Source: https://www.zenloop.com/en/legal/data-processing
Timestamp: 2019-06-18 09:33:39
Document Index: 475366201

Matched Legal Cases: ['§ 3', '§ 6', '§ 4', '§ 7', '§ 8', '§ 10', '§ 13', '§ 9', 'Art. 44']

- Data Processor -
(1) General. This agreement (the "Data Processing Agreement") forms part of the master agreement between you and zenloop relating to the provision of our Services (the "Agreement").
(2) Subject matter of Agreement. This Data Processing Agreement describes how zenloop will Process Survey Recipient Data that you provide to us in connection with your use of our Services, in accordance with the requirements of Data Protection Laws.
(1) "Agreement" means the agreement between you and zenloop relating to the provision of our Services, as set forth in our Terms of Service.
(2) "Customer" or "you" refers to you, the person who is entering into the Agreement (including this Data Processing Agreement) with zenloop; If you use our Services on behalf of an organization, you agree to these terms on behalf of that organization and you represent that you have the authority to do so. In such case, "Customer" or "you" will refer to that organization.
(3) "Data Protection Laws" means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, applicable to the processing of personal data (including in connection with providing telecommunication services and conducting email marketing), and including, without limitation, the GDPR, the German Act Against Unfair Competition (UWG), the German Telecommunications Act (TKG) and the German Telemedia Act (TMG).
(4) "GDPR" means the General Data Protection Regulation.
(5) "Process" or "Processing" means any operation or set of operations which is performed by zenloop as part of the Services upon Survey Recipient Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
(6) "Services" means the services that we provide through our Site, including our customer insight and loyalty services.
(7) "Site" means our website, www.zenloop.com, as well as the associated platform.
(8) "Subprocessor" means a third party subcontractor engaged by zenloop which, as part of the subcontractor's role of delivering the Services, will Process Survey Recipient Data.
(9) "Survey Recipient" means any identified or identifiable natural person who is a customer, employee or business contact of yours and who has been or will be contacted by you through our Site.
(10) "Survey Recipient Data" means any personal information relating to a Survey Recipient that you or any of your Survey Recipients provide to zenloop in connection with your use of the Services.
§ 3 Scope, Duration, Type of Survey Recipient Data and Categories of Data Subjects
(1) General Scope. Under the terms of this Data Processing Agreement, zenloop will Process Survey Recipient Data on behalf of Customer in accordance with article 28 GDPR.
(2) Duration. This Data Processing Agreement shall be effective for the duration of zenloop's Services under the Agreement, and shall terminate automatically upon expiration or termination of the Agreement for any reason.
(3) Scope, Nature and Purpose of Processing. The scope, nature and purpose of the Processing of Survey Recipient Data hereunder shall be as defined in the Agreement and in our Privacy Policy.
(4) Types of Data. Processing may include the following types/categories of Survey Recipient Data: personal information including name or email address, IP address, usage data, device data, referral data and information from cookie and page tags.
(1) Processing Instructions. During our Services, you may provide instructions to us in addition to those specified in this Data Processing Agreement with regard to the processing of Survey Recipient Data (each such instruction hereinafter, a "Processing Instruction") in connection with our Services. Any Processing Instruction must be in writing or in electronic form. We will process your Survey Recipient Data according to your instructions.
(1) Compliance of Processing with Data Protection Laws. You are responsible for ensuring that the Processing of Survey Recipient Data hereunder complies with the requirements of Data Protection Laws, including, but not limited to, concerning (i) the transmission of Survey Recipient Data to zenloop (including providing any required notices and obtaining any required consents), (ii) the use of any Survey Recipient Data in connection with any marketing or advertising you conduct, and (iii) your decisions and actions regarding the Processing and use of the Survey Recipient Data.
(2) Customer as Controller. You will be the controller as defined in article 4 paragraph 7 GDPR. You shall have sole responsibility for the accuracy, quality, and legality of Survey Recipient Data and the means by which you have acquired Survey Recipient Data.
§ 6 zenloop Obligations
(1) Processing solely for provision of Services. We will Process your Survey Recipient Data only on documented instructions from you and solely for the provision of the Services in accordance with article 28 paragraph 3 a) to h) GDPR and will not otherwise (i) Process or use your Survey Recipient Data for purposes other than those set forth in the Agreement or this Data Processing Agreement or (ii) disclose your Survey Recipient Data to third parties other than Subprocessors for the aforementioned purposes or as required to do so by Union or Member State law to which we are subject. In such a case, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(2) Processing within and outside the EU/EEA. We will generally Process Survey Recipient Data within the territory of the Federal Republic of Germany, a Member State of the European Union or another signatory to the Agreement on the European Economic Area. In some instances, we may also transfer Survey Recipient Data to our third party service providers located in the United States of America; please see our annex 2 for details on the third party service providers we use.
