text:
Office Workout
English Languages
For the purposes of Article 28(3) of Regulation 2016/679 (the GDPR)
(the data controller)
HeiaHeia Oy (later: HeiaHeia or H2)
Business-ID: 3115720-3
℅ Terkko Health Hub
Haartmaninkatu 14, Building 14
(the data processor)
each a 'party'; together 'the parties'
HAVE AGREED on the following Contractual Clauses (the Clauses) in order to meet the requirements of the GDPR and to ensure the protection of the rights of the data subject.
1.1. These Contractual Clauses (the Clauses) set out the rights and obligations of the data controller and the data processor, when processing personal data on behalf of the data controller.
1.2. The Clauses have been designed to ensure the parties' compliance with Article 28(3) of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
1.3. In the context of the provision of the HeiaHeia service, the data processor will process personal data on behalf of the data controller in accordance with the Clauses.
1.4. The Clauses shall take priority over any similar provisions contained in other agreements between the parties.
1.5. Six appendices are attached to the Clauses and form an integral part of the Clauses.
1.6. Appendices A-D contains details about the processing of personal data, including the purpose and nature of the processing, type of personal data, categories of data subject and duration of the processing.
1.7. Appendix E contains the data controller's conditions for the data processor's use of sub-processors and a list of sub-processors authorised by the data controller.
1.8. Appendix F contains the data controller's instructions with regards to the processing of personal data, the minimum security measures to be implemented by the data processor and how audits of the data processor and any sub-processors are to be performed.
1.9. The Clauses along with appendices shall be retained in writing, including electronically, by both parties.
1.10. The Clauses shall not exempt the data processor from obligations to which the data processor is subject pursuant to the General Data Protection Regulation (the GDPR) or other legislation.
2. The rights and obligations of the data controller
2.1. The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State (References to "Member States" made throughout the Clauses shall be understood as references to "EEA Member States") data protection provisions and the Clauses.
2.2. The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.
2.3. The data controller shall be responsible, among other, for ensuring that the processing of personal data, which the data processor is instructed to perform, has a legal basis.
3. The data processor acts according to instructions
3.1. The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A-F. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses.
3.2. The data processor shall immediately inform the data controller if instructions given by the data controller, in the opinion of the data processor, contravene the GDPR or the applicable EU or Member State data protection provisions.
4. Confidentiality
4.1. The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under the data processor's authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, such access to personal data can be withdrawn, if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons.
4.2. The data processor shall at the request of the data controller demonstrate that the concerned persons under the data processor's authority are subject to the above-mentioned confidentiality.
5. Security of processing
5.1. Article 32 GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
The data controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, the measures may include the following:
a. pseudonymisation and encryption of personal data;
b. the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services;
c. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
d. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
5.2. According to Article 32 GDPR, the data processor shall also – independently from the data controller – evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this effect, the data controller shall provide the data processor with all information necessary to identify and evaluate such risks.
5.3. Furthermore, the data processor shall assist the data controller in ensuring compliance with the data controller's obligations pursuant to Articles 32 GDPR, by inter alia providing the data controller with information concerning the technical and organisational measures already implemented by the data processor pursuant to Article 32 GDPR along with all other information necessary for the data controller to comply with the data controller's obligation under Article 32 GDPR.
If subsequently – in the assessment of the data controller – mitigation of the identified risks require further measures to be implemented by the data processor, than those already implemented by the data processor pursuant to Article 32 GDPR, the data controller shall specify these additional measures to be implemented in Appendix F.
6.1. The data processor shall meet the requirements specified in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor).
6.2. The data processor shall therefore not engage another processor (sub-processor) for the fulfilment of the Clauses without the prior general written authorisation of the data controller.
6.3. The data processor has the data controller's general authorisation for the engagement of sub-processors. The data processor shall inform in writing the data controller of any changes concerning the addition or replacement of sub-processors in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s). The list of sub-processors already authorised by the data controller can be found in Appendix E.
6.4. Where the data processor engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in the Clauses shall be imposed on that sub-processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Clauses and the GDPR.
The data processor shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to which the data processor is subject pursuant to the Clauses and the GDPR.
6.5. A copy of such a sub-processor agreement and subsequent amendments shall – at the data controller's request – be submitted to the data controller, thereby giving the data controller the opportunity to ensure that the same data protection obligations as set out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the data controller.
6.6. The data processor shall agree a third-party beneficiary clause with the sub-processor where – in the event of bankruptcy of the data processor – the data controller shall be a third-party beneficiary to the sub-processor agreement and shall have the right to enforce the agreement against the sub-processor engaged by the data processor, e.g. enabling the data controller to instruct the sub-processor to delete or return the personal data.
6.7. If the sub-processor does not fulfil his data protection obligations, the data processor shall remain fully liable to the data controller as regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR – in particular those foreseen in Articles 79 and 82 GDPR – against the data controller and the data processor, including the sub-processor.
7. Transfer of data to third countries or international organisations
7.1. Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V GDPR.
7.2. In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest.
7.3. Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses:
a. transfer personal data to a data controller or a data processor in a third country or in an international organisation
b. transfer the processing of personal data to a sub-processor in a third country
c. have the personal data processed in by the data processor in a third country
7.4. The data controller's instructions regarding the transfer of personal data to a third country including, if applicable, the transfer tool under Chapter V GDPR on which they are based, shall be set out in Appendix F.6.
7.5. The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR.
8. Assistance to the data controller
8.1. Taking into account the nature of the processing, the data processor shall implement appropriate technical and organisational measures, to enable the data controller to fulfill the data controller's obligations to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR.
This entails the data controller's compliance with:
a. the right to be informed when collecting personal data from the data subject
b. the right to be informed when personal data have not been obtained from the data subject
c. the right of access by the data subject
d. the right to rectification
e. the right to erasure ('the right to be forgotten')
f. the right to restriction of processing
g. notification obligation regarding rectification or erasure of personal data or restriction of processing
h. the right to data portability
i. the right to object
j. the right not to be subject to a decision based solely on automated processing, including profiling
8.2. In addition to the data processor's obligation to assist the data controller pursuant to Clause 6.3., the data processor shall furthermore, taking into account the nature of the processing and the information available to the data processor, assist the data controller in ensuring compliance with:
a. The data controller's obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, OFFICE OF THE DATA PROTECTION OMBUDSMAN of Finland, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons;
b. the data controller's obligation to without undue delay communicate the personal data breach to the data subject, when the personal data breach is
likely to result in a high risk to the rights and freedoms of natural persons;
c. the data controller's obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment);
d. the data controller's obligation to consult the competent supervisory authority, OFFICE OF THE DATA PROTECTION OMBUDSMAN of Finland, prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk.
8.3. The parties shall define in Appendix F the appropriate technical and organisational measures by which the data processor is required to assist the data controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in Clause 9.1. and 9.2.
9. Notification of personal data breach
9.1. In case of any personal data breach, the data processor shall, without undue delay after having become aware of it, notify the data controller of the personal data breach.
9.2. The data processor's notification to the data controller shall, if possible, take place within 72 hours after the data processor has become aware of the personal data breach to enable the data controller to comply with the data controller's obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33 GDPR.
9.3. In accordance with Clause 9(2)(a), the data processor shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that the data processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3)GDPR, shall be stated in the data controller's notification to the competent supervisory authority:
a. The nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
b. the likely consequences of the personal data breach;
c. the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
9.4. The parties shall define in Appendix D all the elements to be provided by the data processor when assisting the data controller in the notification of a personal data breach to the competent supervisory authority.
