Data Processing Agreement

This agreement is Annex 1 to the JewelExperts App Terms (the “terms”) between Webcollation BV (“we”, “us”) and the customer that accepted the terms (“you”).

1. Scope and roles

1.1 This agreement applies whenever we process personal data on your behalf while providing our apps, as defined in the terms. It applies to every app, plugin and widget you use, directly or through a platform, and to our customer portal.

1.2 For that personal data, you are the controller and we are your processor. If you act as a processor for someone else, you confirm that your instructions to us are authorised by that controller.

1.3 Where we process personal data for our own purposes, for example the data of your account and its users, we are the controller, and our Privacy Policy applies instead of this agreement.

1.4 Our widgets may also send technical measurements that do not identify shoppers. We use them to run, secure and improve our apps and to report usage to you. They are not personal data, and this agreement does not apply to them.

1.5 Annex A describes the processing. Words defined in the GDPR have the same meaning here. “Data protection law” means the GDPR and the laws of the EU and its Member States that apply to the processing.

2. Instructions

2.1 We process the personal data only on your documented instructions, including with regard to transfers to a third country, unless EU or Member State law to which we are subject requires otherwise. In that case we tell you of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

2.2 Your instructions are the terms, this agreement, the settings you choose and the way you use our apps, and any other written instruction we agree with you.

2.3 We inform you immediately if, in our opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.

3. Confidentiality

We ensure that everyone we authorise to process the personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

4. Security

4.1 We take all measures required by Article 32 GDPR. Annex B lists them in general terms.

4.2 We may change these measures, as long as the overall level of security is not reduced.

5. Sub-processors

5.1 You give us a general written authorisation to engage other processors (“sub-processors”), directly or through one of our sub-processors. The current list is published on our sub-processor page.

5.2 We inform you of any intended addition or replacement of a sub-processor at least 30 days before the change, by email to the contact email address we hold for you or, if we hold none, by a notice in the app, and we update the sub-processor page at the same time. This gives you the opportunity to object. A change that one of our sub-processors notifies to us with shorter notice is passed on to you as soon as we receive it.

5.3 You may object in writing within that period, on reasonable grounds relating to data protection. We will then discuss the objection with you in good faith. If we cannot resolve it, you may end the affected service before the change takes effect.

5.4 We ensure that each sub-processor is bound by a contract, with us or with the sub-processor that engages it, to the same data protection obligations as this agreement sets out, in particular sufficient guarantees to implement appropriate technical and organisational measures.

5.5 Where a sub-processor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that sub-processor’s obligations.

6. Help with data subjects’ requests

6.1 Taking into account the nature of the processing, we help you by appropriate technical and organisational measures, as far as possible, to respond to requests from people who exercise their rights under Chapter III GDPR.

6.2 If we receive such a request directly, we forward it to you without undue delay. We do not answer it ourselves, unless you instruct us to.

6.3 When you, or your app, ask us to erase a person’s data, we delete it, or keep only figures that identify no one, such as totals for your reports. We keep only:

• the person’s identifier in a coded form that cannot be reversed, with the date, as long as needed so that the erasure stays effective: an unchanged repeat of an earlier event, or an event dated before the erasure, does not bring the erased data back. Data you enter again afterwards, for example by importing it into your CRM, is treated as new. This coded identifier is deleted with the rest of the data at the end of the services (8.1); if you install the app again after that, data sent to us is treated as new, whatever its date;
• a record of the request and its completion, with the person’s identifier only in coded form and under a random name, as long as needed to show that it was carried out;
• a note of any event about the person that arrives after the erasure, with the event’s identifiers but none of its content, as long as needed so that a repeat of it is recognised and not applied.

6.4 We may also keep anonymous information about erased records, for your reports and our statistics: counts per store and period, and summaries of groups of at least five erased people of one store, which show only the kinds of their main events in broad ranges, with no name, identifier, contact detail or content. They cannot be linked to any person or to the records above.

7. Help with security, breaches and impact assessments

7.1 Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 GDPR: security, notifying personal data breaches, data protection impact assessments and prior consultation.

7.2 We notify you without undue delay after becoming aware of a personal data breach affecting the personal data. We give you the information Article 33(3) GDPR describes as far as we have it, and the rest as it becomes available.

