Trade-in Privacy Policy

This clause governs the processing of personal data provided by the Partner or Customer, or obtained directly from the data subject, by the Data Processor on behalf of the Partner or Customer. The processing shall be strictly limited to the extent necessary for the performance of services under this Agreement (hereinafter referred to as “Commissioned Processing”).

Ownership and Handling of Personal Data

Any personal or sensitive personal data provided by the Partner, Customer, or their customers to the Data Processor, and used by the Data Processor’s associates in fulfilling their obligations under this Agreement, shall remain the exclusive property of the Partner and Customer. The Data Processor must clearly identify, mark, and record such data accordingly across all media and documentation.

Data Processing Restrictions

The Data Processor shall process personal or sensitive personal data strictly for the purpose of performing the Commissioned Processing, in compliance with this Agreement, applicable data protection laws, and the instructions of the Partner or Customer. The Data Processor shall not use the data for any other purpose, including its own business activities, unless required by law. In such cases, the Data Processor must notify the Partner or Customer before processing, unless prohibited by law due to public interest.

Data Copies and Backup

The Data Processor is prohibited from making copies of personal or sensitive personal data without prior written approval from the Partner or Customer, except for necessary backup copies to ensure proper data processing, statutory compliance, or legal evidence preservation.

Data Security and Integrity

The Data Processor shall ensure that all associates handling personal data receive appropriate training to maintain data integrity and prevent unauthorized access, loss, damage, or destruction. Data must be properly labeled, and if processed for multiple purposes, must be tagged accordingly.

Incident Reporting

The Data Processor shall immediately inform the Partner or Customer of any significant operational disruptions, suspected data protection breaches, or irregularities related to data processing.

Additionally, the Data Processor shall notify the Partner or Customer about any communication, orders, investigations, or actions from supervisory authorities that relate to the processing of data under this Agreement. Information will only be provided to third parties or supervisory authorities after prior consultation with the Partner or Customer.

Confidentiality Obligations

All personnel authorized to process personal data must commit to confidentiality obligations or be subject to statutory confidentiality requirements. They must also be familiar with the relevant data protection regulations. This confidentiality obligation extends beyond the term of contracted services.

Data Subject Rights Support

The Data Processor shall support the Partner or Customer at no cost in responding to data subject requests for data rectification, erasure, or processing restrictions, wherever feasible, using appropriate technical and organizational measures.

Data Erasure Upon Termination

Upon expiration or termination of this Agreement, the Data Processor shall instruct all associates and personnel to erase all personal or sensitive personal data provided by the Partner, Customer, or data subjects, unless retention is required by applicable law.