Terms & Conditions

General Terms and Conditions for Order Processing

Contract for contract under Article 28(3) GDPR

This additional agreement specifies the data protection obligations of the contracting parties arising from the conclusion of the contract for the processing of order data. They are therefore an addition to the General Terms and Conditions of the Contractor and are recognized by the Client together with the General Terms and Conditions.

Preamble

The client would like to entrust the contractor with the services referred to in Section 3. Part of the execution of the contract is the processing of personal data. In particular, Article 28 GDPR places certain requirements for such order processing. In order to comply with these requirements, the parties conclude the following agreement, the fulfilment of which is not remunerated separately, unless expressly agreed.

Section 1 Definitions

(1) In accordance with Article 4(7) of the GDPR, the person responsible is the body which decides, alone or jointly with other controllers, on the purposes and means of processing personal data.

(2) In accordance with Article 4(8) GDPR, processor is a natural or legal person, authority, body or other body that processes personal data on behalf of the controller.

(3) In accordance with Article 4(1) GDPR, personal data are all information relating to an identified or identifiable natural person (hereinafter referred to as the data subject); Identifiable is a natural person who can be identified, directly or indirectly, in particular by association with an identifier such as a name, identification number, location data, online identifier or one or more specific characteristics that are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

(4) Particularly sensitive personal data are personal data in accordance with the Article 9 GDPR, which gives evidence of racial and ethnic origin, political opinions, religious or ideological beliefs or the union membership of data subjects, personal data in accordance with Article 10 GDPR on criminal convictions and criminal offences or related safeguards, as well as genetic data in accordance with Article 4(13) GDPR, biometric data in accordance with Article 4(14) GDPR , health data in accordance with Art. 4 sec. 15 GDPR and data on the sex life or sexual orientation of a natural person.

5. In accordance with Article 4(2) GDPR, processing is any operation or series of operations carried out with or without the aid of automated procedures in connection with personal data such as the collection, collection, organisation, ordering, storage, adaptation or modification, reading, querying, use, disclosure by transmission, dissemination or any other form of provision, matching or linking , the restriction, deletion or destruction.

(6) Pursuant to Article 4(21) GDPR, the supervisory authority is an independent public body established by a Member State in accordance with Article 51 GDPR.

Section 2 Indication of the competent data protection supervisory authority

(1) The responsible supervisory authority for the contractor is the Berlin Commissioner for Data Protection and Freedom of Information Mrs. Maja Smoltczyk, Friedrichstr. 219, 10969 Berlin.

2. The contracting entity and the contractor shall cooperate, on request, with the supervisory authority in the performance of their tasks.

Section 3 Subject matter of the contract

(1) The contractor provides services to the client in the area of appointmentagreements on the Internet on the basis of the GTC and the service offer at www. travelappointments.com of the contractor. In doing so, the contractor gains access to personal data and processes them exclusively on behalf of and under the direction of the client. The scope and purpose of the data processing by the contractor result from the main contract (and the corresponding service description). The client is responsible for assessing the admissibility of the data processing.

(2) In order to specify the mutual data protection rights and obligations, the parties conclude this agreement. The provisions of this agreement, in case of doubt, precede the provisions of the main contract.

3. The provisions of this contract shall apply to all activities relating to the main contract in which the contractor and his employees or agents come into contact with personal data originating from the client or collected for the client.

(4) The term of this contract shall be governed by the term of the main contract, unless any obligations or termination rights beyond this result from the following provisions.

Section 4 Right of Instruction

1. The Contractor may collect, process or use data only within the framework of the main contract and in accordance with the instructions of the contracting authority; this applies in particular to the transfer of personal data to a third country or to an international organisation. If the Contractor is required by the law of the European Union or the Member States to which it is subject to further processing, it shall notify the Contracting Entity of these legal requirements before processing.

(2) The instructions of the client are initially determined by this contract and may then be amended, supplemented or replaced by the client in written form or in text form by individual instructions (individual instruction). The client is entitled to issue appropriate instructions at any time. This includes instructions regarding the correction, deletion and blocking of data.

3. All instructions given shall be documented by both the client and the contractor. Instructions that go beyond the service agreed in the main contract shall be treated as an application for a change in performance.

(4) If the Contractor considers that an instruction from the Client violates data protection regulations, he must inform the Customer immediately. The Contractor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the Client. The contractor may refuse to carry out a manifestly unlawful instruction.

