{"id":7323,"date":"2021-02-19T14:32:18","date_gmt":"2021-02-19T13:32:18","guid":{"rendered":"http:\/\/cw20202.compliance-wise.com\/grub-processor-agreement\/"},"modified":"2025-06-12T13:59:30","modified_gmt":"2025-06-12T11:59:30","slug":"grub-processor-agreement","status":"publish","type":"page","link":"https:\/\/compliance-wise.com\/en\/grub-processor-agreement\/","title":{"rendered":"GRUB Processor Agreement"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

GRUB Processor Agreement<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Version December 18, 2020 - 2nd version<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t<\/i>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\tDownload<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ComplianceWise BV <\/strong>, having its registered office and principal place of business at 1059 CM Amsterdam at Anthony Fokkerweg 3, Chamber of Commerce number 59384999, hereinafter referred to as “ Processor <\/strong>“, and the “ Controller <\/strong> “, hereinafter jointly referred to as\u201c Parties <\/strong> \u201d, consider the following: <\/p>\n

    \n
  1. Controller and Processor have by signing the Grub order form a Agreement concluded, hereinafter referred to as \u201cAgreement\u201d, for the provision of services by Processor to Controller; <\/li>\n
  2. On the basis of the Agreement, Processor will process Personal Data on behalf of and on behalf of Controller; <\/li>\n
  3. The agreements that apply between the Parties in that regard are laid down in this Processor Agreement; <\/li>\n<\/ol>\n

    And correspond as follows: <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    1. Definitions<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The terms below are written with a capital letter and have the following meaning: <\/p>\n

