Personal data processing agreement

• “Controller” means the provider of personal data, in this case the customer, and the only one competent to update, modify or request modification of the personal data associated with his customer account.
• “Customer Data” means any data that RAYA HALAL processes on behalf of the Customer in the course of providing the Services in accordance with the Agreement.
• “Data Protection Laws” means all data protection and privacy laws and regulations applicable to the processing of personal data under the Agreement, including, where applicable, the EU General Data Protection Regulation (GDPR).
• “EU Personal Data Protection Law” means (1) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); and (2) Directive 2002/58/EC on the processing of personal data and the protection of privacy in the communications sector.
• “Personal Data” means any customer data relating to an identified or identifiable natural person to the extent that such information is classified as personal data under applicable data protection law.
• “Processor” means an entity that processes personal data on behalf of the operator.
• “Security Incident” means any unauthorized or unlawful breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access of Personal Data.
• “Services” means any product or service provided by RAYA HALAL to the Customer in accordance with and as specifically described in the Agreement.
• “Third Party Company” means any processor engaged by RAYA HALAL to provide services on its behalf, to facilitate the operation of current services or to provide complementary services.

This Agreement applies if and only to the extent that RAYA HALAL processes the customer’s personal data in the course of providing the services, and such personal data is subject to the data protection laws of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom. The parties agree to comply with the terms and conditions of this Personal Data Processing Agreement.

The customer is the controller of the personal data, and RAYA HALAL will process the personal data only as a processor.

The Customer agrees that it will (1) comply with its obligations as a controller under data protection laws with respect to the processing of personal data and any processing instructions it issues to RAYA HALAL; and (2) RAYA HALAL undertakes to provide notice and has obtained (or will obtain) all necessary consents and rights under the Data Protection Act to process personal data and provide the Services in accordance with this Agreement.

As a processor, RAYA HALAL will process personal data only for the following purposes: (1) processing to perform the services in accordance with the agreement; (2) processing to perform any step necessary to fulfill the agreement; and (3) comply with other reasonable instructions provided by Customer to the extent consistent with the terms of this Agreement.

Such customer data may contain special categories of data depending on how the Services are used by the Customer. Customer data may be subject to the following process activities: (1) storage and other processing necessary to provide, maintain and improve the Services provided to the customer; (2) provide customer with technical support; and (3) disclosures as required by law, state regulations, or otherwise provided for in the agreement.

The customer agrees that RAYA HALAL may employ sub-processors to process personal data on behalf of RAYA HALAL only to provide, improve and update the customer’s services or only if it is necessary to transmit personal data to third party companies.

RAYA HALAL is not obliged to convey to the customer that the data is sent to a third party, RAYA HALAL being responsible for the processing of the customer’s data. RAYA HALAL will conclude personal data protection contracts with contracted third parties.

RAYA HALAL must: (1) enter into a written agreement with the sub-processor imposing data protection terms requiring the sub-processor to protect personal data to the standard required by data protection laws; and (2) remain responsible for compliance with the obligations of this Agreement.

RAYA HALAL must implement and maintain appropriate technical and organizational security measures to protect personal data from security incidents and to preserve the security and confidentiality of personal data in accordance with the security standards of applicable laws.

RAYA HALAL ensures that any person who is authorized by RAYA HALAL to process personal data (including its staff, partners and subcontractors) will have an appropriate duty of confidentiality (whether a contractual or statutory duty).

Upon becoming aware of a security incident, RAYA HALAL will notify the Customer without undue delay and provide timely information regarding the security incident as it becomes known or as reasonably requested by the Customer.

The customer acknowledges that the security measures are subject to technical progress and development and that RAYA HALAL may update or modify the security measures periodically, provided that such updates and changes do not result in the degradation of the overall security of the services purchased by the customer.

RAYA HALAL will continue to provide written (confidential) responses to all reasonable requests for information made by the Customer, including responses to information security and audit questionnaires, that the Customer (acting reasonably) deems necessary to confirm RAYA’s compliance HALAL with this Agreement, provided that the Customer does not exercise this right more than once per year.

To the extent that the Standard Contractual Clauses apply and Customer argues and reasonably determines that the above documentation and/or other third party audit reports are not sufficient to demonstrate compliance with the obligations set forth in this Agreement, Customer may conduct an audit provided that, in such event, the parties agree: (a) Customer is responsible for all costs and fees related to such audit (including time, costs and materials expended by RAYA HALAL); (b) a third party auditor shall be mutually agreed upon by the parties to follow industry standard and appropriate audit procedures; (c) such audit must not unreasonably interfere with RAYA HALAL’s business activities and must be reasonable in time and scope; and (d) the parties must agree to a specific audit plan prior to such audit, which must be negotiated in good faith between the parties.

For the avoidance of doubt, nothing in this section modifies or varies the standard contractual clauses and, to the extent that a competent authority finds otherwise or any other part of the section is otherwise prohibited, unenforceable or inappropriate having regard to the standard contractual clauses, sub-section shall be deleted and its remaining provisions shall not be affected.

Upon termination of services, all personal data is deleted, except when the legislation in force obliges RAYA HALAL to keep the personal data of customers for a certain period of time.

In the case of personal data archiving, RAYA HALAL undertakes to ensure advanced and up-to-date personal data protection methods, so that there is no leakage or loss of personal data.

RAYA HALAL, legally represented by RAYA TRADING GLOBAL SRL can be contacted through:

• Mail: STR. PRAJA, NO. 37, ROOM 1, SLANIC, JUD. PRAHOVA
• Contact telephone number: 0701 002 000
• Contact email address: contact@rayahalal.ro
• DPO contact: protectia.datelor@rayahalal.ro

In the case of personal data archiving, RAYA HALAL undertakes to ensure advanced and up-to-date personal data protection methods, so that there is no leakage or loss of personal data.