This Data Processing Addendum ("DPA") is effective upon the earlier of your clicking “Accept” to the Terms and Conditions (the ‘Terms’) or your use of any of the Services and forms part of the Terms between Pan Cyprian Volunteerism Coordinative Council through PVCC Website (“PVCC”) and the entity entering the Terms as an Organizer ("Organizer").

This DPA is supplemental to the Terms and sets out the roles and obligations that apply when PVCC processes Personal Data falling within the scope of the GDPR on behalf of Organizer in the course of providing the Services.

All capitalized terms not defined in this DPA shall have the meanings set forth in the Terms.

1. Definitions

1.1 For the purposes of this DPA:

(a) “EEA" means the European Economic Area.
(b) "GDPR” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
(c) "Terms" means the Terms and Conditions or other written or electronic agreement between PVCC and Organizer setting out the provision and use of the Website’s Services.
(d) The terms "Controller", "Processor", "Personal Data", "processing", "special categories of data" and "Data Subject" have the meanings given to them in the GDPR.
(e) “Website” means the Website operated by PVCC, accessible from www.ethelontis.net;

2. Applicability of DPA

2.1 Applicability.

This DPA will apply onwards to the extent and when PVCC processes Personal Data falling within the scope of the GDPR on behalf of Organizer in the course of providing the Services.

3. Roles and Responsibilities

3.1 Roles of the Parties.

This DPA governs the services where PVCC processes data on behalf of the Organizer. To that extend and in relation to such services Organizer is the Data Controller of the Personal Data described in Annex A and PVCC shall process the Personal Data as a Data Processor.

3.2 Organizer Processing of Personal Data.

Organizer shall be responsible for:

(a) Complying with all applicable laws relating to privacy and data protection in respect of its use of the Services, its processing of the Personal Data, and any processing instructions it issues to PVCC;
(b) Ensuring it has the right to transfer, or provide access to, the Personal Data to PVCC for processing pursuant to the Terms and this DPA; and

3.3 PVCC Processing of Personal Data.

PVCC shall process the Personal Data for the purposes set out in Annex A and in accordance with the lawful, documented instructions of Organizer (including the instructions of any users accessing the Website’s Services on Organizer 's behalf) as set out in the Terms, this DPA or otherwise in writing.

4. Security

4.1 Security

PVCC shall implement appropriate technical and organizational measures to protect the Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (a "Security Incident").

4.2 Confidentiality obligations.

PVCC shall ensure that any personnel that it authorizes to process the Personal Data shall be subject to a duty of confidentiality.

4.3 Security Incidents.

Upon becoming aware of a Security Incident affecting Personal Data processed by PVCC, PVCC shall notify Organizer without undue delay. PVCC shall make reasonable efforts to identify the cause of the Security Incident and to take such steps as PVCC deems necessary and reasonable to mitigate the effects of such Security Incident, to the extent such efforts are within PVCC reasonable control. PVCC shall make reasonable efforts to provide such information as Organizer may reasonably require to enable Organizer to fulfil any data breach reporting obligations under the GDPR.

5. Sub-processing

5.1 Sub-processors.

Organizer agrees that PVCC may engage PVCC affiliates and third-party sub-processors (collectively, "Sub-processors") to process Personal Data on PVCC behalf provided that:

(a) PVCC shall maintain an up-to-date list of Sub-processors which will be available upon request, and;
(b) PVCC imposes on such Sub-processors data protection terms that require it to protect the Personal Data to the standard required by applicable data protection laws.

6. International Transfers

6.1 International transfers.

To the extent that PVCC transfers any Personal Data originating from the EEA to a country that has not been designated by the European Commission as providing an adequate level of data protection, it shall put in place such measures as are necessary to ensure such transfer is in compliance with the GDPR. Organizer authorizes transfers of Personal Data to such destinations outside of the EEA subject to such appropriate safeguards having been put in place.

7. Cooperation

7.1 Data subject rights.

PVCC shall, taking into account the nature of the processing, provide reasonable assistance to Organizer insofar as this is possible, to enable Organizer to respond to requests from data subjects seeking to exercise their rights under the GDPR. In the event such request is made directly to PVCC, PVCC shall promptly inform Organizer of the same and response to such request.

7.2 Provision of information.

PVCC shall make available to the controller reasonable information necessary to demonstrate compliance with the obligations laid down in this DPA by request to info@volunteerism-cc.org.cy;

7.3. Audit.

Whilst it is the parties' intention ordinarily to rely on the provision of the documentation to verify PVCC compliance with this DPA, PVCC shall permit the Organizer (or its appointed third-party auditors) to carry out an audit of PVCC processing of Personal Data under the Terms following a Security Incident suffered by PVCC, or upon the instruction of a data protection authority. Organizer must give PVCC reasonable prior notice of such intention to audit, conduct its audit during normal business hours, and take all reasonable measures to prevent unnecessary disruption to PVCC operations. Any such audit shall be subject to PVCC security and confidentiality terms and guidelines.

8. Return/Deletion of Data

8.1 Return or deletion of Personal Data.

Upon termination or expiry of the Terms, PVCC shall delete or return to Organizer the Personal Data (including copies) in PVCC possession. This requirement shall not apply to the extent that PVCC is required by applicable law to retain some or all of the Personal Data.

9. Miscellaneous

9.1 Except as amended by this DPA, the Terms will remain in full force and effect.

9.2 Any claims brought under this DPA shall be subject to the Terms, including but not limited to the exclusions and limitations of liability set forth in the Terms.

9.3 If there is a conflict between this DPA and the Terms, in relation to data protection issues the DPA.

Annex A

Data Processing Description

This Annex A forms part of the Agreement and describes the processing that the processor will perform on behalf of the controller.

Controller

The controller is:

The entity using the Portal for the provision of services provided through the Website , referred to as "Organizer" in the DPA.

Processor

The processor is :

PVCC, which provides services through the Website as per the Terms and other related services ("Services") to the Organizer.

Data subjects

The personal data to be processed concern the following categories of data subjects:

• Beneficiaries and Intermediaries Volunteers and employees of the Organizer: past, present and potential volunteers and employees of the Organizer located in the EEA whose Personal Data is submitted to the Services. Other EEA individuals whose Personal Data is submitted to or processed through the Services on behalf of the Organizer.

Categories of data

The personal data to be processed concern the following categories of data:

• Contact information: such as names, email addresses, phone numbers, contact details, qualifications and other data related to the volunteer service

Any other data are circulated directly by the Volunteer to the Organizer

Special categories of data (if appropriate)

Νο special data shall be added in the Website

Processing operations

The personal data will be subject to the following basic processing activities:

• Hosting and operation of the Portal.