Data processing agreement

Parties

• Controller: [NAME OF CUSTOMER ORGANISATION], established in [PLACE OF BUSINESS], Chamber of Commerce number [COMMERCE NUMBER] (the “Controller”).
• Processor: AGENTICA, established at Langeland 18, 2548 WE The Hague, Chamber of Commerce number 94577056, VAT number NL005093484B44 (the “Processor”).

Article 1: Definitions

• GDPR: General Data Protection Regulation.
• Personal Data: any information relating to an identified or identifiable natural person that is processed under this Agreement.
• Processing: any operation performed on Personal Data, such as collecting, storing, consulting and erasing.
• Sub-processor: a third party engaged by the Processor to carry out (part of) the Processing.

Article 2: Subject matter and duration

The Processor processes Personal Data solely for and on the instructions of the Controller, in the context of the use of TelMaar. This Agreement runs concurrently with the main agreement and terminates by operation of law upon its termination, without prejudice to the provisions that by their nature remain in force after termination (including article 10 on return and erasure).

Article 3: Nature and purpose of the processing

The Processing comprises storing, managing and processing Personal Data of the Controller's relations (customers, suppliers and their contact persons) for the purposes of financial administration, invoicing and customer relationship management, as further described in the Controller's privacy statement. The categories of data subjects and Personal Data correspond to articles 2 and 4 of that privacy statement.

Article 4: Obligations of the Processor

• The Processor processes Personal Data solely on the basis of written instructions from the Controller, unless a legal obligation requires otherwise.
• The Processor ensures that persons authorised to process Personal Data have committed themselves to confidentiality.
• The Processor provides reasonable assistance with data subject requests for access, rectification or erasure, within the limits of the statutory retention duty.
• The Processor informs the Controller without delay if, in its opinion, an instruction infringes applicable law.
• The Processor does not use Personal Data to train or improve its own or anyone else's models, and imposes that obligation on the Sub-processors it engages.

Article 5: Security measures

The Processor takes appropriate technical and organisational measures, including:

• Encryption of data in transit using TLS 1.3.
• Encryption of data at rest using AES-256, with additional envelope encryption (a per-organisation data encryption key, encrypted with a master key) for payment provider credentials and other particularly sensitive fields.
• Role-based access control (RBAC) and row level security in the database, so that data of one organisation is never accessible to another.
• Mandatory two-factor authentication (2FA) for users with write access to financial data.
• An append-only audit log of changes to financial data, including time, IP address and user.
• Periodic, encrypted backups with a retention period of at least 7 and no more than 30 days, so that no copy remains after an erasure under article 10.

Article 6: Sub-processors

The Controller authorises the Processor to engage the following Sub-processors: Supabase (database, authentication, storage), Vercel (hosting), Resend (email), Stripe and Mollie (payment processing), Cloudflare (security and content delivery), Anthropic (processing the questions and documents the Controller submits via the assistant), Sentry (error reports from the application, stripped of personal data), Expo, Google and Apple (delivering notifications to the phone), Google ML Kit (on-device text recognition when photographing a receipt), Mapbox (map display for an address), overheid.io (Business Register lookups) and postcode.tech (address from postcode). The assistant is only available to users with a financial role and processes only what the user submits; submitted data is not used to train models. The Processor imposes obligations on each Sub-processor comparable to those in this Agreement and informs the Controller of any change to this list, with the possibility to object.

Article 7: Transfers outside the EEA

Processing takes place within the European Economic Area in principle. Insofar as a Sub-processor processes Personal Data outside the EEA, this takes place solely on the basis of an adequacy decision of the European Commission or of the European Commission's standard contractual clauses (SCCs), supplemented by appropriate additional measures such as encryption of data in transit and at rest. On request, the Processor provides the Controller with insight into the transfer basis applicable to each Sub-processor.

Article 8: Data breaches and notification period

The Processor notifies the Controller of any identified personal data breach without undue delay and no later than 48 hours after discovery, so that the Controller can comply in good time with its own notification duty (within 72 hours) towards the Dutch Data Protection Authority. The notification covers at least the nature of the breach, the categories and approximate number of data subjects concerned, and the measures taken or proposed.

Article 9: Audits

The Controller is entitled, after prior written notice with a reasonable period of at least four weeks, to have audits carried out on compliance with this Agreement, or to be informed by means of a report from an independent third party made available by the Processor. The costs of an audit by the Controller are borne by the Controller, except where shortcomings are identified.

Article 10: Return and erasure after termination

Upon termination of the main agreement the Processor makes all Personal Data available in a common export format at the Controller's request, and then erases all Personal Data, with the exception of data that must be retained under a statutory retention duty (including the seven-year retention duty for tax purposes). Erasure takes place within 30 days of the request.

Article 11: Liability

The liability of the parties under this Agreement is governed by the main agreement between the parties, namely article 11 of the terms and conditions.

Article 12: Governing law

This Agreement is governed by Dutch law. Disputes are submitted to the competent court in the district of The Hague, unless mandatory law provides otherwise.

Article 13: Annex for Controllers in the United Arab Emirates

This article applies only where the Controller is established in the United Arab Emirates. Where it differs from the preceding articles, this article prevails.

Applicable framework. The processing is subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Where this Agreement refers to the GDPR, the corresponding provisions of the PDPL apply to the Controller.

Transfer. The Processor processes the personal data on servers in the European Union. The Controller instructs that transfer; it is necessary to perform the Agreement, and the destination territory maintains a level of protection at least equivalent to that of the PDPL.

Personal data breaches. The Processor notifies the Controller of a personal data breach without undue delay, so that the Controller can meet its notification obligations towards the UAE Data Office and towards data subjects.

Rights of data subjects. The Processor provides the Controller with reasonable assistance with requests for access, correction, erasure, restriction, portability and objection under the PDPL.

Retention. By way of derogation from article 10, tax records are retained for as long as UAE law requires: five years after the end of the tax period for VAT and fifteen years for records relating to real estate.

Governing law. By way of derogation from article 12, disputes arising from this annex are submitted to the competent court in Dubai, and the law of the United Arab Emirates applies to those disputes.

Signatures

Agreed and signed by both parties: