Podrobnosti výzvy k podání nabídek
Stav
Datum podání
30/10/2019
Datum odpovědi
31/10/2019
Jazyk
Stav
Odpovězeno
Podrobnosti otázky
Předmět
Service Contract II.9.2 Processing of personal data by the contractor
Otázka
Please note that this section II.9.2 is not entirely acceptable: the purpose of the contract not being the processing of personal data, the controller doesn’t act as data processor (under art. 28 GDPR) but rather as data controller. As such, it processes the data collected under the contract – which is exclusively business data - in compliance with its own, internal, management methods and procedures. As such, we kindly request that this be drafted as follows: “The processing of personal data by the contractor shall meet the requirements of Regulation (EU) No 2018/1725 and be processed solely for the purposes set out by the controller. The contractor shall assist the controller for the fulfilment of the controller’s obligations under Chapter III (Articles 14-25) of Regulation (EU) No 2018/1725. Should the controller be made aware directly of any such requests the contractor shall inform, without delay, the controller about such requests.”
Odpověď
31/10/2019
Please note EDA is not in a position to modify the general conditions of the service contract. Please also note that the GDPR does not apply to EDA. The applicable legal framework to the contract is indeed Regulation 2018/1725. EDA is the ‘data controller’ meaning that EDA defines the purpose and means of the processing of personal data. The contractor assists the data controller and acts on its behalf under its supervision and instructions. Finally, business data is rather of a commercial nature and therefore, not subject to data protection rules.