These are the standard contractual clauses for the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to third countries which do not ensure an adequate level of protection (controller to controller transfers). By accessing or using the Website www.reverb.com or any of its affiliated websites from outside the United States and within the European Union, you expressly agree to these standard contractual clauses.
Name of the data exporting organization: The user of any website operated by Reverb.com, LLC or its affiliated companies who inputs personal information into the website www.reverb.com or any site linked thereto which is affiliated with Reverb Holdings, Inc. (‘the data exporter’)
Name of the data importing organization: Reverb.com, LLC, 3345 N. Lincoln Ave, Chicago, IL 60657 Tel: 1-888-726-2728 e-mail: firstname.lastname@example.org (‘the data importer’)
HAVE AGREED on the following contractual clauses (‘the Clauses’) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1:
For the purposes of the Clauses:
(a) ‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (‘hereinafter the Directive’);
(b) the ‘data exporter’ shall mean the controller who transfers the personal data;
(c) the ‘data importer shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection.
The details of the transfer, and in particular the categories of personal data and the purposes for which they are transferred, are specified in Appendix 1 which forms an integral part of the Clauses.
The data subjects can enforce this Clause, Clause 4(b), (c) and (d). Clause 5(a), (b), (c) and (e), Clause 6(1) and (2), and Clauses 7, 9 and 11 as third-party beneficiaries. The parties do not object to the data subjects being represented by an association or other bodies if they so wish and if permitted by national law.
The data exporter agrees and warrants:
(a) that the processing, including the transfer itself, of the personal data by him/her has been and, up to the moment of the transfer, will continue to be carried out in accordance with the relevant provisions of the Member State in which the data exporter is established (and where applicable has been notified to the relevant authorities of that State) and does not violate the relevant provisions of that State;
(b) that if the transfer involves special categories of data the data subject has been informed or will be informed before the transfer that this data could be transmitted to a third country not providing adequate protection;
(c) to make available to the data subjects upon request a copy of the Clauses; and
(d) to respond in a reasonable time and to the extent reasonably possible to inquiries from the supervisory authority on the processing of the relevant personal data by the data importer and to any enquiries from the data subject concerning the processing of this personal data by the data importer.
The data importer agrees and warrants:
(a) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling its obligations under the contract and that in the event of a change in that legislation which is likely to have a substantial adverse effect on the guarantees provided by the Clauses, it will notify the change to the data exporter and to the supervisory authority where the data exporter is established, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) to process the personal data in accordance with the mandatory data protection principles set out in Appendix 2 to process in all other respects the data in accordance with:
- the relevant provisions of national law (attached to these Clauses) protecting the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data applicable to a data controller in the country in which the data exporter is established, or
- the relevant provisions of any Commission Decision under Article 25(6) of Directive 95/46/EC finding that a third country provides adequate protection in certain sectors of activity only, if the data importer is based in that third country and is not covered by those provisions, in so far as those provisions are of a nature which makes them applicable in the sector of the transfer;
(c) to deal promptly and properly with all reasonable inquiries from the data exporter or the data subject relating to its processing of the personal data subject to the transfer and to cooperate with the competent supervisory authority in the course of all its inquiries and abide by the advice of the supervisory authority with regard to the processing of the data transferred;
(d) at the request of the data exporter to submit its data processing facilities for audit which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications, selected by the data exporter, where applicable, in agreement with the supervisory authority;
(e) to make available to the data subject upon request a copy of the Clauses and indicate the office which handles complaints.
1. The parties agree that a data subject who has suffered damage as a result of any violation of the provisions referred to in Clause 3 is entitled to receive compensation from the parties for the damage suffered. The parties agree that they may be exempted from this liability only if they prove that neither of them is responsible for the violation of those provisions.
2. The data exporter and the data importer agree that they will be jointly and severally liable for damage to the data subject resulting from any violation referred to in paragraph 1. In the event of such a violation, the data exporter or the data importer or both.
3. The parties agree that if one party is held liable for a violation referred to in paragraph 1 by the other party, the latter will, to the extent to which it is liable, indemnify the first party for any cost, charge, damages, expenses or loss it has incurred.
