CUSTOMER DATA SHARING WITH BUSINESS PARTNERS

Effective date: [Insert date]
Company name: [Insert full legal company name]
Registered address: [Insert registered address]
Contact email: [Insert privacy contact email]
Data Protection Officer (if applicable): [Insert contact details]

1. Purpose and Scope

These Terms and Conditions explain how [Company Name] (“we”, “us” or “our”) may collect, use, disclose and share customers’ personal data with selected business partners in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable national data protection laws.

These terms apply to personal data collected from customers through our website, applications, services, transactions, customer support channels and other business interactions.

Where required by law, we will obtain the customer’s valid consent before sharing personal data for the relevant purpose.

2. Categories of Personal Data

Depending on the services provided and the purposes of processing, we may share the following categories of personal data:

• Identification data: Name, title and customer reference number.

• Contact information: Email address, telephone number and postal address.

• Transaction information: Purchase history, orders, bookings, payment status and service preferences. We do not share full payment card details unless lawfully required and appropriately safeguarded.

• Customer preferences: Product interests, communication preferences and interactions with our services.

• Technical information: IP address, device identifiers and website or application usage information, where lawfully collected.

• Other information: Additional information that is relevant and necessary for a specific, disclosed purpose.

We will not share more personal data than is reasonably necessary for the relevant purpose.

Special-category personal data, such as health information, biometric data or information revealing religious or political beliefs, will not be shared under this general permission. Any such processing requires a separate assessment and an appropriate legal basis under the GDPR.

3. Business Partners and Recipients

We may disclose relevant customer data to selected business partners, which may include:

• Service providers supporting our business operations, such as hosting, customer support, delivery and IT providers.

• Commercial partners providing complementary products or services.

• Marketing and advertising partners, where permitted by law and, where required, based on valid consent.

• Analytics and research providers, where the processing is lawful and appropriate safeguards are in place.

• Professional advisers, auditors, insurers and other recipients where disclosure is necessary and lawful.

• Public authorities or other organisations where disclosure is required by law.

Where appropriate, we will identify relevant partners by name or provide an accessible and sufficiently specific list of recipients in our Privacy Notice.

We will not treat this clause as permission to disclose customer data indiscriminately to any third party.

4. Purposes of Data Sharing

Subject to the applicable legal basis and the information provided to the customer, we may share personal data for the following purposes:

a. To fulfil orders, bookings, requests or contracts and provide related services.

b. To enable trusted service providers to deliver services on our behalf.

c. To provide customers with information about relevant products, services, promotions or offers from our company or selected business partners, where permitted by applicable law.

d. To improve our products, services, customer experience and business operations.

e. To conduct market research, service evaluation and statistical analysis, using anonymised or appropriately protected information where possible.

f. To detect and prevent fraud, protect our systems and comply with legal or regulatory obligations.

g. To establish, exercise or defend legal claims where necessary.

Each sharing activity must have a defined purpose and an appropriate legal basis. Consent to one purpose does not automatically constitute consent to another.

5. Legal Basis for Processing

We will process and share personal data only where a lawful basis under Article 6 of the GDPR applies.

Depending on the circumstances, this may include:

• The customer’s freely given, specific, informed and unambiguous consent.

• The necessity of processing to perform a contract with the customer or take requested pre-contractual steps.

• Compliance with a legal obligation.

• Our legitimate interests or those of a third party, where applicable, after assessing the customer’s rights and freedoms and providing the required information.

Where processing relies on consent, we will obtain and record consent before undertaking the relevant activity. Where consent is not the appropriate legal basis, we will explain the applicable basis in our Privacy Notice.

6. Optional Consent to Share Data with Commercial Partners

Where consent is the appropriate legal basis, we will ask customers to provide a separate, affirmative indication of their agreement.

Suggested consent statement:

“I agree that [Company Name] may share the personal data categories described in its Privacy Notice with the business partners identified or described in that notice, for the specific purposes of [describe the relevant purposes, such as receiving offers for complementary products and services]. I understand that this permission is voluntary, that I may refuse without being unfairly disadvantaged, and that I may withdraw my consent at any time. I understand that withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.”

This consent must be presented separately from acceptance of these general Terms and Conditions, where required by the GDPR.

The consent request must clearly identify or adequately describe the relevant recipients, the categories of data involved and the specific purposes for sharing. Where partners will use the data for their own direct marketing, that purpose must be clearly explained.

Consent must not be pre-selected, implied by inactivity or made a condition of purchasing a service where the sharing is unnecessary for that service.

Where different purposes require separate consent, we will provide separate choices.

7. Responsibilities of Business Partners

Before sharing personal data, we will take appropriate steps to ensure that relevant partners are subject to suitable data protection obligations.

Depending on their role, partners may act as:

a. Data processors, processing personal data only on our documented instructions under an appropriate written agreement in accordance with Article 28 of the GDPR;

b. Independent data controllers, determining their own purposes and means of processing and being responsible for their own compliance with applicable data protection law; or

c. Joint controllers, jointly determining the purposes and means of processing, in which case an arrangement addressing their respective responsibilities will be put in place as required by Article 26 of the GDPR.