10. Erasure and return of data
10.1. Data retention policies applying to personal data processed under this agreement are defined in Appendices A-D.
11. Audit and inspection
11.1. The data processor shall make available to the data controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and the Clauses and allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.
11.2. Procedures applicable to the data controller's audits, including inspections, of the data processor and sub-processors are specified in appendices F.7. and F.8.
11.3. The data processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller's and data processor's facilities, or representatives acting on behalf of such supervisory authorities, with access to the data processor's physical facilities on presentation of appropriate identification.
12. The parties' agreement on other terms
12.1. The parties may agree other clauses concerning the provision of the personal data processing service specifying e.g. liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.
13. Commencement and termination
13.1. The Clauses shall become effective on the date, when both parties have signed the Commercial agreement and the Customer's representative has approved these terms in HeiaHeia's Admin tools.
13.2. Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation.
13.3. The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the provision of personal data processing services, the Clauses cannot be terminated unless other Clauses governing the provision of personal data processing services have been agreed between the parties.
13.4. If the provision of personal data processing services is terminated, and the personal data is deleted or returned to the data controller pursuant to Clause 11.1. and Appendix F.4., the Clauses may be terminated by written notice by either party.
14. Data controller and data processor contacts/contact points
14.1. The parties may contact each other using the contacts/contact points defined in the Commercial agreement
Appendix A:
Information about the processing (Case: the Customer is an employer)
This appendix provides detailed information about personal data processing, when the Customer is either a private or public sector employer, and the data subjects are the Customer's employees. Public sector customers may also provide services for citizens, these cases are covered in Appendix B.
A.1. The purpose of the data processor's processing of personal data on behalf of the data controller
The Customer provides an employee wellbeing program utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer. The purpose of Processing of Personal Data is to provide a wellbeing-improving service for the employees of the Customer.
A.2. The nature of the data processor's processing of personal data on behalf of the data controller
The Parties hereby agree that the scope and manner of Personal Data Processing shall be the following:
The Customer provides an employee wellbeing program utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer.
Personal data processing governed by this agreement shall consist of the following cases:
HeiaHeia is a "freemium SaaS service" consisting of a free service level and premium services provided via "communities". Personal data processing in HeiaHeia governed by this agreement takes place in the context of communities, one customer may run many communities, which may have different functionality enabled, different sets of users (data subjects), and different personal data processing related controller-processor roles.
The Act on the Protection of Privacy in Working Life (of the Finnish law, Työelämän tietosuojalaki in Finnish) limits how and what kind of personal data of employees an employer can process (and thus limits the employer's possible privacy related roles). Employers need to have a lawful purpose and a reason related to the occupation of the employee for processing any personal data of the employee, and some data types (such as health or location data) are seen as particularly sensitive, processing those is not allowed without a specific reason related to meeting obligations or rights of the employer or the employee. In HeiaHeia, such requirements are not met: an employer's data processing role is limited to special cases listed below.
HeiaHeia Oy is the Data Controller for personal data collected and processed. The legal basis for processing is end-user consent: HeiaHeia Oy becomes the Data Controller for an individual end-user's personal data upon end-user giving consent to personal data collection and processing.
In the case of an employer inviting employees to HeiaHeia via email (or HeiaHeia assisting the employer in the practical invitation process), the employer is the Data Controller for the list of employees, which includes personal data (e.g. names and emails), and HeiaHeia is a Data Processor on behalf of the employer. After the email invitations have been sent, the employer remains the Data Controller for the original list of employees, which may contain both individuals, who have given consent to HeiaHeia and individuals who have not given consent to HeiaHeia, and HeiaHeia Oy remains a Data Processor for this list of employees. For clarity, HeiaHeia Oy is the Data Controller for all user accounts and personal data collected to the accounts with no Controller-Processor relationship involving the Customer.
HeiaHeia's community product includes a possibility for activity challenges. Activity challenges may include different types of community level targets as well as a list of participants visible in the product. The same participation data may be visible in Customer reporting and can be used e.g. for rewarding for activity. The reporting includes both aggregate community data and individual data for typical rewarding cases (e.g. meeting step goal, collecting a given amount of wellbeing points, etc). Individual data is included in reporting based on a separate participation list consent by end-users, which end-users can remove (or re-enable) at any time. Individual data in community reports is defined as high level and thus non-sensitive, no individual events are included. In the case of HeiaHeia providing the Customer reporting including personal data, the Customer is the Data Controller for these reports, and HeiaHeia is a Data Processor working on behalf of the Controller.
A.3. Types of personal data about data subjects included in the processing
Personal details: Name, email address
End-user memberships and consents: community memberships (B2B community consent), team memberships, participant list consent
Admin and coach roles
Reporting content: aggregate activity data, aggregate step data, aggregate wellbeing task completion data, wellbeing point summary, team memberships, aggregate social activity
The detailed contents of this personal data register are listed in the HeiaHeia Privacy Policy: www.heiaheia.com/privacy
A.4. Data subject categories included in the processing
Admin users
A.5. Duration of the data processor's processing of personal data on behalf of the data controller
In HeiaHeia, end-users own and control their own personal data. The service includes a free subscription level, which end-users can utilise prior to joining any premium services levels, and can continue utilising, if their access to a premium service is discontinued for any reason. If the user's membership in a community is discontinued by either the user leaving the community (user removes community consent), the user being removed from the community (e.g. the user's employment status changing) or the community being discontinued (e.g. the user's employer discontinues offering the HeiaHeia service), HeiaHeia continues as the data controller of the free service.
HeiaHeia continues processing the email list of invitees as long as the commercial agreement with the Customer continues. If a user's membership in a community is discontinued, the user's data is longer included in the reporting, and HeiaHeia discontinues processing this data. If a user removes consents from the free and the premium services, the user's personal data is removed from the service and all personal data processing, for which HeiaHeia is a controller, discontinues.
Appendix B:
Information about the processing (Case: the Customer is not an employer)
This appendix provides detailed information about personal data processing, when the Customer is not an employer, and thus the data subjects are not the Customer's employees. Public sector customers may also provide services citizens as well as employees, the latter cases are covered in Appendix A.
B.1. The purpose of the data processor's processing of personal data on behalf of the data controller
The Customer provides a wellbeing promotion program utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer. The purpose of Processing of Personal Data is to provide a wellbeing-improving service for end-users.
B.2. The nature of the data processor's processing of personal data on behalf of the data controller
The Customer provides a wellbeing promotion program utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer.
The Act on the Protection of Privacy in Working Life (of the Finnish law, Työelämän tietosuojalaki in Finnish) limits how and what kind of personal data of employees an employer can process (and thus limits the employer's possible privacy related roles). Employers need to have a lawful purpose and a reason related to the occupation of the employee for processing any personal data of the employee, and some data types (such as health or location data) are seen as particularly sensitive, processing those is not allowed without a specific reason related to meeting obligations or rights of the employer or the employee. In HeiaHeia, such requirements are not met: for employees, the Customer's data processing role is limited to special cases listed in Appendix A; for Customers that are not employers, the role is typically the data controller.
1) Email invitations
In the case of the Customer inviting users to HeiaHeia via email, the Customer is the Data Controller for the list of, which includes personal data (e.g. names and emails) and HeiaHeia is a Data Processor on behalf of the Data Controller.
After end-users have given consent for data processing, the Customer remains the Data Controller for the original list of invitees, which may contain both individuals, who have given consent and individuals, who have not given consent, and HeiaHeia remains a Data Processor for this list.
