Data processing agreement

This agreement is between you, our client, and us. You are the controller: you decide why and how personal data on your site is used. We are the processor: we process that data only for you.

Business

Casa Lab., sole proprietorship (eenmanszaak)

Chamber of Commerce (KvK) number

97816930

VAT number

NL002397505B81

Address

Kleine Kolonieweg 104, 8075 PC Elspeet

E-mail

info@casa-lab.eu

Words such as personal data, processing, data subject and personal data breach (data breach) have the same meaning here as in the GDPR (in Dutch: AVG), the European privacy law.

This agreement covers the personal data we process because we host and maintain your site. It is part of our terms and conditions. By accepting the proposal you also accept it; no separate signature is needed. If you would like a signed copy, we send one on request.

The agreement runs for as long as we host or maintain your site, and ends automatically with the hosting. Arrangements that by their nature continue, such as confidentiality and deletion, still apply afterwards.

What we do

Store your site and show it to visitors (hosting), forward messages that come in through a form on your site to you by e-mail, maintain the technology of your site and secure it.

Which data

Technical data of visitors in the hosting logs, such as IP address, browser and time; what visitors fill in on a form, such as name, e-mail address, phone number and message; and personal data you put on your site yourself, such as names and photos of staff.

About whom

Visitors to your site, your customers and others who use a form on your site, and your staff or others shown on your site.

Special data

Your site is not meant for special categories of personal data, such as health data. If your site does need them, we agree extra measures in advance.

We process the data only on your written instructions. These are in the proposal, in the terms and conditions, in this agreement and in the e-mails in which you ask us something. We do not use the data for ourselves or for others.

If we believe an instruction breaks the GDPR or another privacy rule, we tell you at once. If the law obliges us to process data in a way you did not ask for, we tell you beforehand, unless the law forbids this.

We keep the personal data confidential. Apart from ourselves, only our sub-processors have access to it, and only as far as their task requires (article 7). If we engage someone who can access the data, the same confidentiality applies to that person.

We take appropriate technical and organisational measures to secure the data, including:

• encrypted connections (https) for your site and for our management of it;
• access only for us, with strong passwords and two-step verification: signing in with an extra code;
• security updates for the software your site runs on;
• hosting with a professional provider that has its own security measures;
• no more data than needed: we forward messages sent through a form and keep them no longer than needed to deliver them, unless we agree otherwise with you.

We adjust these measures when the risks or the technology change.

You give us permission to engage these parties (sub-processors). They only process what their task requires:

• Vercel (United States): hosting of your site and the related log files;
• Resend (United States): sending messages through a form on your site, if your site has such a form;
• Google (Google Workspace): our e-mail, if messages or data from your site pass through our mailbox.

With each sub-processor we have a data processing agreement that protects the personal data at least as well as this agreement, as Article 28(4) GDPR requires. We remain responsible to you for its work.

If we want to add or replace a sub-processor, we announce it at least one month in advance by e-mail. If you have a well-founded objection, let us know within that period. If we find no solution together, you can cancel the hosting with effect from the day the change applies.

Data only goes to a country outside the European Economic Area with the safeguards the GDPR requires: the EU-US Data Privacy Framework, for companies certified under it, or the standard contractual clauses of the European Commission, fixed model terms on privacy.

If we receive a request from someone about their data on your site, for example for access or deletion, we forward it to you at once. You answer it; we help you, for example by finding or deleting data.

We also help you, as far as fits our role, with security, with reporting data breaches, with an assessment of the privacy risks (DPIA) and with consulting the Dutch Data Protection Authority. If this help takes more than a small effort, we agree the costs with you in advance.

If we discover a data breach at our end or at a sub-processor that affects personal data of your site, or a sub-processor reports one to us, we report it to you by e-mail without undue delay, aiming to do so within 48 hours of discovering it. We tell you, as far as we know:

• what happened, and when;
• which data is involved, and about roughly how many people;
• what the likely consequences are;
• which measures we have taken or propose.

If we do not know everything yet, we add to the report as soon as we know more. You decide whether to report the breach to the Dutch Data Protection Authority, which must happen within 72 hours, and to the people concerned. We help you with this and keep a record of all data breaches.

We give you all the information needed to show that we comply with this agreement. If you want to verify this with an audit, it can be carried out by you or by an independent expert you appoint, bound to confidentiality, at most once a year and announced at least one month in advance. After a data breach, or when a supervisory authority asks for it, it can also happen more often and at shorter notice. The costs are yours, unless the audit shows that we fail to comply with this agreement on an important point. We may use reports and certificates of our sub-processors about their security as information.

Before the end date you receive on request a copy of the personal data we keep for your site, such as stored form messages, in a common file format.

Within 30 days after the end date we delete all personal data we process for your site, also at our sub-processors as far as we are able to. Log files and backups at sub-processors disappear under their own retention periods. This does not apply to data the law requires us to keep. On request we confirm by e-mail that we have deleted the data.

• You make sure you have a valid legal basis to process the data on your site.
• You tell visitors in a privacy statement on your site which data you process and why. We put it on your site if you supply it.
• You only give us instructions that comply with the law.
• You tell us in advance if your site is going to process special categories of personal data (article 3).

For liability between you and us, the Liability article of the terms and conditions applies. That article does not limit the rights that visitors and other data subjects have themselves under the GDPR.

If this agreement and the terms and conditions say something different about personal data, this agreement prevails.

Dutch law applies. For disputes, the Applicable law and disputes article of the terms and conditions applies.

For questions about this agreement, e-mail info@casa-lab.eu. This English text is a translation of the Dutch verwerkersovereenkomst. If the texts differ, the Dutch text prevails.