Terms and conditions<\/p>\n\n\n\n
Last changed on 20.03.2023.\u00a0<\/p>\n\n\n\n
That is concluded, on the one hand, between [INSERT ORGANIZATION NAME], as principal (hereinafter: Data Controller)<\/p>\n\n\n\n
Postal Address: [INSERT ADDRESS]
Representative who is authorized to sign: [INSERT NAME]
VAT number: [INSERT VAT NUMBER]<\/p>\n\n\n\n
and, on the other hand, Driveco Oy, with legal premises in Mets\u00e4nneidonkuja 6, 02130 Espoo, Finland,
Represented by Mr. Jon Uotila,
VAT No. FI10090521
(hereinafter: Data Processor)<\/p>\n\n\n\n
(hereinafter together: Contracting Parties) in the undersigned place, on the undersigned day and within the undermentioned conditions:<\/p>\n\n\n\n
Contracting Parties, in conformity with the Finnish Personal Data Act (213\/1999), and Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter: Regulation), ascertain within the framework of the present contract the rules of personal data processing carried out by the Data Processor upon the mandate provided by the Data Controller<\/p>\n\n\n\n
1. The Subject of Data Processing Carried out by the Data Processor<\/strong><\/p>\n\n\n\n Personal data related to Test drive data measuring and processing, fleet management, or car sharing.<\/p>\n\n\n\n 2. The Duration of Data Processing Carried out by the Data Processor<\/strong><\/p>\n\n\n\n The personal data (hereinafter: data) processing will continue until the expiration or termination of agreement. The Agreement for starting the service shall commence upon [INSERT START DATE] and it will elapse in [INSERT END DATE]. The Parties agree that this Agreement can be extended, but will not do so automatically and needs a written consent from both parties.<\/p>\n\n\n\n 3. The Purpose of Data Processing Carried out by the Data Processor<\/strong><\/p>\n\n\n\n Data Processor will provide a service for recording the route data from vehicles and with GPS-location included. Route data is visualized with selected key indicators, such as e.g. consumption, emissions and the percentage of electric motor used during driving.<\/p>\n\n\n\n 4. The Type of Data Processing Carried out by the Data Processor<\/strong><\/strong><\/p>\n\n\n\n Data processing carried out by IT system.<\/p>\n\n\n\n 5. Persons Affected by the Data Processing Carried out by the Data Processor<\/strong><\/strong><\/p>\n\n\n\n The test drivers, fleet drivers, and\/or car sharing customers.<\/p>\n\n\n\n 6. The Categories of Personal Data Processed by the Data Processor<\/strong><\/strong><\/p>\n\n\n\n The driver\u2019s data:<\/p>\n\n\n\n +<\/p>\n\n\n\n 7. The Rights and Obligations of the Data Controller<\/strong><\/strong><\/p>\n\n\n\n The Data Controller is entitled to control the execution of the contractual activity carried out by the Data Processor.<\/p>\n\n\n\n 7.2.<\/strong> The Data Controller \u2013 for the purpose of executing its decisions in relation to data processing \u2013 may define operations for the Data Processor in order to secure the adequate execution of contractual tasks.<\/p>\n\n\n\n 7.3.<\/strong> The liability for instructions to the Data Processor regarding the contractual tasks lies with the Data Controller, however, the Data Processor is obliged to inform the Data Controller forthwith, if in the Data Processor\u2019s belief the Data Controller\u2019s instruction or its execution are contrary to any relevant legal norm.<\/p>\n\n\n\n 7.4<\/strong>. If the Data Subject requests information on his personal data being processed from the Data Processor based upon the Subject\u2019s legal rights, the information is always provided by the Data Controller. The Data Controller is from its user account able to extract the Data Subject\u2019s personal data, and can convey all collected personal data to the Data Subject, without including the Data Processor. If the request is made to the Data Processor, the Data Processor is obliged to forward the request to the Data Controller. If the Data Subject, based upon the Subject\u2019s legal rights, requests the rectification or deletion of his\/her personal data, the Data Controller is obliged to decide about the request, and based upon the Data Controller\u2019s decision, instruct the Data Processor in writing to rectify or delete the personal data. If the request is made to the Data Processor, the Data Processor is obliged to forward the request to the Data Controller. In case of refusal to comply with the Data Subject\u2019s request for rectification or deletion, the Data Controller is obliged to inform the Data Subject, and, at the same time to inform the contact person of the Data Processor about its decision.<\/p>\n\n\n\n 8. The Rights and Obligations of the Data Processor<\/strong><\/strong><\/p>\n\n\n\n 8.1<\/strong>. The Data Processor may not make any substantial decision in relation to data processing; the Data Processor is obliged to perform the tasks defined in Point 1. according to the instructions of the Data Controller and according to the interests of the Data Controller.<\/p>\n\n\n\n 8.2.<\/strong> The Data Processor is obliged to inform the Data Controller without delay, before executing the instruction, if the Data Processor perceives that the Data Controller gives unsuitable, unprofessional instruction, or, if the instruction is contrary to any relevant legal norm.<\/p>\n\n\n\n 8.3<\/strong>. In the course of performing the agency contract, the Data Processor may not process personal data for its own purpose, all personal data and information that comes into its possession may only be utilized for the Data Controller.<\/p>\n\n\n\n 8.4.<\/strong> The Data Processor is obliged to perform all organizational and technical operations that are necessary for the safe processing of personal data, and to prevent the access to the personal data by unauthorized persons. The Data Processor is only liable for direct damages arising from the intentional or negligent breach of this obligation.<\/p>\n\n\n\n 8.5.<\/strong> Immediately, without any unjustifiable delay, upon becoming aware of it, the Data Processor reports any data protection incident to the Data Controller. In the report<\/p>\n\n\n\n 8.6.<\/strong> The Data Processor, for the execution of the tasks defined in Point 1. may only have recourse to further data processor based upon the prior, written permit of the Data Controller. In such case, i.e. if the Data Processor has recourse to further data processor, the Data Processor guarantees that the further data processor operates according to the updated legislation, and according to the provisions of the present contract. The Data Processor is liable for the direct damages arising from having recourse to further data processor.<\/p>\n\n\n\n 8.7.<\/strong> Data Controller has access to personal data through the user account, which has versatile features to follow up test drives. Personal data can also be fetched through the Data Processor\u2019s API. Data Controller is responsible for maintenance of passwords and password policy, so that unauthorized usage is prohibited. Data Processor keeps detailed logs with limited history of usage of user accounts and API.<\/p>\n\n\n\n 8.8.<\/strong> The Data Processor secures that, within its sphere of operation, those persons who process personal data undertake the obligation of confidentiality in writing. The Data Processor assumes the obligation that it, without the Data Controller\u2019s consent, may only grant access to third parties, if that is prescribed in this agreement or by law and in a manner defined by it.<\/p>\n\n\n\n 8.9.<\/strong> Based upon the instruction of the Data Controller, the Data Processor is obliged to transfer the personal data processed by the Data Processor to the Data Controller or to another data processor designated by the Data Controller, or, based upon the instruction of the Data Controller, if the data processing cannot be pursued lawfully, ensure the erasure of the data, register it, and to transmit that registry to the Data Controller<\/p>\n\n\n\n 8.10.<\/strong> After terminating the data process service, based upon the decision of the Data Controller, the Data Processor is obliged to delete all personal data or return them to the Data Controller.<\/p>\n\n\n\n 8.11.<\/strong> The Data Processor acknowledges that it is obliged to co-operate with the Data Controller\u2019s employees, staff members and any other person designated by the Data Controller in the course of performing this contract.<\/p>\n\n\n\n