This Data Sharing Agreement ("Agreement") is entered into:

Between:

1. MyBuilder Limited ("MyBuilder") and
2. Tradesperson ("Tradesperson")

(together the "parties").

Whereas:

1. MyBuilder Limited owns and operates the website MyBuilder.com in which the Tradesperson is a registered member.
2. This agreement is to be read in addition to the MyBuilderTerms and Conditionsand Quote ToolTerms of Usethat the Tradesperson has agreed to and thePrivacy Notice该商人已阅读并理解。
3. MyBuilder has provided the Tradesperson with software known as the Quote Tool which is used by the Tradesperson to provide a quote to their customers for work to be completed. This may involve the Tradesperson collecting personal data from a data subject unknown to MyBuilder.

1. Definitions and Interpretation

   1. In this Agreement

      1. "Controller", "Data Subject", "Personal Data", "Process/Processing" and "Processor" shall have the same meanings as in the GDPR;
      2. "Core Offering" means the online platform operated by MyBuilder which enables consumers to post jobs on a website and connect with tradespeople for the purpose of completing the posted job.
      3. "C-to-C Transfer Clauses" means the Standard Contractual Clauses for the transfer of Personal Data from the EEA (European Economic Area) to third countries approved by EC Commission Decision of 27 December 2004 as set out in Schedule 1 to this Agreement;
      4. "Data Protection Laws" means any applicable law or regulation relating to the protection of personal data or the privacy of individuals, including but not limited to the GDPR and legislation implementing the requirements of the GDPR in each EU Member State.
      5. "GDPR" means European Union Regulation (EU) 2016/679.

2. Compliance with laws

   1. Both parties will comply with the Data Protection Laws in the collection and processing of Personal Data they collect themselves or receive from the other party pursuant to this Agreement.
   2. The parties acknowledge and agree that neither of them will act as a data processor on behalf of the other, and that they are each responsible for meeting their respective compliance obligations under the Data Protection Laws.

3. Warranties

   1. MyBuilder warrants that:

      1. 将在从商户处收到个人数据后14天内，按照所有适用的数据保护法，向所有数据主体提供隐私通知;and
      2. it will respond promptly to all enquiries from the Tradesperson or from Data Subjects relating to the Personal Data;
      3. it shall action all requests from Data Subjects to exercise their rights under Data Protection Laws on request from either the relevant Data Subject or from the Tradesperson.

   2. Tradesperson warrants that:

      1. it will only Process the Personal Data it receives from MyBuilder solely for the purposes described in Annex B to Schedule 1 of this Agreement;
      2. 将在从MyBuilder收到个人数据后的14天内，按照所有适用的数据保护法，向所有数据主体提供隐私通知;and
      3. it will respond promptly to all enquiries from MyBuilder or from Data Subjects relating to the Personal Data;
      4. it will action all requests from Data Subjects to exercise their rights under Data Protection Laws on request from either the relevant Data Subject or from MyBuilder.
      5. it will maintain adequate security measures to provide a level of protection appropriate to comply with the relevant Data Protection Laws.

4. International Transfers of Personal Data

   1. Where Personal Data originating from within the European Economic Area (the "EEA") or otherwise subject to the EU General Data Protection Regulation is processed by the Tradesperson outside the EEA, the Tradesperson agrees to comply with the C-to-C Transfer Clauses included in Schedule 1, whereby MyBuilder will be regarded as the Data Importer and the Tradesperson will be regarded as the Data Exporter.
   2. In the event of inconsistencies between the provisions of the C-to-C Transfer Clauses and this Agreement, or other agreements between the parties, the C-to-C Transfer Clauses shall take precedence. The terms of this Agreement shall not vary the C-to-C Transfer Clauses in any way, and the C-to-C Transfer Clauses may only be varied or terminated as specifically set out therein.
   3. 如果C-to-C转移条款被欧盟委员会或根据适用法律修订、替换或废除，双方应真诚合作订立C-to-C转移条款的任何更新版本，或真诚协商解决方案，使个人数据的转移能够在符合数据保护法的情况下进行。

5. Miscellaneous

   1. MyBuilder may share data received from the Tradesperson with its subsidiaries from time to time.
   2. 双方应负责支付因遵守本协议而产生的所有费用。

   3. Both parties shall notify each other without undue delay after having become aware of any accidental, unauthorised, or unlawful destruction, loss, alteration, or disclosure of, or access to, Personal Data ("data breach").