2) Personal data created after consent
HeiaHeia is a "freemium SaaS service" (a service that consists of for-free and paid-for service levels), where Controller-Processor roles can be depicted with the Community Interface Model, as described below. The complete model includes elements outside of the scope of this agreement, but are described below for clarity. The scope of this agreement is data processing by HeiaHeia on behalf of the Customer, as described below. In the following, the term "Partner" refers to the Customer.
Background of the Community Interface Model:
The pivot point of this model is The Community Interface, which forms a Controller Demarcation Line (a separation line for separate registers of personal data with separate data controllers). The Controller Demarcation Line indicates the point at which this responsibility (controllership) changes hands.
The purpose of this model is to reconcile and clarify data control and data processing in the case of a free / B2C relationship that pre-dates the Partner (Customer) relationship, and/or an end-user wishing to continue using the free / B2C service after severing ties with the Customer. The Community Interface creates the legal and technical space to allow (repeatedly) shifting data controllership.
Description of the Community Interface model:
HeiaHeia is the data controller for all data held solely within its servers. This controllership can be initiated by the end-user (e.g. through the free service). As the model shows, this relationship may commence before any relationship with the Customer.
HeiaHeia provides a Community Interface that crosses the Controller Demarcation Line. In essence, the Community Interface encapsulates the technical and legal controls that allows HeiaHeia to transfer and then regain controllership between Customers. When HeiaHeia provides access to data held within its servers through the Community Interface, the Partner (Customer) becomes the controller and HeiaHeia becomes a data processor on behalf of the Partner. This shift happens by granting the Partner the ability to use/extract the data for its own purposes. The double-sided arrow in the model indicates the ability for controllership of the data to cross back over the demarcation line. Securing this ability is handled in both the Privacy Policy and the DPA.
The Community Interface serves as the "control center" for Partners and allows an easy way for Partners to manage the content of the service as well as gather, analyse, and modify well-being data for research purposes as well as for tracking and/or improving the well-being of data subjects.
Linking of Personal Data to the Community Interface (disclosure) requires end-user consent.
The functionality offered by and content managed by the Community Interface maybe be adjusted by HeiaHeia in accordance with the Commercial Agreement and end-user consent. HeiaHeia can gradually extend the functionality of The Community Interface without disturbing the controller/processor balance.
HeiaHeia shall remain the controller of the data that is collected by HeiaHeia prior to the Partner relationship. HeiaHeia shall have the right to extract all and any personal data from the Interface and use it for the original purpose of data processing as described in the end-user consent (i.e. extracting end-user wellbeing data for providing the free service). For clarity, HeiaHeia does not have any rights for any intellectual property or other content of the Partner or customers of the Partner. HeiaHeia will act as a controller for any data that it extracts from the Interface. This establishes the ability to cross back over the Controller Demarcation Line.
HeiaHeia shall be the sole controller of the data retained in its own systems, outside of the Community Interface. HeiaHeia shall have the right at any point in time to dispose, block, modify or otherwise use this data.
The end-user may at any time remove consents for different service elements, which results in removing personal data from those service elements.
3) Premium service discontinued
In the case of the paid-for service being discontinued for an end-user for whatsoever reason (Partner discontinuing, end-user discontinuing the use of the HeiaHeia premium service), the end-user continues as a user of the free service level of HeiaHeia, for which HeiaHeia is the sole data controller, and the Partner's controllership ends. For clarity, the end-user may at any point discontinue using the free service level (remove all personal data from HeiaHeia), which causes the personal data to be removed from all parts of the service and from all registers within the scope of HeiaHeia.
B.3. Types of personal data about data subjects included in the processing
End-user's activity data, wellbeing tasks completed, programs started, surveys answered, and other data entered to the service by the user in the scope of the premium community
B.4. Data subject categories included in the processing
B.5. Duration of the data processor's processing of personal data on behalf of the data controller
In HeiaHeia, end-users own and control their own personal data. The service includes a free subscription level, which end-users can utilise prior to joining any premium services levels, and can continue utilising, if their access to a premium service is discontinued for any reason. If the user's membership in a community is discontinued by either the user leaving the community (user removes community consent), the user being removed from the community or the community being discontinued (e.g. the Customer discontinues offering the HeiaHeia service), HeiaHeia continues as the data controller of the free service, and the Customer's controllership ends.
HeiaHeia continues processing the email list of invitees as long as the commercial agreement with the Customer continues.
If a user removes consents from the free and the premium services, the user's personal data is removed from the service and all personal data processing, for which HeiaHeia is a controller, discontinues.
Appendix C:
Information about the processing (Case: the Customer is a reseller, whose customer is an employer)
This appendix provides detailed information about personal data processing, when the Customer is a reseller, providing wellbeing challenges or wellbeing coaching to either private or public sector employers, and the data subjects are employees. Resellers for the public sector may also provide services for citizens, these cases are covered in Appendix D.
C.1. The purpose of the data processor's processing of personal data on behalf of the data controller
The Customer is a reseller providing employee wellbeing programs utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer. The purpose of Processing of Personal Data is to provide a wellbeing-improving service for the employees of the Customer's customers.
C.2. The nature of the data processor's processing of personal data on behalf of the data controller
The Customer is a reseller providing employee wellbeing programs utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer.
In the case of an Employer inviting users to HeiaHeia via email, the Employer is the Data Controller for the list of, which includes personal data (e.g. names and emails), the Customer is a Data Processor on behalf of the Data Controller, and HeiaHeia is a Sub-Processor on behalf of the Customer.
After end-users have given consent for data processing, the Employer remains the Data Controller for the original list of invitees, which may contain both individuals, who have given consent and individuals, who have not given consent, the Customer remains a Data Processor for this list, and HeiaHeia remains a Sub-Processor.
C.3. Types of personal data about data subjects included in the processing
C.4. Data subject categories included in the processing
C.5. Duration of the data processor's processing of personal data on behalf of the data controller
Appendix D:
Information about the processing (Case: the Customer is a reseller, whose customer is not an employer)
This appendix provides detailed information about personal data processing, when the Customer is a reseller, providing wellbeing challenges or wellbeing coaching to its customers (later: 'end-customer', 'end-customers'), and the data subjects are not employees of the end-customer. Resellers for the public sector may also provide services for public sector employees, these cases are covered in Appendix C.
D.1. The purpose of the data processor's processing of personal data on behalf of the data controller
The Customer is a reseller providing wellbeing promotion programs utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer. The purpose of Processing of Personal Data is to provide a wellbeing-improving service for end-users nominated by the end-customer.
D.2. The nature of the data processor's processing of personal data on behalf of the data controller
The Customer is a reseller providing wellbeing promotion programs utilising the HeiaHeia digital service provided by HeiaHeia Oy, based on the commercial terms set in the Commercial agreement between HeiaHeia Oy and the Customer.
In the case of an end-customer inviting users to HeiaHeia via email, the end-customer is the Data Controller for the list of, which includes personal data (e.g. names and emails), the Customer is a Data Processor on behalf of the Data Controller, and HeiaHeia is a Sub-Processor on behalf of the Customer.
After end-users have given consent for data processing, the end-customer remains the Data Controller for the original list of invitees, which may contain both individuals, who have given consent and individuals, who have not given consent, the Customer remains a Data Processor for this list, and HeiaHeia remains a Sub-Processor.
