Source: https://livesession.io/data-processing-agreement
Timestamp: 2019-04-26 16:26:55+00:00

Document:
This Personal Data Processing Agreement (hereinafter referred to: the „Agreement”) is concluded in order to supplement the SaaS Agreement as defined in the SaaS Agreement between LiveSession and Client (hereinafter referred to as: the „SaaS Agreement”).
The Controller and the Processor are hereinafter jointly referred to as the Parties and solely and the Party.
In accordance with the conditions and principles arising from this Agreement and the SaaS Agreement, the Controller entrusts the Processor the processing of personal data (hereinafter referred to as: "data" or "personal data").
By the processing of personal data, the Parties understand in particular any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
The purpose of this Agreement is to define the conditions and principles for the processing of personal data. At the same time, to the extend not specified in this Agreement, the Parties shall accept the conditions and principles for the processing of personal data resulting from the Regulation and other generally applicable legal acts.
The Processor, taking into account the nature of the processing and the available information, assists the Controller to meet the obligations set out in articles 32-36 of the Regulation, guaranteeing at the same time the high level of security of processing of personal data. The Processor assists the Controller to meet the obligation to respond to the requests of the data subject in exercise of rights set out in Chapter III of the Regulation.
the purpose of data processing is to ensure that providing non-exclusive SaaS (software as a service) license (right to use) by Processor complies with the Regulation.
and other data that turn out to be necessary due to the purpose and nature of the implementation of the SaaS Agreement.
The processing of personal data concerns the following categories of persons: visitors and users of Processor’s websites to which LiveSession SaaS is applied.
The processing of personal data shall take place in the manner necessary and proportionate to the purpose and nature of the processing of personal data resulting from the SaaS Agreement and specified in §2 sec. 1.
The Controller grants the general consent to the Processor to entrust specific data processing activities to other processors. (hereinafter referred to as: the „Sub-Processor”).
Entrusting the processing of personal data by the Processor to the Sub-Processors requires, for its validity, the conclusion of a written (including electronic) agreement on the sub-entrusting the processing of personal data (hereinafter referred to as: the "Sub-entrusting agreement").
In accordance with Sub-entrusting agreement, the Processor obliges the Sub-Processor to act in accordance with the principles and conditions resulting from this Agreement. In particular, the Sub-Processor is obliged to process personal data taking into account the principles and obligations resulting from the Regulation, the generally applicable provisions of law and this Agreement having regard to the nature and purpose of the processing of personal data resulting from the SaaS Agreement.
The Processor shall promptly, yet not later than within 30 business days, inform the Controller about any instances of sub-entrusting, changing, adding or replacing any Sub-Processor. The obligation to inform may be performed by an update of the list of Sub-Processors made available on the LiveSession’s website https://livesession.io/subprocessors to what the Controller explicitly consents. The Controller may, for justified reasons, file an observation to sub-processing, changing, adding or replacing any of the Sub-Processors. For an avoidance of any doubt, by consenting to this Agreement the Controller agrees to the following, but not limited to, Sub-Processors: Google Ireland Limited.
In the case when the observation has been filed by the Controller, the Processor is not entitled to entrust data to the Sub-Processor covered by the observation, and if the observation concerns the current Sub-Processor, entrusting the processing of personal data to this Sub-Processor shall immediately be terminated.
In the event of concluding further Sub-entrusting agreements, the Controller retains the right to be informed of every case of sub-entrusting and retains the right to file the observation.
Providing information and filing observations shall be made by means of electronic communication to the e-mail addresses indicated in § 13 sec. 5.
The Processor declares to know and adheres to the conditions and principles of using the services of another Processor (Sub-Processor).
The Processor is responsible for the actions and omissions of the Sub-Processor as for his own actions and omissions. For the avoidance of doubt, full responsibility for ensuring compliance of the processing of personal data by the Sub-Processor with the SaaS Agreement, this Agreement, Regulation and other provisions of generally applicable law rests with the Processor.
