Privacy Policy and Data Processing Agreement CCO Insights

Data Processing Agreement

The processing conditions stated in this document (hereinafter referred to as the “Conditions”) apply to all services (as defined below) of CCO Insights, a trade name of Reijntjens Holding B.V., a company under Dutch law, registered under number 09153616, located at Ernest Hemingwaystraat 7, 6836 TJ Arnhem, Netherlands (hereinafter referred to as “CCO Insights”).

Your acceptance of these terms

Any company, business, person, or other party that has an account on the CCO Insights platform or otherwise uses the Services (hereinafter referred to as the “Client”) is deemed to have unconditionally accepted the Conditions.

You acknowledge that you have read, understood, and agree to be bound by this DPA, which governs the processing of personal data as part of your use of the services provided by CCO Insights. Your continued use of the Site or the App following the posting of changes to this policy will be deemed your acceptance of those changes.

If you do not agree to this DPA, you must not create an account or use the SaaS application.

In the context of these Conditions, the Client will be designated as the Data Controller and CCO Insights as the Data Processor.

Recitals

Considering Article 28 of Regulation (EU) 2016/679 (GDPR), these Conditions will apply to all Services that CCO Insights provides to the Client, as well as the agreements between the parties regarding the processing of personal data of the Client.

1. Definitions

1.1. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons regarding the processing of personal data.

1.2. “Data Subject” means any natural person whose personal data is processed by CCO Insights.

1.3. “EEA” means the European Economic Area.

1.4. “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

1.5. “Services” means any activity provided or performed by CCO Insights for the Client.

1.6. “Personal Data” has the meaning set forth in Article 4 of the GDPR.

1.7. “Client’s Personal Data” means all personal data of the Client that is processed by CCO Insights or third parties under the instruction of CCO Insights in connection with the Services.

1.8. “Privacy Shield” means the EU-U.S. framework that provides a means for companies to comply with data protection requirements when transferring personal data from the EU to the United States.

1.9. “Sub-processor” means any party or entity designated by or on behalf of CCO Insights to process Personal Data of the Client.

1.10. “Controller” has the meaning set forth in Article 4 of the GDPR.

1.11. “Processor” has the meaning set forth in Article 4 of the GDPR.

1.12. All terms not defined above have the same meanings as in the GDPR, and related terms will be interpreted similarly.

By making the Services available to the Client, CCO Insights will process Personal Data of the Client. The parties will agree on relevant conditions regarding the Personal Data of the Client and will act in good faith in this regard.

2. Applicability and Duration of the Conditions

2.1 These Conditions apply to all Personal Data of the Client that is processed by CCO Insights in relation to the Services. CCO Insights trusts that the person accepting these Conditions is authorized to do so on behalf of the Client. The Conditions remain in effect until automatically terminated when all Personal Data of the Client is deleted and/or returned as described in Article 11 of the Conditions (Deletion or Return of Personal Data).

3. Processing of Personal Data

3.1 The Client is responsible for collecting and managing Personal Data of the Client and determines in what manner this data is used via or through CCO Insights’ website, platform or services.

3.2 CCO Insights will facilitate the processing of the Client’s Personal Data in connection with the delivery of the Services.

3.3 CCO Insights will process the Client’s Personal Data solely for the purpose of improving and providing the Services to the Client. CCO Insights will process the Client’s Personal Data only on behalf of the Client and in accordance with these Conditions and the documented instructions of the Client, unless otherwise required by the relevant law to which CCO Insights is subject.

3.4 CCO Insights will comply with all applicable laws regarding data protection during the processing of the Client’s Personal Data.

3.5 CCO Insights will inform the Client without undue delay if, in the opinion of CCO Insights and upon instruction from the Client, the processing of the Client’s Personal Data violates applicable data protection laws and/or these Conditions, unless the applicable law prohibits this.

4. Security Measures and Confidentiality

4.1 CCO Insights will take appropriate technical and organizational measures to protect the Client’s Personal Data.

4.2 Our security measures include, but are not limited to, measures for encrypting the Client’s Personal Data; the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; the ability to restore the availability and access to the Client’s Personal Data in a timely manner in the event of an incident; and regularly testing, assessing, and evaluating the effectiveness of the applied measures to ensure the security of the Processing.

4.3 CCO Insights will take appropriate steps to ensure compliance with security measures by persons authorized to process the Client’s Personal Data. In this regard, all persons authorized to process the Client’s Personal Data are bound by confidentiality or are under an appropriate statutory obligation of confidentiality.

4.4 CCO Insights ensures that only those persons who are authorized to process the Client’s Personal Data have access to such data as is necessary to provide and improve the Services to the Client.

4.5 CCO Insights is not responsible for Personal Data of the Client that is collected by or via the Client outside the Services, nor for Personal Data of the Client that is collected by third parties such as websites of third parties, or tools or plug-ins used by the Client

5. Sub-processing

5.1 CCO Insights may appoint Sub-processors to perform certain processing activities under these Conditions provided that the Sub-processor complies with data protection standards equivalent to those of CCO Insights, including conditions for data transfers to the United States of America (subject to the Privacy Shield framework or equivalent).

5.2 Regarding each Sub-processor, CCO Insights will ensure that:

5.2.1 Such an engagement is set out in a written agreement or another written legal act.

5.2.2 The obligations set out in these Conditions and under Article 28(3) of the GDPR will be imposed on the Sub-processor by contract or other legal act under Union or Member State law, mutatis mutandis.

