1. Jarltech Europe GmbH ("Jarltech") agrees that the Customer may, in some cases, be the responsible person (Ordering Party) for personal data, according to applicable data protection laws, which Jarltech receives from the Customer and processes on behalf of the Customer, as part of the provision of services under the General Terms and Conditions. Jarltech would then be the processor for the processing of the Customer's personal data; Jarltech, however, retains all rights, titles and interests in the personal information that Jarltech provides to the Customer, and will consider the Customer as a processor for the processing of Jarltech's personal Information in accordance with the General Terms and Conditions.

2. The Customer agrees that Jarltech may transfer personal information, including those of the Customer's customers, to Jarltech Europe GmbH, other Jarltech affiliates, manufacturers/sub-suppliers and/or sub-contractors located in the United States or third countries for the purpose of fulfilling their contractual obligations in accordance with the General Terms and Conditions, fulfilling contractual obligations to manufacturers/suppliers and/or fulfilling other legal obligations.

3. Jarltech may rely on the Customer that he has obtained the consent of the parties concerned (Data Subjects) if and where required, and/or otherwise is legally entitled to process personal data through Jarltech. The Customer agrees that, in order to safeguard their own claims and to fulfil their own obligations, Jarltech has the right to provide detailed information about quantities, articles, sales and the name and address of the Customer, as well as the End Customer, to manufacturers/sub-suppliers, especially in project business (manufacturer-supported retail business) at home and abroad (manufacturer reporting).

4. As long as Jarltech processes personal data on behalf of the Customer, Jarltech has the following obligations:

a) To process personal data only for legal purposes, in accordance with the documented instructions of the Customer and for no purpose other than those specified by the Customer, in compliance with the provisions of data protection laws;

b) Not to transfer personal data to countries outside the European Economic Area (EEA), to otherwise disclose any personal information to third parties or make it available elsewhere without the Customer's prior written consent, except, as may be necessary, to enable Jarltech to comply with any legal obligation, or General Terms and Conditions, or other agreement with the Customer;

c) To take reasonable measures to ensure the trustworthiness of the employees who have access to the Customer's personal data, which are processed in the context of providing the products or services in accordance with the General Terms and Conditions, and to ensure that these employees are subject to confidentiality;

d) To take appropriate technical and organizational measures against unauthorized or unlawful disclosure and processing of personal data and its accidental loss, destruction or damage;

e) To inform and collaborate with the Customer as soon as possible upon any inquiries from Data Subjects, third party communications, breaches of security or the loss of the Customer’s personal data, in order to prevent/alleviate any consequences;

f) To provide the Customer with adequate support to fulfil his obligations in accordance with data protection laws;

g) Upon termination of the business relationship with the Customer, cease the processing of the Customer's personal data and any files containing personal data, and either delete it or, at the option of the Customer, return it, with the exception that Jarltech is entitled to store copies of personal data for the purpose of the fulfilment of their other legal obligations;

h) Not to outsource the processing of the Customer's personal data to third parties without the Customer's express prior written consent, which may not be unreasonably withheld, with the exception of Jarltech-related companies, factoring banks, freight forwarders and sub-contractors. Jarltech remains responsible to the Customer regarding the use of affiliates and third parties who, as sub-contractors, process the Customer's personal information;

i) Upon reasonable notice, Jarltech agrees to facilitate and contribute to providing the Customer, or a mutually agreed upon independent and confidential party, with all information required to demonstrate compliance with Jarltech's processing obligations under the General Terms and Conditions and to conduct audits, including inspections. All audits and inspections must be performed at the Customer's expense during working hours and must not interfere with Jarltech's business operations.

5. The global Jarltech Data Protection Policy is available at https://www.jarltech.com/data_privacy; inquiries or requests for personal data should be addressed to privacy@jarltech.com.