Let's say we have two companies "WeServe" and "OurContent" and the following relationships, who is the Controller and who is the Processor or are they Joint Controllers (Art. 26 GDPR) or is there another kind of relationship or none at all?
- The most common case,
ourcontent.com
is hosted by WeServe. OurContent is the Controller and WeServe the Processor, OurContent has a Privacy Policy and needs a DPA from WeServe ourcontent.weserve.com
orweserve.com/ourcontent
with 100% of the content provided by OurContent. Still the same as #1, apart from WeServe being visible in the url, I suppose.- OurContent uploads content to WeServe and is part of some page of WeServe and it may not be obvious content is provided by OurContent and OurContent does not access or process any user data.
- OurContent uploads content to WeServe and is part of some page of WeServe but processes some user data on its own.
- WeServe crawls the internet and copies and hosts content of OurContent that processes some user data. OurContent doesn't necessarily mind this and may even see this as beneficiary. (similar to the wayback machine of archive.org)
- OurContent provides a url to WeServe which will be embedded in an iframe as part of a page of WeServe.
- WeServe embeds pages of OurContent in an iframe in its own pages. (e.g. Google Translate).
If WeServe and OurContent are Joint Controllers, is it sufficient if both of them have their own privacy policy with a contact point for data subjects or do they need an extra arrangement that combines both privacy policies in an appropriate way?