Data processing agreement
1. Parties and subject
This data processing agreement is concluded between the Customer (controller) and Bouwivo (processor) and forms part of the agreement on the use of the Service. It governs the processing of personal data by Bouwivo on behalf of the Customer within the meaning of article 28 of the General Data Protection Regulation (GDPR). Terms have the meaning given in the GDPR and the terms and conditions.
2. Nature, purpose and duration of processing
- Nature: hosting, storage, backup, security and technical processing of the data the Customer, its Users and Portal Users enter in the Service, and sending invitations, password links and other system e-mails on behalf of the Customer.
- Purpose: exclusively providing, securing, supporting and maintaining the Service for the Customer.
- Duration: as long as the agreement runs, plus the 30-day export period.
- Data subjects: employees and other Users of the Customer, customers, dealers and Portal Users of the Customer, contact persons of the Customer's suppliers.
- Categories of personal data: name, e-mail address, telephone number, address, company details, role and permissions, sign-in and log data, quote, order, purchase, delivery and invoice data, notes and documents the Customer adds. The Customer does not enter special categories of personal data, criminal data or citizen service numbers unless agreed otherwise in writing.
3. Instructions
Bouwivo processes the personal data only on the documented instructions of the Customer. The agreement, the settings the Customer chooses in the Service and the actions of its Users (such as entering an employee or portal customer) count as instructions. Bouwivo informs the Customer if, in its opinion, an instruction infringes the GDPR. Bouwivo may disclose personal data where required by law; it informs the Customer in advance unless the law prohibits this.
4. Confidentiality
Bouwivo ensures that persons with access to the personal data are bound by confidentiality. Bouwivo support only accesses the Customer's environment if the Customer has granted permission in the customer portal, for the duration of that permission.
5. Security
Bouwivo takes appropriate technical and organisational measures, including: a separate, isolated environment and database per customer; encrypted connections (HTTPS/TLS); passwords stored only in hashed form; mandatory two-step verification for the main administrator; role-based permissions; an activity log; daily encrypted backups and periodic restore tests; updates only with a signed release package; and limiting access to persons who need it for their work. The Customer is responsible for the permissions it gives Users and Portal Users, for keeping login details secret and for the security of its own devices and network. Bouwivo may adjust the measures provided the level of security does not decrease.
6. Sub-processors
The Customer gives Bouwivo general authorisation to engage sub-processors. Currently these are: the hosting and server provider (servers in the European Union), the e-mail provider for sending system e-mails and Mollie B.V. for payments. Bouwivo imposes at least the same obligations on sub-processors as in this agreement and announces a new sub-processor in advance by e-mail or in the Service. The Customer may object with reasons within 14 days; if the parties cannot agree, the Customer may terminate the agreement with effect from the date the new sub-processor is engaged. Bouwivo does not have personal data from a customer environment processed outside the European Economic Area without appropriate safeguards under the GDPR.
7. Data subject rights
If Bouwivo receives a request from a data subject about data in the Customer's environment, it forwards the request to the Customer. The Customer can handle most requests itself in the Service (view, change, export, delete). Bouwivo provides reasonable assistance on request; work beyond the standard functions may be charged at the applicable hourly rate.
8. Data breaches
Bouwivo informs the Customer without undue delay, and where possible within 48 hours of discovery, of a personal data breach affecting the Customer's data, with the information the Customer reasonably needs to meet its notification obligation. Notifying the Dutch Data Protection Authority and data subjects is the Customer's responsibility. Bouwivo takes reasonable measures to limit the consequences.
9. Assistance and audits
On request Bouwivo provides the Customer with the information needed to demonstrate compliance with this agreement and reasonably assists with a data protection impact assessment. The Customer may have an audit carried out by an independent expert bound by confidentiality at most once a year, with at least 30 days' notice. The audit must not disrupt Bouwivo's operations or the confidentiality of other customers' data. The costs of the audit are borne by the Customer.
10. End and return
After the end of the agreement the Customer can export its data for 30 days. Bouwivo then deletes the Customer's environment, including its backups, unless Bouwivo is subject to a statutory retention obligation. On request Bouwivo confirms the deletion.
11. Liability and order of precedence
The liability arrangements in the terms and conditions (articles 15 and 16) apply to the parties' liability, to the extent the GDPR or other mandatory law permits. The Customer indemnifies Bouwivo against claims and fines resulting from the Customer's failure to comply with the GDPR or from unlawful instructions. In case of conflict between this data processing agreement and the terms and conditions, this data processing agreement prevails as regards the processing of personal data.