Translation; in the event of any discrepancy, the German version prevails.
Between XARC Solutions SHPK, Rruga Ali Demi, Ndërtesa P.263, Hyrja 1, Ap. 1, 1000 Tiranë, Albania ("Offrano"), and the buyer. This agreement forms part of the terms and conditions for buyers and prevails over them in the event of conflict.
1. Roles
(1) Once the contact details are released, the buyer is a controller in its own right for their further processing within the meaning of Art. 4(7) GDPR (or the UK GDPR and the Swiss FADP respectively). It is neither Offrano's processor nor a joint controller with Offrano.
(2) The buyer complies with all obligations that apply to it as a controller. The following rules apply in addition; they are conditions on which the customer gave consent and are therefore binding on the buyer.
2. Purpose limitation
(1) The buyer uses the data of an enquiry solely to make the customer a quote for the requested work and, if the customer so wishes, to carry out the job.
(2) Prohibited in particular: marketing other services, adding the customer to newsletters or mailing lists, matching with other datasets for marketing purposes, requesting reviews where no job has been placed.
3. No resale, no disclosure
(1) The buyer does not sell, rent, swap or otherwise make the data available to third parties — including affiliated companies, partner businesses or subcontractors.
(2) Exempt are the buyer's own staff and service providers acting for the buyer on its instructions as processors (Art. 28 GDPR), in so far as they need the data for the purpose in clause 2. If the buyer wishes to pass the job to another business, it needs the customer's prior agreement.
(3) Contractual penalty: if the buyer culpably breaches paragraph 1, it pays Offrano, for each enquiry affected, a contractual penalty of ten times its purchase price. Further claims, in particular for damages, are unaffected; the penalty is credited against them.
4. Information at first contact (Art. 14 GDPR)
(1) At first contact, and at the latest within one month of the purchase, the buyer informs the customer in accordance with Art. 14 GDPR, at least of: who it is and how it can be contacted, that it obtained the data through Offrano, the purpose for which it processes the data, how long it keeps them, what rights the customer has and where its privacy notice can be found.
(2) A sufficient opening sentence would be, for example: "Hello, this is [company]. We received your enquiry about [trade] through Offrano. You can read how we handle your data at [link to privacy notice]." On a phone call, a spoken notice is sufficient if the full information follows by email immediately afterwards.
5. Contacting the customer
(1) The buyer makes no more than five contact attempts within 14 days of the purchase, by whatever channel (call, email, text message). After that it makes no further attempts unless the customer has replied or asked to be contacted again.
(2) The customer has consented to being contacted by the buyer by phone, text message and email. The buyer uses only the phone number and email address from the enquiry; it may not use contact details obtained elsewhere.
(3) The buyer calls only during normal business hours, does not withhold its number and complies with the law of the customer's country of residence.
(4) The buyer uses messaging services (for example WhatsApp) only if the customer suggests this channel.
6. Withdrawal of consent and objection
(1) If a customer withdraws consent or objects to being contacted — to Offrano or directly to the buyer — the buyer acts on it within 48 hours: no further contact, deletion of the data unless a statutory retention obligation applies.
(2) If the buyer receives a withdrawal directly from the customer, it informs Offrano within the same period.
(3) If the customer has already entered into a contract with the buyer, the processing necessary for that contract remains permitted.
(4) The obligations under paragraph 1 apply whether or not the buyer receives a refund. For a withdrawal via Offrano's withdrawal link within 24 hours of release, Offrano refunds the price automatically (terms and conditions for buyers, clause 6(4)); for a later withdrawal there is no refund, but the buyer must still stop all contact and delete the data.
7. Deletion
(1) If no job is agreed within six months of the purchase, the buyer deletes the enquiry data completely, including copies in inboxes, spreadsheets and phones, unless a statutory retention obligation applies.
(2) If a job is agreed, further storage is governed by the contract with the customer and the buyer's statutory obligations.
(3) On request, the buyer confirms deletion to Offrano in text form.
8. Security and data breaches
(1) The buyer protects the data by appropriate technical and organisational measures (Art. 32 GDPR), at least by personal logins, protected devices and restricting access to the people handling the enquiry.
(2) The buyer reports any breach affecting data from Offrano enquiries to Offrano without undue delay and at the latest within 48 hours of becoming aware of it, to contact@offrano.com, stating the nature of the breach, the enquiries affected and the measures taken. Its own obligations to notify the supervisory authority and data subjects (Arts. 33 and 34 GDPR) are unaffected.
9. Customers' requests and rights
The buyer answers customers' requests concerning their rights (Arts. 15 to 21 GDPR) itself and within the time limits. It assists Offrano where a customer contacts Offrano and processing by the buyer is concerned.
10. Buyers outside the EU and EEA
(1) If the buyer is established outside the EU and EEA in a country for which there is no adequacy decision of the European Commission, the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 1: transfer controller to controller) apply in addition for enquiries from the EU and EEA, with Offrano as data exporter and the buyer as data importer. Offrano makes the completed annexes available in the account.
(2) For enquiries from the United Kingdom, the ICO's International Data Transfer Addendum also applies; for enquiries from Switzerland, the adaptations for the Swiss FADP.
11. Warranties
The buyer warrants that it holds the professional and trade licences required for the work offered and that the details in its account are correct. If a licence lapses, it informs Offrano without delay and buys no enquiries in the trade concerned until then.
12. Checks and consequences
(1) Where there is reasonable suspicion of a breach, Offrano may ask how the buyer has dealt with particular enquiries. The buyer replies within seven days.
(2) In the event of breaches of this agreement, Offrano may suspend the account and terminate without notice under clause 10 of the terms and conditions for buyers.
(3) The buyer indemnifies Offrano against third-party claims, in particular from customers and authorities, arising from a culpable breach by the buyer of this agreement or of data protection law.
13. Duration
The obligations under this agreement apply for as long as the buyer processes data from enquiries, including after the business relationship has ended.