Data Processing Agreement - Kipi Commerce
This Data Processing Agreement ("Agreement") is part of the Services Agreement ("Main Agreement") between
Rebel Beans VOF
Gerard Doustraat 40A 1072VS Amsterdam The Netherlands
Phone: +31 0642251022
Email: info@kipicommerce.com
Tax ID: NL86 292 533 2B01
KVK Number: 83584323
​
("Company") and
Site Visitors
("User")
(collectively, the "Parties") (collectively, the "Parties")
WHEREAS
(A) The Company acts as the Data Controller.
(B) The Company wishes to subcontract certain Services to the Data Processor that involve the processing of personal data.
(C) the Parties seek to implement a data processing agreement in accordance with the requirements of the current legal framework on data processing and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data concerning them and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
(D) The parties wish to set out their rights and obligations.
IT IS AGREED AS FOLLOWS:
1. Definitions and Interpretation
1.1 Unless otherwise defined, capitalized terms and expressions used in this Agreement shall have the following meaning:
1.1.1 “Agreement” means this Data Processing Agreement and all Annexes;
1.1.2 “Company Personal Data” means all Personal Data Processed by the Contract Processor on behalf of the Company under or in connection with the Master Agreement;
1.1.3 “Contract Processor” means a Sub-Processor;
1.1.4 “Data Protection Laws” means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
1. 1.5 “EEA” means the European Economic Area;
1.1.6 “EU Data Protection Laws” means EU Directive 95/46/EC as transposed into the domestic legislation of each Member State and as amended, replaced or superseded from time to time, including the GDPR and laws implementing or supplementing the GDPR;
1.1.7 ‘GDPR’ means EU General Data Protection Regulation 2016/679;
1.1.8 “Data Transfer” means:
1.1.8.1 the transfer of Company Personal Data from the Company to the Contract Processor; or
1.1.8.2 onward transfer of Company Personal Data from the Contracted Processor to the Subcontracted Processor or between two entities of the Contracted Processor, in each case where such transfer would be prohibited by Data Protection Laws (or the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws);
1.1.9 “Services” means all services provided by Rebel Beans VOF.
1.1.10 “Sub-processor” means any person appointed by or on behalf of the Processor to process Personal Data on behalf of the Company in connection with the Agreement.
1.2 The terms “Commission”, “Controller”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Personal Data Breach”, ‘Processing’ and “Supervisory Authority” shall have the same meaning as in the GDPR and their respective terms shall be interpreted accordingly.
2. Processing of Company Personal Data
2.1 Processor:
2.1.1 The Company shall comply with all applicable Data Protection Laws in the Processing of the Company Personal Data; and
2.1.2 The Company shall not Process the Company Personal Data except on the documented instructions of the relevant Company.
2.2 The Company instructs the Processor to Process Company Personal Data.
3. Processor Personnel
Processor shall take reasonable steps to ensure the trustworthiness of any employee, agent or contractor of any Contract Processor who may have access to Company Personal Data, in each case ensuring that access is strictly limited to persons who have a need to know/access the relevant Company Personal Data, as strictly necessary for the purposes of the Master Agreement and in the context of such person's duties to the Contract Processor, ensuring compliance with Applicable Laws, ensuring that all such persons are subject to confidentiality undertakings or professional or legal obligations of confidentiality.
4. Security
4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, the Processor shall, in relation to Company Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures set out in Article 32(1) of the GDPR.
​
4.2 In assessing the appropriate level of security, the Processor shall take into account the risks presented by the Processing, in particular arising from a Personal Data Breach.
​
5. Sub-processing
5.1 The Processor may not appoint any Sub-processor (or disclose any Company Personal Data) unless required or authorized to do so by the Company.
6. Data Subject Rights
6.1 Taking into account the nature of the Processing, the Processor shall assist the Company in fulfilling its obligations to respond to requests to exercise Data Subject rights, as reasonably understood by the Company, by implementing appropriate technical and organizational measures.
​
6.2 The Processor shall:
6.2.1 promptly notify the Company if the Company receives a request from a Data Subject under any Data Protection Law relating to their Personal Data; and
6.2.2 ensure that it does not respond to such request except as required by the Company's documented instructions or Applicable Law to which the Processor is subject, in which case the Processor shall, to the extent permitted by Applicable Law, inform the Company of such legal requirement before the Contracted Processor responds to the request.
7. Personal Data Breach
​
7.1 Upon becoming aware of a Personal Data Breach affecting Company Personal Data, the Processor shall cooperate with the Company and take reasonable commercial steps to investigate, mitigate and remediate any Personal Data Breach as directed by the Company, providing the Company with sufficient information to enable the Company to fulfill its obligations under Data Protection Laws to report or notify the Personal Data Breach.
8. Data Protection Impact Assessment and Preliminary Consultation
The Processor shall provide the Company with reasonable assistance with any data protection impact assessment and preliminary consultation with Supervisory Authorities or other competent data privacy authorities that the Company reasonably considers necessary pursuant to Article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law; in each case, only in relation to the Processing of Company Personal Data by the Contracted Processors and taking into account the nature of the Processing and the information to which the Contracted Processors have access.
​
9. Deletion or Return of Company Personal Data
9.1 Subject to this section 9, the Processor shall promptly, and in any event within 10 business days of the date of termination of any Services involving the Processing of Company Personal Data
(“Termination Date”), delete all copies of such Company Personal Data and ensure its deletion.
​
10. Audit rights
10.1 Subject to this section 10, the Processor shall make available to the Company upon request all information necessary to demonstrate compliance with this Agreement and shall permit and contribute to audits, including inspections, by the Company or an auditor authorized by the Company in relation to the Processing of Company Personal Data by the Contracted Processors.
10.2 The Company's information and audit rights arise under section 10.1 only to the extent that the Agreement does not grant them information and audit rights that meet the relevant requirements of the Data Protection Act.
​
11. Data Transfer
11.1 The Processor may not transfer or authorize the transfer of Data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of the Company. If personal data processed under this Agreement is transferred from a country within the EEA to a country outside the EEA, the Parties shall ensure adequate protection of personal data. To achieve this, unless otherwise agreed, the Parties shall rely on standard contractual clauses approved by the EU for the transfer of personal data.
12. General Terms
12.1 Confidentiality. Each Party must keep this Agreement and any information it receives about the other Party and its activities in connection with this Agreement ("Confidential Information") confidential and must not use or disclose such Confidential Information without the other Party's prior written consent, unless:
​
(a) disclosure is required by law;
(b) the relevant information is already publicly available.
12.2 Notices. All notices and communications given under this Agreement must be in writing and must be delivered personally, sent by mail or sent by e-mail to the address or e-mail address set forth in the header of this Agreement, or such other address as notified by the Parties as the address changes from time to time.
​
13. Governing Law and Jurisdiction
13.1 This Agreement is governed by the laws of the Netherlands.
IN WITNESS WHEREOF, this Agreement has entered into force as of the date first set forth below.
​
Last updated: March 28, 2025
​
14. Contact Us
If you have any questions about this contract, you can contact us:
By e-mail: info@kipicommerce.com