Joint Controllership Agreement

(„Agreement”)

concluded on ................................... in , by and between:

… („Executive Controller”)

and

… („Joint-controller B”)

and

… („Joint-controller C”)

called also the “Party” and jointly called “Joint-controllers” or the “Parties”.

Given that:

1. A.The Parties jointly determine purposes and means of processing relating to their joint activity [i.e. joint compliance management in the group of companies, joint talent and personnel management in the group of companies, joint client acquisition, joint product offering, a consortium], being joint personal data controllers in the meaning of Article 26 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”).
2. B.Article 26 GDPR obliges the Parties as joint-controllers to comply with obligations regarding processing of personal data, including those connected with data subject rights and fulfilment of information duties as described in articles 13 and 14 of the GDPR.
3. C.The purpose of this Agreement is to jointly determine respective responsibilities of the Joint-controllers and to establish relation between the Joint-controllers and between the Joint-controllers and data subjects, including means of handling of data subjects’ requests.

The Parties have decided to enter into the following Agreement:

§ 1 Description of joint-controllership

1. 1.1.Subject matter. [GDPR.26.1] The Agreement determines the division of responsibilities of the Parties as joint controllers of personal data resulting from GDPR.
2. 1.2.Purpose and means. [GDPR.26.1] Purpose and means of the processing of personal data covered by this Agreement (hereinafter called also just “data”) by the Joint-controllers is described in the Main Agreement/ is described in this Agreement. In particular, the Parties decided that:
3. A joint purpose of the processing is:
4. Data are processed with the following means:
5. [describe means of processing]
6. 1.3.Type of data. Processing by the Joint-controllers will cover types of data indicated in the Annex no. 1 to the Agreement – Types of processed data OR LIST TYPES BELOW.
7. 1.4.Data subject categories. Processing of data by the Joint-controllers will cover the following categories of data subjects:

[for instance:

1. 1)employees of the Joint-controllers and entities associated with the Joint-controllers
2. 2)Joint-controllers’ service/product clients
3. 3)persons, with whom the Joint-controllers’ clients engage into social interactions
4. 4)contractors’ personnel (recipients and suppliers) of Joint-controllers
5. 5)recipients of Joint-controllers’ clients’ electronic correspondence

§ 2 Joint-controllers’ obligations

1. 2.1.Data subjects. Information obligation and handling of data subjects’ requests (“Data subjects rights”) will be fulfilled by the Executive Controller. If a data subject addresses their request to another Joint-controller, the receiving Joint Controller will pass the data subject’s request immediately (the closest working Friday or Monday, no later than within 5 working days) to the Executive Controller and will independently start actions necessary to process the request if the request concerns that Joint Controller directly.
2. 2.2.The Parties determine roles and the scope of fulfilling GDPR duties as follows:
   1. 1)Complying with principles of data processing [GDPR.5] The Joint-controllers undertake to process data in compliance with the principles of data processing set in Article 5 GDPR.
   2. 2)Accountability [GDPR.5.2] The Executive Controller maintains all documentation relevant to the joint-controllership.
   3. 3)Lawfulness of processing [GDPR.6,9] Joint-controllers undertake to process data only when one of the legal grounds for processing prescribed in articles 6 or 9 GDPR exists and only within the scope there allowed.
   4. 4)Processing outside of the EEA [GDPR 44]. The Joint-controllers do not transfer data outside of the EEA.
   5. 5)Privacy by design [GDPR.25.1] While planning a change in the processing of data, the Parties are obliged to follow the privacy by design principle, as described in Article 25.1 GDPR, and are obliged to inform the other Parties on planned changes in such advance, that the Parties retain a real possibility to react, if changes planned by the Party, in opinion of at least one the other Parties, may adversely affect the appropriate level of security of data or increase the risk to the rights and freedoms of natural persons, posed by the processing of data by the Parties.
   6. 6)Data minimisation. [GDPR.25.2] The Parties undertake to limit access to data only to persons whose access to data is necessary for the performance of goals of processing.
   7. 7)Confidentiality. [GDPR.29] Only persons having a Party’s authorisation and subject to a non-disclosure obligation may be allowed to access data on behalf of the Parties.
   8. 8)RPA. [GDPR.30.1] Each of the Parties undertakes to keep documentation describing means of processing, including the Record of Processing Activities (“RPA”) (as required in Article 30 GDPR). The Party makes their RPA available to other Parties in the scope of the processing activities covered by the joint-controllership.
   9. 9)Security. [GDPR.32] Each of the Parties ensures appropriate data security and implements technical and organisational data protection measures as described in Article 32 GDPR and in further provisions of this Agreement.
   10. 10)Data Protection Officer. [GDPR.37] The Parties have appointed one Data Protection Officer (“DPO”)./ The Executive Controller has appointed a Data Protection Officer (“DPO”)./ carried out a documented analysis that points to the conclusion, that it is not obligatory to appoint a DPO, but the data protection specialist (“DPS”) has been appointed. The Parties have exchanged DPO and DPS’s data.
   11. / Each of the Joint-controllers has appointed a Data Protection Officer (“DPO”) / data protection specialist (“DPS”). The Parties have ex-changed their DPO and DPS’s contact data.
   12. 11)Trainings. The Parties ensure that persons allowed to process data were provided with an appropriate training in the scope of personal data protection principles and regulations as well as consequences of breaching them, including in particular procedures on protecting personal data and their roles pursuant to those procedures.
   13. 12)Communicating the joint-controllership [GDPR.26] The Joint-controllers inform data subjects on the fact of the joint-controllership and the essence of the arrangements made in this Agreement, in particular on the relation between the Parties, relation between the Parties and data subjects and the scope of duties of each of the Parties. Information on the joint-controllership and on the essence of the arrangements of the Joint-controllers should be disclosed at the time of collecting data for the joint-controllership purposes. Information on the joint-controllership might be included in the information obligation fulfilled in accordance with Articles 13, 14 and 26 GDPR. Information on the essence of arrangements made by the Joint-controllers with an information duty is enclosed in the Annex no. 2 hereto.
   14. 13)Data protection breach notification [GDPR.33] In case of a data protection breach, the Executive Controller is responsible for the notification of the breach to the supervisory authority. The Parties undertake to cooperate pursuant to further provisions of the Agreement.
   15. 14)Communication of a data breach to data subjects [GDPR.34.1] If a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Executive Controller is responsible for communicating the data breach to the data subject without undue delay. The Parties undertake to cooperate pursuant to further provisions of the Agreement.

