The software solutions marketed by Trackforce are designed and developed internally, without any use of subcontracting. However, Trackforce may need to approach third-party companies for certain services such as data hosting or the provision of dedicated software such as customer relationship management, sales management, sales force, production management, or project management.
These subcontracting Clauses therefore define the conditions under which Trackforce may either entrust these types of services to third party subcontractors, or execute itself, as a Subcontractor, the services on behalf of the Client Data Controller according to European Regulation no. 2016/679 of 27 April 2016 on the protection of personal data as of its entry into force on 25 May 2018 (hereinafter the "GDPR").
As a result, these Subcontracting Clauses supplement the Trackforce Terms and Conditions of Sale as regards subcontracting as set out below.
Clause no. 1: Subcontracting between TRACKFORCE and third party subcontractors
The Client expressly authorizes TRACKFORCE to subcontract all or part of the services stipulated in the CGV to any third party subcontractor of its choice.
The purchase by the Client of the Goods listed and marketed in the TRACKFORCE's CGV implies acceptance by the Client of the Subcontractor's terms and conditions of services.
It is TRACKFORCE's responsibility to ensure that the chosen Subcontractor provides sufficient guarantees for the implementation of appropriate technical and organizational measures to ensure that the processing the requirements of the GDPR.
Clause no. 2: Subcontracting between TRACKFORCE and the Client
Pursuant to this article 2, TRACKFORCE is the Subcontractor and the Client is the Data Controller as defined in the GDPR for all personal data processed by TRACKFORCE on behalf of the Client pursuant to TRACKFORCE's CGV.
Clause no. 2-1: Subject
The purpose of this Clause 2.1 and its subsections is to define the conditions under which TRACKFORCE (acting as a Client's Subcontractor) undertakes to perform on behalf of the Client (acting as Data Controller) the personal data processing operations defined below.
As part of their contractual relations, the Parties undertake to respect the regulations in force applicable to the processing of personal data and, in particular, the mandatory GDPR as of 25 May, 2018.
Clause no. 2-2: Processing on instructions
TRACKFORCE and any person acting under its authority, having access to the Client's personal data, undertake to process such data only on the Client's documented instructions, including, if need be, the transfer of such data to a third country or to an international organization, unless TRACKFORCE is required to do so under European Union law or the law of the Member State to which TRACKFORCE is subject. In this case, TRACKFORCE informs the Client of this legal obligation prior to processing, unless the right concerned prohibits such information for important reasons of public interest.
TRACKFORCE will inform the Client immediately if, according to TRACKFORCE, a Client's instruction constitutes a breach of European Legislation relating to the protection of personal data.
Clause no. 2-3: Description of the subcontracted process
TRACKFORCE is authorized to process on behalf of the Client the personal data necessary to provide the service(s) defined by mutual agreement between the Parties, including the duration of the processing, its nature and purpose, its type and the categories of individuals concerned, and the obligations and rights of the Client as the Data Controller.
Clause no. 2-4: Obligations of the TRACKFORCE Subcontractor to the Client Data Controller
As a Subcontractor for the data involved in the Subcontracting, TRACKFORCE undertakes to:
Clause no. 2-5: 2nd rank subcontracting
As a subcontractor for data involved in Subcontracting, TRACKFORCE may use another subcontractor (hereinafter, the "2nd rank subcontractor") to conduct specific processing activities.
In this case, TRACKFORCE informs the Data Controller in advance and in writing of any proposed change regarding the addition or replacement of other subcontractors. This information must clearly indicate the subcontracted processing activities, the subcontractor's identity and contact information, and the dates of the subcontracting agreement. The Data Controller has a period of 10 (ten) days from the date of receipt of this information to present his objections. This subcontracting can only be done if the Data Controller has not objected within the agreed period.
