Data Processing Agreement

This agreement sets out the rights and obligations that apply when the data processor processes personal data on behalf of the data controller.

The agreement has been prepared for the purpose of ensuring the parties’ compliance with Article 28, subsection 3 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free exchange of such data, and on the repeal of Directive 95/46/EU (General Data Protection Regulation), which sets out specific requirements concerning the contents of a data processing agreement.

The data processor’s processing of personal data shall take place for the purpose of fulfilling the parties’ "main agreement", which is the agreement the data controller has entered into with either the data processor or another central sports organisation representing the data controller.

The data processing agreement and the "main agreement" are mutually dependent on one another and cannot be terminated individually. Nevertheless, the data processing agreement may, without termination of the "main agreement," be replaced by another valid data processing agreement.

This data processing agreement shall take precedence over any similar provisions in other agreements between the parties, including the "main agreement".

There are four appendices to this agreement. The appendices act as integral parts of the data processing agreement.

The contents of the data processing agreement Appendix A comprise further information about the processing, including the purpose and nature of the processing, the type of personal data, the category of data subjects and the duration of the processing.

The data processing agreement Appendix B includes the data controller’s conditions for the data processor using any subcontracted data processors, as well as an overview of any subcontracted data processors approved by the data controller.

The data processing agreement Appendix C includes further instructions regarding the processing the data processor will carry out on behalf of the data controller (processing object), the minimum security measures that must be taken, as well as how supervision of the data processor and any subcontracted data processors is carried out.

The data processing agreement Appendix D covers the parties’ governance of circumstances that are otherwise not set out in the data processing agreement or the parties’ "main agreement".

The data processing agreement and associated appendices shall be archived, including electronically, by both parties.

This data processing agreement shall not relieve the data processor of any obligations that directly arise under the General Data Protection Regulation (GDPR) or any other legislation.

The data controller is generally responsible for ensuring that the processing of personal data takes place within the constraints of the GDPR and the Danish Data Protection Act.

The data controller therefore has both the right and obligation to make decisions as to
what purposes the processing shall be carried out for and what tools shall be used.

The data controller is, among other things, responsible for ensuring that there is a legal basis for the processing that the data processor is instructed to perform.

The data processor shall only process personal data in accordance with documented instructions from the data controller unless otherwise required in accordance with EU law or national law in the member states in which the data processor is based; in such a case the data processor shall notify the data controller of such legal requirements prior to processing, unless the legislation in question prevents such notification for reasons of important societal interests, cf. Article 28, subsection 3, item a.

The data processor shall immediately notify the data controller if it believes that an instruction contravenes the General Data Protection Regulation or data protection provisions in other EU legislation or national legislation in member states.

The data processor shall ensure that only the persons authorised to do so have access to the personal data processed on behalf of the data controller. Access to information shall therefore be immediately denied in the event of the authorisation being revoked or expiring.

Only persons who require access to personal data in order to fulfil the data processor’s obligations to the data controller shall be authorised.

The data processor shall ensure that the persons authorised to process personal data on behalf of the data controller have consented to confidentiality or are subject to appropriate statutory non-disclosure requirements.

The data processor shall, upon request from the data controller, be able to demonstrate that the relevant employees are subject to the aforementioned confidentiality.

The data processor shall implement all measures required in relation to Article 32 of the General Data Protection Regulation, which, among other things, states that after taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a security level appropriate to the risk.

The abovementioned obligations mean that the data processor must carry out a risk assessment and subsequently implement measures to manage the identified risks. This could, depending on relevance, include the following measures:

In connection with the above, and in all circumstances, the data processor shall, as a minimum, implement the security levels and measures specified in further detail in Appendix C to this agreement.

Any governance/agreement concerning the parties’ remuneration or similar in connection with the data controller or data processor’s subsequent requests to establish further safety measures shall be included in the parties’ "main agreement" or Appendix D to this agreement.

In order to use another data processor (subcontracted data processor), the data processor must fulfil the conditions addressed in Article 28, subsection 2 and 4 of the GDPR.

As such, the data processor cannot use another data processor (subcontracted data processor) to fulfil the data processing agreement without prior specific or general written approval from the data controller.

In the event of general written approval, the data processor shall notify the data controller of any planned changes concerning the addition or replacement of other data processors, thereby providing the data controller with the opportunity to object to such changes.

The data controller’s further conditions for the data processor’s use of any subcontracted data processors can be found in Appendix B of this agreement.

The data controller’s approval of any specific subcontracted data processors can be found in Appendix B of this agreement.

Once the data processor has obtained approval from the data controller for the use of a subcontracted data processor, the data processor shall ensure that the subcontracted data processor is bound by the same data protection obligations as those specified in this data processing agreement, through the use of a contract or other legal document in accordance with EU legislation or national legislation in the member states in which the necessary guarantees are provided, to ensure that the subcontracted data processor will implement appropriate technical and organisational measures in such a way that the processing fulfils the requirements set down in the GDPR.