HeiaHeia provides a Community Interface that crosses the Controller Demarcation Line. In essence, the Community Interface encapsulates the technical and legal controls that allows HeiaHeia to transfer and then regain controllership between Customers. When HeiaHeia provides access to data held within its servers through the Community Interface, in the case of this Appendix D, the end-customer becomes the the controller, the Customer becomes a data processor on behalf of the end-customer, and HeiaHeia becomes a sub-processor on behalf of the Customer. This shift happens by granting the end-customer the ability to use/extract the data for its own purposes. The double-sided arrow in the model indicates the ability for controllership of the data to cross back over the demarcation line. Securing this ability is handled in both the Privacy Policy and the DPA.
The Community Interface serves as the "control center" for end-customers and Partners and allows an easy way for end-customers and Partners to manage the content of the service as well as gather, analyse, and modify well-being data for research purposes as well as for tracking and/or improving the well-being of data subjects.
In the case of the paid-for service being discontinued for an end-user for whatsoever reason (Partner discontinuing, end-user discontinuing the use of the HeiaHeia premium service), the end-user continues as a user of the free service level of HeiaHeia, for which HeiaHeia is the sole data controller, and the end-customer's controllership ends. For clarity, the end-user may at any point discontinue using the free service level (remove all personal data from HeiaHeia), which causes the personal data to be removed from all parts of the service and from all registers within the scope of HeiaHeia.
D.3. Types of personal data about data subjects included in the processing
D.4. Data subject categories included in the processing
D.5. Duration of the data processor's processing of personal data on behalf of the data controller
Appendix E:
Authorised sub-processors
On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors:
Name (Country)
Description of Processing
makandra GmbH (Germany)
Data hosting
Datadog, Inc / makandra GmbH (Germany)
Log file hosting
Amazon Web Services EMEA Sarl (Ireland)
Log file hosting, image and GPX file hosting
Finnchat Oy (Finland)
The data controller shall on the commencement of the Clauses authorise the use of the above-mentioned sub-processors for the processing described for that party. The data processor shall not be entitled – without the data controller's explicit written authorisation – to engage a sub-processor for a 'different' processing than the one which has been agreed upon or have another sub-processor perform the described processing.
Appendix F:
F.1. Authorised sub-processors
This Data Processing Agreement and the Commercial Agreement form the data controller's final and complete instructions at the time of execution of the DPA for the Processing of Personal Data. Any additional or alternate instructions must be agreed on separately.
F.2. Security of processing
The processing involves a large volume of personal data. The data types that are processed are not classified as sensitive or medical (mostly activity data that is designed to be shared with other users).
The data processor shall hereafter be entitled and under obligation to make decisions about the technical and organisational security measures that are to be applied to create the necessary (and agreed) level of data security.
The data processor shall however – in any event and at a minimum – implement the following measures that have been agreed with the data controller:
State of the art technical security measures applied, including pseudonymisation and encryption of personal data, whenever applicable
3rd party security audits commissioned systematically
Architecture and processes to ensure high availability and ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
Extensive logging of user and admin actions applied
Protection of data during storage:
The Data Processor's applications are deployed onto a Private VLAN in a hosting platform that makandra GmbH provides. It is a private network that is separate from the office network.
The configuration addresses security by limiting outside access to minimum, applying firewalling for each server instance and deploying services to subnets that have limited access to each other and to outside networks.
Limiting access from outside: The only access points to the private network are the load balancers. These access points can be found from the above diagram.
Network access: SSH connections are done with personal SSH keys and only a few people responsible for system operations are granted access. Each SSH session is logged.
Firewalls: Each service type has their own security rules that determines which other services can connect to selected ports. E.g. application servers allow HTTP and HTTPS traffic to ports 80 and 443 only from load balancers.
Security: We operate a server cluster optimized for data and failure safety with multiple machines in order to be able to guarantee smooth operation even in case of hardware failures. We maintain the host systems regularly and install available security updates.
Makandra GmbH is certified according to TISAX VDA-ISA 3.0.
Data centre:
The data centre has all relevant security and precautionary mechanisms in place. Among them are the following:
Heat and smoke sensors
Sensors for particle analysis
Extinguishing systems in several zones
Cooling system with redundancy (n+1)
Power supply via two power feeds (A+B)
24/7 personnel for remote hands
Video surveillance system with motion sensors
Biometric fingerprint scanners and/or access cards with personal PIN
Automatic alarm systems with direct connection to the security service
All hardware servers have redundant power supply units as well as redundant hard disk arrays (RAID) - thus failures are further limited.
Fault tolerance:
With this high-availability architecture there is no so-called "single point of failure" and enables a maximum of availability - in the past 12 months an availability of over 99.99% has been achieved.
In case of one or multiple servers breaking, we have configured auto-scaling procedures that are monitoring the health of the servers and if problems are detected such as non-responsive server instances, the malfunctioning instance is automatically removed and replaced with a new instance.
If needed, also auto-scaling could be enabled for the situations where we would get higher load from increase in http requests. In this situation the auto-scaling would start new instances and add them to loadbalancers to share the load between additional computing units.
Database is provided with dedicated instances on physically separate servers for maximum reliability and performance and we have automatic deactivation of a server in case of local malfunction. Setup includes two database servers at different physical locations to achieve redundancy. Thus if one of the servers goes offline (failure, outage, planned maintenance) the databases are still available and usable.
Backups:
We copy backups for disaster recovery cases via an encrypted connection to a separate fire compartment. These backups include database dumps or exports, static assets such as images or files uploaded to the application. We practice the recovery of backups on a regular basis to ensure that the process runs smoothly in an emergency. Data uploaded by the user (GPX files, pictures) are held in AWS S3 and are not included in extraneous backup procedures.
F.3. Processing location
The processing involves a large volume of personal data.
Processing of the personal data under the Clauses cannot be performed at other locations than the following without the data controller's prior written authorisation:
Data processor and sub-processor offices and employee remote work locations inside the European Union.
F.4. Instruction on the transfer of personal data to third countries
Personal data hosting and processing of the HeiaHeia service takes place inside the European Union.
Customer support tickets (including personal data in the form of email address and ticket content), are managed with a support portal that runs on HubSpot, a service hosted in the US. HubSpot is GDPR compliant.
F.5. Procedures for the data controller's audits, including inspections, of the processing of personal data being performed by the data processor
To ensure GDPR compliance, the data processor runs an annual process, including a DPIA, where it consults external experts, when necessary. The DPIA reports shall be made available for the data controller.
If the data controller requests, the data processor shall at the data controller's expense obtain an auditor's report from an independent third party concerning the data processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses.
Energy for individuals,
team spirit for organizations!
© 2023 HeiaHeia – All rights reserved


text:
Mattel Essay
Mattel's China Experience: A Crisis in Toyland Case Study Analysis Introduction Mattel is a company that has been around for decades and has long relied on its brand name to sell toys. It leveraged the post World War Two economic boom to become a giant in the toy industry. The rise to the top of the industry included many management changes and controversy along the way. Having a positive public image and portraying characteristics such as caring about the safety and quality of their products has been the cornerstone of their success. Being able to acquire and maintain partnerships in the entertainment industry to market products, as well as solidify product image has also been a large part of the success for Mattel. Evolution of the electronic and digital media age, along with slow response to market change, and product recalls have proved to be an equation for the decline and struggles of this toy manufacturing giant. The technological factor in their remote environment has played a big role in taking business away from the consumer purchasing of toys. A technological breakthrough can have a sudden and dramatic effect on a firm's environment (Pearce, J.). Synopsis of the Situation Mattel was once a giant not only in the toy industry, but across all industries worldwide. Damage to their image and brand name, decline in stock prices, impact of a changing external and global environment, slow market evolution, and product recall issues have sent the company on a rapid decline since 2007. (Trouble in Toyland). Key Issues Children across the world are not playing with traditional toys as much as in the past (Berk, C). The brand image of Mattel has taken a serious hit due to unsafe products and the product recalls. Changing external environment and the progression of the electronic media market has caused a decline in traditional toy sales. Define the Problem
A. G. Gilbert Case
Toy stores were more interested in the low price products than a high quality products which made A.C. Gilbert company to lose their competitive advantage. 3. Discuss how the societal environment in the US culture was changing. How did the changes affect the toy industry and Gilbert? A.C. Gilbert company has suffered a big loss in sales and profit.