§ 3 Entrusting processing

1. 3.1.Entrusting processing. [GDPR.28.2] Each of the Parties may entrust processing (“Processing”) to another processor (“Processor”) by a data processing agreement concluded in a documented form (“Processing Agreement”) In such a case the entrusting Party is obliged to ensure the fulfilment of all duties related to entrusting of the personal data processing arising from the GDPR and inform the Parties of the Processor(s) identity.
2. 3.2.A list of accepted Processors is enclosed in the Annex no. 3 hereto – A List of Accepted Processor.
3. 3.3.Objection. [GDPR.28.2 phrase. 2] Each of the Parties may, due to compelling reasons, object (in a documented form) to entrusting data processing to a specific Processor. Where the objection is raised, the entrusting Party is not allowed use the Processor covered by the objection. In case an objection concerns a previously accepted Processor, the entrusting Party must terminate the processing that is covered by the objection. The entrusting Party and the objecting Party agree means and timelines allowing to sustain the processing continuity and agree on alternative solutions. If the Parties do not reach a mutually satisfactory conclusions, each Party may terminate this Agreement.

§ 4 Personal data security

1. 4.1.Risk analysis. [GDPR.32] Each of the Joint-controllers have carried out a risk analysis and implements its results as to organisational and technical security measures that correspond to the established risk to the rights and freedoms of data subjects. The Parties update their risk analysis with accordance to their needs and inform the other Parties on the results of the update.
2. 4.2.Data security measures. The Parties confirm that they implement a level of security measures appropriate to the risk established in the risk analysis described in the previous section. In particular, each of the Parties has decided, informed the other Parties and obliges to update information on adequacy and implemented technical and organisational measures including:
   1. 4.2.1.the pseudonymisation and encryption of personal data;
   2. 4.2.2.the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
   3. 4.2.3.the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
   4. 4.2.4.a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
3. 4.3.DPIA. [GDPR.35.1] Where a planned type of processing covered by the joint-controllership - in particular using new technologies - taking into account the nature, scope, context and purposes of the processing - is likely to result in a high risk to the rights and freedoms of natural persons, the Parties will decide on the rules of the cooperation regarding the data protection impact assessment for the planned processing activities.

