ANNEX NO. 2 TO THE TERMS OF SERVICE FOR THE ELECTRONIC PROVISION OF SERVICES OF THE SERVICE 2.0 SYSTEM
DATA PROCESSING AGREEMENT
(hereinafter: the “DPA”)
concluded between the Workshop (hereinafter the “Controller”) and Service 2.0 Prosta Spółka Akcyjna (Service 2.0 P.S.A.), with its registered office in Poznań, ul. Święty Marcin 29/8, 61-806 Poznań, entered in the register of entrepreneurs of the National Court Register under KRS number 0001102708, whose registration files are kept by the District Court for Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, NIP 7831903174, REGON 528481031 (hereinafter the “Processor”), by the Workshop’s acceptance of the Terms and of the DPA.
§ 1. Purpose and subject matter of the entrustment
The DPA is concluded for the purpose of performing the agreement for the provision of the services of the Service 2.0 system concluded on the terms set out in the Terms (hereinafter: the “Main Agreement”) and forms an integral part of it.
The Controller entrusts the Processor with the processing of personal data for the purpose of, and to the extent necessary for, the performance of the Main Agreement, including making available and maintaining the tools of the Service 2.0 system (among others the Panel, the App and the Connector extension) and providing technical support. The processing comprises storing data in the cloud, processing data within the functionalities of the Service 2.0 system, and maintenance and technical support of the Service 2.0 system.
The scope of the entrusted data covers:
Within the Panel, the App and the Loyalty App: data of Users and employees of the Workshop (first name, surname, telephone number, email address, records of Users’ actions in the Panel and their statistics), data of Workshop Clients (first name, surname, telephone number, email address, IP address, login data, transaction history and other data entered by Workshop Clients when using the Loyalty App, in particular in messages sent in the Loyalty App), vehicle data (make, model, year, VIN, registration numbers, repair history), data of Workshops’ suppliers (first name, surname, telephone number, email address).
Within the Connector extension: appointment data, vehicle data, the order number and the first name and surname of the Workshop Client – retrieved solely for the purpose of synchronising parts orders with the e-Catalogue of Inter Cars S.A.
§ 2. Specifics of processing by the Connector extension
The Parties confirm that the Connector extension operates on the personal data of Workshops’ clients only temporarily and locally, in the cache memory (RAM) of the User’s web browser.
The Connector extension does not save the entrusted data on the hard drives of devices, does not store it permanently and does not send it to the Processor’s servers. This data is irreversibly deleted once the order is finalised or the session is closed.
The only external transfer operation performed by the Connector is the automatic transmission of the technical appointment number in the format [S20 appointment number] to the external e-Catalogue of Inter Cars S.A. together with the order placed by the User.
The Controller is responsible for ensuring the security of the end devices on which Users install and run the Connector extension, including protecting those devices against unauthorised access by third parties and against malware.
The Processor is not liable for irregularities in the processing or transfer of data by the Connector extension resulting from technical changes, modifications of the source code, or errors or technical problems on the side of Inter Cars S.A.
§ 3. Obligations of the Processor
The Processor undertakes to:
Process data only on the documented instructions of the Controller, which are deemed to be the operations ordered by Users in the Service 2.0 system. The conclusion of the Main Agreement and the use of the functionalities of the Service 2.0 system are also deemed to be such instructions.
Ensure that the persons authorised to process the data have committed themselves to confidentiality.
Apply technical and organisational measures ensuring cloud security, including encryption of connections using the SSL/TLS protocol.
Notify the Controller of a personal data breach without undue delay, and no later than within 48 hours of its discovery.
Assist the Controller, as far as possible, in fulfilling its obligation to respond to requests from data subjects.
§ 4. Further entrustment (Sub-processing)
The Controller gives its general consent to the Processor using the services of other processors (Sub-processors) indicated in the current Privacy Policy.
The Processor will inform the Controller of planned changes of Sub-processors by email or in the Panel, giving the Controller the right to object within 14 days.
§ 5. Inspection and audit
The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR.
The Controller has the right to carry out an audit of IT procedures relating solely to its own data, after giving 30 days’ notice. The audit may not breach business secrets in relation to other clients of the Service 2.0 system or disrupt the operation of the system.
§ 6. Duration and deletion of data
The DPA remains in force for the duration of the Main Agreement and expires on the date on which the Main Agreement expires.
After the Main Agreement expires, the Processor deletes all personal data and deletes existing copies, unless applicable law requires their further storage.
Upon expiry of the Main Agreement, personal data in the production databases is permanently deleted within 30 days of the date of expiry of the Main Agreement. The data is completely deleted from backup copies within a further 30 days.
§ 7. Final provisions
Capitalised terms used in this DPA that are not defined in this DPA have the meaning given to them in the Terms of Service for the Electronic Provision of Services of the Service 2.0 System (the “Terms”).
The DPA is governed by the law of the Republic of Poland. In matters not regulated by this DPA, the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”) and the provisions of the Polish Civil Code apply. All disputes will be subject to the jurisdiction of the courts of the Republic of Poland and will be resolved by the common court having local jurisdiction over the Processor’s registered office.