As of April 2023
Preamble
According to the provisions of the General Data Protection Regulation (see Article 37 (1) of the GDPR) and the Federal Data Protection Act (see Section 38 (1) (FDPA), under certain circumstances, non-public bodies are obliged to appoint a company data protection officer. The client has decided not to fill this function internally but to outsource it to kedapro GmbH as an external service provider (contractor). The detailed requirements for the transfer of these tasks are regulated by this contract.
1. Restriction on entrepreneurs
The contractor's offer is exclusively aimed at entrepreneurs who trade in their commercial, professional or independent professional activity and not for private purposes. The conclusion of the contract is subject to the fact that the examination of the entrepreneurial characteristic is positive when the contract is concluded.
2. Subject of the contract
(1) Upon conclusion of the contract, the contractor acts as a company data protection officer pursuant to Art. 39 GDPR for the client. The present contract specifies the details of the tasks of the contractor in concretization of the legal requirements.
(2) To prove the fulfillment of the naming obligation, a separate designation document shall be signed by the contracting parties.
3. Time, place and staff to provide services
(1) The contractor shall decide on the time and place of deployment for the client at its own discretion. In urgent cases, the contractor will also be available at short notice.
(2) The contractor carries out his activity in his own premises.
(3) The contractor shall be permitted to employ suitable own personnel to fulfill this contract as well as competent and reliable third parties as subcontractors after prior agreement with the client. The own responsibility of the contractor remains untouched.
4. Specification of statutory tasks
(1) The client shall provide the contractor with a list of all processing activities with the information pursuant to Art. 30 GDPR and shall keep it up to date. The contractor will provide suitable forms in electronic form at the request of the client and will advise on this Creation of the processing directories.
(2) The contractor has a direct reporting right vis-à-vis the client's management.
(3) The contractor shall examine the cooperation with external business partners on data protection compliant data processing and contract design, in particular with regard to the order processing requirements according to Art. 28 GDPR. However, the contractor does not owe immediate control measures to the business partner (service provider); In that regard, it satisfies its obligation by examining the client's checks or by providing sufficient self-audits of the respective processors.
(4) When responding to external requests for data protection, the Contractor will, on the basis of the required mutual consideration, generally only make such statements with the prior involvement of the Client.
(5) The tasks of the contractor shall be performed using only means of distance communication, namely by e-mail or ticketing system. Employee training is provided, as necessary, by the provision of appropriate training materials, in particular training videos, and the preparation of data protection relevant documents. Further services and local appointments are made on customer request and by separate agreement.
5. Confidentiality obligation
(1) The contractor is obliged to keep confidential all information about the client, which becomes known to the contractor in connection with the execution of his tasks.
(2) The duty of confidentiality does not exist if and insofar as the contractor has been released from this obligation by the client.
(3) The duty of confidentiality does not exist even then
(i) as far as the disclosure of information for the protection of the legitimate interests of the contractor, even taking into account any conflicting interests of the client is essential;
(ii) as far as the contractor is obliged to inform and cooperate according to the insurance conditions of his professional liability;
(iii) if the Contractor is required by law to disclose, in particular to supervisory authorities or professional chambers, or
(iv) insofar as the Contractor in his capacity as company data protection officer, in particular pursuant to Art. 39 (1) lit. d) and e) GDPR is entitled or obliged to cooperate with the supervisory authority.
(4) This duty of confidentiality of the contractor shall continue for the duration of the contractual relationship.
(5) This contract and its contents are mutually subject to a confidentiality obligation beyond the end of the contract.
(6) Employees and other vicarious agents shall be obliged to maintain secrecy to the same extent as the parties themselves. The parties mutually prove this on request.
(7) Unaffected by the above provisions, the special confidentiality obligations of the company data protection officer for the protection of the data subject remain in accordance with § 6 (5) sentence 2 and (6) FDPA.
6. Remuneration
(1) All agreed lump-sum fees are due in advance at the beginning of each calendar month.
(2) If travel is required to fulfill the activity assumed by the contractor with this contract, the travel expenses will be reimbursed against proof after actual effort. Travel is only possible after special assignment.
(3) Payment shall be made by separate SEPA direct debit mandate and until it is issued by bank transfer to the following bank account by the third banking day of the relevant settlement month:
IBAN: DE79 3206 0362 1050 5820 15
Account No .: 1050582015
Bank code: 32060362
Bank: Volksbank Krefeld eG
7. Liability
(1) The liability of the contractor for damages due to simple negligence is excluded, as far as the injury to life, body, health or claims under the Product Liability Act is not affected. The liability also for simple negligence remains unaffected in case of breach of cardinal obligations, ie duties whose fulfillment makes the execution of the contract possible in the first place and on whose observance the client may regularly rely; however, liability in this case is limited to compensation for damages typically associated with the contract and foreseeable.
(2) The above paragraph applies equally to the contractor's own employees and other vicarious agents.
8. Final provisions
(1) Should individual provisions of this contract be or become ineffective, this will not affect the validity of the remaining provisions.
(2) The contracting parties undertake to replace ineffective provisions by mutual agreement with provisions that are as close as possible to the original purpose and whose effectiveness is not in conflict with any of these. The same applies to the case of contract gaps.