The Processor is not allowed to entrust the Sub-Processor with the processing of personal data to the full extent specified in this Agreement without the prior written consent of the Controller.
The Parties jointly agree that the personal data may be transferred to a country or international organization from outside of the European Economic Area, with the reservation of § 4 sec. 3.
The Processor informs that it uses subcontractors, in particular Sub-Processors, who transfer data to natural or legal persons from countries or organizations from outside of the European Economic Area, with the reservation of § 4 sec. 3.
The Processors may transfer the personal data, or may allow a Sub-Processor to transfer the personal data outside of the EEA, provided that requirements prescribed by the Article 45 or 46 or 49 of GDPR are fulfilled.
If the obligation to transfer data outside of the European Economic Area is imposed on the Processor by the European Union law or the law of a Member State, in such a case before the processing begins, the Processor informs the Controller about this legal obligation, unless this law prohibits revealing such information due to important public interest.
The Processor processes personal data only in accordance with the documented orders and instructions of the Controller.
The Processor shall obtain, from persons who have been authorized to process personal data, written declarations to keep confidentiality of all information and data about which they have learned directly or indirectly in conjunction with the processing of personal data.
The Processor ensures the protection and security of personal data and takes the necessary measures to protect personal data referred to in art. 32 of the Regulation.
The Processor undertakes to cooperate and assist the Controller in the implementation of the rights of the individual set out in Chapter III of the Regulation, in particular through the use of appropriate technical and organizational measures to comply with a request of the data subject in the exercise of rights set out in Chapter III of the Regulation.
The Processor undertakes to cooperate and assist the Controller in the implementation of obligations arising out from the area of personal data protection, referred to in art. 32 - 36 of the Regulation. The abovementioned area of personal data protection covers, in particular, protection of personal data, reporting violations to the supervisory authority, notifying people affected by data breach, assessment of consequences for the protection of personal data and prior consultation with the supervisory authority.
The Processor undertakes to provide the Controller, upon every reasonable request, all pieces of information necessary to ensure the lawfulness of personal data processing, demonstrating the Controller's compliance with the provisions of the Regulation and enables the Controller or the auditor authorized by the Controller to carry out audits and inspections of personal data processing.
The Processor shall promptly inform the Controller if, in his opinion, orders or instructions issued to him violate the provisions of the Regulation, other provisions of the law of the European Union or law of the Member State regarding personal data protection. The Processor shall promptly inform the Controller about any doubts raised, under the pain of losing the right to assert claims against the Controller in this respect.
The Processor cooperates with the appropriate authority for the protection of personal data in the scope of performing its tasks, as well as with other European Union bodies, national and local government authorities as the extent this cooperation is related to the protection and security of personal data.
The processor undertakes to comply with the requirement to use the default privacy protection settings referred to in Article 25 sec. 1 of the Regulation and immediately informs about plans to change the way of the processing of personal data. Changes in the way of the processing of personal data shall not lower down the agreed level of security of the processing of personal data.
The Processor agrees that access to personal data shall be limited only to one that is necessary for the proper performance of the Agreement and shall be available only to persons authorized and trained in the scope of provisions on the protection of personal data.
The Processor undertakes to maintain a registry of activities related to the processing of personal data. At every request of the Controller, the Processor shall provide the registry of personal data processing activities, excluding information constituting business secrets of the Processor’s other clients.
The Controller undertakes to cooperate and assist the Processor in order to correctly implement the provisions of this Agreement and the SaaS Agreement aiming at guaranteeing the high level of personal data security and full compliance of the actions taken in accordance with the Regulation and other generally applicable laws. The Controller cooperates and assists the Processor, in particular for the purpose of implementing the rights of the individual set out in Chapter III of the Regulation, and in order to fulfill the obligations arising from the area of personal data protection, referred to in art. 32 - 36 of the Regulation.
