Data Exchange Agreement

Parties

HBMEO B.V., having its registered office at Reguliersgracht 56, 1017 LT Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 27188914, organiser of Mastercard Hotelnacht, hereinafter “HBMEO”;

and

the company that operates a participating hotel or a participating spot and has registered for Mastercard Hotelnacht, as stated in the registration form with its legal name, Chamber of Commerce number, address, the locations covered by the registration and whether it participates with a hotel, a spot or both, hereinafter the “Partner”;

hereinafter jointly the “Parties” and each a “Party”.

Recitals

A. HBMEO organises Mastercard Hotelnacht and, in that context, sells packages and passe-partouts to festival visitors.

B. In order to carry out bookings and reservations, HBMEO provides personal data of festival visitors to the Partner.

C. The Partner uses that data to handle the booking or reservation itself and, in the case of a hotel, to comply with its own legal obligations. Each Party determines the purposes and means of its own processing.

D. In this agreement, the Parties set out how they handle the exchanged data.

Article 1 – Definitions

1.1 Terms from the General Data Protection Regulation (EU) 2016/679 (“GDPR”), such as personal data, processing, controller, processor, data subject and personal data breach, have the same meaning in this agreement as in the GDPR.

1.2 “Exchanged Data”: the personal data that HBMEO provides to the Partner, as described per partner type in Annex 1.

1.3 “Edition”: the edition of Mastercard Hotelnacht for which the Partner has registered according to the registration form.

1.4 “Participation Terms”: the participation terms of Mastercard Hotelnacht in the version accepted by the Partner when registering for the Edition.

Article 2 – Subject matter and roles

2.1 This agreement governs the provision of the Exchanged Data by HBMEO to the Partner and the processing of that data by both Parties.

2.2 The Parties assume that each of them is an independent controller for its own processing of the Exchanged Data, and that they are not joint controllers within the meaning of Article 26 GDPR. The Partner is a processor of HBMEO only when it scans tickets at HBMEO’s request in accordance with Annex 2. Before the Parties materially change a processing operation, they reassess the allocation of roles. If it turns out that they are joint controllers for a processing operation, they will make an arrangement in advance in accordance with Article 26 GDPR.

2.3 Each Party is itself responsible for complying with the GDPR in respect of its own processing.

Article 3 – Purpose limitation

3.1 The Partner uses the Exchanged Data solely to:

• carry out the data subject’s booking or reservation for Mastercard Hotelnacht and communicate with the data subject about it;
• comply with legal obligations of the Partner, such as keeping a guest register and paying tourist tax.

3.2 The Partner does not use the Exchanged Data for profiling or for commercial purposes other than its own direct marketing in accordance with Article 3.3. The Partner does not disclose the Exchanged Data to third parties, including other companies within its own group, except to its own processors in accordance with Article 10.

3.3 The Partner may use the name and contact detail of a data subject for its own direct marketing about its own hotel or spot, but only if the data subject has given consent for this through HBMEO or directly to the Partner, for example at check-in or during the visit, and only through the channels to which that consent applies. Consent given through HBMEO is only valid if the data subject gave it freely and separately, by means of a checkbox that is not pre-ticked, is not a condition for the booking or reservation, and names the operator, the name of the hotel or spot, the purpose and the communication channels. The Partner does not use the Exchanged Data to ask data subjects for marketing consent by email, telephone or message.

3.4 HBMEO passes consent given through HBMEO on to the Partner, together with the name of the data subject, the contact detail to which the consent applies, the text used to request consent, and the date and time of the consent. HBMEO remains responsible for obtaining, recording and passing on the consent; the Partner is independently responsible for using it for marketing. If a data subject withdraws consent with HBMEO, HBMEO passes this on to the Partner without undue delay. The Partner offers an easy way to unsubscribe in every marketing message and processes unsubscriptions immediately.

3.5 HBMEO provides the Exchanged Data solely for the purposes in Article 3.1 and, to the extent the data subject has consented, for marketing by the Partner in accordance with Article 3.3.

