Data Processing Agreement

Controller is responsible for the processing of Personal Data in the context of the implementation of the Agreement. Processor does not have independent control over the Personal Data.

The Processor processes Personal Data only on instructions from the Controller in the context of the execution of the Agreement, in accordance with the objectives determined by the Controller and resources and the retention periods as agreed in the assignment(s), as well as in accordance with any other instructions provided by the Controller.

Controller will guarantee that his instructions to the Processor result in a processing by the Processor that will comply with applicable regulations, including - but not limited to the GDPR and will not infringe any third party right(s).

The processing relates to the categories of Personal Data, nature and type of Personal Data submitted by the Controller.

The processing operations are specified by the Processor in Appendix 1 of this Data Processing Agreement.

Processor only provides access to those Employees for whom this access to Personal Data is necessary for the performance of the Agreement.

The obligations of the Processor of this Data Processing Agreement also apply to those who process personal data under the authority of the Processor, including but not limited to employees in the broadest sense of the word.

In connection with the processing, the Processor shall support the Controller to the extent necessary in fulfilling its data protection obligations, in compiling and updating the records of processing activities, in carrying out the data protection impact assessment and any necessary consultation with the supervisory authority. The necessary information and documentation shall be kept available and shall be forwarded without delay to the Controller upon request.

Processor ensured that the required security measures have been taken, which guarantee an adequate level of protection, taking into account the current state of IT development and the costs of the implementation, in view of the risks involved of the processing and the nature of the data to be protected.

In this context, the Processor has implemented the measures mentioned in Appendix 2.

If the Processor is liable towards the Controller for direct damage that the Controller suffers as a result of a culpable shortcoming and / or wrongful act attributable to the Processor. The total liability under the Agreement, including this Data Processing Agreement, or violation by the Processor and / or Sub-processor(s) of the GDPR, will never amount to more than EUR 50.000,- per year. If the data subject will hold the Processor liable for the damage that he or she has suffered as a result of an infringement of his or her personal data, then the Processor will submit this claim to the Controller so that he or she can deal with this.

Processor shall never be liable for consequential damage, including pure financial loss, lost profit, and immaterial damage. In particular, Processor is not liable for any damage in connection with and/or due to: i) termination or modification of the service provided; ii) communication failures in connection with hardware, software, network or other computer problems; iii) the use of data or data files prescribed by the Controller; iv) loss, mutilation or destruction of data or data files; and/or v) inaccessibility of the Processor's service.

Insofar as fulfillment is not permanently impossible, Processor's liability due to culpable shortcoming in the performance of the Data Processing Agreement only arises if the Controller expressly and in writing gives notice of default in good time, a reasonable period for the purification of the shortcoming is made, and the Processor after that term falls short in the fulfillment of its obligations. The letter of formal notice must contain as complete and detailed a description of the shortcoming as possible, so that the Processor is able to respond adequately.

A condition for the existence of any right to compensation is always that the Controller reports the damage to the Processor in writing as soon as possible after the occurrence thereof. Any claim for damages towards Processor expires by the mere lapse of twelve (12) months after the claim arose.

An (administrative) fine imposed by the competent Supervisory Authority to the Controller can never be recovered from the Processor if the competent Supervisory Authority has not included the extent to which Processor is liable for the imposition of the (administrative) fine.

The Controller has the right to have audits carried out, with the aim of verifying whether the measures and provisions taken by the Processor are in accordance with the provisions of this Data Processing Agreement.

The Processor will cooperate and provide all information relevant to the audit in a timely manner.

The persons conducting an audit will conform to the security procedures as they apply to the Processor shall be in force, insofar as these security procedures have been made known to the Controller.

The reasonable costs for the deployment of the auditors and own personnel of Controller and / or a Supervisor and Processor are at the expense of the Controller.

If substantial irregularities are found during an initial audit, the Controller and / or a supervisor, or a third party engaged by the Controller and / or a supervisor, can take a second audit. If during this second audit it appears that the previously observed irregularities still occur, all costs of the second audit and any further audits will be for the account of the Processor.

