General Data Protection Regulation (GDPR) Joint Controller Agreement

This General Data Protection Regulation (GDPR) Joint Controller Agreement is a part of and can only be used in conjunction with our general Terms and Conditions.

ARTICLE 1

(1) This agreement determines the rights and obligations of the controllers (hereinafter also referred to as "parties") for the joint processing of personal data. It applies to all activities of the parties, or processors appointed by a party, when processing personal data. The parties have jointly determined the purposes and means of processing personal data in accordance with Art. 26 GDPR.

(2) Sending emails/newsletters to users that have entered their email address and consent on the website of the Company processes personal data. For the other sections of processing, where the parties do not jointly determine the purposes and means of data processing, each contracting party is a controller pursuant to Article 4 No. 7 GDPR. As far as the contracting parties are joint controllers pursuant to Article 26 GDPR, it is agreed as follows:

ARTICLE 2

(1) In context of joint controllership, the Company is competent for the processing of personal data in operating range A. Operating range A includes sending emails and newsletters. The processing may concern the following categories of data: email address, mailing preferences. The legal basis for the processing of personal data is consent and/or contract.

(2) In the context of joint controllership, you are competent for the processing of personal data in operating range B. Operating range B includes sending emails and newsletters. The processing may concern the following categories of data: email address, mailing preferences. The legal basis for the processing of personal data is consent and/or contract.

ARTICLE 3

Each party shall ensure compliance with the legal provisions of the GDPR, particularly in regards to the lawfulness of data processing under joint controllership. The parties shall take all necessary technical and organisational measures to ensure that the rights of data subjects, in particular those pursuant to Articles 12 to 22 GDPR, are guaranteed at all times within the statutory time limits.

ARTICLE 4

(1) The Parties shall store personal data in a structured, commonly used, and machine-readable format.

(2) the Company and/or you shall ensure that only personal data which are strictly necessary for the legitimate conduct of the process are collected.

ARTICLE 5

The Parties commit themselves to provide the data subject with any information referred to in Articles 13 and 14 of the GDPR in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. The information shall be provided free of charge. The Parties agree that the Company provides the information on the processing of personal data in operating range A and you provides the information on the processing of personal data in operating range B.

ARTICLE 6

The data subject may exercise his or her rights under Articles 15 to 22 GDPR against each of the joint controllers. In principle, the data subject may receive the requested information from the contracting party to whom the request was made.

ARTICLE 7

(1) the Company and/or you shall provide the data subject access according to Article 15 of the GDPR.

(2) Where the data subject requests access according to Article 15 GDPR, the parties shall provide this information. If necessary, the parties shall provide each other with the necessary information from their respective operating range. Each party must immediately inform the other of any change of the contact person.

ARTICLE 8

(1) If a data subject exercises his or her rights against one of the parties, in particular of the rights of access, correction, or deletion of his or her personal data, the parties are obliged to forward this request to the other party without undue delay. This applies irrespective of the general obligation to guarantee the right of data subjects. The party receiving the request must immediately provide the information within its operating range to the requesting party.

(2) If personal data are to be deleted, the parties shall inform each other in advance. A party may object to the deletion for a legitimate interest, for example, if there is a legal obligation to retain the data set for deletion.

ARTICLE 9

The parties shall inform each other immediately if they notice errors or infringements regarding data protection provisions during the examination of the processing activities.

ARTICLE 10

The parties undertake to communicate the essential content of the joint controllership agreement to the data subjects (Article 26 (2) GDPR).

ARTICLE 11

Both parties are obliged to inform the supervisory authority and the data subjects affected by a violation of the protection of personal data in accordance with Articles 33 and 34 GDPR concerning their operating ranges. The parties shall inform each other about any such notification to the supervisory authority without undue delay. The parties also agree to forward the information required for the notification to one another without undue delay.

ARTICLE 12

Documentations within the meaning of Article 5 (2) GDPR, which serve as proof of proper data processing, shall be archived by each party beyond the end of the contract in accordance with legal provisions and obligations.

ARTICLE 13

(1) Within their operating range, the parties shall ensure that all employees authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality in accordance with Articles 28 (3), 29, and 32 GDPR for the duration of their employment, as well as after termination of their employment. The parties shall also ensure that they observe the data secrecy provisions prior to taking up their duties and are familiarised with the data protection legislation and rules relevant to them.

(2) The parties shall independently ensure that they are able to comply with all existing storage obligations with regard to the data. For this purpose, they must implement appropriate technical and organisational measures (Article 32 et seq. GDPR). This applies particularly in the case of termination of the cooperation/agreement.

(3) The implementation, default-setting, and operation of the systems shall be carried out in compliance with the requirements of the GDPR and other regulations. In particular, compliance with the principles of data protection by design and data protection by default will be achieved through the implementation of appropriate technological and organisational measures corresponding to the state of the art.

ARTICLE 14

(1) The parties commit themselves to conclude a contract in accordance with Article 28 GDPR when engaging processors within the scope of this agreement (see Article 1).

(2) The parties shall inform each other upon request of subcontracted processors. The parties shall only commission subcontractors who meet the requirements of data protection legislation and the provisions of this agreement. Services which the contracting parties use from third parties to support the execution of the contract, such as telecommunications services and maintenance, shall not be seen as services provided by subcontractors within the meaning of this contract. However, the parties are obligated to make appropriate contractual agreements in accordance with the law and to take controlling measures to guarantee the protection and security of personal data, even in the case of additional third party services.

ARTICLE 15

Notwithstanding the provisions of this contract, the parties shall be liable for damages resulting from processing that fails to comply with the GDPR. In external relations they are jointly liable to the persons concerned. In the internal relationship the parties are liable, notwithstanding the provisions of this contract, only for damages which have arisen within their operating range.

ARTICLE 16

Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:

(a) disclosure is required by law;

(b) the relevant information is already in the public domain.

ARTICLE 17

All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address.

This Agreement is governed by the laws of Slovenia.

Any dispute arising in connection with this Agreement, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of Novo mesto, Slovenia.

ARTICLE 18

If you need any information or assistance with the website, you can contact us via contact page.