(3) Personnel of zenloop. We will ensure that our personnel engaged in and authorized for the Processing of Survey Recipient Data are informed of the confidential nature of the Survey Recipient Data and have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(4) Our data protection officer. We have appointed a data protection officer: Inna Gendelman, ISiCO Datenschutz GmbH, Am Hamburger Bahnhof 4, 10557 Berlin. The person may be reached by email via dpo@zenloop.com.
(1) zenloop TOMs measures. When we Process Survey Recipient Data on your behalf, we will take all measures required pursuant to Article 32 GDPR, and have implemented and will maintain certain technical and organizational security measures for the Processing of such data, as such measures are specified in Annex 1. These measures are intended to protect Survey Recipient Data against accidental or unauthorized loss, destruction, alteration, disclosure or access, and against all other unlawful forms of processing.
(1) Customer Audits. You may, prior to the commencement of our Services and up to once per year during the performance of our Services, audit the technical and organizational measures implemented by zenloop. You may perform more frequent audits to the extent required by Data Protection Laws.
(2) Details regarding Audits. In the course of such audit, you may, in particular, conduct the following measures: (i) You may obtain all such information from zenloop that is necessary to demonstrate compliance with the obligations laid down in this Data Processing Agreement. (ii) You may request zenloop to submit to you an existing certificate by a qualified third party auditor. (iii) You may, upon reasonable advance agreement, during regular business hours and without interfering with zenloop's business operations, conduct an on-site inspection of those parts of zenloop's business facilities where Survey Recipient Data is being processed, subject to zenloop's then-applicable security policies.
(3) On-Site Inspections. To request an on-site inspection, you must submit an inspection plan to us at least two weeks in advance of the proposed inspection date, describing the proposed scope, duration and start date of the inspection. We will review the inspection plan and provide you with any concerns or questions (for example, any request for information that could compromise zenloop's security, privacy, employment or other relevant policies).
(6) Costs of audits. Any audits are at your expense. Any request for zenloop to provide assistance with an audit is considered a separate service if such audit assistance requires the use of resources different from or in addition to those required for the provision of the Services. We will seek your written approval and agreement to pay any related fees before performing such audit assistance.
(7) Third party auditors. If a third party is to conduct the audit, the third party must be mutually agreed to by Customer and zenloop and must execute a written confidentiality agreement acceptable to zenloop before conducting the audit.
(1) Subprocessors. We may engage Subprocessors to assist in the Processing of your Survey Recipient Data. By entering into this Data Processing Agreement with us, you give your prior general written authorization to our use of Subprocessors in accordance with article 28 paragraph 2 GDPR. A list of Subprocessor is providedin annex 2. Where we intend to add or replace a Subprocessor, we will inform you of such intended change, thereby giving you the opportunity to object to such change. If you don’t object within two weeks from our notification regarding the change of a Subprocessor, it has the same effect as a consent.
(2) Our agreements with Subprocessors. We will ensure that all of our Subprocessors are required to abide by substantially the same obligations as zenloop under this Data Processing Agreement as applicable to their performance of the Services. This shall apply in particular, but not be limited to, the requirements in § 4,§ 7,§ 8, and § 10to § 13. zenloop remains responsible at all times for compliance with the terms of this Data Processing Agreement by all Subprocessors engaged in the performance of our Services to you.
(3) As far we work with freelancers, who have access to your personal data, we ensure that we only collaborate with freelancers providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject. Processing by a freelancer is governed by a data processing agreement which ensures the same data protection standard you and we agreed on. We will provide a list of the freelancers upon request.
(4) Copies of relevant terms. You are entitled, upon written request, to receive copies of the relevant terms of zenloop's agreement with each Subprocessor that Processes your Survey Recipient Data, unless the agreement contains confidential information, in which case zenloop may provide a redacted version of the agreement.
(5) Ancillary Services. This § 9shall not apply where we engage third parties for ancillary services; these include, but are not limited to, telecommunications services, mail and shipping services, building security services, facility management services, and services relating to the cleaning or disposal of data media.