Pop Culture During the Great Depression
Known also as Black Tuesday, October 29th left stockholders shattered with recorded losses reaching $40 billion dollars (Kelly, n.d.). Many banks and financial institutions began collapsing which led to irretrievable, uninsured deposits and savings. Fearing further loss, people began spending less which led to a decrease in production and an increase in unemployment. As companies began to fail, the government devised the Smoot-Hawley Tariff in order to protect American businesses. The Tariff placed high taxes on imports leading to a decline in international trade.
How Does Methamphetamine Affects The Body
Drugs have been out of control in the past few years, and the numbers have just continued to grow. One of the main drugs being abused is Methamphetamine. In today's society Methamphetamine has sky rocketed to abusers too people cooking this drug in their own homes the numbers are outrageous. Methamphetamine is a horror drug once you use it your addicted. Meth addiction harms the body in a horrific way, the drug is made up of chemicals that can kill a person also leading to the addiction, and in order to get over the drug it's a continuous battle the person must want it for themself, and have the strength over their own mind they can't be weak or they will fail and relapse.
The Riots in England 2011
Many believe that the budget cuts had the biggest impact on proletarian families due to the fact that they would suffer as they had not the money to pay substantial amounts for things that, due to the cuts, increased in price. However, others believe that it was other factors that caused the outbreak of riots such as technology, a lack of education in the hooligans who did riot and some even believe that the rioters are simply bad people. The government have been blamed several times for the outbreak of the riots in London. There are many reasons for this and one is the very cornerstone of the outbreak – the death of Mark Duggan. On Thursday 4th August, Duggan was killed by the Metropolitan police force.
John Major Government Case Study
John majors government came into office after the downfall of Margret Thatcher, which ultimately created divisions within the party. Not only did the party suffer from the internal conflict but also faced the problems of the recession after the 'Lawson boom'. In order to stabilise the economy he joined the ERM getting a good deal but ultimately resulting in 'black Wednesday' causing Major to raise interest rates to 15%. This was political suicide and he soon lost the support of the press we had once relied so much on to get re-elected in 1992. The housing market also plummeted leading to negative equity, which the majority of the working class could not afford resulting in the repossession of their houses combined with the drastic increase in unemployment Britain was in a mess.
J.C. Penney's Fair and Square Pricing
This downward spiral continued during the recession of 2008 thru 2011 with many stores old, disorganized and dated which left a feeling of a dated brand. Ron Johnson, CEO of J.C. Penney knew a change was necessary after the second quarter earnings were reported to Wall Street in August 2012 after several years of changes within J.C. Penny to survive in the retail department store market. It was clear that the performance of the company did not meet the expectations of the stockholders, therefore demanding immediate action and change to the existing business strategy. This was very disappointing as a recent change to the business model was done six months earlier by Johnson and his management team. The major "repositioning" was a change in the existing price strategy of high-low pricing to a new "Fair and Square" pricing commonly used by department stores.
Examine Different Sociological Views on Changes in the Experience of Childhood in the Past 50 Years or so
Sue Palmer is another sociologist that believes the increasing impact of technology and the media over the past 50 years is causing childhood to deteriorate. Palmer argues that in modern society there is a 'toxic childhood' due to an excessively screen-based culture which she feels is why there has been an increase in developmental conditions in children. She has reasons for some of these conditions, for example ADHD could be caused to screen saturation as the rapid changes of images on TV can make an immature brain go into overdrive resulting in the child seeing real life as boring. Palmer also believes the increase in screen-based activities has made it more difficult for children to develop literacy skills. Also Palmer
The Impact of the Recession on Britain's Young People
It has continued to be one of the most crucial challenges facing the country. It has recently been described by the Archbishop of Canterbury as an increasingly "toxic and corrosive problem." As a result of the recession, a growing number of our youths haven't had the opportunity to enter into the labour market. This was due to the fact that during the recession period many companies around the country (both within the private and public sector) resort to cutting the hours and freezing the pay of their existing employees rather than cutting their jobs, thus leading to a recruitment freeze. Hence, this meant the vast majority of young people leaving education were not able to obtain any form of employment. Furthermore, most employers are less likely to employ people with little or no experience or skill and unfortunately young people would fall into this category and so would be left without jobs.
How Did The Great Depression Affect The Economy
The Great Depression changed and effected Americans and the economy. Millions of Americans lost their jobs and homes. The economy went though a lot of failure of meeting financial obligation in banking and in trading. Because of this Europe and many other nations were set back from many of our abilities to help with their broken economies as well.The unemployment in the Depression was very scary. The Depression started with the market crash of 1929.
What Caused The Great Depression Essay
This was because unemployment was rising fast (Doc. E), which meant people were spending less to the point that it caused a huge shortage of income to many companies and businesses. The stock exchange was a replacement of work, where people risked their money on what they speculated would do well (Doc. F). Since the unemployment rate was high and businesses were failing, the stock market went through a dramatic crash causing many people and companies to go bankrupt.
More about Mattel Essay

redpajama_set_name: RedPajamaCommonCrawl


Interested in studying abroad? CE has specifically developed study abroad opportunities at the sites listed below so that students can take coursework there and transfer credits back to Purdue. With such preplanned programs, students can more easily make decisions about planning to study abroad in a Fall- or Spring-semester. Some sites offer Summer opportunities but not all. Please plan to meet with a CE study abroad advisor to confirm your plans.
The following links will give you a basic overview about each program as well as eligibility, Purdue credit, estimated costs, financial aid, application deadlines and other resources. Eligibility includes a GPA Requirement. CE prefers that students study abroad in their junior or senior year.
Course transferability options are listed. Please check for new additions every semester. Note: Although substitutions are listed, CE reserves the right to further evaluate coursework to confirm enrollment priorities.
Please check for new additions to this list every semester.
For more information on these programs, please contact the Study Abroad Office by phone (765) 494-2383 or email studyabroad@purdue.edu. That office is located in Young Hall, room 105. They sponsor a Study Abroad Fair every semester in the first week or two of school for students to talk with representatives from various programs.
You can also visit the Global Engineering Program office (GEP) in Wang Hall on the 4th floor.
To encourage participation, CE will provide a $1000 scholarship to the first 2 students who apply and are accepted to study at one of these institutions. Additional funding opportunities are listed.
GEP serves the students, staff and faculty of Purdue University College of Engineering. Comprehensive undergraduate- and graduate- academic programs are offered in education, research and learning. The focus is on diversity, experience, reputation and effective solutions to the global engineering challenges of the 21st century and beyond. Students are welcome to contact GEP with questions about study abroad by visiting the GEP office in Wang Hall 4th floor, going to the GEP website, or by emailing gep@purdue.edu.
Scroll all the way to the bottom of a study abroad program web page and click on the "Search for Returnees Now" button. You will see a list of Purdue students who have participated in a program and are willing to be contacted. If you get no results, you can use the search form to find people who studied in the country you are interested in.
