Common use of Scope of the Processing Clause in Contracts

Scope of the Processing. 2.1. Service Provider shall process the Customer Personal Data on behalf of and in accordance with the instructions of the Customer within the meaning of article 28 GDPR. The Parties agree that Customer is the controller within the meaning of article 4 paragraph 7 GDPR and Service Provider is the processor within the meaning of article 4 paragraph 8 GDPR. 2.2. The processing of Customer Personal Data by Service Provider occurs in the manner and the scope and for the purpose specified in the Services Description; the processing relates to the types of personal data and categories of data subjects and involves the processing operations that are specified in the Services Description, where those being applicable at the time of the Parties entering into the Agreement may also be set forth in an Exhibit to this DPA. In case of any contradictions the processing activities as being set forth in the online Services Description shall prevail. 2.3. The duration of processing corresponds to the term of the Agreement or as otherwise set forth in the Services Description. 2.4. Service Provider reserves the right to anonymize or aggregate the Customer Personal Data in such a way that it is no longer possible to identify individual data subjects, and to use them in this form for the purposes specified in the Agreement. The Parties agree that anonymized and according to the above requirement aggregated Customer Personal Data are no longer considered Customer Personal Data for the purposes of this DPA. 2.5. The processing of Customer Personal Data by Service Provider shall in principle take place in the Service Provider’s country or inside the European Union or another contracting state of the European Economic Area (EEA) or equivalent country. Service Provider is nevertheless permitted to process Customer Personal Data in accordance with the provisions of this DPA outside of the EEA if it informs the Customer in advance about the place of data processing and if the requirements of Chapter V GDPR are fulfilled. If Customer Personal Data shall be processed by a sub-processor whose processing of the Customer Personal Data is not subject to the GDPR, section 7.4 of this DPA applies.