      1. The parties shall take appropriate measures to secure the data and limit any possible detrimental effect on the data subjects incurred as a result of the data breach.

   4. The Tradesperson will indemnify MyBuilder in respect of all liabilities, costs and expenses, suffered and incurred by the Tradesperson or MyBuilder arising from:

      1. any security or data breach caused by the Tradesperson;
      2. any negligent act or omission by the Tradesperson in the exercise of the rights granted to it under the applicable law.
   5. This Agreement shall take effect from the date of the latest signature below.
   6. This Agreement and the obligation herein shall survive the termination of any other commercial agreement entered into between MyBuilder and the Tradesperson.
   7. If any provision of this Agreement is judged by any Court of a competent jurisdiction to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect.
   8. The parties may amend this Agreement (except for the substantive provisions of the C-to-C Transfer Clauses) and any amendments to this Agreement must be in writing and duly signed by authorised representatives of each party.
   9. This Agreement may be executed in any number of counterparts (including delivery via electronic mail), each of which will be deemed an original and all of which together will be considered one and the same agreement.

Definitions

For the purposes of the clauses:

1. "personal data", "special categories of data/sensitive data", "process/processing", "controller", "processor", "data subject" and "supervisory authority/authority" shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby "the authority" shall mean the competent data protection authority in the territory in which the data exporter is established);
2. "the data exporter" shall mean the controller who transfers the personal data;
3. "the data importer" shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country's system ensuring adequate protection;
4. "clauses" shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

1. Obligations of the data exporter

   The data exporter warrants and undertakes that:

   1. The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter.
   2. It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses.
   3. It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established.
   4. It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond. Responses will be made within a reasonable time.
   5. It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required.

2. Obligations of the data importer

   The data importer warrants and undertakes that:

   1. It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.
   2. 它将有适当的程序，以便任何它授权有权访问个人数据的第三方，包括处理器，将尊重和维护个人数据的机密性和安全性。任何在资料输入者的授权下行事的人，包括资料处理者，均有义务仅根据资料输入者的指示处理个人资料。本条文不适用于获法律或规例授权或要求查阅该等个人资料的人士。
   3. It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.
   4. 本局会为附件B所述的目的处理个人资料，并有权作出保证及履行本条款所载的承诺。
   5. 资讯科技署会向资料导出者指明其组织内的联络点，授权该联络点回应有关处理个人资料的查询，并会在合理时间内就所有有关查询与资料导出者、资料当事人及当局进行真诚合作。如果数据出口商在法律上解散，或者如果双方已经这样同意，数据进口商将承担遵守第I(e)条规定的责任。
   6. At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient to fulfil its responsibilities under clause III (which may include insurance coverage).
   7. 根据数据出口商的合理要求，它将提交其数据处理设施，数据文件和文件处理所需的审查，审计和/或证明的数据出口商(或任何独立或公正的检查代理人或审计师，选择的数据出口商和数据进口商不合理地反对)，以确定遵守这些条款中的保证和承诺，在合理的通知和正常的营业时间。该请求将需要获得数据进口商所在国家的监管或监督机构的任何必要同意或批准，数据进口商将试图及时获得这些同意或批准。
   8. It will process the personal data in accordance with the data processing principles set forth in Annex A.

   9. It will not disclose or transfer the personal data to a third party data controller located outside the European Economic Area (EEA) unless it notifies the data exporter about the transfer and:

      1. the third party data controller processes the personal data in accordance with a Commission decision finding that a third country provides adequate protection, or
      2. the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU, or
      3. data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or
      4. with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the onward transfer

3. Liability and third party rights

   1. 每一方都应向其他方承担因违反本条款而造成的损害赔偿责任。当事人之间的责任限于所遭受的实际损害。惩罚性损害赔偿(即为惩罚当事人的无耻行为而造成的损害赔偿)被明确排除在外。对于因违反本条款下的第三方权利而造成的损害，每一方都应向数据主体承担责任。这并不影响数据出口商在其数据保护法下的责任。
   2. 双方同意，数据主体有权以第三方受益人的身份针对数据进口商或数据出口商，就其个人数据违反其各自的合同义务，执行本条款和条款I(b)、I(d)、I(e)、II(a)、II(c)、II(d)、II(e)、II(h)、II(I)、III(a)、V、VI(d)和VII，并为此在数据出口商的设立国接受管辖权。在涉及指称数据输入者违反规定的案件中，数据主体必须首先要求数据输出者采取适当行动，以执行他对数据输入者的权利;如果数据导出者没有在合理期限内(正常情况下为一个月)采取这种行动，数据主体可以直接对数据导入者行使其权利。数据主体有权直接起诉数据输出方，该数据输出方未能使用合理的努力来确定数据输入方能够履行其在这些条款下的法律义务(数据输出方应有责任证明其采取了合理的努力)。