If you find that you need supplemental funds to pay for study abroad, the first place to look is the Other Funding for Overseas Study on the Study Abroad Office website. This is a comprehensive list.
President Mitch Daniels sponsors a Purdue Moves Study Abroad Scholarship every year. Purdue will offer up to $3,000 for a semester-long experience earning at least 12 credits to eligible Purdue students applying for a credit bearing, Study Abroad approved program. This is for undergraduates only. Please note: students cannot travel to their home country.
NISO, which is a part of the Purdue University Honors College, is available to serve all Purdue students. They assist students who have excellent academic records in their scholarly development to apply for any of the 13 highly selective national and international awards that require a nomination by Purdue. To explore the major scholarships and fellowships NISO coordinates, visit the NISO website, go to Duhme Hall, room 134 or call 496-3389 to schedule an appointment.
Scholarships that provide funding for study abroad expenses.
The application process for these scholarships may require more advance preparation than traditional scholarships.


text:
Home » Media » National » News » UP Election 2017 » You are reading »
Yogi Adityanath: 5 most controversial statement made by new CM of Uttar Pradesh
Rajat Pandey March 19, 2017 Yogi Adityanath: 5 most controversial statement made by new CM of Uttar Pradesh2017-03-19T16:25:53+00:00 Media, National, News, UP Election 2017 No Comment
Yogi Adityanath is a surprising choice for the BJP for Uttar Pradesh Chief Minister.
Adityanath is no stranger to controversy. In fact, for a good chunk of his political career, he has stayed in the front pages for his controversial remarks.
Also Read: Lok Sabha Election 2019: It's too soon to say anything about Modi Victory
Yogi Adityanath, Hindi Yuva Vahini.
Here are the top 5 most controversial statements made by Adityanath:
1) On Minorities:
"There have been 450 riots cases in West UP in two-and-a-half years of Samajwadi Party rule because the population of a particular community is rising manifold. Why are there no riots in Eastern UP? You can easily understand. In places where there are 10-20% minority population, stray communal incidents take place. Where there are 20-35% of them, serious communal riots take place and where they are more than 35%, there is no place for non-Muslims."
2) On Kairana 'Exodus':
"Yogi is not talking about today, Yogi is talking about future. Exodus is a very big issue for us, BJP will not let western Uttar Pradesh turn into another Kashmir."
3) On Mother Teresa:
"Mother Teresa was part of the conspiracy to Christianize India. Hindus were converted in the name of doing service and then converted."
4) On Yoga:
"Lord Shankar was the biggest Yogi who started Yoga. Mahadev lives in every particle of this country. So those who want to avoid Yoga and Lord Shankar can leave Hindustan."
5) On Shah Rukh Khan:
"Shah Rukh Khan should remember that if people would boycott his films, he would also have to wander in the streets like a normal Muslim… These people are speaking in the language of terrorists. I think there is no difference between the language of Shah Rukh Khan and Hafiz Saeed."
Also Read: Uttar Pradesh CM: BJP picks Yogi Adityanath as new Chief Minister of Uttar Pradesh
Source: Times Of India
https://thebeepingbell.com/yogi-adityanath-5-most-controversial-statement-made-by-new-cm-of-uttar-pradesh/https://thebeepingbell.com/wp-content/uploads/2017/03/yogi-adityanath-759-e1489920728511.jpghttps://thebeepingbell.com/wp-content/uploads/2017/03/yogi-adityanath-759-150x150.jpg 2017-03-19T16:25:53+00:00 Rajat PandeyMediaNationalNewsUP Election 2017Controversy,Exodus,Kairana,Mother Teresa,Muslims,Shah rukh khan,Yoga,Yogi AdityanathYogi Adityanath is a surprising choice for the BJP for Uttar Pradesh Chief Minister. Adityanath is no stranger to controversy. In fact, for a good chunk of his political career, he has stayed in the front pages for his controversial remarks. Also Read: Lok Sabha Election 2019: It's too soon to say...Rajat PandeyRajat Pandeyrajatrexton.cs@gmail.comAdministratorThe Beeping Bell
Controversy, Exodus, Kairana, Mother Teresa, Muslims, Shah rukh khan, Yoga, Yogi Adityanath
Salman Khan signs deal with Amazon Prime Video
Imtiaz Ali's film Starrer Shah Rukh Khan Anushka Shrama shoot begins; both looking fab in Punjabi avatar
After Gutkha and Cigarettes, Yogi Government Bans Jeans and T-Shirt in UP Govt Colleges
It's just a partial relief but a step in the right decision; said Rahul Gandhi on UP farmers loans wave offs
Good news for UP farmers as Yogi Adityanath govt cuts off Rs 36,359 crore loan; Akhilesh not happy
« Yogi Adityanath is UP CM: Will pressure of governance have sobering influence on Adityanath?
IT: Cognizant may cut more than 10000 Jobs »


Previous postDoes every girl need a Sweet Talkin' Ken?
:::chuckle::: I just noodled in this direction as well, though with a different take. I am still persistently, doggedly knocking out those goals… but perhaps I just need 'the moment' right now.
You've given me a lot to consider. Thanks.


text:
Fidelin Kiln
Fidelin Kiln Guadeloupe, France
This kiln, of which many remains can still be seen, was created by Jean-Pierre Fidelin shortly after 1760. He acquired a second pottery with his son at Trois-Rivières in 1785.
In the late eighteenth century, it would appear that pottery production focused almost exclusively on sugar molds and refinery pots. This production was required to meet the high demand from sugar refineries. Indeed, each refinery used around three thousand sugar molds, and renewals for regular breakages became a significant business outlet.
Sugar molds, which were over 50 cm in height, were produced in large kilns. Clay was brought in from Terre-de-Haut and worked by slaves on the pottery site. By 1811, the number of enslaved people working on the plantation had risen to 121, and would rise to 130 by 1837.
Not only were these enslaved workers employed as potters, they were also responsible for transporting the clay and the finished articles using oar-propelled canoes. Some were employed to cut the vast quantities of wood required for pottery production, while others loaded the kiln or worked the clay. Slaves were housed in some thirty cabins made of wood or wattle and daub, with thatched roofs.
From 1815 onward, when the market for white sugar collapsed, the pottery diversified its production. Flower pots, jars, pots with handles, and also tiles were subsequently produced in the Fidelin kiln. During the second half of the nineteenth century, operations became intermittent and then ceased permanently toward the end of the century.
Fidelin Kiln is part of the Slave Route—Traces of Memory network organized by the Conseil Général of Guadeloupe.
Sugar refining complex
More from Fidelin Kiln:


The Murray is the longest navigable river in Australia and the third longest in the world. Melting snow feeds the Upper Murray in the Australian Alps. But that is not the only source of water for this magnificent stream.
Howlong Caravan Park is nestled beside a shady branch of the Murray River. A short walk will take you to one of two river beaches, each set within beautiful parkland with facilities. An ideal place for fishing and swimming.
Riverbend Caravan Park is located in serene natural bushland settings on the bank of the mighty Murray River in the very beautiful town of Renmark in South Australia.
Great Aussie Holiday Park is located on the banks of Lake Hume and is your complete outdoor adventure playground - created to offer you the ultimate holiday experience. Large, grassy caravan & camping sites & cabins to suit all budgets.
Quiet, relaxed, just off the beaten track, Rich River Tourist Park - hidden away from the crowds but ever so close to everything.
The Bundalong Holiday Resort is situated on the Murray Valley Highway in the tranquil village of Bundalong, just a short drive 10 minute from the tourist centre of Yarrawonga and beautiful Lake Mulwala.
