processing is done on a server of Amazon, Inc. in Frankfurt / Main (Germany). Contracts exist between Taskworld and Amazon Web Services Inc., regarding the use of the Amazon Web Services service and processing, which oblige Amazon Web Services Inc. to protect personal data. Detailed information from Amazon Web Services Inc. about Amazon Web Services Inc.’s compliance with data protection requirements can be found at https://aws.amazon.com/compliance/gdpr-center/?nc1=h_ls.
4. The Contractor shall inform the Client in advance of any intended change with regard to the involvement or replacement of other processors. The Customer may object to this change vis-à-vis the Contractor within 14 days of receipt of the information by the Client. An objection may not be lodged without an interest of the Client which outweighs the interests of the Contractor.
5. If the subcontractor performs the agreed service outside the EU/EEA, the Contractor shall ensure the legal admissibility of data protection by taking appropriate measures.

Control rights of the Client

1. The Client shall have the right, in consultation with the Contractor, to carry out inspections or to have them carried out by inspectors to be appointed in each case. The Client shall have the right to convince himself of the Contractor’s compliance with this contract at the Contractor’s premises by means of random checks, which are generally to be notified in good time.
2. The Contractor shall ensure that the Client can satisfy himself that the obligations of the Contractor pursuant to Art. 28 GDPR are being complied with. The Contractor undertakes to provide the Client upon request with the necessary information and, in particular, to prove the implementation of the technical and organisational measures.
3. Evidence of such measures, which do not only involve the specific order, can be provided by
   1. Compliance with approved rules of conduct pursuant to Art. 40 GDPR,
   2. Certification according to an approved certification procedure in accordance with Art. 42 GDPR,
   3. Current certificates, reports or report extracts from independent entities (e.g. chartered accountants, internal auditors, data protection officers, IT security department, data protection auditorium, quality audit),
   4. a suitable certification through an IT security or data protection audit (for example according to BSI IT-Grundschutz).
4. The Contractor can claim remuneration for the facilitation of controls by the Client.

Powers of instruction of the Client

1. Oral instructions shall be confirmed by the Client without delay (at least in text form).
2. The Contractor shall inform the Client immediately if he is of the opinion that an instruction violates data protection regulations. The Contractor is entitled to suspend the execution of the respective instruction until it is confirmed or amended by the Client.

Deletion and return of personal data

1. Copies or duplicates of the data shall not be made without the knowledge of the Client. Excluded from this are backup copies, insofar as they are necessary to guarantee proper data processing, as well as the storage of data, which is necessary with regard to compliance with statutory storage obligations.
2. Upon completion of the contractually agreed work or earlier upon request by the Client - at the latest upon termination of the performance agreement - the Contractor shall surrender to the Client all documents in his possession, processing and usage results as well as data stocks created in connection with the contractual relationship or, after prior consent, destroy them in accordance with data protection regulations. The same applies to test and scrap material. The deletion log shall be provided on request. The Contractor’s obligations under this Clause 8.2 shall not apply if there is an obligation to store personal data under EU law or the law of Member States of the EU.
3. Documentation which serves as proof of data processing in accordance with the order shall be stored by the Contractor in accordance with the respective statutory periods beyond the end of the contract. He may hand them over to the Client to discharge him upon termination of the contract.

Duration of order, termination

1. The duration of this order corresponds to the duration of the performance agreement and also includes the period after the end of the performance agreement until the complete return or deletion of the data provided to the Contractor by the Client in connection with the execution of the main contract.
2. The right of each contracting party to terminate this order without notice for good cause shall remain unaffected.

Applicable Law, Place of Performance, Place of Jurisdiction

1. German law shall apply to this contract.
2. Place of performance is Hamburg.
3. The exclusive place of jurisdiction for any disputes arising from this contract shall be Hamburg.

Miscellaneous

1. Amendments, supplements and additions to this contract shall only be valid if agreed in writing between the contracting parties. This shall also apply to any amendment of this provision of the contract.
2. Should any provision of this contract be or become invalid, this shall not affect the validity of the remainder of the contract. The invalid provision shall be deemed replaced by a valid provision which comes as close as possible to the economic purpose of the invalid provision. The same shall apply in the event of a contractual gap.