Source: https://retargeting.biz/personal-data-processing-contract
Timestamp: 2019-04-24 02:07:34+00:00

Document:
The current addendum to the Terms and Conditions for the usage of Retargeting.biz services provides the specific rules concerning the processing of the personal data sent by the Beneficiary, in the role of Operator, to Retargeting.biz, in the role of Provider.
1. The terms of the current addendum, will be interpreted according to art. 4 of GDPR.
Personal data processing is done for the purpose of providing the services stated in Terms and Conditions available on the Retargeting.biz website and for statistical purposes.
Data transfer to third parties will be done only following written instructions, within the confines and instructions received from the Operator, according to art. 9.
• Collect, process and host personal data, mentioned in article 5, received directly from the Operator by integration of the codes provided by the Provider inside of the Operator’s website, and use this data with the purpose of profiling the users of the Operator’s website.
Personal data processing will be done in accordance with the Operator’s instructions, but the period cannot exceed the duration of the Terms and Conditions.
Even if most of the communications done by the provider are based on information obtained from profiling the Operator’s users, they don’t have any judicial effects and it doesn’t affect it in any significant way. However, the Operator can input new actions and he is the one that has to make sure that the sent messages can’t be interpreted as effects required by art. 22 of GDPR.
• User’s actions on the Operator’s website, together with the actions performed by the Operator towards the user such as: discount code, discount value, shipping costs, order value, ordered products’ price, product variation, products, device, OS, IP location, timestamps about viewed pages, viewed page, category, brand, click on picture, mouseover cart, mouseover price, scroll up & down, add to cart, remove from cart, variation selection, add to wishlist, comment, Facebook Like, Help page visit, cart products’ IDs, price categories, promotion tag, in email action, in push notification action, in SMS action, in pop-up action.
Retargeting.biz is not intended for the collection of special personal data or personal data belonging to vulnerable groups and we caution the Operators against using it to that effect.
However, it is possible that the Operator, if he has activities in a certain field, to be technically capable of using parts of the Provider services without the Provider being aware.
We remind you that the Operator has the duty to analyze and choose the appropriate legal basis on which he stands on when he processed personal data, including the ones sent to Retargeting.biz to be process by it, in its role of Provider to the Operator.
The groups of persons targeted are visitors, registered users and clients of the Operator’s website, as appropriate, accordingly to the chosen service.
According to art. 28, paragraph (3) of Regulation (EU) 12016/679 the contract is mandatory for the contracting parties.
8.1. The Provider has the obligation, for the entire period of the contract and after its closure, for 5 years, not to share personal data and/or confidential information that could be considered personal data, that it acquired during the contract duration.
8.2. The Provider has the obligation, for the entire period of the contract, to provide training for the employees concerning personal data processing and the privacy of this data.
8.3. The Provider has the obligation, during the entire period of the contract, to implement and monitor the activity of the instruments and procedures associated internally with the privacy of personal data, owned by the Operator.
b. Not to reuse personal data and any information and/or document containing personal data and whereof took note in implementation of the contract, in any way and for any other reason not stated in the current contract, in self interest, a third party interest, free or burdensome.
8.4. The Provider is allowed to disclose/ divulge certain personal data, including confidential information, when required by authorities, public institutions, legal institutions, or a legally licensed third party, due to a legal obligation or other statutory circumstances.
9.1. In case the Provider is the one processing the data through other providers recruited by him (from now on known as “Secondary Providers”), this operation will take effect under this article.
- Other providers that, for privacy reasons, cannot be disclose, but are part of EU, EEA or a country with proper protection acknowledged by the European Commission directive and has security standards at least as high of those offered by the Provider according to art. 28, paragraph (4) of GDPR.
9.3. For future Secondary Providers, the Provider gets a general authorization to subcontract any other Provider from EU, EEA or a country with proper protection acknowledged by the European Commission directive, based on a similar contract, informing the Operator and giving him the possibility to object, within 5 working days.
The Provider has established internally the implementation of proper organizational and technical security measures. The measures stated at art. 10 are included in the Internal Security Policies.
e. The Provider doesn’t replace the Operator, solely responsible to notify the national supervisory authority.
e.3. Will carry out, at the Operator’s request, the operation of notifying the targeted individuals, via email; any other form of communication imposed by the authority will be done solely by the Operator and at the Operator expense, except if the Provider is found responsible.
a. The provider acts according to the Operator instructions as stated in art. 2, under his leadership, and processes personal data as they are acquired by the Operator. The gathering of personal data by the Provider is done on behalf of the Operator, on the basis of this contract.
b. In the partnership with the Operator, the Provider does not establish the reasons or the way the personal data is processed, even when he advises the Operator about different processing methods.
c. The Operator has the sole responsibility of establishing the legal ground and, if necessary, get the consent of the targeted individuals in order to process the personal data that represent the entity of the current contract or the use of another legal ground, including when the Provider collects personal data on behalf of the Operator.
d. In all circumstances in which the Operator has to carry out an obligation, such as informing a targeted person about a data security breach, the Provider is not accountable for the inactions of the Operator.
e. The Operator and the Provider are establishing the responsibilities concerning personal data protection (eg. confidentiality and processing security), according to the access and control over the data, from both a legal and a technical point of view.
f. If the Provider defies GDPR, by establishing the reasons and means of personal data processing and/or breaching them, the Provider is considered an operator only when it comes to that processing.
The Operator can appoint o data protection officer for his Retargeting.biz account.
c. To be assisted by the Provider in order to carry out his obligation to reply to requests regarding the specific rights of the targeted person.
b. To cover the general costs for assisting the Operator in the circumstances stated at art. 10.1.e, 12.1.b, 12.1.c.
c. To use statistical information containing only anonymized data, resulted from the services provided according to the current contract and/or the Provider’s services in general, in his own purposes of research, analysis and promotion of the Provider’s services.
j. To allow audits, including inspections, done by the Operator or other mandated representative and to provide all necessary information.
To abide, on his own, the regulations of GDPR in his duty as Operator, concerning personal data processing by the Provider, on his behalf.
14.1. The Provider is responsible for the damage caused by the processing if he didn’t abide by his GDPR obligations and according to the partnership rules stated at art. 10.2 of the current contract.
14.2. The Provider is responsible for the damage caused by the processing if he acted outside or against the legal instructions of the Operator.
14.3. If the Provider recruited a secondary provider that didn’t abide by the personal data obligations, the Provider is solely responsible towards the Operator concerning the accomplishment of the obligations of the secondary provider.
d. Lack or vitiation of agreement of targeted persons.
No party is responsible for damage caused by events provided with evidences of lack of liability, such as entries issued by authorities that state the intervention of a force majeure event.
The current contract is servient to the judicial circumstance of the Terms and Conditions to the degree and within the limits of the objectives related to personal data processing, as stated in art. 2.1 and is applied prevalently to the Terms and Conditions, that contains commune law norms.

References: art. 4
 art. 9
 art. 22
 art. 28
 art. 28
 art. 10
 art. 2
 art. 10
 art. 10
 art. 2