The 2nd rank subcontractor is required to comply with the obligations of this agreement on behalf of and in accordance with the Data Controller's instructions. It is the responsibility of the Subcontractor to ensure that the 2nd rank Subcontractor provides sufficient guarantees for the implementation of appropriate technical and organizational measures to ensure that the processing meets the requirements of the GDPR. If the 2nd rank Subcontractor does not fulfil its data protection obligations, the original subcontractor remains fully responsible to the Data Controller for performance of its obligations.
Clause no. 2-6: Right of information of the people concerned
It is the responsibility of the Client Data Controller to provide information to those involved in the processing operations at the time of data collection.
Clause no. 2-7: Exercising personal rights
Whenever possible, TRACKFORCE, as a Subcontractor, will assist the Client Data Controller in fulfilling his obligation to respond to requests for exercise of the rights of persons involved: right of access, rectification, erasure and opposition, right to limitation of processing, right to data portability, right not to be the subject of an individual automated decision (including profiling).
When the persons concerned present the TRACKFORCE Subcontractor with requests to exercise their rights, TRACKFORCE must send these requests as soon as they are received by email to the Client's email address as shown on its profile.
Clause no. 2-8: Notification of personal data breaches
As a subcontractor, TRACKFORCE will notify the Client Data Controller of any personal data breaches as soon as possible in accordance with article 34 of the GDPR, after having read it, and by e-mail to the Client's contact e-mail address as shown on its profile.
This notification will be accompanied by all relevant documentation to enable the Client Data Controller, if necessary, to notify this breach to the competent supervisory authority, in this case the National Data Protection Commission (CNPD) as regards Luxembourg.
Clause no. 2-9: Help to TRACKFORCE's Subcontractor as part of compliance by the Client Data Controller with its obligationss
As a Subcontractor, TRACKFORCE will assist the Client Data Controller in producing impact analyses relating to data protection and prior consultation of the supervisory authority.
The services set out in this Clause 2-9 will be provided by TRACKFORCE under the particular financial and time conditions to be agreed in advance between the Client and TRACKFORCE.
Clause no. 2-10: Security measures
Insofar as article 32 of the GDPR stipulates that the implementation of security measures is the responsibility of the Data Controller and the subcontractor, each Party undertakes, insofar as the personal data for which it is responsible is involved, to instigate technical and organizational security measures guaranteeing a level of security consistent with the risk, including, inter alia, according to needs:
The application of an approved code of conduct as stipulated in section 40 of the GDPR or an approved certification mechanism as stipulated in section 42 of the GDPR may be used as an element to demonstrate compliance with the prescribed safety requirements of paragraph 1 of article 32 of the GDPR as recalled above.
Clause no. 2-11: Fate of data
TRACKFORCE undertakes to destroy personal data at the end of its retention period determined according to the nature of said data, it being recalled that the Client must regularly make its own backups using the software tools made available on the Guardtek Platform.
Clause no. 2-12: Data Protection Officer
In its capacity as Subcontractor, TRACKFORCE communicates to the Client Data Controller the name and contact details of its Data Protection Officer, hereinafter "DPO", designated in accordance with article 37 of the GDPR, if the Client requests it.
Clause no. 2-13: Processing activity categories register
As a Subcontractor, TRACKFORCE declares it will keep in writing a register of all categories of processing activities performed on behalf of the Client Data Controller, including:
Clause no. 2-14: Documentation
As a Subcontractor, TRACKFORCE makes available to the Client Data Controller the necessary documentation to demonstrate compliance with all its obligations and to perform audits, including inspections, by the Client Data Controller or another auditor it may have appointed, and contribute to these audits.
Clause no. 3: Obligations of the Client Data Controller to the TRACKFORCE Subcontractor
As a Data Controller, the Client undertakes to:
Clause no. 4: Maintenance of non-contrary provisions of TRACKFORCE's CGV
These Subcontracting Clauses supplement TRACKFORCE's Terms and Conditions of Sale, the non-contrary provisions of which remain applicable.