Article 4 – Legal basis and information to data subjects

4.1 HBMEO provides Exchanged Data:

• to the extent necessary to carry out the booking or reservation, because this is necessary for the performance of the contract between HBMEO and the buyer (Article 6(1)(b) GDPR);
• for marketing by the Partner, solely on the basis of the data subject’s consent (Article 6(1)(a) GDPR) in accordance with Article 3.3.

For any other provision of data, the Parties will determine a legal basis in writing in advance.

4.2 The Partner processes the Exchanged Data on the legal basis stated per activity in Annex 1. Where the Partner relies on a legitimate interest, it records the balancing of interests in advance. For the guest register and tourist tax, the legal basis is a legal obligation (Article 6(1)(c) GDPR).

4.3 In its own privacy policy, HBMEO informs buyers that their data is provided to the hotel or spot where they have booked or reserved, and for what purpose.

4.4 The Partner itself informs data subjects about its own processing of the Exchanged Data, to the extent they have not yet received that information (Article 14 GDPR). The Partner does so no later than at the first contact with the data subject, for example at check-in or during the visit, and in any event within one month of receiving the Exchanged Data.

Article 5 – Data minimisation and accuracy

5.1 HBMEO provides no more data than is necessary for the purposes in Articles 3.1 and 3.5. Annex 1 sets out which data that is per partner type. Each Partner only has access to the bookings and reservations for its own locations. For marketing, the Partner uses only the name, the contact detail for which consent was given and the proof of that consent, not the home address, dates of stay or other booking data.

5.2 Mastercard Hotelnacht is open only to visitors aged 18 and over. HBMEO uses the date of birth of buyers solely to check this, does not provide it to the Partner and does not keep it longer than the other booking data.

5.3 If a Party discovers that Exchanged Data is inaccurate or incomplete, it notifies the other Party as soon as possible.

Article 6 – Security

6.1 Each Party takes appropriate technical and organisational measures to secure the Exchanged Data, in accordance with Article 32 GDPR.

6.2 The Parties exchange data through the systems listed in Annex 1. Only where that is not possible is data shared in another way, and then only securely, for example via an encrypted connection or a protected file. After receipt, the receiving Party also stores files containing Exchanged Data securely.

6.3 Each Party ensures that:

• only staff who need the data for their work have access to it, using a personal account where the system supports this; shared accounts only as a controlled exception;
• those staff are bound by confidentiality;
• the data is only processed on devices with a passcode, up-to-date software and, where appropriate, encryption;
• access is revoked in good time when a member of staff no longer needs it.

Article 7 – Retention periods

7.1 Each Party determines the retention period of the data it processes and does not keep it longer than necessary for the purpose for which it was obtained or than required by law.

7.2 The Partner deletes the overviews and files containing Exchanged Data supplied by HBMEO as soon as they are no longer needed to handle bookings and reservations, and no later than 12 months after the end of the Edition, unless a legal obligation requires longer retention. This also applies to copies and to data that the Partner has transferred from those overviews and files to other systems.

7.3 Article 7.2 does not apply to the name and contact detail that the Partner uses for marketing on the basis of consent (Article 3.3). The Partner keeps these for as long as the consent applies and it needs them for that purpose. The Partner keeps the proof of consent and a record of unsubscriptions no longer than necessary to demonstrate the consent and respect unsubscriptions.

7.4 Nor does Article 7.2 apply to data that the Partner obtains itself from the guest because the guest actually stays at or visits the location, such as at check-in. Copying supplied data at check-in does not count as obtaining it itself. For data it obtains itself, the Partner also observes purpose limitation, data minimisation and appropriate retention periods.

Article 8 – Personal data breaches

8.1 Each Party is itself responsible for notifying a breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where necessary, to data subjects.

8.2 If a breach at the Partner affects Exchanged Data, the Partner notifies HBMEO without undue delay and no later than 24 hours after becoming aware of it, via info@hotel-night.com and, in the case of an urgent incident, also by telephone on +31 6 2454 1327. If a breach at HBMEO affects Exchanged Data that the Partner has received, HBMEO informs the Partner without undue delay.