(1) Pass-through of Data Subject requests. Where a Data Subject requests us to correct, delete or block Survey Recipient Data, we will pass on such request to you. zenloop will not respond to any requests of Data Subjects without your prior written consent.
(2) Assistance. Where a Data Subject requests you to correct, delete or block Survey Recipient Data or to provide information about the collection, processing or use of Survey Recipient Data in connection with our Services and you are unable to fulfil the request by yourself through our Site, we will support you in responding to the request and in fulfilling the request by appropriate technical and organisational measures, insofar as this is possible, provided that (i) you instruct us to do so in writing or in text form and (ii) you reimburse us for the cost and expenses incurred in providing such support.
(1) No copies or duplicates. We will not create copies or duplicates of your Survey Recipient Data without your prior knowledge. Notwithstanding the preceding sentence, we may (i) create backup copies, to the extent such backup copies are required to ensure the proper Processing of Survey Recipient Data, and (ii) prepare and retain copies of Survey Recipient Data where required by us to comply with any statutory retention and storage obligations.
(2) Deletion of data. Upon cancellation of your account, or at any prior time upon your written request, we will at your choice either delete all copies of your Survey Recipient Data from our systems within one month or return such Survey Recipient Data to you. We are not liable for any loss or damage following, or as a result of, such deletion or return, and it is your responsibility to ensure that any Survey Recipient Data which you require is backed-up or replicated before deletion or return.
(3) Return of data media. If, in connection with our Services, we have received from you any data media containing Survey Recipient Data, we will return to you any such data media still in our possession at the time of cancellation of your account or upon your written request.
(4) Continued use for legal obligations. Notwithstanding the above, we will retain only those Survey Recipient Data which are required to comply with our legal obligations, resolve disputes, and enforce our agreements.
(1) Service Analyses. We may (i) compile statistical and other information related to the performance, operation and use of our Services, and (ii) use data from our Services environment in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes (clauses (i) and (ii) are collectively referred to as "Service Analyses").
(2) No Personal Data in Service Analyses. Service Analyses will not incorporate Customer's Survey Recipient Data in a form that could identify or serve to identify any Survey Recipient. zenloop retains all intellectual property rights in Service Analyses.
(1) Notification of (governmental) searches and seizures. We will, without undue delay, inform you if your Survey Recipient Data becomes subject to search and seizure, an attachment order, confiscation during bankruptcy or insolvency proceedings, or similar events or measures by third parties while in our control. In such event, we will inform all pertinent parties in such action, that any data affected thereby is in your sole property and area of responsibility, that data is at your sole disposition, and that you are the responsible body in the sense of the GDPR.
(2) Notification of incidents and breaches. We will, without undue delay, inform you if we determine that (i) your Survey Recipient Data has been subject to a security incident (including by a zenloop employee) or (ii) there has been a breach by zenloop (including by a zenloop employee) of Data Protection Laws applicable to the performance of our Services to you or of any or any of the provisions set forth in this Data Processing Agreement. In such event, we will promptly investigate the security incident or breach and take reasonable measures to identify its root cause and prevent a recurrence.
(1) Changes to these terms. zenloop may change these terms at any time for a variety of reasons, such as to reflect changes in applicable law, to reflect updates to our Services or the technical and/or organizational measures we employ, and to account for new Services or functionalities.
(2) Notification of changes. Typically, we will not notify you in advance when we modify or update the terms of this Data Processing Agreement. However, when you first log in to our Site after such modification or update, we will notify you of the change by electronic means. If you continue to use our Services following such notice, you consent to any such amendment or modification, unless zenloop receives a timely objection from you.
(3) Current version. Amendments to these terms will be effective immediately when posted on our Site. You are responsible for ensuring familiarity with the latest terms of our Data Processing Agreement. You can always find the most current version of our terms at https://www.zenloop.com/de/legal/data-processing.
Annex 1 - Data Protection Agreement (DPA)
The Processor currently works with the following subcontractors and the Controller hereby agrees to their appointment. If data processing takes place outside the European Economic Area (EEA) or if access is made from outside the EEA, the following overview must also list the measures and guarantees that ensure an appropriate level of data protection during processing in accordance with Art. 44 GDPR ff. (e.g. EU Standard Contractual Clauses, certification according to EU-U.S. Privacy Shield, Binding Corporate Rules or other arrangements by the European Commission).
Data processing activities: Data center
Company: Amazon Web Services, Inc. ("AWS")
Data location: Ireland and Frankfurt zone https://aws.amazon.com/about-aws/global-infrastructure/