PERSONAL DATA PROTECTION

DATED 28.06.2018

  1. When using the Product, the User shall enable customers and third parties to enter certain information and data, including shipping information and billing information, such as names, email, address, phone number, delivery address for the purpose of purchasing and delivery of goods by customers.
  2. Eri Digital shall be acting in its capacity of a data processor for storing above data for a period of thirty (30) days on behalf of the User.
  3. After expiry of the 30-day period, personal and other data, entered and stored with the Product, shall be erased by Eri Digital. Eri Digital is therefore obliged to exercise reasonable care to protect the personal data and not to distribute, sell or provide to third parties the personal data, unless sharing data is required for the execution of its obligations, by a competent authority or required by law.
  4. The User confirms that Eri Digital shall not be responsible for the lawful processing of personal data, besides the activities, specifically defined herein – 30-day storage and transfer of data towards Payment Service Providers. Eri Digital shall be in no case responsible and liable for the proper and legitimate collection of personal data through the Product or other processing activities.
  5. The User shall be responsible for the collection and proper processing of personal data through the Product, including for the provision of required information and acquiring the required consents by data subjects, if applicable. Parties agree that Eri Digital shall have no access to customers and shall be practically unable to provide with such information or acquire such consents.
  6. The content, which the User enters into the Product, including User personal data, is his sole responsibility.
  7. Parties shall comply with all requirements that the General Data Protection Regulation 2016/679 (GDPR) imposes for Eri Digital as a processor and the User as a controller.
  8. Without limiting the foregoing, Eri Digital agrees that it: processes the personal data only on documented instructions from the User;
    • Eri Digital shall immediately inform the User if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
    • ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
    • takes all measures required by the GDPR, regarding security of processing, appropriate technical and organisational measures, fulfilment of the User's obligation to respond to requests for exercising the data subject's rights and engaging another processor.
    • User agrees that for the time being Eri Digital shall engage processors for providing server space, such as Amazon. The User is informed and accepts that Amazon servers may be based outside the EU.
    • For the avoidance of doubt, Eri Digital shall only assist and enable User to meet User’s obligations to satisfy data subjects' rights, if User is unable to do so personally, but Contractor shall not respond directly to data subjects.
    • Eri Digital deletes all the personal data after the end of the 30-day storage period.
  9. The Parties agree that if any data subject or third party, who has suffered damage as a result of any breach of User’s obligations referred to in these terms or the applicable data protection legislation, is entitled to receive compensation from Eri Digital for the damage suffered, then the User shall compensate Eri Digital for all compensations paid to such data subject or third party.
  10. The Parties agree that if any sanctions shall be imposed by a competent authority to Eri Digital as a result of any breach of User’s obligations referred to in these Terms or the applicable data protection legislation, Eri Digital shall be entitled to receive compensations from the User for the damage suffered by Eri Digital, including compensation for any monetary sanctions paid by Eri Digital.