8.3 The first notification contains the information available at that time: what happened, which data and how many data subjects are expected to be affected, and what measures have been taken. The notification is supplemented as soon as more is known.

8.4 The Parties work together to limit the consequences and coordinate communication to data subjects and the press in advance. Such coordination does not delay a legally required notification. Article B2.5 of Annex 2 applies to breaches in connection with ticket scanning.

Article 9 – Rights of data subjects

9.1 Each Party itself handles requests from data subjects concerning its own processing, within the time limits of the GDPR.

9.2 If a Party receives a request that (also) concerns the processing by the other Party, it forwards the request within five working days and informs the data subject accordingly.

9.3 The Parties assist each other where necessary in correcting, deleting or restricting the processing of Exchanged Data. Forwarding a request does not release a Party from its own obligations. When forwarding, a Party shares only what is necessary, and no copy of an identity document.

Article 10 – Engaging processors

10.1 Each Party may engage processors for its own processing as a controller, such as a booking or reservation system, and concludes a data processing agreement with them in accordance with Article 28 GDPR. Each Party remains responsible for its own processors. Article B2.7 of Annex 2 applies to ticket scanning.

Article 11 – Transfers outside the EEA

11.1 A Party only transfers Exchanged Data to a country outside the European Economic Area, including through hosting in or access from such a country, if there is a valid basis for this under Chapter V GDPR, such as an adequacy decision or the European Commission’s Standard Contractual Clauses with any supplementary measures required. On request, a Party provides the other Party with information about relevant transfers and the safeguards used.

Article 12 – Liability

12.1 The liability of the Parties towards data subjects follows from Article 82 GDPR. This agreement does not limit the statutory rights of data subjects.

12.2 A Party that attributably fails to perform this agreement or its obligations under the GDPR compensates the other Party for the resulting damage and reasonable costs, to the extent attributable to it. This includes amounts that the other Party consequently owes by law to data subjects or third parties and, solely to the extent permitted by law, administrative fines.

12.3 Liability between the Parties for indirect damage, including loss of profit, is excluded. Reasonable costs of incident investigation, damage limitation, legally required communication and legal assistance, and the compensation owed to data subjects or third parties referred to in Article 12.2, are not excluded merely because they could be regarded as indirect damage.

12.4 The total liability of HBMEO towards the Partner arising from or in connection with this agreement is limited per Edition to the total participation fee, excluding VAT, owed by the Partner for that Edition according to the registration form. No contractual maximum applies to the liability of the Partner towards HBMEO arising from or in connection with this agreement.

12.5 The exclusion and limitation of liability do not apply in the event of intent or deliberate recklessness of the liable Party. They are without prejudice to Article 12.1 and to mandatory liability and rights of recourse.

12.6 The Parties inform each other without undue delay of relevant claims by third parties and cooperate reasonably in handling them. A Party does not admit liability or reach a settlement on behalf of the other Party without its prior written consent.

Article 13 – Term, suspension and termination

13.1 This agreement applies for as long as the Partner participates in Mastercard Hotelnacht and for as long as a Party processes Exchanged Data.

13.2 In the event of a serious breach of this agreement or of the GDPR by the Partner, HBMEO may immediately suspend the provision of Exchanged Data and access to HBMEO’s systems, including the scanning app, until the breach has been remedied.

13.3 In the event of a serious or repeated breach of this agreement or of the GDPR by the Partner, HBMEO may terminate this agreement and the Partner’s participation with immediate effect, with due observance of the Participation Terms.

13.4 After expiry or termination of this agreement, the following remain in force:

• liability for earlier failures and existing claims (Article 12);
• the confidentiality obligations;
• Articles 3, 6, 7, 8, 9 and 11, for as long as a Party processes Exchanged Data;
• Annex 2, until the settlement, return and deletion under Article B2.9 have been completed.