As such, the data processor is responsible, through the execution of a subcontracted data processing agreement, for ensuring that the subcontracted data processor is subject to, as a minimum, the obligations that the data processor itself is subject to under the data protection regulations, as well as this data processing agreement and associated appendices.

A copy of the subcontractor data processing agreement and any later changes thereto must be issued, upon request from the data controller, to the data controller, who shall thereby have the opportunity to assure itself that a valid agreement has been entered into between the data processor and the subcontracted data processor. Any commercial terms, e.g. prices, that do not affect the data protection legislative contents of the subcontractor data processing agreement shall not be issued to the data controller.

In its agreement with subcontracted data processors, the data processor shall include the data controller as a third party beneficiary in the event of the data processor’s bankruptcy so that the data controller can assume the data processor’s rights and invoke these against the subcontracted data processor, e.g. so that the data controller can instruct the subcontracted data processor to make deletions or return any information.

In the event that the subcontracted data processor fails to fulfil its data protection obligations, the data processor shall be fully liable to the data controller for the fulfilment of the subcontracted data processor’s obligations.

The data processor shall only process personal data in accordance with documented instructions from the data controller, including the transfer (transfer, disclosure and internal use) of personal data to third countries or international organisations unless required in accordance with EU legislation or national legislation in member states to which the data processor is subject; in such a case the data processor shall notify the data controller of such legal requirements prior to processing, unless the legislation in question prevents such notification for reasons of important societal interests, cf. Article 28, subsection 3, item a.

Without instructions or approval from the data controller, the data processor can therefore not, within the constraints of the data processing agreement;

Any instructions or approvals from the data controller with respect to the transfer of personal data to a third country can be found in Appendix C of this agreement.

The data processor shall assist, depending on the nature of the processing and to the extent possible, the data controller using appropriate technical and organisational measures to fulfil the data controller’s obligation to respond to requests to exercise the rights of the data subject as set down in Chapter 3 of the General Data Protection Regulation.

This means that the data processor shall, to the extent possible, assist the data controller in connection with the data controller ensuring compliance with:

The data processor shall assist the data controller to ensure compliance with the data processor’s obligations pursuant to Articles 32-36 of the GDPR with regard to the nature of the processing and the data available to the data processor, cf Article 28, subsection 3, item f.

This means that the data processor, subject to the nature of the processing, shall assist the data controller in connection with the data controller ensuring compliance with:

Any governance/agreement concerning the parties’ remuneration or similar in connection with the data processor’s assistance to the data controller shall be included in the parties’ "main agreement" or Appendix D to this agreement.

The data processor shall notify the data controller without undue delay after becoming aware of a breach of personal data security on the part of the data processor or a subcontracted data processor.

The data processor’s notification to the data controller shall, if possible, take place no later than 36 hours after it has become aware of the breach, to ensure that the data controller has the opportunity to comply with its obligation to report the breach to the supervisory authorities within 72 hours.

In accordance with Section 10.2, item b of this agreement, the data processor shall, subject to the nature of the processing and the information available, assist the data controller in reporting breaches to the supervisory authorities.

This could mean that the data processor should assist in obtaining the following information, which, according to Article 33, subsection 3 of the GDPR, must be included in the report from the data controller to the supervisory authority:

Upon termination of the processing-related services, the data processor shall be obliged to delete or return all personal data to the data controller, as decided by the data controller, and to delete all existing copies, unless EU legislation or national legislation requires the storage of the personal data.

The data processor shall make all information necessary to demonstrate the data processor’s compliance with Article 28 of the General Data Protection Regulation and this agreement available to the data controller and shall enable and contribute to audits, including inspections performed by the data controller or another auditor authorised by the data controller.

The procedure for the data controller’s supervision of the data processor can be found in Bilag C of this agreement.

The data controller’s supervision of any subcontracted data processors shall generally take place through the data processor. The procedure for this can be found in Appendix C of this agreement.

The data processor shall be obliged to provide the authorities that, under the legislation applicable at any time, have access to the data controller and data processor’s facilities, or representatives acting on behalf of the authorities, with access to the data processor’s physical facilities upon presentation of appropriate identification.

Any (specific) governance of the consequences of the parties’ breach of the data processing agreement can be found in the parties’ "main agreement" or in Appendix D of this agreement.

Any governance of other matters between the parties can be found in the parties’ "main agreement" or in Appendix D of this agreement.

This agreement shall automatically enter into force upon the data controller’s use of Players 1st software.

Both parties shall be entitled to request renegotiation of the agreement in the event of legislative changes or inexpediencies in the agreement giving rise thereto.

The data processing agreement can be terminated in accordance with the termination terms, including notice period, specified in the "main agreement

The agreement shall apply for as long as the processing takes place. Regardless of termination of the "main agreement" and/or the data processing agreement, the data processing agreement shall remain in force until the end of the processing and the deletion of the data on the part of the data processor and any subcontracted data processors.

All contact concerning data processing with the data processor shall take place via: privacy@players1stgroup.com