This agreement (the "Data Processing Agreement") has been entered into between Adtraction and You (the "Publisher").
1. Introduction and scope
The Publisher and Adtraction have entered into an agreement which enables the Publisher to provide space on its website or other internet marketing channels for links and advertisements for the websites that have a Publisher program registered with Adtraction (the "Publisher agreement").
The purpose of this Data Processing Agreement is to fulfill the demands set out in Section 30 of the Swedish Personal Data Act (1998:204) (the "PDA") and as of 25 May 2018 the General Data Protection Regulation (EU 2016/679) and/or the new PDA (the "GDPR"). This Data Processing Agreement covers all processing of personal data that Adtraction process and for which the Publisher is responsible under the PDA and/or the GDPR.
As a consequence of the Publisher agreement, Adtraction may receive access to personal data for which the Publisher is responsible under the PDA and/or the GDPR. The Publisher hereby grants permission for Adtraction to process personal data as set out in this Data Processing Agreement.
The Publisher and Adtraction are referred to individually as a "Party" and jointly as the "Parties".
2. Validity and use of the data processing agreement
This Data Processing Agreement applies to every occasion when Adtraction is processing personal data for which the Publisher is responsible under the PDA and/or the GDPR.
This Data Processing Agreement terminates automatically when the Publisher agreement terminates, for whatever reason.
Adtraction shall be of assistance when a data subject exercises its right to have personal data concerning him or her rectified, blocked, erased or restricted. Further, Adtraction shall be of assistance when a data subject exercises its right to receive personal data, which the data subject has provided.
3. Purpose and instructions for processing of personal data
Adtraction is only allowed to process personal data in accordance with The Publisher's instructions and only in order to fulfill its obligations under the Publisher agreement, this Data Processing Agreement and agreements with advertisers.
If Adtraction is lacking sufficient instructions for a specific situation and/or a specific instruction conflicts with the PDA and/or the GDPR Adtraction shall notify the Publisher immediately.
The Publisher shall have the right to supervise that Adtraction process personal data in accordance with this Data Processing Agreement. Adtraction shall lend reasonable assistance to the Publisher during such supervision. Adtraction shall also lend reasonable assistance to the Publisher in order for the publisher to fulfill its obligations under the PDA and/or the GDPR.
4. Security safeguards
Adtraction will limit the access to personal data to its employees who need to have access to the personal data in order to carry out the tasks set out in the Publisher agreement. Adtraction shall be able to specify and report to the Publisher which employees who have processed personal data on a given date.
Adtraction will make sure that it does not process personal data in breach of the PDA and/or the GDPR. Adtraction will take appropriate technical and organizational measures to protect personal data against unauthorized access, destruction and change as well as ensure that only the personal data which is necessary for each specific processing purpose is processed.
In the case of a personal data breach, Adtraction shall take necessary actions to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed by Adtraction. Adtraction shall without undue delay and, where feasible, not later than 24 hours after having become aware of it, notify the Publisher of the personal data breach.
Adtraction shall maintain a record of the processing activities under its responsibility. The record shall at least contain: the categories of processing carried out and if applicable transfers of personal data to a third country or an international organization, including the identification of that third country or international organization and if possible a general description of the technical and organizational security measures for processing the data.
Adtraction shall incorporate sufficient routines to comply with the PDA and/or the GDPR.
Return or deletion of personal data
Following termination of the Agreement, Adtraction will return to the Publisher or otherwise make available for retrieval to the Publisher, all personal data it has processed.
Compensation
Adtraction has no right to be compensated for the fulfillment of its obligation under this Data Processing Agreement.
Secrecy
Adtraction undertakes not to disclose information to third parties regarding the processing of personal data under this Data Processing Agreement, or other information that the Publisher has provided to Adtraction. Adtraction will make sure that the employees that are given access to personal data will be informed how the personal data is allowed to be processed and make sure that these employees are subject to this secrecy undertaking.
This secrecy undertaking is valid even after this Data Processing Agreement has been terminated.
Subcontractors, etc
Adtraction is allowed to use subcontractors/processors to process personal data for which the Publisher is responsible under the PDA and/or the GDPR.
Dispute, choice of law and forum
This Data Processing Agreement shall be governed by the substantive law of Sweden. Any dispute, controversy or claim arising out of or in connection with this Data Processing Agreement, or the breach, termination or invalidity thereof, shall be settled by general courts in Sweden, with Stockholm District Court as court of first instance.
Liability
If a private individual, an advertiser, The Swedish Data Protection Authority and/or other third party makes demands towards the Publisher due to the processing of personal data carried out by Adtraction, Adtraction will indemnify and hold the Publisher harmless from any reasonable loss, cost and expense, if such demands are due to
- Adtractions breach of the Publisher Agreement or this Data Processing Agreement
- Adtractions breach of the PDA and/or the GDPR.
The above applies also if the Publisher is subject to administrative fines and/or other fines and cost.
Invalidity
If any provision in this Data Processing Agreement or part thereof is found to be invalid, this shall not entail that this Data Processing Agreement in its entirety is invalid.