Data processing agreement

Parties and subject matter

The controller is the client: a member who creates logins for its people, or a warehouse or customs declarant account. The processor is Mywatrade s.r.o., company ID 19798148, V. Poláka 2269/2, 741 01 Nový Jičín, Czech Republic, which operates the KONEKTOR platform. The subject matter is the processing of personal data that the controller enters into the platform's tools: the company console, the warehouse tools and the declarant tools.

Duration

For as long as the controller uses these tools, and until the data is deleted under “End of processing”.

Nature and purpose

Storing, displaying, editing and deleting data in the tools, backups and technical administration. The purpose is to provide the tools to the controller and no other purpose. The one exception is the anonymous comparison of companies (the Comparison with similar companies panel in the Dashboard): for it the processor may only count records in the tools, for example how many load plans, documents or people the controller has. No names or other personal data go into the comparison, and other companies see the result only as a total for a group of at least five companies. The controller can opt out of the comparison in the Dashboard at any time.

Types of data and categories of people

The controller's employees and collaborators: name, work e-mail, function, sign-ins, tasks, messages and activity record. The controller's clients and partners and their contact persons: name, contact, company identification, powers of attorney, consignment and pallet movement data. Drivers: name and vehicle registration number. Special categories of data (Art. 9 GDPR) are not processed in the tools.

The controller's management sees the activity record of employees and collaborators in the Company Console: for each month, the number of days with a sign-in, the number of tasks and actions by type, and a record of what they published or signed on the controller's behalf. The Dashboard and the monthly report show only totals for the whole company. The activity overview does not show what anyone read or the content of messages. The controller informs its people about this; in addition, the platform describes it to them in the User Confidentiality Commitment they confirm at their first sign-in.

Obligations of the processor

The processor:

a) processes the data only on documented instructions from the controller; using the tools is also an instruction. If it believes an instruction infringes the law, it says so without delay;

b) binds everyone with access to the data to confidentiality;

c) takes the measures required by Art. 32 GDPR, in particular access control, encrypted transfer, encrypted backups and a sign-in record;

d) engages other processors only under “Other processors”;

e) helps the controller handle requests from people exercising their rights and meet its obligations under Art. 32 to 36 GDPR;

f) notifies the controller of a personal data breach without undue delay and at the latest within 48 hours of discovering it;

g) provides the information needed to demonstrate compliance and allows a reasonable audit after prior notice.

Other processors

The controller gives general authorisation to engage other processors for the server, network protection, backups and sending e-mails. Their current list is public in the Privacy Policy, under “Other processors”. The processor announces an intended change on the platform at least 30 days in advance; within that period the controller may object and, if the parties do not agree, may stop using the affected tools. The processor imposes the same data protection obligations on any other processor and remains responsible for their performance. Transfers outside the European Union only with safeguards under Chapter V GDPR.

Processor's access to content

The processor does not look into the data. Exceptions are a technical intervention the controller requests or an obligation imposed by law.

End of processing

When the use of the tools ends, the processor lets the controller download the data and then deletes it, including copies; it disappears from backups as they are routinely overwritten. It keeps only data it must retain by law.

Conclusion and governing law

The agreement is concluded electronically. A warehouse or declarant account accepts it together with the Terms for warehouse and customs declarant accounts, of which it forms part; a member accepts it together with the Services Agreement, of which it forms part (Article VIII(4)).

The agreement is governed by the law of the Czech Republic and Regulation (EU) 2016/679.