Standard Terms and Conditions exhibitor invitation portal

GDPR: the General Data Protection Regulation 2016/679.

Terms and Conditions: these standard terms and conditions which apply to the delivery by RAI of the Exhibitor Invitation Portal Services.

Exhibitor Invitation Portal services: the services to use the Exhibitor Portal to send personalized e-mailings for inviting (potential) relations of Partner to the Event.

Data: the personal data described in Annex 1.

Data Processing Agreement: these Terms and Conditions.

Parties: RAI and Partner.

Partner: any natural or legal person that agrees to use the Exhibitor Invitation Portal Services.

Principal Agreement: the request of Partner and acceptance of RAI to use the Exhibitor Invitation Portal Services.

RAI: RAI Amsterdam B.V., which has its registered office at Europaplein 24, 1078 GZ, Amsterdam, The Netherlands, registered in the trade register of the Chambre of Commerce under number 34192575.

Data Processor: RAI.

Data Controller: Partner.

These Terms and Conditions apply to all offers, requests for the delivery by RAI of the Exhibitor Invitation Portal Services to Partner.

If and to the extent that any provision of these Terms and Conditions is null and void or is avoided, the other provisions of these Terms and Conditions will remain in full force and effect. In such case, RAI will replace the provision with one that is of the tenor of the former provision.

Where relevant, these Terms and Conditions will supersede all previous data processing agreements and/or similar agreements between the Parties concerning the Exhibitor Invitation Portal Services.

The Data Controller hereby engages the Data Processor to process the Data described in Annex 1 on the Data Controller's behalf in accordance with the provisions of this Data Processing Agreement, which engagement the Data Processor accepts.

The Parties acknowledge that the processing of the Data is subject to the GDPR, as well as any and all other European and national regulations governing the protection of personal data applicable at any point in time.

The Data Processor will only process the Data in accordance with the documented instructions from the Data Controller in accordance with the instructions set out in this Data Processing Agreement and will not process the Data for other purposes or its own purposes, unless Union or Member State law – including but not limited to orders given by competent supervisory authorities, government bodies or an investigating, prosecuting or national security body – to which the Data Processor is subject, imposes a processing obligation on the Data Processor. In such cases, the Data Processor will inform the Data Controller of that legal requirement before processing that Data, unless said law prohibits such information on important grounds of public interest. If the Data Processor believes that an instruction constitutes a violation of the GDPR or any provision of Union or Member State law, the Data Processor will inform the Data Controller of this within a reasonable term.

The Data Processor has no control over the purposes of and the means used to process the Data. Under no circumstances will the Data Processor have control over the Data.

The Data Processor will only process the Data in the European Economic Area. If the Data Processor wishes to process Data outside the European Economic Area, either itself or through third parties (Sub-processors), the Data Processor must first obtain the Data Controller's prior written consent. Said consent may be made subject to additional conditions, such as taking additional contractual measures to ensure an adequate level of protection of the Data.

Insofar as any provision of this Data Processing Agreement is incompatible with the Principal Agreement, the provisions of this Data Processing Agreement will prevail.

Where relevant, this Data Processing Agreement will supersede all previous data processing agreements and/or similar agreements between the Parties concerning the Principal Agreement.

The Data Processor shall keep the Data confidential and will impose the obligation on the persons in its employment or service to observe confidentiality in respect of all Data.

The Data Processor will fulfil all obligations as a processor arising from article 32 of the GDPR. Consequently, the Data Processor will implement – taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons – appropriate technical and organisational measures (“security measures”) to ensure a level of security appropriate to the risk. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Data transmitted, stored or otherwise processed.

Taking into account the nature of the processing and the information provided, the Data Processor will assist the Data Controller in fulfilling the obligations arising from article 32 of the GDPR.

The Data Processor will enable the Data Controller to check the Data Processor's compliance ('Audit') with this Data Processing Agreement maximum once (1) a year at the cost of Data Controller, subject to a reasonable notice period of at least 1 month, by an independent and certified auditor.

The Data Processor shall provide the auditor with all relevant information.

