Data processing agreement

This data processing agreement forms part of every agreement between NorthDock B.V. (the "Processor") and its customer (the "Controller") under which NorthDock processes personal data on behalf of the customer, as referred to in Article 28 of the General Data Protection Regulation (GDPR).

1. Definitions

Terms such as personal data, processing, controller, processor, sub-processor, data subject and personal data breach have the meaning given to them in the GDPR. "Agreement" means the agreement for the provision of the Services, to which NorthDock's general terms and conditions apply.

2. Subject and duration

The Processor processes personal data only to provide the Services under the Agreement. The nature and purpose of the processing, the types of personal data and the categories of data subjects are described in the annex below. This data processing agreement applies for as long as the Processor processes personal data on behalf of the Controller.

3. Instructions

The Processor processes personal data only on documented instructions from the Controller, including the use of the Services as configured by the Controller, unless required to do otherwise by Union or Member State law. The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR.

4. Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality and only have access to the extent necessary for their tasks.

5. Security

The Processor takes appropriate technical and organisational measures as referred to in Article 32 GDPR, taking into account the state of the art and the risks involved. These include at least encryption of data in transit, access control based on least privilege, logging of access to production systems, regular backups, separation of customer environments and timely installation of security updates.

6. Sub-processors

The Controller gives general authorisation for the engagement of sub-processors, such as hosting and email providers. The Processor maintains a list of sub-processors, which it provides on request, and informs the Controller at least 30 days in advance of any intended addition or replacement. The Controller may object on reasonable grounds within that period. The Processor imposes on each sub-processor the same data protection obligations as set out in this agreement.

7. Transfers outside the EEA

The Processor only transfers personal data outside the European Economic Area if an adequate level of protection is ensured in accordance with Chapter V GDPR, for example through an adequacy decision or standard contractual clauses.

8. Assistance

Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects exercising their rights, and in complying with its obligations regarding security, data protection impact assessments and prior consultation. The Processor may charge reasonable costs for assistance that goes beyond the standard functionality of the Services.

9. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 48 hours after becoming aware of it, of a personal data breach affecting the Controller's personal data. The notification contains the information available at that time that the Controller needs to meet its own notification obligations. The Processor takes reasonable measures to limit the consequences of the breach.

10. Audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement. The Controller may have an audit performed once per year by an independent auditor bound by confidentiality, with at least 30 days' notice, at its own expense and without unreasonably disrupting the Processor's business operations.

11. Return and deletion

At the end of the Agreement the Controller can export its personal data within 30 days. After that period, the Processor deletes the personal data, including existing copies, unless storage is required by law. Deletion from backups takes place in the regular backup cycle.

12. Liability and final provisions

The limitations of liability in the general terms and conditions apply to this agreement. In case of conflict between this agreement and the Agreement regarding the processing of personal data, this agreement prevails. This agreement is governed by Dutch law.

Annex: description of the processing

The purpose of the processing is in all cases the provision, maintenance, security and support of the Services as agreed in the Agreement. Personal data is processed for the duration of the Agreement.