Data protection agreement for partners
Effective: [terms.effectiveDate.en]
Agreement on the transfer of personal data between controllers, between the partner company that integrates Handl into its app through the API (the "partner") and [company.name] [company.legalForm], [company.street], [company.zip] [company.city] ("Handl").
This agreement forms part of the terms for partners (§ 8) and specifies them. The German version is binding; this translation is provided for convenience.
§ 1 Roles
(1) Handl is the controller for customer accounts, orders, quote requests and payment processing. Handl is the customers' contracting party.
(2) The partner is the controller for its app, its own customer accounts and all data it receives through the API and stores in its systems.
(3) Each party acts as an independent controller. There is no processing on behalf of the other party; joint determination of purposes and means (Art. 26 GDPR) is not intended.
§ 2 Transfers
(1) From the partner to Handl:
- in the token exchange: the customer's identifier in the partner's system, email address and — where provided — name, phone number and language, to create or match a customer account at Handl;
- with orders and quote requests: the details the customer enters in the partner's app (for example address, phone number, appointment, notes).
(2) From Handl to the partner: order and quote data of customers ordering through its app, via the API and by webhook, and customer account data insofar as the partner retrieves it for display in its app.
(3) The partner does not receive data of customers of other partners or of Handl's website.
§ 3 Obligations of the partner
(1) Legal basis and information: The partner transfers data only where it has a legal basis to do so, and informs customers before their first order that orders are handled by Handl, by making Handl's privacy policy and terms for customers available in the app.
(2) Purpose limitation: The partner uses data received from Handl only to display and handle the respective order in its app, for customer service on that order and to comply with statutory obligations. Use for advertising, profiling or disclosure to third parties is permitted only where the partner has its own legal basis and has informed the data subjects itself.
(3) Security: The partner takes appropriate technical and organisational measures under Art. 32 GDPR, in particular: secret keys only on its servers, never in an app; verifying the signature of every webhook; encrypted transmission; access only for persons who need it.
(4) Accuracy: In the token exchange the partner transmits only verified email addresses of its own signed-in customers.
§ 4 Data subject rights
(1) Each party fulfils data subject rights for the processing for which it is the controller.
(2) If the partner receives a request concerning customer accounts, orders or payments at Handl, it forwards it without delay, at the latest within five working days, to [privacy.contactEmail]. Conversely, Handl informs the partner of requests concerning its app.
(3) If a customer requests deletion of their Handl account and this concerns data the partner has stored, Handl informs the partner in text form. The partner deletes order data stored on its side according to its own retention periods.
§ 5 Personal data breaches
Each party notifies the other of a breach affecting data from the cooperation without undue delay, where possible within 24 hours of becoming aware of it, and provides the information the other party needs for its own obligations under Art. 33 and 34 GDPR. If the partner's keys are compromised, the partner revokes them immediately in the partner console and informs Handl.
§ 6 Transfers to third countries
If the partner transfers data received from Handl to a country outside the EU and the EEA, it ensures that the conditions of Art. 44 to 49 GDPR are met.
§ 7 Liability
Each party is liable for the processing for which it is the controller under Art. 82 GDPR. Otherwise the liability rules of the terms for partners apply. The partner indemnifies Handl against third-party claims arising from the partner's breach of this agreement.
§ 8 Term
This agreement applies as long as the partner uses Handl, and beyond that for data from the cooperation that the partner still stores.