Updated : September 1st 2022, version 3

DATA PROCESSING AGREEMENT

Article 1. DEFINITIONS

Unless otherwise defined in the Agreement, all the terms in the upper case used herein, including the Preliminaries, shall have the meaning given in Purchasely’s General Terms and Conditions of Services, or, failing that, as follows:

• Purchasely’s Data Processing Agreement  or Agreement shall mean this contractual document, with the purpose of defining the conditions and terms of enforcement of the Personal Data processing operations, made in the context hereof;
• Supervisory Authority shall mean any authority authorized to control and ensure the respect of the application of the Personal Data Regulations concerning the Personal Data Processing accomplished in the context of the Agreement and the provision of Services;
• Agreement shall mean the General Terms and Conditions and this Data Processing Agreement;
• Personal Data shall mean personal data within the meaning of the Personal Data Regulations;
• Data Subjects’ Rights shall mean the Data Subjects’ rights by virtue of the Personal Data Regulations;
• EEA shall mean the European Economic Area;
• Supplier shall mean PURCHASELY, a simplified joint-stock company, with a share capital of 50 056,00 €, with its registered office located at 59 Promenade du verger, 92130 Issy-les-Moulineaux, registered with the Nanterre Registry of Trade and Companies under the number 890 405 921 represented by Mr. Nicolas Tissier acting in his capacity as President;
• Party(ies) shall mean individually or collectively the Supplier and/or the Client;
• Regulation or GDPR shall mean the (EU) Regulation 2016/679 of the European Parliament and Council dated April 27, 2016 relating to individuals’ personal data protection with regard to the Personal Data Processing and the free flow of this data, and repealing the EC directive 95/46/EC;
• Personal Data Regulations shall mean the Law no. 78-17 dated January 6, 1978 relating to I.T., files and liberties (Data Protection Act) and the General Data Protection Regulations (called “GDPR”) dated April 27, 2016 published in the Official Journal of the European Union on May 4, 2016 relating to the protection of individuals with regard to personal data processing and the free movement of this data, and any regulations which shall apply for personal data protection, in particular the EC Directive 2002/58 by the European Parliament and Council dated July 12, 2002 concerning the processing of personal data and privacy protection in the electronic communications sector (referred to as the “Privacy and electronic communications directive” or “E-privacy directive”) and any new regulation which shall replace such Directive.
• Data Controller, according to Art. 4, paragraph 7 of the GDPR shall mean the organ which, alone or with other directors, shall decide on the purpose and terms of the Personal Data processing;
• Services shall mean the services provided by the Supplier to the Client, as agreed herein; 
• Sub-contractor or Data Processor according to Art. 4, paragraph 8 of the GDPR shall mean the individual or legal entity, public authority, service or any other body which processes Personal Data on behalf of the data controller;
• Subsequent Sub-contractor shall mean an entity hired by the Sub-contractor to assist with (or which accomplishes) the Personal Data Processing for the Data Controller in the context of the Sub-contractor’s obligations in accordance with the Agreement, such as mentioned in the Data Processing Register attached hereto;
• Purchasely ISSMP shall mean the documentation, defines the organizational and technical security rules setup by the Supplier. This documentation may be modified at any time (without substantively calling into question the level of security), without notice, by the Supplier depending, in particular, on the Service developments. The duly modified documentation shall automatically apply upon notification sent by the Supplier to the Client. This documentation is at the Client’s disposal upon his request by email;
• Processing or process shall mean, within the meaning of the Personal Data Regulations, any operation or set of operations, whether or not carried out with the assistance of automated processes and applied to Personal Data, such as the collection, registration, organization, structuration, retention, adaptation or modification, extraction, consultation, utilization, communication by transfer, dissemination or any other form of availability, the reconciliation, interconnection, limitation, deletion or destruction;
• Personal Data Breach shall mean a security breach resulting, accidentally or unlawfully, in the destruction, loss, alteration, unauthorized disclosure of Personal Data.