    AP: Dutch Data Protection Authority
    Audit: The investigation referred to in Article 11 of this Processing Agreement
    GDPR: General Regulation data protection (EU) 2016\/679
    Data Subject: An identified or identifiable natural person whose Personal Data are being processed
    Attachment: An attachment to this Processor Agreement that forms an integral part thereof
    Data breach: A breach in connection Personal data as referred to in article 4 sub 12 of the AVG
    Agreement: The agreement referred to in consideration A.
    Parties: Processor and Controller.
    Personal data: All information as referred to in article 4 sub 1 of the GDPR that Processor processes on the basis of the Agreement and \/ or Processor Agreement on behalf of Controller.
    PIA (Privacy impact assessment): Data protection impact assessment as referred to in Article 35 of the GDPR
    Sub-processor: Another processor engaged by the Processor
    Controller: The party with whom the Processor has concluded the Agreement referred to in consideration A.
    Implementation Act: The Implementing Act General Data Protection Regulation
    Processor Agreement: This agreement between Processor and Controller, including considerations and Appendices. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    2. Duration of the Processor Agreement<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    2.1. This Processor Agreement commences on the effective date of the Agreement and will be in effect as long as the Agreement is in force. By signing the Agreement, the Parties also declare that they agree with this Processor Agreement. Upon termination of the Agreement, this Processor Agreement will end by operation of law without any further (legal) action being required. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    3. Relationship parties<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    3.1. This Processor Agreement contains the agreements between the Parties about the processing of Personal Data in the context of the provision of services by the Processor for the execution of the Agreement.
    3.2. Controller independently determines the purpose and means of the processing of the Personal Data.
    3.3. Processor processes the Personal Data on behalf of and for the purposes as determined by Controller. Processor is not entitled to use the Personal Data for its own purposes or for its own use.
    3.4. The parties will provide each other with all reasonably required information to enable proper compliance with the laws and regulations applicable to them with regard to the protection of personal data.
    3.5. If the Processor is of the opinion that the instructions of the Controller are in conflict with the applicable laws and regulations, the Processor will notify the Controller thereof. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    4. Processing<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    4.1. The parties have described in Annex I the nature and purpose of the processing, the type of Personal Data that is processed and the categories of Data Subjects. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    5. Security<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    5.1. Processor must take and maintain the appropriate technical and organizational measures agreed by Parties to protect the Personal Data processed on the basis of the Agreement.
    5.2. When determining appropriate technical and organizational measures, the parties take into account the risks that a security incident or data breach could cause with regard to the relevant processing and also look at the current technical security options, the implementation costs and the nature, scope and context of the processing. of the Personal Data.
    5.3. The parties have included in Appendix II which technical and organizational security measures the Processor must take. The controller has accepted the measures included in Annex II as being of an appropriate level as referred to in Article 5.1. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    6. Help with Data Leaks<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    6.1. The Processor will inform the Controller immediately and in any case within 24 hours as soon as it becomes aware of a Data Breach with regard to Personal Data that the Processor processes on the basis of the Agreement. In doing so, the Processor will indicate as soon as possible which events and circumstances have led to the Data Breach and which measures have been taken to close the Data Breach.
    6.2. If the Controller has to report the Data Breach to the AP and \/ or the Data Subjects, the Processor will provide the Controller with reasonable assistance to enable the Controller to make this report (s) within the statutory deadlines set.
    6.3. In the event of a Data Breach, the parties will observe the procedure set out in Annex III. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    7. Assistance in exercising data subjects' rights, PIAs and prior consultation<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    7.1. Processor will provide Controller with reasonable assistance to enable Controller to comply with requests from Data Subjects to exercise their rights under the GDPR within the legal deadlines.
    7.2. If a Data Subject submits a request as referred to in the first paragraph directly to the Processor, the Processor will inform the Controller of this by sending the relevant request to the Controller.
    7.3. If the Controller is required to perform a PIA pursuant to the GDPR, or the PIA proves that the AP must be consulted, the Processor will provide the Controller with all reasonable assistance that may be expected from the Processor in this regard.
    7.4. Processor can charge costs associated with providing the reasonable assistance as set out in this Article 7 to Controller after prior written notification of these costs to Controller. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    8. Vertrouwelijkheid<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    8.1. Processor will keep the Personal Data that it processes on the basis of the Agreement and \/ or the Processor Agreement secret, as well as all other information that is or becomes known to it under this Processor Agreement, unless it is required to disclose the Personal Data or other information by law or a court decision. obligated. However, CW is entitled to share confidential information with its Sub-processors and other third parties that it engages for the performance of the Agreement.
    8.2. Processor ensures that its employees or other persons or Sub-processors that it deploys in the performance of the Agreement and \/ or the Processing Agreement observe confidentiality with regard to Personal Data as referred to in Article 8.1. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    9. Sub-processor<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    9.1. The Controller hereby gives the Processor general permission as referred to in Article 28 paragraph 2 of the GDPR to engage the Sub-processor (s) in the performance of the Agreement. The Processor will enter into an agreement with Sub-processor (s), in which the Sub-processor -in particular with regard to security and the reporting of Data Leaks- is bound to similar requirements as laid down in this Processor Agreement.
    9.3. If a Sub-processor is engaged, the Processor remains responsible for the fulfillment of its obligations under this Processor Agreement.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    10. International aspects<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    10.1. Processor processes the Personal Data exclusively within the European Economic Area (EEA), unless the Controller has agreed to transfer to countries outside the EEA and one of the measures is provided to ensure an adequate level of protection for these Personal Data. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    11. Audit<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    11.1. The Controller is entitled to carry out an investigation (hereinafter: Audit) at the Processor after prior written notification, subject to a period of four weeks, to check whether the applicable laws and regulations and the provisions of this Processor Agreement are complied with. The controller is entitled to engage an independent third party for this purpose, provided this third party maintains confidentiality. Controller bears the costs of the Audit.
    11.2. An Audit will take place no more than once per calendar year, unless the Controller has concrete indications that the Processor is not complying with its legal or contractual obligations and he notifies the Processor in writing and documented.
    11.3. Processor will provide the Controller or the engaged independent third party with access to its buildings, offices, systems, information and documentation and provide reasonable cooperation if and insofar as this is necessary for the Audit performed by or on behalf of the Controller. The associated costs are for the account of the Controller.
    11.4. The Controller will share the results with the Processor within a reasonable period of time after completion of the Audit. If irregularities are found, the Parties will determine in mutual consultation how and within what period they will be adjusted and rectified.
    11.5. If the DPA or another supervisory authority starts an investigation at the Processor, the Processor will immediately inform the Controller of this in writing or by email, unless the Processor is not entitled to do so on the basis of a legal obligation, a court decision or an order from the DPA. The parties will cooperate in joint consultation with the investigation. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    12. Liability<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    12.1 For the liability of each of the Parties arising from or in connection with this Processor Agreement and the Agreement in total, the exclusions and limitations of liability as agreed by the Parties in the Agreement apply. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    13. End of Processor Agreement<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    13.1 At the end of the Processor Agreement, the Controller has the option of obtaining the Personal Data by means of an export functionality during a period described in the Agreement. After that period, the Processor will delete the Personal Data, unless the Processor is obliged to keep the Personal Data on the basis of a legal obligation or court decision. <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    14. Other<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    14.1. In the event of any contradiction between the provisions of this Processor Agreement and the Agreement, the provisions of this Processor Agreement will prevail, unless the Parties have expressly agreed otherwise in writing.
    14.2. The Controller is not entitled to transfer rights and obligations under this Processor Agreement to a third party, unless the Processor has given prior written consent.
    14.3. Parties can only change this Processor Agreement in writing.
    14.4. Obligations under this Processor Agreement which by their nature are intended to continue after the end of this Processor Agreement, such as but not limited to the article regarding liability, will continue to exist after the end of this Processor Agreement.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    15. Applicable law and competent court<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    15.1. This Processor Agreement is exclusively governed by Dutch law.
    15.2. All disputes that may arise from this Processor Agreement will be submitted exclusively to the body that is also authorized to judge disputes that may arise from the Agreement. In the absence thereof, the competent court in Amsterdam will have exclusive jurisdiction. <\/p>\n

    By signing the Agreement, the Parties also agree to this Processing Agreement. <\/strong> <\/em> <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Appendix 1: Processing of personal data<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    This Appendix describes which processing activities take place in the context of the performance of the services by the Processor on behalf of the Controller as agreed in the Agreement. <\/p>\n

    Contact details of the Processor (including country where the data are processed) : <\/p>\n