The Processor declares that he ensured the high level of security of personal data in view of the nature, scope, context and purposes of the processing of personal data.
The Processor has carried out an analysis of the risk of the processing of personal data that has been entrusted to him (hereinafter referred to as the "Report"). The Processor implemented the appropriate technical and organizational measures corresponding to the risk resulting from the Report, taking into account the state of technical knowledge and reasonable costs of implementing safeguards.
The Processor shall conduct analyzes of the processing of personal data at least once in the calendar year. Based on the Report and the resulting level of risk, the Processor shall take actions to ensure the high level of data security, taking into account the state of technical knowledge and reasonable costs of implementing safeguards.
test regularly, measures and evaluates the effectiveness of technical and organizational measures to ensure the security of data processing.
The Processor declares that he has taken steps to ensure that every natural person acting as the entity authorized by the Controller or Processor, who has access to personal data, processes them only at the Controller's request through such organization of the system of operation that access to the data being processed is limited only for persons authorized and trained in the scope of provisions on the protection of personal data.
On demand, the Processor provides the Controller with certificates, declarations as well as other documents confirming the high level of security of processing personal data and implementation of appropriate technical and organizational measures.
The Processor, after finding the breach of personal data protection, without unnecessary delay, yet not later than within 24 hours from finding the breach, notifies the Controller about the fact of the breach.
describe measures taken or proposed by the processor to remedy an infringement of personal data protection, including, where appropriate, measures to minimize its potential adverse effects.
The processor is obliged to act without undue delay, seeking for the Controller to report a breach of personal data protection authority to the supervisory body no later than within 72 hours after finding the breach.
The Processor shall document any breaches on the protection of personal data, including the circumstances of personal data breach, its consequences and the remedial actions taken.
The Controller declares that he is authorized to process data to the extent that he entrusted processing to the Processor.
The Controller declares that he has the knowledge, capabilities, resources and experience to correctly perform his obligations under this Agreement.
The Processor declares that as part of his business activity he professionally deals with the processing of personal data covered by the Agreement and the SaaS Agreement, possessing the necessary knowledge, capabilities, resources and experience. In particular, the processor possesses the appropriate technical and organizational measures necessary for lawful processing of data, thus giving a guarantee of due performance of this Agreement.
The Processor is liable for damages caused by the processing of personal data when he has not fulfilled his obligations which the Regulation imposes directly on the Processor, or when he acted outside the lawful Controller's instructions or contrary to these instructions.
The Processor is responsible in particular for actions or omissions that violate the guarantee of the high level of data security.
The Parties mutually agree that the processing of personal data shall be carried out during the period of the SaaS Agreement and special period (hereinafter referred to as: the "Withdrawal period").
This Agreement has been concluded for the duration of the SaaS Agreement, with the reservation of the Withdrawal period.
The Withdrawal period lasts for 30 days and is counted from the date of termination or expiration of the SaaS Agreement. The Parties may agree to change the Withdrawal period.
If the provisions of this Agreement are either invalid or ineffective, or the Agreement contains a loophole, it shall not affect the validity and effectiveness of the remaining provisions of the Agreement. Instead of invalid or ineffective provisions, or to fill the loophole, the appropriate regulation will be binding, which – as long as is legally admissible – would be as close as possible to what the Parties have agreed upon or what the Parties agreed upon if they would conclude such a provision, under the condition that, the entire Agreement without invalid or ineffective provisions preserves reasonable content.
In matters not covered by this Agreement provisions of the Regulation and SaaS Agreement shall apply as well as the provisions of generally applicable law on the territory of the Republic of Poland.
In the event of a crash between the provisions of this Agreement and the provisions of the SaaS Agreement, the provisions of this Agreement shall prevail to the extent to which they regulate the relationship of entrusting the processing of personal data between the Controller and the Processor.

References: §2
 § 13
 § 4
 § 4
 art. 32
 art. 32
 art. 32