5.2.3 The Sub-processor will process the Client’s Personal Data in accordance with the applicable technical and organizational measures required under these Conditions and Article 32 of the GDPR.

5.3 CCO Insights is responsible for the processing of the Client’s Personal Data by the Sub-processor.

6. Rights of Data Subjects

6.1 CCO Insights enables the Client to disclose, correct, delete, restrict, or export the Client’s Personal Data.

6.2 Requests by Data Subjects

6.2.1 If a Data Subject makes a request regarding the Client’s Personal Data, CCO Insights will assist in responding to such a request upon the Client’s request, provided the requests are legitimate.

6.2.2 CCO Insights will help the Client fulfill its duty to respond to requests from Data Subjects and to exercise the rights of Data Subjects as laid down in Chapter III of the GDPR.

7. Data Sharing

7.1 The Client’s Personal Data is processed exclusively by CCO Insights and/or designated Sub-processors: (i) within the EEA; (ii) in the United States of America (subject to the condition that such an American party complies with the Privacy Shield); or (iii) in a country recognized by the European Commission as providing an adequate level of data protection.

7.2 When CCO Insights is permitted by the Client to transfer Personal Data to a recipient located outside the EEA or the United States of America (subject to the condition that such an American party complies with the Privacy Shield); and the data protection system of such a country is (i) not recognized by the European Commission as providing an adequate level of data protection; or (ii) does not fall under a suitable certification mechanism recognized by the relevant authorities or courts as providing an adequate level of data protection, then CCO Insights will implement standard contractual clauses (based on the European Commission’s decision of February 5, 2010, regarding standard contractual clauses).

8. Data Breach

8.1 In the event of a Data Breach that affects the Client’s Personal Data, CCO Insights will immediately inform the Client of the breach. CCO Insights will take immediate measures to stop the breach and mitigate any adverse effects.

8.2 CCO Insights will assist the Client in complying with legal obligations to report the breach to a supervisory authority or Data Subjects affected by the Data Breach in accordance with Articles 33 and 34 of the GDPR.

9. Impact Assessments

9.1 CCO Insights will assist the Client in conducting impact assessments, including consultations with supervisory authorities or other competent data protection authorities, to fulfill the obligations outlined in Articles 35 and 36 of the GDPR, or equivalent provisions of any other applicable data protection law.

10. Register of Processing Activities

10.1 CCO Insights will maintain a register of processing activities with regard to these Conditions and the Client’s Personal Data, in accordance with the requirements as set out in Article 30 of the GDPR.

10.2 CCO Insights will make such information available to the Client upon request.

11. Deletion or Return of Personal Data

11.1 The Client determines how long the Client’s Personal Data is retained, in accordance with relevant legislation. CCO Insights will by default delete the Client’s Personal Data in accordance with clauses 11.2 and 11.3, unless the Client chooses another retention period as agreed upon between the parties in a documented manner. [By default, CCO Insights will delete all personal customer data within one (1) year, unless the Client chooses another retention period.]

11.2 Upon termination of the Services, or at an earlier time upon written request by the Client, CCO Insights will delete or return all the Client’s Personal Data, including any copies thereof, unless required by law to retain them.

11.3 Upon receipt of a written deletion request from the Client, CCO Insights will delete the Client’s Personal Data processed by CCO Insights within a maximum of one month.

12. Audit

12.1 The Client, or a third party acting under the Client’s instruction, has the right to perform, at their own expense, an audit regarding data security and privacy procedures of CCO Insights, compliance with these Privacy Conditions, and relevant legislation on data protection, insofar as it concerns the Processing of the Client’s Personal Data. The Client may require CCO Insights to demonstrate that these procedures have been followed instead of or in addition to performing such an audit.

13. Liability

13.1 CCO Insights is never liable for any indirect or consequential damages suffered by the Client, including but not limited to consequential damage and non-material damage resulting from the use or non-use of the Services.

13.2 If CCO Insights is liable for any damage, CCO Insights’s liability is limited to the amount paid out by its insurer in that specific case.

13.3 In the event that the insurer does not cover the damage (fully), CCO Insights’s liability towards the Client, regardless of the cause, is limited to the amount the Client paid for the Services during the three (3) months preceding the event that caused the damage.

13.4 Interruptions or any other form of service delivery failure by third parties, such as other (hosting) providers, data storage or telecommunication services, and other suppliers of CCO Insights, are not attributable to CCO Insights and are not the responsibility of CCO Insights, and therefore cannot cause CCO Insights to be held liable for these interruptions.

13.5 CCO Insights is not liable for the loss, alteration, or unauthorized access to Personal Data of the Client stored outside the Services, nor for Personal Data of the Client processed by third parties such as websites or tools, or plug-ins used by the Client. The Client will hold CCO Insights harmless from any claims by third parties in this regard.

14. Final Provisions

14.1 These Privacy Conditions and their interpretation are exclusively governed by Dutch law.

14.2 Any dispute regarding these Privacy Conditions will be resolved by the Dutch court, which will have exclusive jurisdiction over the matter unless the parties agree otherwise in writing.

14.3 Future amendments to these Privacy Conditions will be documented in writing. Such amendments will be included in an update of these Conditions.

14.4 If any provision of these Privacy Conditions is deemed invalid or unenforceable, the remaining provisions will remain in full force and effect. The invalid or unenforceable provision will be (i) modified to the extent necessary to ensure its validity and enforceability, while preserving the intent of the parties, or if this is not possible, (ii) construed in such a manner as if the invalid or unenforceable part had never been included.