Section 5 Type of data processed, circle of data subjects

1. The nature of the personal data shall include:

(a) IP address and time of access;

(b) personal master data, i.e. data on the names and addresses of the customers and the employees of the order agent;

(c) contact details such as telephone numbers and e-mail addresses;

(d) Any other information required for appointments, which may be determined by the relevant client.

(2) The categories of data subjects include customers and interested parties of the client who use the online appointment agreement provided by the contractor, as well as the employees of the client.

Section 6 Protection measures of the Contractor

(1) The contractor is obliged to comply with the statutory provisions on data protection and not to pass on the information obtained from the customer's area to third parties or to suspend their access. Documents and data must be secured against the knowledge of unauthorized persons, taking into account the state of the art.

2. The contractor, in his area of responsibility, shall design the internal organisation in such a way that it meets the specific requirements of data protection. It shall take all necessary technical and organisational measures to adequately protect the data of the contracting entity in accordance with Article 32 GDPR. The Contractor reserves the right to change the security measures taken, ensuring that the contractually agreed level of protection is not exceeded.

(3) Persons employed in the processing of data by the contractor are prohibited from collecting, processing or using personal data without authorisation. The Contractor will oblige all persons entrusted by him with the processing and performance of this contract (hereinafter referred to as the employee) accordingly (obligation of confidentiality, Art. 28 sec. 3 lit.b GDPR) and ensure compliance with this obligation with due care. These obligations must be such that they remain in place even after the termination of this contract or the employment relationship between the employee and the contractor. The contracting authority shall prove the obligations in an appropriate manner on request.

Section 7 Obligations of the Contractor to Provide Information

(1) In the event of malfunctions, suspicion of data breaches or breaches of contractual obligations of the contractor, suspicion of security-related incidents or other irregularities in the processing of personal data by the contractor, persons employed by him within the scope of the contract or by third parties, the contractor shall inform the customer immediately in written form or text form. The same applies to audits of the contractor by the data protection supervisory authority. The notification of a breach of personal data protection shall contain at least the following information:

(a) a description of the nature of the breach of the protection of personal data, where possible, indicating the categories and number of data subjects, the categories concerned and the number of personal data sets concerned;

(b) a description of the measures taken or proposed by the contractor to remedy the breach and, where appropriate, measures to mitigate its potential adverse effects.

(2) The contractor shall immediately take the necessary measures to secure the data and to reduce possible adverse consequences of the data subjects, inform the customer and request further instructions.

(3) The contractor is also obliged to provide the client with information at any time insofar as his data are affected by a breach in accordance with paragraph 1.

(4) Should the data of the client be endangered by attachment or seizure, by insolvency or settlement proceedings or by other events or measures of third parties, the contractor shall inform the customer immediately, unless this is prohibited by court or official order. In this context, the contractor will immediately inform all competent authorities that the decision-making authority over the data rests exclusively with the contracting entity as the "responsible person" within the meaning of the GDPR.

(5) Über wesentliche Änderung der Sicherheitsmaßnahmen nach § 6 Abs. 2 hat der Auftragnehmer den Auftraggeber unverzüglich zu unterrichten.

(6) A change in the person of the company data protection officer/contact person for data protection must be notified to the client without delay.

7. The contractor and, where appropriate, his representative shall keep a list of all categories of processing activities carried out on behalf of the contracting authority, containing all the information provided for in Article 30(2) OF GDPR. The list shall be made available to the client on request.

(8) The contractor shall cooperate to an appropriate extent in the preparation of the list of procedures by the contracting authority. He shall provide the contracting authority with the necessary information in an appropriate manner.

Section 8 Control rights of the client

(1) The client is satisfied with the technical and organisational measures of the contractor. For this purpose, he may, for example.B, obtain information from the contractor, obtain existing testates from experts, certifications or internal audits, or, after timely coordination at the normal business hours, personally examine the technical and organisational measures of the contractor himself or have it checked by a competent third party, provided that the contractor is not in a competitive relationship with the contractor. The contracting authority will carry out checks only to the extent necessary and will not disproportionately interfere with the operations of the contractor.

2. The Contractor undertakes, at the customer's oral or written request, to provide the contracting authority within a reasonable period of time all the information and evidence necessary to carry out a review of the contractor's technical and organisational measures.

