Data Processing Terms

Tilbage

DATA PROCESSING TERMS

These Data Processing Terms (hereinafter the “Terms”) govern the rights and obligations between the Company (hereinafter the “Company”) and JobbFinn ehf., a company incorporated under the laws of Iceland with its registered seat at Dalsel 25, IS-109, Iceland, Reg. No 5302201760. The Company and JobbFinn may jointly be referred to as the “Parties” or individually as a “Party”.

DEFINITIONS

Unless otherwise provided in the Terms, the meaning of capitalized words is stated in Annex A to the Terms.

TERMS

The Terms govern the processing and security of Company Personal Data.

ROLES AND DATA PROCESSING INSTRUCTIONS

The Parties acknowledge and agree that:

a

JobbFinn is a processor of Company Personal Data;

b

the Company is a controller or processor, as applicable, of Company Personal Data;

c

each Party will comply with the obligations applicable to it under the applicable law with respect to the processing of Company Personal Data.

If the Company is a processor, the Company warrants to JobbFinn that Company’s instructions and actions with respect to Company Personal Data, including its appointment of JobbFinn as another processor, have been authorized by the relevant controller.

By entering into the Terms, the Company instructs JobbFinn to process Company Personal Data only in accordance with applicable law: (a) to provide the Processor Services; (b) as further specified via Company’s use of the Processor Services; (c) as documented in the Agreement, including the Terms; and (d) as further documented in any other written instructions given by the Company and acknowledged by JobbFinn as constituting instructions for purposes of the Terms.

DURATION OF PERSONAL DATA PROCESSING

Processing of Company Personal Data shall be performed for the duration of the Agreement plus the period until the deletion of all Company Personal Data in accordance with the Terms.

NATURE AND PURPOSE OF PERSONAL DATA PROCESSING

JobbFinn shall process Company Personal Data through means of automated processing to provide the Company with the Processor Services.

TYPES OF PERSONAL DATA

The Company Personal Data may include data collected by the JobbFinn System during the use of JobbFinn System, login data, identification data, user type data, user activity data, contact data, communication data and voice and image records.

CATEGORIES OF DATA SUBJECTS

Company Personal Data will concern the following categories of data subjects:

Depending on the nature of the Processor Services, these data subjects may include (a) Company’s employees or other Company’s co-workers, (b) members of Company’s bodies; (c) Company’s clients.

RIGHTS AND OBLIGATIONS OF THE PARTIES

If any third person, particularly a data subject or supervisory authority, requests any Party to provide any information in relation to personal data processing under the Agreement or the Terms, or in this relation makes any claim or exercises any right against any Party, the Party undertakes to inform the other Party about such procedure without undue delay.

The Company is liable for fulfilling all obligations in relation to Company Personal Data processing, particularly for informing data subjects about Company Personal Data processing, obtaining consent with Company Personal Data processing if necessary, dealing with data subjects’ requests relating to the exercise of their rights (such as right to information, access, rectification, erasure, restriction of processing, right to data portability, right to object etc.). The Company is further liable for fulfilling all notification obligations towards any supervisory authority relating to Company Personal Data processing, especially for notifying the supervisory authority on any personal data breach.

The Company is solely responsible for reviewing the Terms and evaluating for itself whether the security measures, and JobbFinn’s commitments hereunder meet Company’s needs, including with respect to any security obligations of the Company under the applicable law

The Company acknowledges and agrees that (considering the state of the art, the costs of implementation and the nature, scope, context, purposes and differently probable and differently serious risks to individuals) the security measures implemented and maintained by JobbFinn as set out in the Terms provide a level of security appropriate to the risk in respect of the Company Personal Data.

For the duration of Company Personal Data processing, if JobbFinn receives any request from a data subject in relation to Company Personal Data, JobbFinn shall advise the data subject to submit its request to the Company and the Company will be responsible for responding to any such request.