1. The parties agree that if there is a dispute between a data subject and either party which is not amicably resolved and the data subject invokes the third-party beneficiary provision in clause 3, they accept the decision of the data subject:
(a) to refer the dispute to mediation by an independent person or, where applicable, by the supervisory authority;
(b) to refer the dispute to the courts in the Member State in which the data exporter is established.
2. The parties agree that by agreement between a data subject and the relevant party a dispute can be referred to an arbitration body, if that party is established in a country which has ratified the New York convention on enforcement of arbitration awards.
3. The parties agree that paragraphs 1 and 2 apply without prejudice to the data subject’s substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
The parties agree to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under national law.
The parties agree that the termination of the Clauses at any time, in any circumstances and for whatever reason, does not exempt them from the obligations and/or conditions under the Clauses as regards the processing of the data transferred.
The Clauses shall be governed by the law of the Member State in which the Data Exporter is established.
The parties undertake not to vary or modify the terms of the Clauses.
(The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.)
The data exporter is (please specify briefly your activities relevant to the transfer): A user of the services provided by the website www.reverb.com or other site affiliated with Reverb Holdings, Inc. that is located within the European Union.
The data importer is (please specify briefly your activities relevant to the transfer): Reverb.com, a digital marketplace for the buying and selling of new, used and vintage musical instruments and equipment.
The transfer is necessary for the following purposes (please specify): to effect the cross-border buying and selling of new, used and vintage musical instruments and equipment.
The personal data transferred fall within the following categories of data (please specify): See data subjects.
The personal data transferred may be disclosed only to the following recipients or categories of recipients (please specify): those parties who are necessary to effect the cross-border buying and selling of new, used and vintage musical instruments and equipment.
The personal data transferred may be stored for no more than (please indicate): the length of the user’s membership to the applicable website or as otherwise defined under applicable U.S. law.
These data protection principles should be read and interpreted in the light of the provisions (principles and relevant exceptions) of Directive 95/46/EC.
They shall apply subject to the mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defense, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others.
Data must be processed and subsequently used or further communicated only for the specific purposes in Appendix 1 to the Clauses. Data must not be kept longer than necessary for the purposes for which they are transferred.
Data must be accurate and, where necessary, kept up to date. The data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.
Data subjects must be provided with information as to the purposes of the processing and the identity of the data controller in the third country, and other information insofar as this is necessary to ensure fair processing, unless such information has already been given by the data exporter.
Technical and organizational security measures must be taken by the data controller that are appropriate to the risks, such as unauthorized access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the controller.
As provided for in Article 12 of Directive 95/46/EC, the data subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this Appendix, in particular because the data are incomplete or inaccurate. He should also be able to object to the processing of the data relating to him on compelling legitimate grounds relating to his particular situation.
Further transfers of personal data from the data importer to another controller established in a third country not providing adequate protection or not covered by a decision adopted by the Commission pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take place only if either:
(a) data subjects have, in the case of special categories of data, given their unambiguous consent to the onward transfer or, in other cases, have been given the opportunity to object.
The minimum information to be provided to data subjects must contain in a language understandable to them: (i) the purposes of the onward transfer, (ii) the identification of the data exporter established in the Community, (iii) the categories of further recipients of the data and the countries of destination, and (iv) an explanation that, after the onward transfer, the data may be processed by a controller established in a country where there is not an adequate level of protection of the privacy of individuals; or
(b) the data exporter and the data importer agree to the adherence to the Clauses of another controller which thereby becomes a party to the Clauses and assumes the same obligations as the data importer.
Where data revealing racial or ehtnic origin, political opinions, religious or philosophical beliefs or trade union memberships and data concerning health or sex life and data relating to offences, criminal convictions or security measures are processed, additional safeguards should be in place within the meaning of Directive 95/46/EC, in particular, appropriate security measures such as strong encryption for transmission or such as keeping a record of access to sensitive data.
Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to ‘opt-out’ from having his data used for such purposes.
Data subjects are entitled not to be subject to a decision which is based solely on automated processing of data, unless other measures are taken to safeguard the individual’s legitimate interests as provided for in Article 15(2) of Directive 95/46/EC. Where the purpose of the transfer is the taking of an automated decision as referred to in Article 15 of Directive 95/46/EC, which produces legal effects concerning the individual or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc., the individual should have the right to know the reasoning for this decision.