(3) The client shall document the result of the inspection and inform the contractor. In the event of errors or irregularities which the contracting entity finds, in particular in the examination of the results of the order, the contracting authority shall inform the contractor without delay. If the inspection reveals facts whose future avoidance requires changes to the ordered procedure, the client shall immediately notify the contractor of the necessary procedural changes.

(4) At the customer's request, the contractor shall provide the client with a comprehensive and up-to-date data protection and security concept for order processing as well as about persons authorised to access it.

(5) The contractor shall assign to the client the obligation of the employees in accordance with Section 6 (4) upon request.

Section 9 Use of subcontractors

(1) Within the scope of its contractual obligations, the Contractor is entitled to establish subcontracting relationships with subcontractors ("subcontractor relationship"), provided that it informs the Customer in advance of this and the latter has agreed to the subcontracting of the subcontractor in advance in writing. The contractor is obliged to carefully select subcontractors according to their suitability and reliability. When involving subcontractors, the contractor must oblige them in accordance with the provisions of this agreement and ensure that the customer can also exercise his rights under this agreement (in particular his inspection and control rights) directly vis-à-vis the subcontractors. If subcontractors are to be involved in a third country, the contractor must ensure that an adequate level of data protection is guaranteed at the respective subcontractor (e.B. by concluding an agreement based on the EU standard data protection clauses). Upon request, the Contractor shall provide the Client with proof of the conclusion of the aforementioned agreements with its subcontractors.

(2) A subcontractor relationship within the meaning of these provisions does not exist if the contractor commissions third parties with services which are to be regarded as purely ancillary services. This includes, for example.B, postal, transport and shipping services, cleaning services, telecommunications services without any specific reference to services provided by the contractor to the client and security services. Maintenance and inspection services constitute subcontracting relationships subject to consent, insofar as these are provided for IT systems that are also used in connection with the provision of services for the client.

Section 10 Requests and Rights of Affected Persons

1. Where possible, the contractor shall assist the contracting authority with appropriate technical and organisational measures in the performance of its obligations under Articles 12-22 and 32 and 36 GDPR.

(2) If a data subject asserts rights, such as the provision of information, rectification or deletion with regard to his data, directly against the contractor, the contractor does not react independently, but immediately refers the data subject to the client and awaits his instructions.

Section 11 Liability

(1) In the internal relationship with the contractor, the customer is solely responsible to the data subject for compensation for damages suffered by a data subject due to data processing or use inthe context of the order processing that is inadmissible or incorrect under the data protection laws.

2. The parties shall release themselves from liability if a party proves that it is in no way responsible for the circumstance which caused the damage to a person concerned.

Section 12 Extraordinary right of termination

(1) The customer may terminate the main contract in whole or in part without notice if the contractor fails to fulfil its obligations under this contract, intentionally or grossly negligently violates the provisions of the GDPR or if the customer cannot or does not want to carry out any instructions from the customer. In the event of simple infringements, i.e. neither intentional nor grossly negligent – the customer shall set a reasonable period of time for the contractor to remedie the infringement.

Section 13 Termination of the main contract

(1) The Contractor shall return to the Client, after termination of the main contract or at any time at his request, all documents, data and data carriers provided to him or, at the request of the Client, unless there is an obligation under Union law or the law of the Federal Republic of Germany to store the personal data. This also applies to any data backups at the contractor. The contractor shall keep the documented proof of the proper deletion of any remaining data. Documents to be disposed of must be destroyed with a shreddening in accordance with DIN 32757-1. Data carriers to be disposed of must be destroyed in accordance with DIN 66399.

(2) The client has the right to check the complete and contractually appropriate return or deletion of the data at the contractor in an appropriate manner.

(3) The contractor is obliged to treat confidentially the data known to him in connection with the main contract, even beyond the end of the main contract. This agreement shall remain valid beyond the end of the main contract as long as the Contractor has personal data which has been forwarded to him or which he has collected for the Client.

Section 14 Final Provisions

(1) The parties agree that the objection of the right of retention by the contractor in the sense of Section 273 of the German Civil Code (BGB) is excluded with regard to the data to be processed and the associated data carriers.

(2) Amendments and additions to this Agreement shall be in writing. This also applies to the renunciation of this formal requirement. This does not affect the primacy of individual contractual agreements.

(3) Should individual provisions of this agreement not be or become legally effective or unenforceable in whole or in part, this shall not affect the validity of the remaining provisions.

(4) This Agreement is governed by German law. The exclusive place of jurisdiction is Berlin.