PERSONAL DATA PROCESSOR AGREEMENT

Data processing agreement (the 'Agreement') between Olssons i Ellös AB, org. no. 556617–0154, Slätthultsvägen 12, 474 31 Ellös, ('Olsson Parts') and you who register customer information on Olsson Parts’ website (the 'Registrant').

In the Agreement, Olsson Parts acts as a data processor and the Registrant as a data controller.

Olsson Parts and the Registrant are individually referred to as 'Party' and jointly as the ‘Parties'.

Background

1.1 The Registrant is given the opportunity to register its customers on Olsson Parts’ website, which means that Olsson Parts will process customers' personal data. For this reason, the Parties enter into the Agreement to regulate Olsson Parts' processing of and access to personal data.

1.2 Terms used in the Agreement shall have the same definition as that resulting from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ('GDPR').
General information about the processing of personal data

2.1 The Registrant is the sole data controller for all personal data that it provides to Olsson Parts. Olsson Parts may process and store the personal data registered by the Registrant, for such processing Olsson Parts is responsible as a personal data processor. The Parties’ responsibilities include, among other things, ensuring that the processing of personal data is carried out in accordance with regulations, privacy policy and GDPR.

2.2 The Registrant is responsible for providing Olsson Parts with instructions for the processing of personal data if the Registrant finds it necessary. Olsson Parts’ privacy policy can be found
Olsson Parts’ obligations

3.1 The Parties agree that Olsson Parts
a) shall obtain written consent from the Registrant if personal data is to be transferred to a country that is not part of EU/EEA or if it is not covered by the European Commission's adequacy decision,
b) shall take all measures required by Article 32 GDPR, and
c) shall delete or return all personal data to the Registrant upon the Registrant's request.

3.2 Olsson Parts shall immediately inform the Registrant if Olsson Parts considers that Olsson Parts is unable to fulfil its obligations under the Agreement.

3.3 Olsson Parts undertakes to process only the personal data that is necessary to achieve the purpose of the respective processing.

3.4 The agreement does not mean that Olsson Parts becomes the data controller for personal data. Olsson Parts is only liable for damage caused by Olsson Parts through gross negligence or intent.
Safety

4.1 Olsson Parts shall take the necessary measures regarding security in connection with the processing of personal data.

4.2 When assessing the appropriate level of security, particular account shall be taken of the risks involved in processing, from accidental or unlawful destruction, loss, alteration or appropriate disclosure of, or access to, the personal data being or having been processed.
Confidentiality

5.1 During the term of the Agreement and for 2 years thereafter, the Parties undertake not to provide third party with information regarding the content of the Agreement and other information that the Parties have received in connection with the Agreement, regardless of whether the information has been provided in writing or oral and regardless of format ('Confidential information'). The parties undertake to use Confidential Information only for the purpose of fulfilling their obligations under the Agreement and not for any other purpose.

5.2 The above does not apply to such information that at the time of disclosure is or later becomes available to the public in any other way than through a breach of the Agreement or was already available to the receiving Party or which it has developed on its own prior to entering into the Agreement and which has not, directly or indirectly, been obtained through a breach of the Agreement.
Personal data breach

If a personal data breach occurs, Olsson Parts shall, upon becoming aware of the breach, in writing notify the Registrant without delay.
Access to information

7.1 Olsson Parts shall provide the Registrant with access to all information required to demonstrate that Olsson Parts has fulfilled its obligations under Article 28 of the GDPR.

7.2 Neither Party shall be entitled to represent the other Party before a supervisory authority or any other third party.
Hiring a sub-processor

If Olsson Parts engages a sub-processor, Olsson Parts shall ensure that the sub-processor is subject to the same obligations as Olsson Parts has under the Agreement.
Termination of the Agreement

The agreement ends when the Registrant deregisters from Olsson Parts’ website. When Olsson Parts ceases to process personal data on behalf of the Registrant, Olsson Parts shall return, delete or destroy all personal data that belongs to the Registrant.
Applicable law

The agreement is governed by Swedish law.

_____________________

The document has been digitally signed. Receipts for digital signing are attached to the Agreement.

Seat cushion for 171-1071/78