Partners must not use shared data for purposes that are incompatible with the disclosed purposes or otherwise unlawful. Where a partner wishes to use data for its own marketing or other independent purposes, that use must have its own appropriate legal basis and satisfy applicable transparency and marketing requirements.

8. Data Security and Confidentiality

We will implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration or disclosure.

Measures may include access controls, encryption, pseudonymisation, staff confidentiality obligations, security assessments, partner due diligence and appropriate contractual safeguards.

We will take reasonable steps to ensure that recipients protect the data they receive and process it in accordance with applicable law and their contractual obligations.

Where a personal data breach occurs, we will comply with applicable GDPR notification and communication obligations.

9. International Transfers

Where personal data is transferred to a country outside the European Economic Area, we will ensure that the transfer complies with Chapter V of the GDPR.

Depending on the circumstances, this may involve an applicable European Commission adequacy decision, approved Standard Contractual Clauses, or another lawful transfer mechanism, together with any supplementary safeguards required.

Customers will be provided with the information about international transfers and safeguards required by applicable law.

10. Data Retention

We will retain personal data only for as long as necessary for the purposes for which it was collected or shared, taking into account applicable legal, regulatory, contractual and record-keeping requirements.

When personal data is no longer required, we will take appropriate steps to delete, anonymise or securely dispose of it, subject to any lawful obligation to retain it.

Where processing is based on consent, withdrawal will be reflected in our processing activities. We will stop the relevant consent-based processing and take appropriate steps regarding data previously shared with recipients, subject to applicable legal obligations and any other valid legal basis.

11. Customer Rights

Subject to the conditions and exceptions provided by law, customers may have the right to:

• Request access to their personal data.

• Request correction of inaccurate or incomplete data.

• Request erasure of their personal data.

• Request restriction of processing.

• Receive certain personal data in a portable format.

• Object to processing based on legitimate interests.

• Object at any time to processing for direct marketing, including related profiling.

• Withdraw consent at any time where processing is based on consent.

• Lodge a complaint with the competent data protection supervisory authority.

Requests may be submitted to [Insert privacy contact email or postal address].

We will respond within the time limits prescribed by applicable law.

12. Withdrawal of Consent

Where consent has been given, customers may withdraw it at any time by:

• Contacting us at [Insert privacy contact email].

• Using the consent or privacy preference settings made available on our website or application.

• Using the unsubscribe or preference-management mechanism provided in a relevant marketing communication, where applicable.

Withdrawal must be as easy as giving consent. It will not affect the lawfulness of processing carried out before withdrawal.

We will cease the relevant processing based on consent and take reasonable and legally required steps to communicate the withdrawal to relevant recipients. Withdrawal does not automatically invalidate processing supported by a separate, independently applicable legal basis.

13. Marketing Communications

Sharing personal data with a partner for direct marketing will take place only where permitted under applicable data protection and electronic communications laws.

Where consent is required for the sharing of contact details or for marketing by email, SMS, telephone or other electronic means, we will obtain the necessary consent before the relevant activity.

Customers may opt out of direct marketing at any time. An objection to direct marketing will be respected in accordance with applicable law, and personal data will not continue to be used for that purpose.

Consent to receive marketing from [Company Name] does not, by itself, constitute consent to receive marketing from every business partner.

14. Changes to These Terms

We may update these Terms and Conditions from time to time to reflect changes in our business operations, partner arrangements or applicable legislation.

Where a change materially affects the purposes or manner of processing personal data, we will provide appropriate information and obtain fresh consent where legally required. We will not treat acceptance of updated general terms as a substitute for consent where separate consent is required.

The current version will be made available at [Insert website or document location].

15. Contact and Complaints

For questions concerning these terms or the handling of personal data, customers may contact:

Company: [Insert full legal company name]
Privacy contact: [Insert name or department]
Email: [Insert privacy contact email]
Postal address: [Insert address]
Data Protection Officer: [Insert details, if applicable]

Customers may also lodge a complaint with the competent data protection supervisory authority in the EU/EEA Member State concerned.

16. Applicable Law

These Terms and Conditions shall be interpreted in accordance with applicable European Union data protection law and the relevant national laws applicable to [Company Name], without prejudice to any mandatory rights afforded to customers under applicable law.

Nothing in these terms is intended to exclude or restrict any right or remedy that customers are entitled to under applicable data protection legislation.

17. Relationship with the Privacy Notice

These terms must be read together with our Privacy Notice, available at [Insert Privacy Notice URL].

The Privacy Notice provides further information about our identity as data controller, the purposes and legal bases of processing, categories of personal data, recipients, retention periods, international transfers and the exercise of data protection rights.

Where legally required, we will provide additional information before commencing a new processing activity or sharing data for a new purpose.

End of document