Article 14 – Formation and order of precedence

14.1 The Partner accepts this agreement by registering for Mastercard Hotelnacht through the online registration form and ticking the box confirming that it accepts this agreement. The person registering the Partner declares that they are authorised to do so. HBMEO records which version of this agreement and of the Participation Terms was accepted, on which date and at what time, by which company and by which person, and keeps those versions. The agreement can be downloaded before registering.

14.2 This agreement applies alongside the Participation Terms. In the event of a conflict concerning the processing of personal data, or liability related to it, this agreement prevails. Other general terms and conditions of a Party do not apply to this agreement.

14.3 HBMEO may amend this agreement. For each Edition, the Partner accepts the version then in force when registering.

14.4 HBMEO may also have an amendment take effect during an Edition if the amendment:

• is necessary to comply with the law, a decision of a supervisory authority or a court ruling; HBMEO informs the Partner of this as soon as possible; or
• does not disadvantage the Partner, such as a clarification, a different system or contact detail, or a measure that improves the protection of the data; HBMEO informs the Partner of this at least 14 days before the amendment takes effect.

Article 15 – Governing law and disputes

15.1 This agreement is governed by Dutch law.

15.2 Disputes are submitted to the competent court of the District Court of Amsterdam, in line with the general terms and conditions of Mastercard Hotelnacht.

15.3 This agreement has been drawn up in Dutch and English. Both versions are equally authoritative. In the event of a difference between the two versions, the provision is interpreted according to what the Parties intended as evidenced by both versions together.

Annex 1 – Exchanged Data

The table describes, per activity, which data HBMEO provides, for what purpose and on what legal basis the Partner processes it.

Annex 2 – Processor provisions for ticket scanning

B2.1 This annex only applies if HBMEO asks the Partner to scan tickets (passe-partouts and packages) at the entrance to Mastercard Hotelnacht events. The Partner does so on behalf of HBMEO using the CM.com scanning app, for which HBMEO provides an event number and password. For this processing, HBMEO is the controller and the Partner the processor.

B2.2 Subject matter, nature, purpose and duration: checking the validity of tickets at the entrance during the festival weekend. Data: the QR code of the ticket, which the festival visitor shows (on paper, as a PDF or in a wallet), and the result of the check: valid or invalid. The scanning app does not show the name or any other data of the festival visitor. Data subjects: festival visitors.

B2.3 The Partner processes this data solely on documented instructions from HBMEO, including with regard to transfers to a country outside the European Economic Area, and not for its own purposes. If the Partner is legally required to process the data otherwise, it informs HBMEO in advance, unless the law prohibits this.

B2.4 The Partner immediately informs HBMEO if, in its opinion, an instruction infringes the GDPR or other data protection rules.

B2.5 The Partner notifies HBMEO of a breach in connection with this data without undue delay and no later than 24 hours after becoming aware of it, with the information referred to in Article 33(3) GDPR insofar as available, and supplements it as soon as more is known.

B2.6 The Partner binds the staff who scan to confidentiality and takes appropriate security measures (Article 32 GDPR). The Partner shares the login details of the scanning app only with those staff and does not make copies or photos of tickets or QR codes.

B2.7 The Partner does not engage sub-processors without HBMEO’s prior written consent. If HBMEO gives that consent, the Partner imposes the same obligations as in this annex on the sub-processor in writing and remains fully responsible towards HBMEO for compliance with them.

B2.8 Taking into account the nature of the processing and the information available to it, the Partner assists HBMEO with appropriate technical and organisational measures in responding to requests from data subjects and in complying with the obligations under Articles 32 to 36 GDPR, such as security, notifications and any DPIA.

B2.9 After the festival weekend, or earlier if the participation or this agreement ends, the Partner deletes or returns, at HBMEO’s choice, all data from this processing, including any local copies and temporary storage on devices, unless the law requires retention. In the case of return, the Partner also deletes the remaining copies. The Partner confirms the deletion in writing at HBMEO’s request. The Partner logs out of the scanning app and HBMEO revokes access.

B2.10 The Partner provides HBMEO with all information necessary to demonstrate compliance with this annex and cooperates with an audit or inspection by or on behalf of HBMEO.