8. Deletion or return at the end

8.1 At the end of the services, we delete all the personal data or, if you choose, return it to you, and we delete existing copies, unless EU or Member State law requires us to keep it, except the records of requests under 6.3. On request, we confirm to you in writing that the personal data has been deleted.

8.2 Where an app offers an export, you can download the data yourself before you close your account. If you make no choice, we delete the data.

8.3 Deleted data may remain in backups for a limited period, until those backups are deleted in their normal cycle.

8.4 Support correspondence with you is our own record. Personal data of your shoppers or customers in it is kept only as long as our rule for support mail allows, and used only to handle the request.

9. Information and audits

9.1 We make available to you all information necessary to demonstrate compliance with Article 28 GDPR.

9.2 We allow for and contribute to audits, including inspections, by you or by an auditor you mandate. You give us reasonable notice, no more than one audit takes place in any 12 months unless a personal data breach, indications of non-compliance or a supervisory authority require another, the auditor is bound by confidentiality, and you bear your own costs. We may first offer documents that show compliance; you decide whether they are enough or whether the audit goes ahead.

10. Transfers outside the EEA

10.1 We transfer personal data to a country outside the European Economic Area only in line with Chapter V GDPR, for example on the basis of an adequacy decision or the European Commission’s standard contractual clauses.

10.2 You authorise the transfers to the sub-processors on the list, under the safeguards the list names.

10.3 Where you are established in a country outside the EEA that has no adequacy decision of the European Commission, our transfers of personal data to you are governed by the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, module four (transfer processor to controller) (the “clauses”). The clauses are incorporated into this agreement by reference and completed as follows: (a) we are the data exporter and you are the data importer; (b) clause 7 and the option in clause 11(a) do not apply; (c) under clause 17, the clauses are governed by Belgian law, and under clause 18, disputes are resolved by the courts of Belgium; (d) in Annex I.A, the data exporter is Webcollation BV, as named in the terms, acting as processor, and the data importer is you, as identified in your account, acting as controller; each party’s contact details are those in the terms and in your account; the activities relevant to the transfers are the services of our apps under the terms; (e) in Annex I.B, the transfers are described by Annex A of this agreement; they are continuous, and take place whenever we make personal data available to you, for example in our apps, in their exports and through their integrations; (f) by accepting the terms, you agree to the clauses as completed here and sign Annex I; we agree to them by making this agreement part of the terms. If the clauses conflict with this agreement or the terms, the clauses prevail.

11. Your obligations

11.1 You are responsible for the lawfulness of the processing, including its legal basis, and for informing the people concerned, for example in your privacy and cookie notices.

11.2 You obtain any consent the law requires and, where our documentation asks you to, connect your consent banner to our widgets as it explains.

11.3 Your instructions comply with data protection law.

11.4 You do not use our apps to process special categories of personal data (Article 9 GDPR) or data about criminal convictions (Article 10 GDPR).

12. Duration, precedence, liability, law and language

12.1 This agreement applies for as long as we process personal data on your behalf.

12.2 If this agreement conflicts with the terms, this agreement prevails on data protection. If the standard contractual clauses apply, they prevail over this agreement.

12.3 The limitations of liability in the terms apply to this agreement, except where data protection law does not allow them.

12.4 This agreement is governed by Belgian law. The courts of the judicial district of Antwerp, Belgium, have exclusive jurisdiction over disputes about it, unless mandatory law provides otherwise.

12.5 This agreement is written in English. If a translation differs from the English text, the English text prevails.

Annex A. Description of the processing

Annex B. Security measures (Article 32 GDPR)

Stated in general terms, as Article 32 requires measures appropriate to the risk.

• Network security: every app is reached through a network security service that protects against attacks; the apps’ hosting adds a web application firewall that filters harmful requests.
• Payments: we never receive full card numbers; the reseller or the platform handles payment.
• Data minimisation: our apps process only the personal data a feature needs, and our logs leave out query strings that can carry credentials.
• Backups: our databases are backed up.
• Monitoring: alarms reach our staff.
• Sub-processors: written agreements under section 5.
• Deletion: we act on the platforms’ erasure requests.

Annex C. Sub-processors

The list published on our sub-processor page, as updated under section 5, including the sub-processors engaged through another sub-processor.