In the event of an actual breach or threatened or suspected breach of security, leading to (or likely to lead to) the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to, the data which is likely to result (a) in a risk for the rights and freedoms of a data subject (such as discrimination, identity theft or fraud) or (b) in financial loss, damage to reputation, loss of confidentiality of data or (c) in any other significant economic or social disadvantage ("Security Breach"), Processor shall:

Processor will provide to Controller with the information on:

Processor will, at the request of Controller, render the requested assistance that Controller deems necessary in order to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or any other competent supervisory authority and/or the data subjects of a Security Breach. Processor may not submit such a notification without the explicit prior permission of Controller.

Processor will continuously inform Controller of possible new developments regarding a Security Breach as well as the measures taken to prevent repetition in the future.

Possible costs linked to Processor's duties under clause 1, 2 and 3 will be borne by Processor.

The Processor is bound to secrecy of all Personal Data and information that it processes as a result of this Data Processing Agreement, except to the extent that such Personal Data or information apparently has no secret or confidential character or are already generally known.

Parties will contractually oblige persons working for them (including employees) involved in the Processing of confidential (Personal) data (for example, by means of a clause in the employment contract) to maintain confidentiality of said confidential (Personal) data and other information.

If the Processor is required to provide data on the basis of a statutory obligation, the Processor shall verify the basis of the request and the identity of the applicant and inform the Controller immediately, if possible and/or allowed, prior to the provision.

The Processor is permitted to make use of Subprocessor(s) within the framework of this Data Processing Agreement. The Subprocessors that are engaged for the performing of services within the scope of the Agreement are mentioned in Appendix 3.

The Processor will always inform the Controller of any changes in the Subprocessors in writing, giving reasonable notice to the proposed change (the “Sub-processor Notification”). The Controller has the possibility to object to such changes. If the Controller has reasonable grounds for objecting to the use of new or additional Sub-processors, it should immediately notify the Processor of this in writing within 14 days of receipt of the Sub-processor Notification. Should the Controller object to a new or additional Sub-processor and this objection is not unreasonable, the Processor will make reasonable efforts to make changes in the Services available to the Controller or to recommend a commercially reasonable alteration in the Controller’s configuration or the Controller’s use of the Services in order to avoid Personal Data being processed by the new or different Sub-processor to whom/which an objection has been made, without thereby placing an unreasonable burden on the Controller. If the Processor is unable to make this alteration available within a reasonable period, namely not exceeding sixty (60) days, the Controller may terminate the part of the Agreement affected, albeit solely in respect of those Services that cannot be provided by the Processor without the use of the new or different Sub-processor against whom/which an objection has been made by means of a written notification sent to the Processor.

The Processor contractually lays down the same data protection obligation as that stated in this DPA on all Sub-processors. In particular, the agreement between Processor and Sub-processor provides adequate guarantees for implementation of the technical and organizational security measures as referred to in Appendix 2, insofar as these security measures are important for the services provided by the Sub-processor.

Personal Data may be transferred to third countries or international organizations only if there is an appropriate level of protection and the Controller has given specific consent for this in writing.

The Controller may attach further conditions to the consent in writing as referred to in Clause 8.1, including but not limited to demonstrating that the requirements included in Clause 8.3 have been satisfied.

The Controller may only give the Processor consent for a transfer of Personal Data to third countries or international organizations if either:

The Processor will fully cooperate in order for the Controller to fulfill its legal obligations in the event that a Data Subject exercises his rights under the terms of the GDPR or other applicable regulations regarding the Processing of Personal Data.

If a Data Subject directly contacts the Processor with regard to the execution of his / her rights under the GDPR, then the Processor will not - in the first instance - answer this (unless explicitly instructed otherwise by the Controller), but the Processor will immediately inform the Controller of this with a request for further instructions.

This Data Processing Agreement has a term equal to the Agreement. Articles that, given their nature,  are intended to be completed after the end of the Data Processing Agreement remain in force after termination of the Data Processing Agreement.

Within one month after the Agreement ends, the Processor - for a limited fee that does not exceed the costs reasonably incurred by Processor for this purpose - shall destroy and/or return all Personal Data and/or the Processor shall transfer the same Personal Data to another party to be designated by the Controller, at the Controller's discretion. All existing (other) copies of Personal Data, whether or not held by (legal) persons engaged by the Processor, including but not limited to Employees and/or Sub-processors, will also be permanently deleted.