Data Processing Addendum (DPA) — iFurn.pro
This Data Processing Addendum (hereinafter — the “DPA”) applies where the Provider (the iFurn.pro platform, hereinafter — the “Service”) processes personal data on behalf of the User when providing the Service and where the EU General Data Protection Regulation 2016/679 (hereinafter — “GDPR”) or other applicable data protection legislation applies to such processing.
The DPA forms part of the Public Offer Agreement and supplements the Privacy Policy. In the event of a conflict regarding the processing of personal data subject to the GDPR, this DPA applies; matters of liability are governed by the Public Offer Agreement. Terms not defined herein have the meaning given to them by the GDPR.
1. Roles of the parties
With respect to the personal data that the User enters or uploads into the Service (hereinafter — the “User Data”), the User is the controller, and the Provider is the processor acting on behalf of the User. With respect to the data of the User’s own account and the Service’s technical data, the Provider acts as the controller (see the Privacy Policy).
2. Subject matter and details of processing
Subject matter and duration: provision of the Service during the term of the Public Offer Agreement. Nature and purpose: processing necessary for the operation of the Service’s functions in accordance with the User’s instructions.
Categories of data: identification and contact data, as well as other data that the User enters into the Service (including regarding the User’s customers, employees or counterparties). Categories of data subjects: persons whose data the User processes through the Service. Processing operations: collection, storage, structuring, use, transfer within the Service and deletion necessary for providing the Service. The rights and obligations of the User as controller are determined by the GDPR, this DPA and the Public Offer Agreement. The User must not enter special categories of data unless this is necessary and lawful.
3. User’s instructions
The Provider processes User Data only on the User’s documented instructions, including the Public Offer Agreement, the Privacy Policy and the Service settings, except where processing is required by law; in such a case the Provider shall inform the User of the relevant legal requirement before processing, unless the law prohibits such notification. If, in the Provider’s opinion, an instruction infringes data protection legislation, the Provider shall immediately notify the User thereof.
4. Confidentiality
The Provider ensures that persons authorised to process User Data are bound by an obligation of confidentiality.
5. Security
The Provider implements appropriate technical and organisational measures taking into account the state of the art, the costs, and the nature, scope and risks of processing, as described in the Security Policy. No measures guarantee absolute security; the Provider does not guarantee complete protection against all possible threats.
6. Subprocessors
The User grants a general authorization for the engagement of subprocessors (in particular hosting providers, data centres, providers of cloud infrastructure, email, analytics and payment services). The current list of subprocessors is permanently available to the User (in particular, it is published by the Provider). The Provider notifies the User in advance of any planned addition or replacement of a subprocessor (including by updating the list), giving a reasonable opportunity to raise an objection.
The User may raise an objection, reasoned on data protection grounds, to a new subprocessor within a reasonable period before the relevant processing begins. If the objection cannot be resolved, the User has the right to cease using the relevant part of the Service. The Provider imposes on subprocessors corresponding obligations regarding the protection of personal data in the cases and to the extent provided for by applicable law. The Provider's liability for the acts or omissions of subprocessors is determined by applicable law and the Public Offer Agreement. The Provider's pecuniary (monetary) liability is limited in accordance with the Public Offer Agreement to the extent that such limitation is permitted by the mandatory provisions of applicable law.
7. Assistance to the User
Taking into account the nature of the processing and insofar as technically possible, the Provider provides the User with reasonable assistance: by means available in the Service — in respect of data subjects’ requests; and also in respect of ensuring security, notification of incidents and impact assessments (DPIA) and consultation with the supervisory authority. Assistance going beyond the standard functionality of the Service is provided at the User’s reasonable expense. The handling of data subjects’ requests concerning User Data is ensured by the User itself as controller.
8. Personal data incidents
The Provider notifies the User of a personal data incident affecting User Data without undue delay after becoming aware of it and provides the information available at that time. Notification of the supervisory authority and data subjects (where necessary) is carried out by the User as controller.
9. Deletion or return of data
Upon termination of the provision of the Service, the Provider, at the User’s choice, deletes or returns User Data by available means, except where their further storage is required by law. The User independently exports the data it needs in advance; technical backups are deleted in accordance with ordinary cycles.
10. Audit
Upon the User’s reasonable written request, the Provider provides the information necessary to demonstrate compliance with this DPA — primarily in the form of available documentation, certificates, inspection reports or written responses; as a rule, this is sufficient to confirm compliance. If the information provided is objectively insufficient or there are reasonable doubts as to compliance with this DPA or the GDPR, the Provider allows for and contributes to an audit or inspection. The organizational details of such an audit (scope, timing and procedure) are agreed in writing in advance; such agreement may not be unreasonably delayed or used to refuse an audit. Scheduled audits are conducted, as a rule, no more than once a year, during working hours, with reasonable prior notice, with confidentiality maintained, without undue interference with the operation of the Service and at the User’s reasonable, documented expense; this frequency limitation does not apply in the case of a personal data breach, reasonable grounds to believe that a breach has occurred, a material change to the processing or a requirement of the supervisory authority. The costs of the audit are not borne by the User to the extent that the audit has revealed a material breach on the part of the Provider. With respect to subprocessors (in particular data centres and cloud providers), direct physical access may be limited by the terms of the relevant suppliers; in such a case, the Provider ensures equivalent audit rights in its contracts with subprocessors and provides available reports, certificates and other reasonable assistance. The limitations as to frequency and procedure do not apply to the extent that the supervisory authority expressly requires otherwise on the basis of law.
11. International transfers
If the processing involves the transfer of personal data outside the European Economic Area (EEA), such transfer is carried out where there is a legal basis in accordance with the GDPR (including an adequacy decision, Standard Contractual Clauses or other appropriate safeguards).
12. Liability
This DPA does not extend or increase the Provider’s liability compared to the Public Offer Agreement. The Provider’s aggregate liability related to the processing of personal data is limited in accordance with the Public Offer Agreement. The Provider is not liable for the User’s instructions, for the lawfulness of User Data or for the User’s failure to fulfil its obligations as controller. The limitations of liability do not apply to the extent they are prohibited by mandatory provisions of law.
13. Relationship between documents
With respect to the processing of personal data subject to the GDPR, this DPA prevails over the Privacy Policy. With respect to liability, the Public Offer Agreement prevails. In all other respects, the Public Offer Agreement and the Privacy Policy apply. All provisions apply subject to the mandatory provisions of law.