TradeAware
This Addendum is an Addendum to (and incorporated into) the TradeAware Platform Terms.
Capitalized terms have the meaning set forth in the TradeAware Platform Terms. The terms “controller”, “data subject”, “joint controller”, “personal data” and “supervisory authority” in this Addendum have the meanings set out in the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
In case of conflict between this Addendum and the TradeAware Platform Terms, the provisions of this Addendum shall prevail.
1 Scope and Definitions
1.1 This Addendum sets out the obligations of Users and LiveEO (jointly referred to as the “Parties”) under the when processing data relating to an identified or identifiable natural person using the TradeAware platform (hereinafter “TradeAware”). It governs the rights and obligations of the Parties, each of which is a data controller pursuant to Article 4(7) of the GDPR, while and insofar as the Parties jointly determine the purposes and means of the processing of personal data pursuant to Article 26(1) of the GDPR.
1.2 This Addendum applies to activities in which employees of the Parties or service providers engaged by the Parties for the purpose of exchanging information required under the European Deforestation Regulation via Tradaware.
2 Subject Matter
2.1 TradeAware allows Users to collect, provide, store and share supplier and product origin data for the purposes of complying with the Users’ obligations under the European Deforestation Regulation (“EUDR).
2.2 While this data is mainly technical information, it may also include personal data, e.g. as derived from product and production information, parcel records, supplier contacts and deforestation-free verification documents, legal evidence or other relevant documents.
2.3 Personal Data may include contact information (such as name, email address, telephone, etc.), professional information (such as associated company or organisation, roles and responsibilities, etc.), land ownership and use, and other data. Data subjects include representatives, employees and suppliers of Users, other suppliers and third parties.
3 Spheres of Responsibilities
3.1 Each Party is solely responsible for the processing of personal data on its own systems and sites. The Parties are jointly responsible for the processing of User information, whether collected directly from Users or from publicly available sources, in particular where such information is structured, analysed, stored and shared with third parties on TradeAware.
3.2 Within the scope of joint controllership, Users are responsible for the legality of any transfer of personal data to and from TradeAware, e.g. by uploading, importing, requesting or entering User information. Users are responsible for the accuracy of registration, assignment, authorisation and login data as well as for the uploading or importing of records, documents and other information relating to the User, the User's business, the User's employees, the User's supply chain, properties, products and any data provided when contacting LiveEO, e.g. to obtain technical support or third parties via TradeAware.
3.3 Within the scope of joint controllership, LiveEO is responsible for personal data automatically processed and data processed by LiveEO for the purpose of providing, protecting and improving the TradeAware services as further described in the TradeAware Privacy Policy available here.
3.4 For the avoidance of doubt, the Parties are joint controllers only with respect to the phase of processing necessary to provide the TradeAware services. For any prior or subsequent processing of personal data carried out by the Parties, the Parties shall each act as independent separate controllers.
4 Obligations and Restrictions
4.1 User Obligations and Restrictions
4.1 (a) Users shall only provide such information necessary to demonstrate compliance with the EUDR and as necessary to receive risk indications and assess deforestation in their supply or customer chain in order to enable Businesses to comply with their legal obligations under the EUDR.
4.1 (b) Users shall not share any special categories of personal data through TradeAware and must inform LiveEO immediately if any User Information may reveal a natural person's racial or ethnic origin, religious or philosophical beliefs, political views, trade union membership, health status or sexual orientation, is subject to the prohibition from processing under Article 9 (1) GDPR, ncluding where an exception under Article 9(2) GDPR applies.
4.1 (c) Users shall inform LiveEO of any requests, inquiries, follow-up activities and similar measures by the supervisory authority or any other authority regarding the TradeAware platform.
4.1 (d) Users are solely responsible for the accuracy and reliability of User information shall inform Liveo EO without undue delay if User Information is inaccurate, outdated or incompatible with the purposes for which they were originally collected by the User sharing the User Information.
4.2 General Compliance and Assistance
Each Party shall comply with the currently applicable data protection laws and regulations in its sphere of responsibility.
4.2 (a) Each Party of the Joint Controllers shall ensure that it has a legal basis for the processing and that personal data is not further processed in a way incompatible with the purposes for which they were originally collected.
4.2 (b) The Parties shall ensure within the scope of their responsibilities that all employees involved in data processing maintain the confidentiality of the data in accordance with Articles 28 (3), 29 and 32 of the GDPR for the duration of their employment as well as after termination of the employment relationship and that they are appropriately bound to maintain data secrecy and are instructed in the data protection provisions relevant to them before commencing their activities.
