Data Processing Agreement

Mopinion sells or grants licences for the use of an application which enables the Client to ask his customers (in general consumers) to participate in a survey in order to be able to obtain feedback from the consumers (hereafter the Customer) about his own products and services (hereafter referred to as the Application).

The application is filled in by the Client personally with the questions which he wishes to put to the Customer. The Client is given the ability to login to the Application, to further fill it in and/or revise it. It is down to the Client to determine which Customers are asked to fill in the survey and what personal data the Client wishes to receive from the Customer. The following personal data is generally requested in the Application and is then processed by the Client personally: surname, christian names, address, email address, telephone number. It is down to Mopinion’s Client to determine what personal data it requests from the Customer.

Mopinion is aware of the fact that it has obligations under the GDPR relating to the personal data which the Client supplies to Mopinion and in this present Contract Mopinion and the Client have made further agreements about the processing of the personal data.

1: Person concerned

1.1 For the purposes of this present contract the parties assume that the Customer of the Client should be regarded as a Person concerned within the meaning of the GDPR, that is to say the person to whom the personal data relates.

2: Processor/Controller

2.1 In this present contract Mopinion is regarded as the Processor and therefore the party who processes the Customer’s personal which is placed at its disposal by the Client under the contract which Mopinion has entered into with the Client, and Mopinion processes that personal data exclusively in that context and at the responsibility of the Client, who is regarded as the Controller within the meaning of the GDPR.

3: Processing of personal data

3.1 In the course of these activities Mopinion processes the personal data placed at its disposal by or via the Client in a proper and conscientious manner and in accordance with the GDPR and other applicable regulations relating to the processing of personal data.

3.2 Mopinion processes data on behalf of the Client in accordance with his instructions.

3.3 Mopinion has no control over the personal data placed at its disposal. It makes no decisions about the receipt and use of the data, its supply to third parties, and the duration of storage of data. Control over the personal data supplied under this present contract will never be vested in Mopinion.

4: Data leaks/security

4.1 Mopinion will report the discovery of breaches of security or data leaks as soon as possible – in any case within 48 hours of first discovery, and will provide all information necessary for the purposes of submitting a report to the Supervisory Authority.

4.2 Mopinion will inform the Client as soon as possible – in any case within 48 hours of first discovery – about all (suspected) breaches of security and other incidents which are required under legislation to be reported to the Supervisory Authority or to the Customer, without prejudice to its obligation to remedy or limit the consequences of such breaches and incidents.

4.3 Furthermore Mopinion shall, upon first request by Client, provide all information which the Client deems necessary in order to assess the incident.

4.4 Mopinion is in possession of a thorough action plan relating to the handling of breaches and will permit the Client, upon request, to inspect the plan. Mopinion will inform the Client about any material changes to the action plan.

4.5 Mopinion will leave reporting to the Supervisory Authorities to the Client.

4.6 Mopinion will offer all necessary cooperation in providing supplementary information if necessary, as quickly as possible, to the Supervisory Authority and/or the Customer.

4.7 Mopinion maintains a detailed log book of all (suspected) breaches of security and of the measures taken in response to such breaches, and will permit the Client to inspect this upon first request.

4.8 Mopinion will take all appropriate technical and organisational measures, in accordance with article 32 GDPR, to protect the personal data which is processed on behalf of the Client and to keep it secure from loss or any form of careless, unprofessional or unauthorised use.

4.9 The Client is at all times entitled to inspect the processing of personal data or to have it inspected. Mopinion is bound to grant access to the Client or the body performing the inspection on behalf of the Client and to cooperate so that the inspection can be performed effectively.

4.10 The Client will only perform an inspection after giving Mopinion prior written notice and after making an appointment for this purpose in consultation with Mopinion.

4.11 Mopinion undertakes to provide information requested to the Client or to a third party en- gaged by the Client within a period of time to be determined by the Client. This way the Client, or the third party engaged by the Client, can form an opinion about Mopinion’s com- pliance with this present agreement. The Client, or the third party engaged by the Client, is bound to treat all information relating to these inspections as confidential.

4.12 Mopinion undertakes to implement any improvements recommended by the Client or third party engaged, within a reasonable period of time to be determined by the Client.

4.13 Upon request by the Client Mopinion will report periodically on the structure and functioning of the system of measures and procedures which are aimed at ensuring compliance with this present agreement.