Article 2. GENERAL STIPULATIONS AND DEFINITION OF ROLES

The performance of the Agreement shall result in the Personal Data Processing by the Parties in order both for the management of the commercial relations between the Parties and the provision of Services for the Client’s benefit.

Such Processing is subject to the Personal Data Regulations. The Parties declare to be aware of each of their respective rights and obligations, resulting from the application of the Personal Data Regulations to the Personal Data Processing setup in the context of the performance hereof.

The Supplier and the Client shall undertake to collect, process, use and transfer the Personal Data within the respect of the Personal Data Regulations.

They undertake to process the Personal Data loyally and legally in all circumstances.

They declare to have respected all their statutory obligations in this regard and undertake to respect them for the entire duration hereof, and, in particular, to proceed with any declaration with the data protection authorities or that of the Data Subjects and/or obtain from such authorities and the Data Subjects any authorization necessary, in the context of the collection and Processing of the Personal Data for the purpose of the Services provided herein.  

The Parties acknowledge to have been fully informed of the Personal Data Regulations obligations which apply in their regard in their respective capacity of:

• Independent Data Controllers for the Supplier and the Client concerning their respective Personal Data processing in order to manage their commercial relations;
• Data Controller for the Client and Sub-Contractor for the Supplier concerning the Personal Data Processing carried out in the context of the provision of Services, i.e., the Processing related (i) to the purchasing of a product or a digital subscription by the Users and (ii) the technical and operational provision of Services, in particular, with the view to the use and/or management on its behalf of the Identifiers enabling the Contacts to access its Internet platform.

Article 3. SUB-CONTRACTING OF THE PROCESSING CARRIED OUT BY THE SUPPLIER

Concerning the Personal Data Processing accomplished in the context of the provision of Services:

• the Supplier acts in the capacity as Sub-Contractor;
• the Client acts in the capacity as Data Controller.

3.1. The Sub-contractor's obligations

In the context of the provision of Services, the Supplier, in his capacity as Sub-Contractor shall undertake to respect the following obligations and ensure that they are respected by his personnel:

• provide the Data Controller with sufficient guarantees for the setup of the appropriate technical and organizational measures, in terms of the formation of the Sub-contractor’s personnel members assigned to the Services, the equipment used, to ensure that the Personal Data processing setup for the purpose of the performance of the Agreement meets the requirements under the Personal Data Regulations;
• only to process Personal Data upon the duly documented instruction of the Data Controller, it being specified that if the Sub-contractor considers that an instruction from the Data Controller constitutes a breach of the Personal Data Regulations, he shall inform the Data Controller as soon as possible;
• process the Personal Data only for the purpose provided by the Agreement, with the exception of subsequent processing of anonymized data exclusively carried out for the purpose of statistics and research for the continuous improvement of the Services, for which the Data Controller acknowledges the Sub-Contractor’s legitimate interest for the implementation thereof;
• ensure that the persons authorized to process the personal data undertake to  respect the confidentiality or are subject to an appropriate statutory confidentiality obligation;
• guarantee the security of the Sub-contractor’s premises, to prevent the destruction, loss, alteration, distortion or other modification, hacking, misappropriation, damage, disclosure or access to the Personal Data by unauthorized persons for which the Sub-contractor has been communicated, stored by the Sub-contractor or, more generally, that he processes in any means whatsoever, on behalf of the Data Controller;
• cooperate with the Data Controller, in particular, by providing him with the necessary documentation to establish the respect of all his obligations, in particular, the realization of audits (according to the terms of Article 3.13), including inspections, by the Data Controller or another auditor, independent and non-competitor of the Sub-contractor, mandated to contribute to these audits; 
• have respected all the Sub-contractor’s obligations under the Agreement by any substituting company or its modus operandi, by expressly providing these same obligations for the Sub-contractor, and any Subsequent Sub-contractor, regardless of his rank in the agreement between the Sub-contractor with the company or any subsequent Sub-contractor, to ensure their respect of the Agreement;
• notify the Data Controller, under the conditions of the Personal Data Regulations and in accordance with Article 3.12 below, of any Personal Data Breach of which the Sub-contractor would have been made aware thereof, take the appropriate measures as soon as possible to remedy this situation, including any appropriate procedure before the competent national protection authority and cooperate with the Data Controller to communicate by mutual agreement on the existence of the Personal Data Breach with the data subjects.

