Processing Agreement
This Processing Agreement applies when Mapwave acts as a processor (Ready Test Go platform). The words written in capital letters in this Processing Agreement are abbreviations, terms and clarifications that have the following meanings for this agreement:
- Main Agreement: the agreement between the Processor and the Controller pursuant to which the Processor provides services. This may be an accepted quotation
- Sub-processor: A natural person or legal entity working directly or indirectly under the responsibility of the Processor, with the exception of persons employed by the Processor.
- Applicable Legislation: The General Data Protection Regulation, other European regulations containing provisions relating to data protection and privacy, as well as the applicable national legislation on data protection and privacy in the Member States, with its amendments and implementing decisions
- The terms Personal Data, Controller, Processor, Data Subject, Third Party, Processing, Personal Data Breach and Supervisory Authority have the meanings given to them in the Applicable Legislation.
Article 1. Scope
- The provisions of the Processing Agreement apply in full to all Processing of Personal Data carried out by the Processor in the context of the processing activities specified in Appendix 1 to the Processing Agreement.
Article 2. Documented instructions from the Controller
- When Processing Personal Data, the Parties shall act in accordance with the Applicable Legislation.
- The Processor shall only use the Personal Data for the performance of its obligations in accordance with the Processing Agreement and in accordance with the documented instructions of the Controller.
- Unless otherwise specified in the Processing Agreement, the Processor shall (i) not use the Personal Data for its own purposes and (ii) not transfer it to a country outside the European Economic Area without the prior written consent of the Controller.
- If European or national regulations require the Processor to perform certain Processing, the Processor shall notify the Controller of that legal requirement prior to the Processing, unless such regulations prohibit such notification for important reasons of public interest.
- The Controller shall give instructions to the Processor in accordance with the Applicable Legislation and shall ensure that all Personal Data entrusted to the Processor has been lawfully obtained and may be processed.
- The Processor shall immediately notify the Controller if, in its opinion, an instruction constitutes a breach of the Applicable Legislation.
Article 3. Technical and organisational security measures
- The Processor shall take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR.
- At the request of the Controller, the Processor shall answer all questions relating to the technical and organisational measures taken that apply to the data processed or to be processed. Furthermore, at the simple request of the Controller, the Processor shall provide evidence that the appropriate technical and organisational measures have been effectively taken.
Article 4. Processing by Sub-processors and employees
- The Processor shall ensure that the persons authorised to process Personal Data are contractually bound to observe confidentiality or are bound by an appropriate legal obligation of confidentiality.
- The Processor is entitled to engage a Sub-processor in the Processing of the Personal Data.
The Processor shall only engage a Sub-processor insofar as it has informed the Controller in a timely manner and in any case in advance of the identity of the Sub-processor and insofar as the Controller has not objected to this. In the absence of any objection within 30 days of notification, the Controller shall be deemed to have accepted the Sub-processor.
- If the Processor engages a Sub-processor, it guarantees that the Sub-processor will be contractually subject to obligations equivalent to those to which the Processor is bound in relation to the Controller under this Processing Agreement.
- Where the Processor entrusts processing activities of Personal Data to Sub-processors, the Processor shall remain fully liable to the Controller for the fulfilment of the Sub-processor’s obligations.
Article 5. Assistance with regard to data protection policy
- Taking into account the nature of the Processing and the information available to it, the Processor undertakes to assist the Controller in complying with the legal obligations of the Controller under Articles 32-36 of the GDPR.
- In line with Article 5.1, the Processor shall notify the Controller without undue delay of any Breach relating to Personal Data. The notification shall be made in such a way that the Controller can comply in a timely manner with its legal obligations as a controller under the Applicable Legislation.
- The Processor shall also assist in the investigation, limitation and remediation of any Personal Data Breach.
- The Processor shall immediately notify the Controller of any complaint, allegation or request made in relation to the Processing of Personal Data by the Processor. The Processor shall provide all necessary cooperation and support that the Controller may reasonably expect in relation to such complaint, allegation or request, including by providing full information about such complaint, allegation or request.
Article 6. Assistance with regard to requests from the Data Subject
- The Processor shall immediately forward any request or question it receives from a Data Subject in connection with the (Processing of) Personal Data to the Controller, who shall decide what action to take.
- Taking into account the nature of the Processing, the Processor shall assist the Controller in fulfilling the Controller’s obligation to respond to requests for the exercise of the Data Subject’s rights by means of appropriate technical and organisational measures.
- The Processor shall not respond to requests and applications from Data Subjects itself, unless otherwise agreed in writing between the Controller and the Processor.