4.14 The cost of the inspection will be borne by the Client, unless the inspection reveals that Mopinion has infringed any provision of this processor contract. In that case the costs of the inspection will be borne by Mopinion.

4.15 Mopinion is only entitled to outsource the performance of the work in whole or in part to third parties after obtaining prior written consent from the Client.

4.16 The Client is entitled to attach conditions to the written consent relating to confidentiality and performance of the obligations under this present Contract.

4.17 Mopinion will continue to act as point of contact in any such case and remains responsible for adherence to the provisions of this present Contract. Mopinion guarantees that this third-party will undertake as a minimum the same obligations as have been agreed between the Client and Mopinion and will permit the Client upon request to inspect the contracts with this third-party in which these obligations are included.

5: Data leaks/security

5.1 Mopinion shall at all times upon first request by Client immediately hand over all the personal data placed at its disposal by the Client in relation to this present Contract.

5.2 Upon request by the Client personal data will be deleted by Mopinion within a reasonable period of time to be determined by the Client in a manner to be further determined, without any copy being kept by Mopinion. The Client will not make any such request more frequently than twice per year, in the absence of compelling reasons to deviate from this.

5.3 As soon as the cooperation ends Mopinion will delete the personal data which it has received from the Client in whatever form, unless the Parties agree otherwise. This deletion is to be performed within a period of time to be further agreed. A report on this will be made upon request by the Client.

6: Compliance with GDPR and other legislation and regulations

6.1 Mopinion will at all times ensure that Client is in a position to comply with his obligations under the GDPR, in particular the rights of the Customer such as the right to request inspection, improvement, addition, removal or screening of personal data, and the lodging of an accepted objection.

6.2 In processing personal data in the course of its activities Mopinion will act in accordance with the applicable legislation and regulations concerning the processing of personal data. Mopinion will follow all reasonable instructions of the Client, provided they do not conflict with its obligations under the legislation.

6.3 Mopinion warrants that Mopinion’s personnel and any other persons engaged by Mopinion will comply with the provisions of the GDPR and of this present contract, if and to the extent that they are in any way involved in the processing of personal data. Mopinion will impose all the obligations arising under this Contract on all other persons engaged by it.

7: Confidentiality

7.1 Persons in service with, or performing work on behalf of Mopinion, and Mopinion itself, are bound to observe a code of secrecy with regard to the personal data that may come to their knowledge, except to the extent that there may be a duty to disclose information under the provisions of any legislation or if disclosure is necessary in order to perform its task. These persons sign a confidentiality statement to this effect.

7.2 If Mopinion is bound to make disclosure on grounds of the provisions of the law Mopinion will verify the basis of the request and the identity of the person making the request and Mopinion will immediately inform the Client, prior to disclosure, unless the law prohibits this.

7.3 Following the end of this present Contract the duty of confidentiality set out in this Contract shall remain in force.

8: Other provisions

8.1 Mopinion does not process any personal data outside the European Union in the absence of the prior explicit written consent of the Client.

8.2 Changes to this present agreement can only be made in writing.

8.3 Mopinion and the Client will consult together about changes to this present Contract if a change to the regulations or the clarification of regulations makes this necessary.

8.4 If Mopinion fails to properly perform its obligations under this processor contract Client can give notice of breach. However Mopinion is immediately in breach if, in the absence of force majeure, performance of the relevant obligation remains impossible within the agreed period of time. Notice of breach occurs in writing, whereby Mopinion is granted a reasonable period of time to still comply with its obligations. This period of time is a strict deadline. If compliance remains outstanding at the end of this period of time Mopinion is in breach.

8.5 Mopinion is only liable to Client for damage suffered or to be suffered which results from an attributable failure by Mopinion to comply with one or more of its obligations under this present Contract, or if it acts in contravention of the GDPR, subject to a maximum of a sum equal to the amount paid by way of licence fee to Mopinion for one year.

8.6 Mopinion is also liable for all damage or harm resulting from any breach of privacy of the Customer due to its activities.

8.7 Dutch law is applicable to this present Contract and to all disputes arising under it or relating to it.

8.8 All disputes arising between the Parties in connection with this present contract will be laid before the competent member of the judiciary in the district court of Rotterdam.