4.2 (c) The parties shall independently ensure that they comply with all statutory data retention obligations. Documentation within the meaning of Article 5 (2) of the GDPR that serves as evidence of proper data processing shall be retained by each Party in accordance with its legal rights and obligations beyond the end of the contractual relationship.
4.2 (d) If a data protection impact assessment pursuant to Article 35 of the GDPR is required for the implementation of a project, it shall be carried out jointly by the Parties.
4.2 (e) The parties shall to the extents necessary assist each other in answering and complying with a request or enquiry coming from the Supervisory Authority or any other authority and relating, in whole or in part, to the use of TradeAware.
4.3 Transparency
4.3 (a) Each of the Parties undertakes to provide the data subject free of charge with the information required under Articles 13 and 14 of the GDPR within their sphere in a precise, transparent, comprehensible and easily accessible form in clear and simple language. This includes the information about the essential contents of this agreement.
4.3 (b) The parties shall support each other at all stages with reasonable means in fulfilling their transparency obligations. User acknowledges the Privacy Policy provided here by LiveEO regarding the processing of personal data on the TradeAware Platform.
4.4 Data Subjects Rights
4.4 (a) Data subjects have various data subject rights, in particular pursuant to Article 12 to 22 of the GDPR, which they may exercise in consideration of the processing of their data ("requests" or "inquiry"). The Parties shall assist each other within the scope of joint controllership in handling inquiries from data subjects.
4.4 (b) Data Subjects may assert their data subject rights under Articles 12 to 22 of the GDPR against any of the Parties. The Parties agree that Users shall be responsible for responding to requests of data subjects to access data, to receive a copy of the data to correct, restrict or delete personal data related to User information. Insofar as a data subject contacts LiveEO with a request in exercising of his or her data subject Rights, Live EO will forward the request to the other relevant User without undue delay. LiveEO shall be responsible for answering inquiries related to any further processing of personal data on the TradeAware Platform by LiveEO.
4.4 (c) If a data subjects requests correction, deletion or restriction of its personal data, the Parties shall inform each other in advance. The respective other Party may object to the deletion for a justified reason, for example if it is subject to a legal retention. The Parties are each solely responsible for the implementation of the rights asserted.
4.5 Notification and Communication of Data Breaches
4.5 (a) The Parties shall inform each other without undue delay and in full if they discover or suspect a data breach during the review of the data processing or otherwise. The Parties shall collaborate appropriately according to the individual case. The same shall apply in the event of irregularities in data processing, even if these do not yet constitute a data protection breach.
4.5 (b) Both Parties shall each be responsible for notifying the competent supervisory authority pursuant to Article 33 of the GDPR in the event of a data breach within the scope of joint controllership that results in a risk to the rights and freedoms of natural persons. To the extent required under Article 34 GDPR, the Parties shall also communicate it to the data subjects.
4.6 Engagement of Processors
The Parties undertake to only use processors in connection with the joint controllership that provide sufficient guarantees for the protection and security of the personal data of the data subjects and enter into a data processing agreement pursuant to Article 28 of the GDPR.
4.7 International Data Transfers
If Personal Data processed under this JCA is transferred from a country within the EEA to a country outside the EEA, which is not subject to an adequacy determination by the European Commission, the Standard Contractual Clauses (“SCCs”) annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 are hereby incorporated by reference and form an integral part of this Addendum in accordance with this Section 4.7. as follows:
- the ‘data exporter’ is LiveEO and Users are the ‘data importer’;
- the Module One terms apply;
- in Clause 7, the optional docking clause applies;
- in Clause 11, the optional language does not apply;
- in Clause 17, Option 1 applies, and the SCCs are governed by German Law
- in Clause 18(b), disputes will be resolved before the courts of Berlin, Germany;
- in Annex I.A and Annex I.B, the details of the parties and the transfer are set out in the Agreement;
- in Clause 13(a), the ”Berliner Beauftragte für Datenschutz und Informationssicherheit” will act as competent supervisory authority
5 Liability
The Parties shall be liable to data subjects in accordance with the statutory provisions.To the extent permitted by law, the internal liability of LiveEO is limited in accordance with the provisions of the Tradaware Platform Terms.
6 Applicable Law and Jurisdiction
Conflicts arising out of this Addendum involving LiveEO shall be governed by the laws of Germany and in front of the courts of Berlin, Germany.