Revised date: 04.03.2024
This DPA applies between Customer and Liquid Barcodes AS, as part of the Agreement between the Parties regarding supply of digital marketing services (“the Agreement”) as specified in the Order Form that has been signed by the Parties. This DPA is part of the Agreement since the services require Processing of Customer’s Personal Data. If the Agreement includes more than one client entity, for example all entities in the Customer’s company group, the term “Client” or “Customer” used herein shall include all such entities.
The purpose of this DPA is to ensure the necessary safeguards in protecting the fundamental rights of the data subjects in accordance with EU General Data Protection Regulation 2016/679 (“GDPR”), other applicable laws and regulations as well as decisions and general advice of any relevant supervisory authority regarding the processing of personal data (collectively referred to as the “Data Protection Act”).
The capitalized terms set out below, as “Personal Data”, “Processing”, “Controller” and “Processor” and other terms used in this DPA also listed in the Data Protection Act, shall have the same meaning as stipulated in the Data Protection Act.
Customer is the Controller of all Personal Data being Processed under the Agreement and is responsible to ensure that all Processing is compliant with the Data Protection Act and, within the terms of the Agreement, decides for which purposes and by which means Personal Data is processed. Customer holds ownership and formal control of its Personal Data being Processed by Liquid Barcodes.
Liquid Barcodes is a Processor for Customerand shall only Process Customer’s Personal Data to perform its obligations under the Agreement and pursuant to documented instructions from Customer. Liquid Barcodes shall take such necessary actions as reasonably required to comply with Customer’s instructions regarding Processing of its Personal Data. Liquid Barcodes shall immediately inform Customer if Liquid Barcodes considers that an instruction from Customer would violate the Data Protection Act or cause Liquid Barcodes disproportionate costs or inconvenience.
Liquid Barcodes’s Processing shall be limited to the following:
Subject for Processing: to operate and manage digital marketing on behalf of Customer using Rewards, Subscriptions, C-StorePay, Coupon shop and other products from Liquid Barcodes’s product portfolio.
Nature, duration and context of the Processing: The primary data processing is related to creating, distributing and redeeming coupons, subscriptions, payments on forecourt and in store, games, surveys and other marketing content to Customer’ customers. Additionally, data may be analyzed during and after campaigns. Data will be stored for up to 3 years for customers with active consent. Customers will automatically be deleted after 12 months of inactivity. Where legal basis for processing data is based on a request from data subjects without further contract or consent, data will be stored for the minimum time required for the system to be operational, maximum 3 months after expiration of any coupons or other content.
Type of categories of Personal Data: Please see specification in the order form.
Categories of data subjects: Please see specification in the order form.
Liquid Barcodes is responsible for ensuring that its personnel only have access to Customer’s Personal Data on a need-to-know basis and that they are legally obligated to keep such data confidential. Upon request from the Customer, Liquid Barcodes shall document that personnel with access to Personal Data are bound by such legal obligations.
Liquid Barcodes will, upon Customer’s written request, provide Customer with necessary information and reasonable assistance to allow Customerto fulfill its obligation to respond to requests for exercising the data subjects’ rights and, when applicable, carry out data protection impact assessments and prior consultations with the relevant Data Protection Authority under the Data Protection Act in relation to the Processing of Personal Data covered by this DPA .
Liquid Barcodes shall not disclose any Personal Data, or instructions provided by Customer regarding Processing, to a third party, except (i) when the Parties agree otherwise, or (ii) Liquid Barcodes is required to disclose such information pursuant to law or by order of a judicial or governmental authority, such as the relevant data protection authority.
Liquid Barcodes is authorized to engage subcontractors to perform its obligations to Customer under the Agreement. In the event that a subcontractor Processes Customer’s Personal Data, it shall be established in or otherwise only Process the data inside the European Economic Area (the “EEA”).
Liquid Barcodes shall inform Customer in writing of any subcontractors that will Process Customer’s Personal Data, including changes regarding the addition or replacement of Processing subcontractors. Customer has the right, upon written request, to obtain a copy of Liquid Barcodes´s agreement with the subcontractors.
Customer shall inform Liquid Barcodes in writing if it objects to the use of any Processing subcontractor and include a justifiable reason for its objection. If Liquid Barcodes cannot adhere to the objection within reasonable time, without causing undue costs or inconvenience, the Parties shall cooperate to find a suitable solution that addresses Customer’s reasons for objection. If no agreement is reached, Customer and/or Liquid Barcodes has the right to terminate the Agreement with immediate effect.
When using a subcontractor that will Process Customer’s Personal Data, Liquid Barcodes shall ensure that the subcontractor adheres to the same data protection obligations set out herein by way of a written data processing agreement. If the subcontractor fails to fulfill the obligations set out therein, Liquid Barcodes shall be liable to Customer for the subcontractor’s performance under the terms in this DPA.