3.2. The Data Controller's obligations

The Data Controller shall undertake to provide to the Sub-contractor all the necessary information and elements enabling the latter to perform the Agreement and provide the Services in accordance with the Agreement, and those enabling the
Sub-contractor to respect its own obligations in terms of personal data protection.

In the event whereby the Data Controller were also to provide Data to the
Sub-contractor, directly or indirectly, he shall ensure that the latter is accurate, relevant, appropriate and limited to that strictly necessary with regard to the processing objectives. 

The Data Controller shall undertake to document in writing any instruction concerning the Data processing by the Sub-contractor. 

The Data Controller shall also be responsible and shall undertake as follows: 

• to ensure the lawful, loyal and transparent collection and processing of the Data; 
• to provide the information necessary to the data subjects and ensure, in the event whereby consent is required, that the latter had been duly obtained, i.e., explicitly issued for each purpose, and that it is able to be tracked and withdrawn at any time by the data subjects. In this regard, and if the Sub-contractor is in charge of accomplishing operations for the collection or processing on behalf of the Data Controller, the latter shall communicate to the Sub-contractor any mention of information or acquisition of consent and any complementary instruction to be issued to the data subjects;
• ensure that the Personal Data is only collected and processed for a specific, explicit and legitimate purpose and that it is adequate, relevant, non-excessive and limited as required with regard to the intended purpose;
• ensure the quality, accuracy and update of the Personal Data;
• ensure that the Personal Data is not kept beyond the duration necessary with regard to its required purpose. In this regard, the Data Controller shall define and communicate to the Sub-contractor the retention periods to be applied to the Personal Data processed by the Sub-contractor in the context of the Agreement;
• to ensure the respect of the data subjects’ rights (in particular, the right of access, interrogation, rectification, objection, deletion, limitation, portability) and to respond to the data subjects’ requests according to the terms and within the periods required.

The Data Controller shall hold harmless the Sub-contractor for any complaint arising from the Data Subjects to the extent the complaint is arising out of Data Controller’s breach of the applicable law..

The Sub-contractor shall hold harmless the Data Controller for any complaint arising from the Data Subjects if arising out of Sub-contractor’s breach of the applicable law or security measures.

3.3. Consent to subsequent sub-contracting

The Data Controller acknowledges, accepts and consents that, for the sole exclusive purpose of the provision of Services and subject to the respect of the terms hereof, the Data Controller’s Personal Data may be processed by the Sub-contractor or its Subsequent Sub-contractors, the list of which is included in Purchasely’s Processing Register.

The Sub-contractor has a general authorization to hire Subsequent
Sub-contractors subject to the Sub-contractor: providing the Data Controller with prior information on the Subsequent Sub-contractors’ identity and informing the Data Controller of any update of the list of Subsequent Sub-contractors in order for the Data Controller to object to the hiring of these Subsequent Sub-contractors.

In the event of change, deletion or new Subsequent Sub-contractor intervening on the Processing, the Sub-contractor shall notify the Data Controller of the updated list of Subsequent Sub-contractors in writing at least two (2) months before the launch date of the Subsequent Sub-contractor’s services. This notification must specifically mention the processing activities sub-contracted, the identity and contact details of the subsequent Sub-contractor and the dates of the sub-contracting Agreement.

The Data Controller shall have a period of ten (10) days as from the date of receipt of this notification to formulate a written and substantiated objection to this modification of the list of Subsequent Sub-contractors. The Sub-contractor shall undertake to present a new Subsequent Sub-contractor and/or present a modification of Services enabling the prevention of recourse to a Subsequent Sub-contractor being objected by the Data Controller.