4. Law applicable to the clauses

   These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause II(h), which shall apply only if so selected by the data importer under that clause.

5. Resolution of disputes with data subjects or the authority

   1. In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.
   2. The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.
   3. Each party shall abide by a decision of a competent court of the data exporter's country of establishment or of the authority which is final and against which no further appeal is possible.

6. Termination

   1. In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.

   2. In the event that:

      1. the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (a);
      2. compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import;
      3. the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;
      4. a final decision against which no further appeal is possible of a competent court of the data exporter's country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or
      5. a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs

      then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses.

   3. 任何一方都可以终止这些条款，如果(i)任何委员会在指令95/46/EC(或任何替代文本)第25(6)条下的积极充分性决定发布的国家(或其部门)的数据被转移和处理的数据进口商，或(ii)指令95/46/EC(或任何替代文本)成为直接适用于该国家。
   4. The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

7. Variation of these clauses

   双方不得修改这些条款，除非为了更新附件B中的任何信息，在这种情况下，他们将在需要时通知当局。这并不排除双方在需要时增加额外的商业条款。

8. Description of the Transfer

   The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject.
2. 数据质量和比例性:个人数据必须准确，必要时及时更新。该等个人资料必须足够、相关及就其转移及进一步处理的目的而言不过分。
3. 透明度:必须向数据主体提供必要的信息，以确保公平处理(例如关于处理目的和关于转移的信息)，除非数据导出方已经提供了这些信息。
4. Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.
5. 访问、纠正、删除和反对的权利:根据指令95/46/EC第12条规定，数据主体必须直接或通过第三方，被提供有关他们的个人信息，一个组织持有，除了明显滥用的请求，基于不合理的间隔或其数量或重复或系统的性质，或访问不需要根据数据出口国的国家的法律授予。如当局事先已给予批准，在查阅资料可能会严重损害资料输入机构或其他与资料输入机构打交道的机构的利益时，亦无须给予查阅资料，而该等利益并不会被资料当事人的基本权利及自由利益所压倒。如果合理的努力无法做到这一点，或者如果个人以外的人的权利将受到侵犯，则无需确定个人数据的来源。如个人资料不准确或根据这些原则处理，资料当事人必须能够要求改正、修订或删除有关个人资料。如有令人信服的理由怀疑有关要求的合法性，机构可在进行更正、修订或删除前，要求有关机构提出进一步的理据。当涉及不相称的努力时，无需向已披露数据的第三方通知任何更正、修订或删除。如有与资料当事人的特殊情况有关的令人信服的合法理由，资料当事人亦必须能够反对处理与他有关的个人资料。任何拒绝的举证责任由数据输入方承担，数据主体总是可以向当局提出质疑。
6. Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause II.
7. Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to "opt-out" from having his data used for such purposes.

8. Automated decisions: For purposes hereof "automated decision" shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when:

   a)

   1. such decisions are made by the data importer in entering into or performing a contract with the data subject, and
   2. 数据主体将有机会与作出该等决定的各方代表讨论相关自动决定的结果，或以其他方式向该等各方作出陈述。

   or

   b) where otherwise provided by the law of the data exporter.

Data subjects

The personal data transferred concern the following categories of data subjects:

1. Tradesperson's customers

Purposes of the transfer(s)

The transfer is made for the following purposes:

1. For the provision of a quote to the customer via the Quote Tool.
2. Analysis of trends in the building industry.

Categories of data

The personal data transferred concern the following categories of data:

1. Names;
2. Phone numbers;
3. E-mail addresses;
4. Addresses;
5. Details of work to be completed by Tradesperson, where these may be considered personal data

Sensitive data(if appropriate)

The personal data transferred concern the following categories of sensitive data:

N/A