§ 5 Reaction times

1. 5.1.Notification of a data breach suspicion. The Party notifies the other Parties on a data breach suspicion within 48 hours from when it has been first made aware of. If it is likely that a personal data breach took, the Party directly affected allows the other Parties to participate in investigations. Independently, the Party informs the other Parties on determining whether there has been a breach or no breach has been found within 4 hours from the moment of such determination.
2. 5.2.Breach notification. Data breach notification should be done by the Executive Controller. If a notification concerns the Party that has found the breach, this Party draws up the contents of the notification immediately. The Executive Controller maintains a record of confirmed data protection breaches connected to the joint-controllership.
3. 5.3.Notification on the access request. Each of the Joint-controllers notifies the Parties on each request to access data made by the authority of the State within 48 hours, unless law prohibits such a notification, in particular criminal law or anti-money laundering laws.
4. 5.4.Data subject’s request notification. Each of the Joint-controllers notifies the Parties on every data subject’s request that the Party received within 48 hours. Additionally, all relevant parties supply the Executive Controller with all necessary documentation relating to the material data subject’s request in order to enable the Executive Controller a performance of the request.
5. 5.5.Continuity. The Joint-controllers will agree on means of communication between the Parties and will determine persons responsible for each of the Joint-controllers, so meeting of the deadlines prescribed above will be ensured, in particular by establishing a requirement of receipt confirmation and redundancy of communication channels as well as appointed persons for each of the Joint-controllers.

§ 6 Contact persons

1. 6.1.Joint-controllers contact point. DPOs should be the contact persons for the purposes of communication regarding personal data breaches and for data subjects.
2. 6.2.Joint-controllers’ DPO’s contact details. Joint-controllers appointed the DPO ……………………, phone number ……………………., e-mail
3. … / DPO appointed by each of the Joint-controllers is ……………………, phone number ……………………., e-mail
4. ……………………………….. ……………………, phone number
5. ……………………., e-mail ………………………………..
6. 6.3.Entirety of the communication between the Parties made in connection to this Agreement should also be directed to contact points, with accordance to the section 5.5 of the Agreement.

§ 7 Liability

1. 7.1.Liability. Each of the Joint-controllers is subject to legal measures and sanctions as described in articles 77-79 of the GDRP as well as articles 82-84 of the GDPR (joint and several liability). With respect to mutual settlements (recourse) the Parties rely on the principle of guilt. Where no Party is guilty or the degree of guilt is similar, the division of liability should be done proportionally to the turnover resulting from the joint controllership processing for each of responsible Parties, and if this is not possible to establish – in equal shares.

§ 8 Term of the Agreement

1. 8.1.Term of the Agreement. The Agreement is concluded for the infinite period
2. / period of…. / term of the Main Agreement.
3. 8.2.Termination. The Agreement may be terminated upon a 3-months notice expiring at the end of the calendar quarter.

§ 9 Final provisions

1. 9.1.Annexes. The Agreement has the following annexes:
2. Annex no. 1 – Types of processed data
3. Annex no. 2 – Information on the essence of arrangements made by the Joint-controllers with an information duty
4. Annex no. 3 – A List of Accepted Processor
5. 9.2.Entering into force. The Agreement comes into force at the day of its signing by the Parties.
6. 9.3.Written form. All modification or additions to the Agreement require a documented form under the pain of invalidity.
7. 9.4.Court’s jurisdiction. All disputes arising from the performance of this Agreement should be taken before the court of the Executive Controller’s registered office.
8. 9.5.Copies. One copy of this Agreement has been drawn up for each of the Parties.
9. 9.6.Governing law. This Agreement is subject to the GDPR and Polish law, in particular the provision of civil code.

signatures:

Annex no. 1 Types of processed data

Please indicate appropriate data categories covered by the joint-controllership or describe types of data in other way.

• Basic identification data
• Identification data assigned by government institutions
• Electronic identification data
• Electronic localization data
• Biometrical identification data
• Financial identification data
• Financial means
• Debts and expenditures
• Solvency
• Loans, mortgages, lines of credit
• Financial assistance
• Insurance policy details
• Pension plan details
• Financial transactions
• Compensation
• Professional activities
• Agreements and settlements
• Permits
• Personal details
• Military details
• Immigrant status
• Physical description
• Private habits
• Addictions
• Lifestyle
• Travel and movement details
• Social contacts
• Possessions
• Public mandates
• Complaints, incidents, or accidents
• Distinctions
• Media use
• Psychological details
• Marriage or current form of cohabitation
• Marital history
• Details regarding other family or household members
• Leisure activities and interests
• Memberships (other than professional, political, or in trade unions)
• Legal data related to suspicions
• Legal data regarding convictions and sentences
• Legal data regarding judicial actions
• Legal data regarding administrative penalties
• Consumption habits
• Residence data
• Physical health data
• Mental health data
• Data regarding risk situations and risk behavior
• Genetic data related to population studies, genetic research, etc.
• Recuperation data
• Education and training
• Academic curriculum
• Publications
• Profession and employment
• Current employment
• Recruitment
• Work termination
• Career
• Absenteeism and discipline
• Occupational medicine
• Wages
• Assets in possession of the employee
• Work organization
• Review
• Training for the position
• Security data (authorizations)
• Access levels
• Use of technology
• Racial or ethnic data
• Data about the sex life
• Political opinions
• Political affiliation
• Membership in an interest group or militant organization
• Membership in a trade union
• Philosophical or religious beliefs
• Beliefs
• Video recordings
• Image
• Sound recordings