The Sub-contractor shall undertake to enter into agreements with the Subsequent Sub-contractors including the same obligations concerning the Processing as this Agreement. The Sub-contractor also undertakes to have recourse to Subsequent
Sub-contractors who present sufficient guarantees, in accordance with those provided under the Agreement, in particular when the latter are applied for setting up appropriate technical and organizational measures for the Personal Data processing, established in accordance hereto. The Supplier shall stand as guarantor for the respect hereof by any Sub-contractors.

The Sub-contractor shall undertake to accomplish an appropriate and reasonable diligence in the selection of Subsequent Sub-contractors and when the Subsequent Sub-contractors fail to comply with their obligations with regard to Personal Data protection, the Sub-contractor shall remain fully liable for the respect of the obligations stipulated herein by the Subsequent Sub-contractors.

3.4. Security measures

Given the status, costs of implementation and type, scope, context and purpose of the Processing, and the risks, the level of probability and gravity of which varies depending on the rights and liberties of individuals, the Sub-contractor shall undertake to implement the appropriate technical and organizational measures in order to guarantee a level of security adapted to the risk.

The Sub-contractor’ technical security measures are detailed in the Purchasely ISSMP, available upon request by the Client.

The Sub-contractor shall undertake to continue these measures throughout the performance of the Agreement. In the event of a change of resources to ensure the Data security, the Provider shall undertake to replace the latter by a performance at least equivalent thereto. 

It is understood that the Sub-contractor’s commitment resides in the implementation of such measures and not for the accomplishment of a result resulting from such implementation.

3.5. Privacy by design / by default procedure

The Sub-contractor must take the appropriate technical and organizational measures:

• intended to effectively implement the minimization and retention principles for the  Personal Data, 
• enabling it to be ensured that, by default, only the Client’s Personal Data for each specific Processing objective shall be processed, including the implementation of archiving and anonymization procedures.

The Sub-contractor uses inter-operable formats to enable the portability of the Client’s Personal Data required by the Personal Data Regulations, and setup the organizational and technical measures enabling the Client to duly respect the Data Subjects’ rights, in particular the right to access their Personal Data, the right to obtain the rectification or deletion of their Personal Data or the blockage for the Processing of their Personal Data, the right to contest the decisions based on the profiling, and the right of portability for the Personal Data, if applicable.

3.6. Impact analyses

The Sub-contractor assists the Data Controller for the realization of impact analyses relating to Data protection if the latter is rendered obligatory by the applicable Regulations, given the nature of the processing and information at the
Sub-contractor’s disposal.

Similarly, the Sub-contractor shall assist the Data Controller for the realization of the prior consultation of the regulatory authority provided under Article 36 of the GDPR.

3.7. Iternational transfers

Unless specifically and expressly authorized to the contrary by the Client, the Sub-contractor shall undertake to process the Personal Data exclusively on the territory of a member State of the EEA.

The Sub-contractor shall undertake not to disclose, render accessible or transfer any of the Client’s Personal Data, even for the purposes of data flow, to any Processing entity or any Subsequent Sub-contractor in a third-party country located outside of the EEA, unless the Client has provided prior written consent. 

In the event of a transfer outside of the EEA authorized by the Client, such transfer shall only be made as required for the provision of the Services, and insofar as this transfer is operated to a State for which the Personal Data protection legislation was recognized by the European Commission as presenting an equivalent level of protection, or established by the conclusion of standard contractual clauses issued by the European Commission or carried out on the basis of any other alternative basis recognized by the Personal Data Regulations, subject to the Client’s prior written approval on this alternative basis. The Provider shall stand as guarantor for the signature and respect of the requirements herein by its own Subsequent
Sub-contractors.

3.8. Cooperation obligations

The Parties cooperate in good faith to ensure the respect of the provisions herein, including, but not exhaustively, to ensure the correct and appropriate exercise of Data Subjects’ Rights, manage incidents in the event of a Personal Data Breach in order to mitigate any undesirable effects.