For the purpose of the Company Personal Data protection JobbFinn undertakes, for the duration of processing Company Personal Data under the Terms, that it:

FINAL PROVISIONS

The Terms have been drawn up in English, Danish, Norwegian, German and Spanish. All obligations of JobbFinn towards the Company related to the Terms shall be fulfilled in the English, Danish, Norwegian, German or Spanish language, at JobbFinn’s sole discretion.

Should any of the provisions hereof be or become invalid, void, ineffective or unenforceable, this fact shall not affect the rest of the Terms. The Parties agree to replace any such invalid, ineffective, void or unenforceable provisions of the Terms with a provision that is valid, effective, not considered void, enforceable and with the same business and legal meaning within 14 (fourteen) days of receiving a request from the other Party.

In the event of changes to the applicable law or changes to the interpretation rules or practices for interpretation of the applicable law, JobbFinn may amend the Terms within a reasonable scope. The amendment of the Terms shall be reported by JobbFinn on its website and by e-mail to the last known e-mail address of the Company used for the communication with JobbFinn. Unless rejected by the Company within 1 (one) month since sending the notification to the Company, the Company is deemed to have adopted the amended Terms. Should the Company reject the amended Terms within the aforementioned period, this fact shall constitute the termination of the Terms with a 2 (two) months termination period; during this period the last Terms accepted by both Parties shall apply. Termination of the Terms under this clause does not constitute termination of the Agreement; however, following the termination of the Terms if the Parties do not reach an agreement on new data processing terms as required by applicable law within a 2 (two) months period, any Party has the right to immediately terminate the Agreement by sending a written termination notice to the other Party effective as of the day of its delivery.



ANNEX A

DEFINITIONS

Agreement

an agreement concluded between the Parties which incorporates the Terms by referring to them, particularly the agreement on using the JobbFinnystem, concluded when the Company accepted the “Company Terms and Conditions for JobbFinn system”.

GDPR

is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Processor Services

are the services provided by JobbFinn to the Company under the Agreement and any related technical support which includes personal data processing.

Company

is the commercial company that has concluded the Agreement with JobbFinn.

Company Personal Data

is the personal data that is processed by JobbFinn on behalf of the Company while providing the Processor Services to the Company.

The terms „controller“, „data subject“, „personal data“, „personal data breach“, „processing“, „processor“ and „supervisory authority

have the meaning given to them in GDPR.



ANNEX B

SECURITY MEASURES

As from the Terms effective date, JobbFinn will implement and maintain the security measures set out in this Annex B. JobbFinn may update or modify such security measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the processing.

Risk-based principle. JobbFinn shall periodically review the risk of information security, in connection with personal data and important activities of the Company. Fulfilment of the JobbFinn’ obligation to ensure the data security is performed by the position of security manager, who acts within the JobbFinn’ management.

Organizational security. JobbFinn shall implement measures to secure the personal data against the human failure, in particular:

Technical measures. JobbFinn shall implement appropriate technical measures to secure the personal data, particularly:

On-site security. To secure the personal data stored in written form and the IT devices, JobbFinn shall particularly implement:

ANNEX C

RULES FOR AUDITS

a

The Company must send any requests for the audit solely to the JobbFinn’s email address jobbfinn@jobbfinn.com.

b

Following receipt by JobbFinn of a request for audit, JobbFinn and the Company will discuss and agree in advance on: (i) the reasonable date(s) of and security and confidentiality controls applicable to any audit; and (ii) the reasonable commencing date, scope and duration of and security and confidentiality controls applicable to any audit.

c

JobbFinn may charge a fee (based on its reasonable costs) for any audit requested by the Company. JobbFinn shall provide the Company with further details of any applicable fee or the basis of its calculation, in advance of any such audit. The Company will be responsible for any fees charged by any auditor appointed by the Company to execute any such audit.

d

JobbFinn may object in writing to an auditor appointed by the Company to conduct any audit, if the auditor is, in JobbFinn ’s reasonable opinion, not suitably qualified or independent, a competitor of JobbFinn, or otherwise manifestly unsuitable. Any such objection by JobbFinn will require the Company to appoint another auditor or to conduct the audit itself.