Article 7. Right of inspection
- The Controller shall at all times have the right to monitor the Processor’s compliance with the Processing Agreement. The Processor shall provide the Controller with all information necessary to demonstrate compliance with the obligations under the Applicable Legislation.
- The Controller shall have the option of having an independent audit carried out by an independent third party designated by it. The Processor may raise reasonable objections with regard to this third party.
- The audit shall be conducted at the expense of the Controller, unless the audit reveals serious shortcomings in compliance with this Processing Agreement or the Applicable Legislation, in which case the costs shall be borne by the Processor. The audit shall not unreasonably interfere with the normal operations of the Processor. The auditor appointed by the Controller shall sign a confidentiality agreement in advance. The auditor’s investigation and report shall relate exclusively to the verification of compliance with the appropriate technical and organisational measures as required under this Processing Agreement and the Applicable Legislation.
- The Processor shall also grant the appointed auditor access to the agreements it has concluded with all Sub-processors involved in the Processing of Personal Data.
- The Processor shall cooperate fully with such an audit and, at the request of the Controller, provide evidence of compliance with its obligations under the Processing Agreement.
Article 8. Data Protection Officer
- The Processor shall act in accordance with Article 37 of the GDPR with regard to the appointment of a data protection officer.
- The Processor shall provide the identity and contact details of the data protection officer to the Controller by means of Annex 1 to the Processing Agreement. If another data protection officer is appointed during the term of this Agreement, the Processor shall immediately notify the Controller thereof.
Article 9. Liability
- The liability provided for in this article shall only apply if no limitation of liability is provided for in the Main Agreement and shall only relate to any liability resulting from a breach of the Applicable Data Protection Legislation and/or this Processing Agreement and shall apply to the fullest extent permitted by law.
- The provisions of this processing agreement are not intended to limit or exclude the possible liability of the Processor (i) as a result of death or physical injury caused by a fault of the Processor (ii) as a result of wilful misconduct or fraud (iii) in any other way where this is not possible under a statutory provision.
- If the Processor is held liable by the Controller for damages as a result of non-compliance with this Processing Agreement or the Applicable Legislation, the total liability of the Processor shall be limited to compensation for the material damage suffered by the Controller (including any fines or other administrative or judicial sanctions) up to a maximum of €10,000 per event and per calendar year. A series of related events shall be considered a single event for the purposes of this article.
- The Processor shall not be liable for any form of indirect damage such as, but not limited to, business interruption, reduced goodwill, lost savings, lost profits, reputational damage or any other form of indirect, incidental or consequential damage, regardless of the nature of the act.
Article 10. Duration and Termination
- This Processing Agreement shall remain in force for as long as the Main Agreement remains in force. If the Main Agreement is terminated, this Processing Agreement shall also be terminated.
- Upon termination of this Processing Agreement, the Processor shall, at the discretion of the Controller, either erase all Personal Data or return it to the Controller and delete any existing copies thereof, unless the storage of the Personal Data is mandatory under Union or national law.
Article 11. Miscellaneous provisions
- This Processing Agreement forms an integral part of the Main Agreement. In the event of a conflict, the provisions of the Processing Agreement shall prevail.
- When the Processor assists the Controller as described in Articles 5, 6 and 7, the Processor may request reasonable compensation from the Controller for this.
Appendix 1: DESCRIPTION OF THE PROCESSING TASK
This Appendix describes the specific processing operations to be carried out by the Processor as instructed by the Controller at the time of concluding the Main Agreement. Any amendments and/or additions to this Appendix shall be made in a separate document attached to this Appendix and dated.
1. The purpose of the processing of personal data
The processing of personal data by the Processor takes place within the framework of the execution of the Main Agreement concerning:
Taking and processing selection tests in the context of selection
Description of the services under the Main Agreement and of the nature and purpose of the processing of personal data in the context of the services:
Administering and processing selection tests in the context of selection
2. The categories of personal data that the Controller has processed by the Processor:
Identification data
Personal characteristics
Occupation and position
Gender
3. The categories of data subjects whose personal data are processed:
Employees of the Data Controller
4. The processing of personal data
The following Sub-processors are approved by the Controller:
Codific BV, platform and platform hosting.
5. Transfer of personal data outside the EEA by the processor
Not applicable.
6. Retention periods for personal data
The Processor shall store the processed personal data in an adequately secure manner for the period necessary for the performance of the Processing Agreement and, with regard to the categories of personal data listed below, for the period specified below:
1 year from the date of taking the test.
7. Contact details
For the Processor:
Name: Elies Hendrickx
Contact details (e-mail): hello@mapwave.be




















