NL FR EN Book a rideBook now

Legal

Data processing agreement.

data processing agreement

This Data Processing Agreement (the "DPA") is a binding agreement that sets out the terms and conditions

Between:

Comobi BV (hereinafter "Processor"), located at Kruideniersstraat 3, 9000 Ghent, with company number BE 0746529420

And:

Any company, customer or partner (hereinafter the "Controller") using the Services (as defined below) of Comobi BV.

Article 1: Definitions

The following terms, in this DPA, have the meanings given in this article, unless clearly indicated otherwise by the context:

'Contractual Relationship' means the main agreement between the Parties that defines the provision of the Services or the cooperation between the Parties

Services means the services offered by Comobi BV to its customers. This includes the processing and execution of reservations regarding comfortable and qualitative passenger transport. In collaboration with professional partners, transport options are offered to both individuals and companies.

Applicable Data Protection Regulations’ means all data protection regulations applicable to the Processing and Use of Personal Data within the framework of activities carried out under the Contractual Relationship, including the General Data Protection Regulation (as defined below).

‘DPA’ means this Data Processing Agreement

‘GDPR’ means the General Data Protection Regulation or, in English, General Data Protection Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 as applicable from 25 May 2018

‘Personal data’ means any information about an identified or identifiable natural person considered 'identifiable'. A natural person who can be identified, directly or indirectly, by reference to an identifier (such as a name, an identification number, location data, an online identifier or to one or more elements characterising that natural person's physical, physiological, genetic, mental, economic, cultural or social identity)

‘Processing’ means any operation with respect to Personal Data or a set of Personal Data (such as collection, recording, organization, structuring, storage, updating or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of data)

‘Personal Data Breach’ means a breach of security leading (accidentally or unlawfully) to the destruction, loss, alteration or unauthorised disclosure of, or unauthorised access to, Personal Data transmitted, stored or otherwise Processed

‘Technical and Organisational Measures’ means the technical and organisational measures as defined in the GDPR

‘Supervisory Authority’ means an independent public authority established by a Member State of the European Union pursuant to Article 51 of the GDPR.

Article 2: Details of processing

The purpose of this DPA is to define the conditions under which the Processor accepts to Process Personal Data on behalf of the Controller as defined in the Contractual Relationship.

It is hereby agreed to share responsibility for "the Processing of Personal Data in accordance with the requirements of EU data protection legislation" and this in connection with Comobi BV's Services provided to the Controller.

The Data Processing Terms apply to all Comobi BV Services. The Controller shall be deemed to have accepted the terms unconditionally.

The Personal Data provided by the Controller to the Processor in the context of the Processing Activities concern the following categories:

  • Contact details (First and last name; Date of birth; Address details; Phone number; Email address)
  • Payment details (Bank account number; Invoices; Payments)
  • Details relating to our service (Positive/Negative feedback)
  • Flight details

The Personal Data of the Controller are processed in the performance of the Contractual Relationship and for the following purpose:

  • Performing the Services of Comobi BV

The Personal Data processed by Processor on behalf of the Processing Responsible Party concerns the following personal data:

  • Contact details of natural or legal persons performing or contributing to the realisation of the Services of Comobi BV.

Article 3 Obligations of the Processor

The Processor shall take all Technical and Organisational Measures to appropriately secure Personal Data against loss, carelessness or unlawful use/processing. The Processor shall notify the Controller as soon as possible in the event of a Personal Data Breach. This notification shall, if possible, be accompanied by any useful documentation that will allow the Processor to notify the competent Supervisory Authority if necessary.

The Processor undertakes to guarantee the confidentiality of the Personal Data processed in the context of the Contractual Relationship between the Parties. To this end, access to the Personal Data shall be strictly limited to those persons who need to access or have knowledge of the Personal Data in the context of the performance of the Contractual Relationship between the Parties. The confidentiality obligation shall continue to apply after termination of the Contractual Relationship between the Parties.

The Processor shall ensure that it has competent personnel to Process Personal Data. In addition, they undertake to ensure the confidentiality of the Personal Data and adhere to a legal confidentiality obligation.

The Processor shall assist the Controller to ensure compliance with the obligations relating to impact assessment and prior consultation (as described in Articles 35 and 36 of the GDPR), taking into account the nature of the Processing and the 5 information available to the Processor (except where such information is already available to the Controller).

Article 4 Obligations and rights of the Processor

The Controller shall provide the necessary information to the Processor for the Processing of the Personal Data.

The Controller has instructed the Processor to process the Personal Data exclusively for Services for the benefit of the Controller and in accordance with the Data Protection Act, the Contractual Relationship and the Controller's instructions.

Article 5: Liability

Subject to different provisions in the Contractual Relationship and taking into account the limitations provided for in the Contractual Relationship, the Controller shall defend, indemnify and hold the Processor harmless from any liability, damages, costs and expenses due to the Processor’s non-compliance with its obligations under this DPA. In order to avoid any ambiguity, it is underlined that the Processor shall not be liable to the Controller for any breach of the Applicable Data Protection Regulations attributable in whole or in part to the Controller or to the Controller's instructions.

Article 6: Jurisdiction and Applicable Law

The Parties acknowledge that the jurisdiction (sole or exclusive) determined between the Parties in the Contractual Relationship also has jurisdiction over any dispute or claim arising from this DPA, including any dispute regarding its existence, its legal validity or its termination or the consequences of its nullity. The Parties acknowledge that this DPA as well as any non-contractual or other obligations relating to this DPA shall be governed by the law of the country specified in the Contractual Relationship between the Parties.

Article 7: Conflict of Terms

Unless otherwise agreed between the Parties, nothing in this DPA shall limit the obligations of the Processor as set out under the Contractual Relationship between the Parties or allow the Processor to Process the Personal Data (or outsource the Processing thereof) in a manner prohibited under the Contractual Relationship. Unless otherwise agreed between the Parties, the provisions of this DPA shall prevail should there be a conflict between this DPA and the Contractual Relationship between the Parties

Article 8: Validity and enforceability

The invalidity or unenforceability of any provision of the DPA, regardless of which one, shall not in any way affect the validity or enforceability of any other provision of the DPA. The relevant provision shall (1) be replaced by a valid and enforceable provision as close as possible to the original intention of the Parties or, if this is not possible, (2) be interpreted as if the invalid or unenforceable provision had never been part of this DPA.