GDPR

AGREEMENT ON THE PROCESSING OF PERSONAL DATA

Between WLC EXPERT SERVICES SRL and the customer, hereinafter each referred to individually as the „Supplier” or the „Beneficiary”. Under this agreement, both parties act as controllers. The terms used in the agreement are defined by Regulation (EU) 2016/679 of the European Parliament.

Subject of the agreement

The subject of this agreement is to set out the manner and the terms in which each Party will process the personal data of the other Party.

Each of the Parties will carry out the processing of these data in accordance with the legal provisions in force applicable at the time of processing.

Purposes and legal bases of the processing

The Parties may process the personal data of the employees and/or other beneficiaries or representatives designated by the Parties in accordance with the applicable legal provisions and:

• For the purpose of fulfilling the obligations assumed by the Parties under the Contract;

• For the purpose of sending communications/notices/notifications to the employees and/or other beneficiaries designated by the Parties and/or to the Parties' representatives concerning the subject of the contract and the payment due dates of the invoices.

Other purposes for which the Parties' personal data may also be used, in specific situations, are the following:

• For the purpose of communicating with public authorities, auditors or institutions with powers to carry out inspections and checks of the Parties' activity and assets, as the case may be.
• For the purpose of collecting debts/recovering outstanding debts, if applicable.
• For the purpose of settling disputes and litigation, enforcing court or arbitration decisions, court orders, etc., if applicable.

The legal basis of the processing is, in accordance with:

1. Art. 6(1)(b) GDPR, namely „processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”;
2. Art. 6(1)(c) GDPR, namely „processing is necessary for compliance with a legal obligation to which the controller is subject”;
3. Art. 6(1)(f) GDPR, namely „processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”.

Categories of data processed

The data to be processed by the Parties for the purposes mentioned are the following: surname, first name, signature, position, phone, e-mail address.

In specific situations, for the purposes mentioned, other data may also be requested, such as the data in the identity card/provisional identity card/identity document/passport/diplomatic passport/temporary residence permit in Romania/birth certificate or others.

The Supplier may also process:

• location data provided by the GPS system;
• rental information: the delivery (rental) location, the return location, the rental period;
• information on additional drivers, if applicable;
• the information contained in documents or any other material containing personal data that you provide for the performance of this Contract;
• data concerning health (for example, in the event of an accident);

Term

This Agreement takes effect from the date it is signed by the Parties and remains in force for the whole period in which they process personal data under the Contract.

Data processing and the Parties' obligations regarding the lawfulness of the processing

The Parties undertake to comply with the applicable provisions on the protection of personal data, including the provisions of the GDPR, of the implementing legislation, and the decisions that the Romanian supervisory authority (ANSPDCP) issues periodically in this regard, when processing personal data in the performance of the order.

The personal data of the Parties' employees and/or of other beneficiaries designated by them and/or of their representatives involved in providing the service will be collected by the Parties in the context of providing the services under the order/contract.

The Parties will disclose only those personal data that they are authorised or entitled to disclose under the applicable legal provisions and the contracts/orders to which they are Parties, making sure that there is an appropriate legal basis for the processing of the data and that the data subjects are properly informed about the disclosure of their personal data, under the order/contract.

The Parties agree not to disclose under any circumstances any other personal data concerning the Parties' employees and/or other beneficiaries designated by them and/or their representatives than those necessary for providing the services under the order/contract.

Each of the Parties will implement appropriate technical and organisational measures to protect the personal data of the Beneficiaries against unauthorised or unlawful processing and against accidental loss, destruction or damage, providing an appropriate level of security.

The Parties will ensure that access to the personal data of the Beneficiaries is limited to the staff involved in providing the Services and/or the persons specifically authorised by each of them.

The Parties will seek to limit the volume of data processed to the data strictly necessary for each specific purpose of processing.

The Parties are responsible, under the applicable provisions on the protection of personal data, for properly informing the data subjects about their own personal data processing operations, including the processing of personal data under the order.

Security of personal data

The Parties must put in place and maintain at all times appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, disclosure or unauthorised access, in particular where the Processing involves the transmission of data over a network, and against any other unlawful form of Processing.

The Parties must take appropriate technical and organisational measures to protect the security of any electronic communications networks or services used for the transfer or transmission of Personal Data (including measures to ensure the confidentiality of communications and to prevent unauthorised access to any computer or system, thus ensuring the security of communications).

Applicable law

This Agreement is governed by Romanian law.

The Parties agree to make every effort to settle amicably any disagreement arising in connection with this Agreement. If the parties fail to settle such disagreements amicably, they will be submitted for settlement to the competent courts.

Liability

Each Party will act as an independent data controller for its own processing of data in connection with the Contract, and neither Party will accept any liability for a breach by the other Party of the applicable legislation on the protection of personal data.

The Beneficiary must inform its employees and/or the beneficiaries it designates as users of the vehicles covered by the rental contract about the processing of their personal data by the Supplier. For more details, please see our Privacy Policy available on our website ..].

[ALTERNATIVE VERSION – The WLC EXPERT SERVICES privacy policy is set out in Annex no. 1 – Information note on the processing of personal data, to this Agreement]

Final provisions

This Agreement represents the Parties' understanding regarding the processing of personal data in connection with the performance of the Contract and replaces any other provisions, agreement and prior understanding, whatever their form, concluded by the Parties regarding their roles and obligations in connection with the processing of personal data for the performance of the Contract.

This Agreement may be supplemented or amended only in writing, by agreement of the parties.