133x
001622
2021-02-25

Data Processing

2.1
The contractor shall process the personal data exclusively on behalf of and in compliance with the client's instructions within the meaning of Art. 28, 29 of GDPR (commissioned data processing). From a data protection legislation perspective, the client shall remain the responsible party ("master of the data") and shall be responsible for the lawful processing of the personal data in accordance with the contract.

2.2
The personal data shall be exclusively and entirely processed in a Member State of the European Union or any other nation that has ratified the Agreement on the European Economic Area and according to the nature as well as for the purpose finalized in Attachment 1 of this DP Agreement. The processing of personal data shall include the type of personal data stated in Attachment 1 of this DP Agreement, as well as the categories of data subjects affected by the processing defined therein.

2.3
The contractor shall not acquire any rights to the personal data and shall surrender the personal data to the client at any time upon request. Rights of retention related to the personal data shall be precluded. On the client's instruction, the contractor shall be obligated to rectify personal data or restrict its processing.

2.4
The contractor shall be obligated to unconditionally follow the instructions arising from the contract and the written instructions of the client for the processing of the personal data (hereinafter referred to as "data protection instructions"), issued in individual cases by the executives as well as the client's data protection officer. The individual data protection instructions shall be issued in written or via email. In justified individual cases, it shall also be possible to give verbal data protection instructions. However, such instructions must be confirmed by the client in writing or via email in a timely manner. If the contractor takes the view that the data protection instruction violates legal provisions and/or the contract, the contractor shall be obligated to inform the client of this without undue delay, and shall be entitled to not execute the data protection instruction until such time as the data protection instruction is confirmed by the client.

2.5
The contractor shall be obligated to commission a company data protection officer in writing, pursuant to § 38(1) s. 1 of the Federal Data Protection Act (BDSG). The contact details of the contractor's company data protection officer are published at www.dlubal.com/en-US/legal-notice/privacy-policy-basic-information.