#ANNEX NO. 2 – INFORMATION OBLIGATION INCLUDING THE ESSENCE OF ARRANGEMENTS OF THE JOINT-CONTROLLERS

With accordance to articles 13, 26 and 28 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), we inform you that we jointly process your data and hereby we present you with the essence of arrangements made between us as the Joint-controllers.

The Joint-controllers are:

…………………. with a registered office in ………………., address

………………………………, more information on ….(website)…….. (“Executive Controller”)

…………………. with a registered office in ………………., address

…………………………………, more information on ….(website)……..

…………………. with a registered office in ………………., address

…………………………………, more information on ….(website)……..

1. I.The Executive Controller and other Joint-controllers jointly process your data for the following purposes:
   1. a.for the purpose of concluding an agreement with you and to jointly perform that agreement by providing you with a service……,
   2. b.for the purposes of direct marketing of our offer,
   3. c.for or the establishment, exercise or defence of legal claims between you and the Executive Controller and other Joint-controllers, which is based in the Executive Controller and other Joint-Controller’s legitimate interest.
2. II.Processors of the Joint-controllers, in particular IT services provider, accountants etc., may be recipients of your data.
3. III.We plan to store your data for a 120 years after the end of our cooperation with you, in order to be able to establish, exercise or defend claims and its good chance by then that you are already dead so GDPR is no longer protecting you.
4. IV.You have the right to request access to, rectification or erasure of your data as well as restriction of processing of data concerning you.
5. V.Where the processing is based on the Executive Controller and other Joint-controller’s legitimate interests, you have the right to object to such processing of your data.
6. VI.Where the processing is based on your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
7. VII.You have the right to data portability, where the processing is based on your consent or for the purpose of concluding and performing of an agreement.
8. VIII.You have the right to lodge a complaint with the supervisory authority.
9. IX.The provision of data is voluntary/ voluntary but necessary for the performance of the …… / a statutory requirement according to …………….
10. X.We also inform you that:
    1. a.The Executive Controller and other Joint-controllers hereby declare that they process your data with accordance to the data protection principles set by Article 5 GDPR.
    2. b.The Executive Controller maintains all documentation relevant to the joint-controllership.
    3. c.The Executive Controller and other Joint-controllers do not transfer data outside of the EEA.
    4. d.The Executive Controller and other Joint-controllers undertake to limit access to your data only to persons, whose access to data is necessary for the performance of the purposes described above. Additionally, the Executive Controller and other Joint-controllers ensure that only persons that have the Executive Controller’s or the Joint-controller’s authorisation and are subject to a non-disclosure obligation may be allowed to process data. Such persons have been provided with an appropriate training in the scope of personal data protection principles and regulations.
    5. e.The Executive Controller and other Joint-controllers ensure an appropriate level of data security. The Executive Controller and other Joint-controllers provide:
       • the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
       • the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
       • a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing
       • the Executive Controller and other Joint-controllers implement pseudonymisation and encryption of personal data when the risk of data processing requires so and benefits of implementing such data security measures overcome detriment to data availability for you and other persons affected.
    6. f.The Executive Controller and other Joint-controllers may entrust the processing of your data to processors, given that the requirements of the GDPR, in particular those of the article 28 of the GDPR are met.
11. XI.In all cases regarding the protection of your personal data, you may contact the Executive Controller as well as the other Joint-Controllers, but we stress that it will be the Executive Controller, who is responsible for replying to you and looking after fulfilment of your data protection rights. Thus, it would be the easiest if you could direct your communication to:

Data Protection Officer, address: (adding “Data Protection Officer”), e-mail:…………………., phone number:…………………..

Annex no. 3 – A List of Accepted Processors