If it is established during an Audit that the Data Controller is non-compliant with the provisions of this Data Processing Agreement, the Data Processor shall, in consultation with the Data Controller, take the measures necessary to ensure that it is as yet compliant.

The Data Controller will bear the costs of the Audit, unless the Audit findings show that the Data Processor is non-compliant with the provisions of this Data Processing Agreement, in which case the Data Processor will bear the costs.

In case of a personal data breach, the Data Processor will notify the data breach to the Data Controller, as soon as possible after having become aware of it.

Notifications made pursuant to article 7.1 must be addressed to the Data Controller or, where relevant, to one or more of the Data Controller's employees stated in writing while this Data Processing Agreement is in place.

Taking into account the nature of the processing and the information available to it, the Data Processor will help the Data Controller to comply with the obligations arising from articles 33 and 34 of the GDPR.

If the Data Controller instructs the Data Processor to do so, the Data Processor will lend its full cooperation – bearing in mind the nature of the processing and the available information – to enable the Data Controller to satisfy requests from data subjects within the meaning of Chapter 3 of the GDPR. The costs will be borne by the Data Controller.

If such a request is submitted directly to the Data Processor, the Data Processor will send the request to Data Controller.

Taking into account the nature of the processing and the information available to the Data Processor, the Data Processor will reasonably assist the Data Controller in fulfilling its obligations arising from Article 35 (data protection impact assessment) and Article 36 (prior consultation) of the GDPR.

The Data Controller gives the Data Processor permission to engage third parties to process the Data. The Data Processor shall inform the Data Controller of any intended change regarding the addition or replacement of sub-processors. The Data Controller has the right to object to this addition or replacement within one month. If the Data Controller objects, parties will consult each other. If they do not reach a solution within a month, parties have the right to terminate the Principal Agreement.

At Data Controller's first request, the Data Processor will provide the Data Controller with an overview of all sub-processors.

The liability of the Data Processor is limited to the compensation of the direct damage suffered by the Data Controller with a maximum amount of € 5,000.00 (five thousand euro). Direct damage only include:

1. the reasonable costs incurred by the Data Controller to rectify the Data Processor's shortcoming;
2. the reasonable costs that the Data Controller must incur to prevent and limit the damage caused by a breach of security attributable to the Data Processor, insofar as the Data Controller can demonstrate that these costs have led to a limitation of the damage;
3. the reasonable costs that the Data Controller must incur to determine the cause and extent of the damage, insofar as the determination relates to direct damage within the meaning of this paragraph.

The compensation for consequential damage, including but not limited to loss of revenue or loss of profit, business stagnation, reputation damage and lost savings, are excluded from compensation.

The Data Controller indemnifies the Data Processor against all claims from third parties, as well as fines and / or other sanctions imposed by a competent authority, which may be imposed against the Data Processor for a breach of the laws and regulations concerning the processing of Data and / or non-compliance with the obligations under this Data Processing Agreement by the Data Controller.

These Terms and Conditions are valid for as long as the Data Controller instructs the Data Processor to process Data under the Principal Agreement.

Upon termination of this Data Processing Agreement, the Data Processor must destroy all documents and data carriers containing Data, as well as copies thereof, unless the Data Processor is required pursuant to a provision of Union or Member State law to retain the Data.

The Data Processor will reasonably cooperate with regard to the transfer of the work concerning the processing of the Data to the Data Controller or a subsequent Data Processor at the cost of Data Controller.

This Data Processing Agreement will remain in force for as long as the Data Processor has Data in its possession. Obligations which by their nature are intended to continue even after termination of this Data Processing Agreement will remain in effect after termination of this Data Processing Agreement.

These Terms and Conditions are governed by Dutch law.

All disputes relating to these Terms and Conditions or its performance will be adjudicated by the competent court in Amsterdam.

The Data Controller will give the Data Processor access to the following Data which the Data Processor may process:

• company name;
• name;
• email address.

The Data concerns the following categories of data subjects:

• relations of Controller (customers, leads, prospects etc.).

Where necessary, the Data may be processed for the following purposes:

• sending mailings.

performance of the Exhibitor Invitation Portal Services.