The Parties cooperate in good faith to make available to the other Party and the Supervisory Authorities, following a control by the Data Controller, the information required to establish the respect of the Personal Data Regulations.

3.9. Processing registers

The Sub-contractor shall keep a register of the processing activities accomplished on behalf of the Data Controller, including those granted to its Subsequent
Sub-contractors to whom it has granted all or part of the Processing with the Data Controller’s authorization, by mentioning for each Subsequent Sub-contractor the Processing activities granted, the service location, and the Data Controller’s Personal Data transfers outside of the EEA and/or outside of the country in which the Data Controller is established or in which the Data Controller’s Personal Data is collected. 

This register must also include the information concerning the implementation of the appropriate protection measures to ensure an adequate level of protection, such as provided by the Personal Data Regulations.

This register, attached hereto, is accessible at any time for the Data Controller and the authority competent for Personal Data protection.

3.10. Data subsjects' rights

Right of information

The Data Controller confirms that he proceeded with all the obligations required with regard to the Personal Data Regulations, and that he had informed the Data Subjects of the use made of such Personal Data. 

Processing of the requests for the exercise of Data Subjects’ right

The Data Controller shall remain liable for the response to solicitations and requests for the exercise of the Data Subjects’ rights. 

The Sub-contractor shall provide the Data Controller with reasonable cooperation and assistance and any information reasonably required to respond to the Data Subjects or otherwise, in order to enable the Data Controller to meet its obligations by virtue of the Personal Data Regulations in relation with the Data Subject’s Rights.

The Sub-contractor shall make technically reasonable efforts to ensure the
inter-operability of Personal Data in order for the Data Subjects to exercise their portability right under the conditions provided by the Personal Data Protection Regulations.

The Sub-contractor shall undertake to notify the Data Controller in writing, within a maximum period of seventy-two (72) hours, as soon as he receives a direct request from a Data Subject. The Sub-contractor shall undertake not to respond to any request from a Data Subject without the Data Controller’s prior written consent, except for confirmation that the request duly relates to the Data Controller, which the latter hereby accepts. 

3.11. The use of the personal data

Upon the termination of the Agreement, the Sub-contractor shall undertake to return and/or destroy the Personal Data under the conditions defined hereafter, at the Data Controller’s discretion.

The Sub-contractor shall return or destroy the Data Controller’s Personal Data, without expense for the Data Controller, upon the latter’s request and upon the expiry or premature termination of the Agreement subject to a written request by the Data Controller, in consideration for a reasonable notice period, unless the applicable mandatory laws (including, but non-exhaustively, the Personal Data Regulations or the authorities in charge of the application of the law), including, but not exclusively, the Supervisory Authority, prevent the Sub-contractor from doing so.

Concerning the Data Controller’s specific requests concerning the return of the Data Controller’s Personal Data, such a request shall be satisfied without an unjustified delay and at the latest fifteen (15) business days after the Data Controller’s request.

If the Data Controller decides to delete the Personal Data, the Sub-contractor shall provide a declaration to ensure such deletion.

3.12. Personal data breach

The Data Controller acknowledges and accepts that the Sub-contractor shall not be held liable for Personal Data Breaches that are not attributable to the Sub-contractor’s negligence. 

If the Sub-contractor of the data becomes aware of a Personal Data Breach, he shall do as follows:

• take the appropriate measures to limit and mitigate such Personal Data Breach, in particular, by notifying the Data Controller as soon as possible, but under no circumstances more than twenty-four (24) hours after the Sub-contractor has become aware of this Personal Data Breach, to enable the Data Controller to promptly setup his program accordingly;
• cooperate with the Data Controller to define the following: the type, categories and approximate number of Data Subjects, the categories and the approximate number of registrations of Personal Data made and the potential consequences of such Personal Data Breach in order for the latter to be proportionate to its gravity and global impact on the Data Controller and the service provision herein;