Nestled in a quiet and serene setting only metres from the banks of the Murray River and only a short walk from the town centre, Berri Riverside Holiday Park offers affordable, luxury accommodation and shaded grassy powered, or ensuite sites.
Time slows down on the riverside. You'll instantly unwind the moment you enter the park and slip straight into 'Holiday Mode'.
The beautiful oasis of River Bend is set in bushland near historic Echuca. You'll find us nestled on the banks of the Goulburn River, and close to the mighty Murray River.
a range of ensuite cabins or one of many powered and unpowered sites.
Murray Bridge Tourist Park has newly developed large drive-thru powered sites, suitable for big rigs. There is a range of cabin accommodation available, ranging from Budget, or our brand new 1 Bedroom & 2 bedroom Executive Units.
Set in the quiet friendly location, this family owned and operated Holiday Park is positioned perfectly in the heart of Moama. Close to the Murray River, clubs, shops and a short walk over the bridge to the Historic Port Precinct. Enjoy your stay with us.
Boomerang Way Tourist Park is a peaceful shady park with abundant bird life, set on 12 acres just 500 mtrs north of the town centre and the majestic Murray river.
Tocumwal is located on the Murray River, 150km NW of Albury and 270km N of Melbourne. BIG4 Tocumwal Tourist Park is just a short walk from the centre of town.
Buronga Riverside Tourist Park is situated right on the lovely Murray River, in a tranquil setting watching the paddle steamers by day and the reflection of the Mildura lights by night.
Waikerie Holiday Park has helpful friendly staff who will make you feel most welcome. Waikerie is situated on the banks of the beautiful Murray River, a mere 179 kms from Adelaide. The Caravan Park is situated just metres from the river.
Conveniently located on Wagga Road and adjacent to a recreation reserve, the Albury All Seasons Tourist Park is ideal for you Albury stopover.
Avoca Dell Tourist Park provides country living on the outskirts of the rural city of Murray Bridge, overlooking the River Murray, and located in peaceful and scenic surrounds.
BIG4 Albury Tourist Park is a friendly, family operated caravan park located only 4 kms to Albury's city centre.
Active Holidays Albury offers a range of accommodation options from deluxe en-suite cabins, powered drive-through en-suite caravan sites, to powered or un-powered camping sites.
The Milang Lakeside Caravan Park is located directly across the road from the Lake Alexandrina foreshore reserve, just a few short steps from the beach and the jetty.
Wymah Hideaway is a small family run caravan park with big water views, situated at the end of the road adjacent to Wymah Ferry.
Sunlands Caravan Park provides powered and unpowered sites and tent sites. There is a service station and general store, with every nicknack you can think of for sale, so you don't need to drive anywhere to get what you need.
Come and relax by the Murray! The Wood Wood Caravan Park provides shady grassed sites where you can enjoy the tranquility of this beautiful location.
Raymond Deed Veteran Retreat welcomes Veterans, Peacekeepers, Service Personnel and Emergency Services Personnel. Family and friends are also welcome if accompanying the above.
Barham Caravan & Tourist Park can be found in the heart town on the banks of the mighty Murray River. River front sites & cabins. Ensuites, powered & unpowered sites. In town close to everything- shops, club,restaurants & sporting facilities.
The Clearwater by the Upper Murray Caravan Park is a peaceful, privately owned, pet friendly park, opposite the magnificent Murray River in the small town of Tintaldra.
Numurkah Caravan Park is a neat, tidy park on the banks of the Broken Creek. It is situated just a few metres walk from the shops in Numurkah.
Just 3 kms from Wodonga town centre, BIG4 Borderland is perfect for exploring local historic towns, Rutherglen Wineries and Lake Hume.
Murray River Hideaway Holiday Park is nestled on the edge of the Barmah National Park and only a stone's throw from the Mighty Murray River.
BIG4 Riverside Swan Hill is situated on the banks of the mighty Murray River in Swan Hill Victoria. Begin your stay with a cruise on the river on an original paddlesteamer or sample a local drop at one of Swan Hill's wineries.
Coomealla Club Motel and Caravan Park is a great place to relax and enjoy the sights with everything you need just a short walk away.
Situated on the foreshore of Lake Hume and only minutes away from the border towns of Albury Wodonga, Lake Hume Tourist Park is a great place to stay for fishing, boating and other water sporting activities.
Barham Lakes Caravan Park offers the perfect place to stay on the river. Positioned in a natural bush setting, enjoy the peace and tranquillity beside the magnificent red gums.
Hill Top Resort is set among 33 acres of beautifully kept grounds and provides motel and cabin accommodation as well as private ensuite-sites.
Murray River Caravan Park & General Store is a nice van park with good grassy sites & plenty of shade trees. Access to the sites is good. The amenities are old but clean. Staff are very helpful & obliging.
Morgan Riverside Caravan Park is beautifully situated close to the Murray River at Morgan, within walking distance of the town centre. Relax in this pleasant environment and enjoy a round of mini golf, hire a canoe or knee-board.
Torrumbarry Weir Holiday Park is an oasis, with helpful, friendly staff, green, shady sites and plenty to do.
Khancoban Lakeside Caravan Resort is just a short walk to Kosciuszko National Park Information Centre, where you can pay National Park Use Fees. The park has hire boats, rods, waders, as well as, fishing licences and pondage maps.
The friendly park on the river and lagoon... Welcome to Rivers Edge Caravan Park at Tailem Bend. We're the perfect stop off point if you're travelling from Melbourne or Sydney to Adelaide.
Curlwaa Caravan Park is an idyllic 20 acre property on the Murray River with modern amenities, in quiet surroundings. Conveniently located on the intersection of Silver City and Calder Highways, between Mildura and Wentworth.
Nyah Village Caravan Park is a friendly, small town van park on the southern outskirts of Nyah. It caters for backpackers during the harvest periods.
Kingston-on-Murray Caravan Park is an ideal location to explore the many attractions the Riverland has to offer. While staying at the park you can partake in many river activities like fishing, boating and canoeing all from our private jetty.
Riverfront Caravan Park & Cafe is located in Murray Terrace, having the convenience of the main street plus the serenity of the beautiful Murray River.
Willow Bend Caravan and Camping Park is quite unique in its location situated at the junction of the Murray and Darling Rivers. Laze by the water's edge or jump in your boat and have some fun.
Welcome to the multi award winning BIG4 Renmark Riverfront Holiday Park situated on the banks of the mighty Murray River in Renmark, South Australia.
The Corowa Caravan Park is a large family park. Nestled on twelve acres amongst tall shady trees, the caravan park is on the banks of the mighty Murray River.
Yarrawonga Westside Caravan Park. Located 3km from the centre of town, is far enough from the hustle and bustle to have a quiet peaceful holiday, but close to all of Yarrawonga's great facilities.
Relax in a quiet, tranquil atmosphere with no highway noise, enjoy the peaceful setting amidst citrus trees and vines. Boat ramps, water skiing, golf courses and National Parks are at your doorstep.
Paringa Caravan Park is a family run business. We pride ourselves on our friendly approach and our exceptionally clean and tidy facilities. A little bit of old fashioned service is always on hand!
Swan Reach Caravan Park is a small private caravan park on the road that goes to the ferry crossing over the Murray River. There are level grassy sites with power and water. Just a short walk to the river where there is a boat ramp and picnic ground.
Ballpark Caravan Park is set on the banks of the Murray River, beside the historic John Foord Bridge. It is located only a minute's walk to the twin town centre of Corowa and Wahgunyah.