Liquid Barcodes shall implement and maintain appropriate technical and organizational measures to protect Customer’s Personal Data against unauthorized or unlawful access and ensure that Liquid Barcodes’s Processing meet the requirements of the Data Protection Act and protect the rights of data subjects. These technical and organizational measures shall ensure a level of security appropriate to the risks related to the Processing of Customer’s Personal Data, taking into account (i) the state of the art, (ii) the costs of implementation, (iii) the nature, scope, context and purposes of Processing, and (iv) the varying likelihood and severity for the rights and freedoms of the data subjects.
Liquid Barcodes will also take appropriate technical and organizational measures, to the extent required and possible, in order to assist Customer in its obligation to respond to requests from data subjects regarding the exercise of their rights under the Data Protection Act.
<br>Liquid Barcodes shall comply with applicable directions of relevant supervisory authorities concerning the fulfillment of security requirements in the Data Protection Act, and assist judicial or governmental authorities in any inspection that such an authority is entitled to carry out to ensure that Liquid Barcodes’s Processing of the Client’s Personal Data is compliant with the Data Protection Act.
Liquid Barcodes shall immediately notify Customer in writing if any material deviations to this data processing agreement occur unless it is unlikely to have a negative and adverse effect on Customer or result in a risk to the rights and freedoms of data subjects (any “Data Breach”). Liquid Barcodes shall also investigate the Data Breach, identify its causes, take appropriate measures to rectify the breach and prevent any recurrence, and assist Customer with the required notification to the relevant data supervisory authority.
Liquid Barcodes shall, upon request, provide Customer with all information required to demonstrate that the obligations set out in this data processing agreement has been fulfilled by Liquid Barcodes. Customer is entitled to conduct an audit of Liquid Barcodes’s Processing of Customer’s Personal Data to demonstrate compliance with this data processing agreement. Such audit, at the cost of the Customer, shall be performed no more than once per agreement year by an independent professional auditor that is appointed and engaged by Customer. Both Parties shall receive a copy of the audit report.
Liquid Barcodes shall promptly provide the auditor with necessary information and other reasonable assistance in respect of any audit. The audit may include review of systems, operations, routines, and security measures, including on-site inspection, but it shall not include access to trade secrets or proprietary information.
Customer shall cover all costs for the auditor, including Liquid Barcodes’s direct expenses. Customer shall also (i) ensure that the auditor is subject to adequate secrecy obligations, (ii) be liable to Liquid Barcodes for the auditor’s performance of such secrecy obligations and all other actions related to the audit, and (iii) ensure that the audit is performed without causing interruptions to Liquid Barcodes’ (and its subcontractors) regular operations.
If the audit reveals inadequate security measures or other non-compliance with this data processing agreement, Liquid Barcodes shall (and, if relevant, ensure that the relevant subcontractor shall) rectify such inadequacy or non-compliance within reasonable time and at its own expense.
Processing of Customer’s Personal Data (including storage) shall only take place inside the EEA.
Liquid Barcodes undertakes not to transfer any of the Client’s Personal Data outside the EEA, without the prior written consent of Customer. If permission for such transmission has been provided by Customer, Liquid Barcodes shall ensure that the transfer is governed by an agreement containing standardized data protection measures adopted by the EU Commission or that such transmission otherwise is permitted under the Data Protection Act.
Liquid Barcodes shall indemnify Customer for reasonable direct damages, up to the limit as defined in the Liquid Barcodes General Terms and Conditions, arising from third party claims of data subjects or relevant supervisory authorities to the extent that such damages is a result of Liquid Barcodes’s Processing of Customer’s Personal Data hereunder in breach of the Data Protection Act (except when the Processing has been approved by or carried out pursuant to instructions of Customer). Liquid Barcodes shall not, in any event, be liable for any indirect damages, including, but not limited to, loss of revenue, contracts, customers or businesses, consequential damages, or anticipated savings or revenues.
This data processing agreement shall remain in force for as long as Liquid Barcodes’s Processes Personal Data on behalf of Customer pursuant to the Agreement, or until it is superseded by a new data processing agreement.
Upon termination of this data processing agreement and upon Customer’s request, Liquid Barcodes shall, without undue delay, destroy, delete or return to Customer, all Personal Data that has been transferred to Liquid Barcodes from Customer for the execution of the Agreement, except from any Personal Data, which Liquid Barcodes is required to store pursuant to applicable law. Any confidentiality obligations shall survive the expiry or termination of this DPA.
Any communications under this DPA shall be directed to, in the case of Liquid Barcodes, the Data Protection Officer and, in the case of Customer, to the contact person as specified in the Order form, or to persons specifically designated by either party.