Maidens Inn Holiday Park is located on the banks of the Murray River and close to the historic Port of Echuca. The powered caravan or camping sites are either paved or grassed with easy access to power and water.
Nyah Two Bays Roadhouse & Caravan Park is a BP roadhouse at the Nyah West turnoff on the Murray Valley Highway. There is a caravan park, restaurant and takeaway food service.
Walwa Riverside Caravan Park, with the magnificent Murray River as it's northern boundary has tall shady cottonwood trees, well-maintained gardens and lawn areas that provide a perfect place to spend a holiday.
Mulwala Shoreline Caravan Park is situated on the shore of Lake Mulwala, with an inviting relaxed atmosphere. There is a private boat ramp in the park for your use and enjoyment.
Kismet riverside lodge is located on the banks of the Murray river 3 km west of Howlong NSW. You can choose from a range of accommodation that includes cabins, caravan sites and riverside camping.
Coachman Tourist Park is only 4 km from Mildura Centre Plaza and less than a 3 minute walk from the Irymple Shopping Centre with two delis/milk bars; a newsagent and a Post Office.
Try Angie's Pizza and Irymple Fast Food if you need something to eat.
Wellington Caravan Park is a cosy park with level shady sites and a friendly casual atmosphere.
Centrally located park where you can base yourself and explore all that Albury has to offer. Only 2km from CBC.
Beautifully situated amongst mature shade trees on the banks of Lake King, Rutherglen Caravan & Tourist Park enjoys a tranquil setting where you can relax and talk about the day's adventure.
Loxton Riverfront Caravan Park is set on approximately 35 hectares with River Murray frontage, you have the choice of either a rustic setting or the near new section of the Park. It is two kilometres from the town centre and protected from traffic noise.
At the heart of the Coorong you will find the Coorong Wilderness Lodge, owned and operated by the Trevorrow's family.
Discovery Parks Lake Hume is located on the shores of Lake Hume, providing the perfect holiday getaway. Choose from a wide range of cabins and villas or caravan and camping sites.
Brolgaroo Caravan Park has a relaxed atmosphere where you can always find powered or unpowered sites or cabin accommodation. It is a pet friendly park, conveniently located within the riverside town of Barooga.
Sun Country Holiday Village, spread over approximately 10 acres of well maintained attractive surroundings, offers a choice of accommodation in Mulwala, 4km from Yarrawonga across the Murray River.
Yarrawonga Holiday Park is situated on the beautiful Murray River, just downstream from Yarrawonga Weir.
Tooleybuc Caravan Park is a small but delightful caravan park just across the road from the Murray River. There is a large grassy riverfront park where you can stroll in the afternoon or wet a line in the river, in this little piece of paradise.
Cobdogla Station Caravan Park is probably one of SA's best kept secrets, Located just 220KM north-east of Adelaide, Cobby is a small family friendly and family operated Caravan Park.
Wodonga Caravan & Cabin Park is the closest accommodation to the new Wodonga Railway Station, just two minutes drive from the Wodonga Town Centre and 10 minutes drive to Albury.
Riverbank Caravan Park Nathalia is proud to be a 'family park'. Nestled on the banks of the Broken Creek where plenty of wildlife is visible.
You will be assured of a warm welcome from Peter, Judy and the Dowell Family. They will take a personal interest in your holiday and strive to make each day enjoyable.
Barmah Caravan Park offers an abundance of fishing, waterskiing or canoeing with plenty of room for tying up your boat, swimming or just lounging in the sun. Bring along your bike for that alternative way to view the forest.
Cobram Oasis Caravan Park is a family friendly environment situated just 2km away from the Murray River and a short walk into town. Cobram Oasis Caravan Park offers a superb stay with unsurpassed amenities.
Moama Riverside offers you a great place for your kids so you can sit back and wind down under the shade of the gum trees, knowing that your kids will have plenty to keep them occupied.
BIG4 Swan Hill offers a diverse range of fully self contained accommodation with linen supplied in all cabins.There are 2 and 3 bedroom superior cabins, some with corner spa baths. Grassy ensuite and powered sites accommodate caravanners and campers.
Located in Echuca, just over 2 hours drive North of Melbourne, Yarraby Holiday Park provides guests with a magnificent holiday destination right on the Murray River.
Lake Anderson Caravan Park, overlooking the beautiful lake, is situated in the leisure/sporting precinct of Chiltern, Victoria. This precinct includes a children's playground, swimming pool, tennis courts and skate rink.
If you love the river, you'll love River Palms Holiday Park, which enjoys absolute river frontage, with its own boat ramp.
Merool on the Murray is a completely self contained Private Holiday Park Resort situated on 68 acres of freehold land with over 2 kilometres of absolute Murray River frontage.
Rivergum Holiday Retreat, on the bank of the Murray River at Corowa, is one of the region's best kept secrets. This beautiful bushland setting of more than 35 hectares enjoys a 1.5km river frontage on the Magnificent Murray.
Moama West Caravan Park is situated on 10.5 hectares of natural bush and gardens. Immerse yourself a treasure trove of places to see and activities to experience. It's a little wonder that Echuca is one of Australia's most popular holiday destinations.
Punyelroo Caravan Park enjoys absolute riverfront on the bank of the Murray River. Launch your boat at the boat ramp and the Mighty Murray River is yours for the taking.
The boating, the beaches and the beautiful views.
Koondrook Caravan is situated on the banks of the Murray River and Gunbower Creek in the historic redgum township of Koondrook.
BIG4 Yarrawonga-Mulwala Lakeside Holiday Park is situated opposite the Lake Mulwala Regional boat ramp. This is an ideal location for the avid fisherman or skier.
Murray Bridge Resort Caravan Park and Marina is situated at Murray Bridge in South Australia on the banks of the Murray River. Only a short drive from the town centre and only 1 Hour east of Adelaide.
Mannum Caravan Park is conveniently located approximately 84km from Adelaide, on the banks of the River Murray, and within easy walking distance of Mannum's main street.
Pental Island Caravan Park & Holiday Farm is located in a delightful rural setting on the Murray River. This relaxed private caravan park is family operated by Alan and Mary Greenham.
Mount Mittamatite Caravan Park is on the south-western edge of Corryong, just a short distance from the town centre. There are powered and unpowered sites and cabins, with a relaxed atmosphere.
Hindmarsh Island Caravan Park has a general store and post office at the entrance. There are powered and unpowered sites and cabins.
As the river moves through rich agricultural land, forming the border between New South Wales and Victoria, the river is fed by several significant tributaries. The most important of these are the Murrumbidgee River and the Darling River.
2520 kilometres from its source in the Upper Murray and the Kosciusko National Park, the mighty Murray meets the sea at the mouth of Lake Alexandrina in South Australia. Along the way it has provided farmland with irrigation water, sustaining a multi billion dollar industry. It also sustains wetlands and provides water for many towns and millions of residents of Victoria, New South Wales and South Australia, along its length. The river hosts four large dams, 16 storage weirs and 15 navigable locks.
One of the major challenges for the Murray River is the high level of salinity that has been caused by irrigation water raising the salt table. The runoff ends up in the river and threatens the many species of plants, animals and fish that live in and around the river.
The Murray River was a highway for transportation of goods and people on paddle steamers throughout the 19th and early 20th centuries. Before federation, the various crossings across the river saw customs posts which imposed duties for the movement of goods between the colonies of Victoria and New South Wales.
River towns such as Corowa and Wentworth have rich historical significance in the role that was played at these places during the early negotiations that lead to federation.