Data Processing Agreement

1. Subject matter and scope

1. 1.1This Data Processing Agreement applies to all processing of personal data that we carry out on your behalf when providing our services and performing our agreement with you.
2. 1.2Terms defined in the General Data Protection Regulation (GDPR) have the same meaning in this Data Processing Agreement.
3. 1.3If this Data Processing Agreement conflicts with the main agreement or the Terms and Conditions, this Data Processing Agreement takes precedence to the extent that the provisions concern the processing of personal data on your behalf.

2. Roles of the parties

1. 2.1You determine the purposes and means of processing the personal data you process through the Platform.
2. 2.2We process this personal data solely on your behalf and on your documented instructions, unless applicable law requires us to process it.
3. 2.3You warrant that the processing of personal data, including its collection and disclosure to us, is lawful and complies with applicable data protection law.
4. 2.4Our Privacy Policy applies to personal data that we process for our own purposes as an independent controller, including certain account, billing, security and administrative data.

3. Nature and purposes of processing

1. 3.1We process personal data only to the extent necessary to provide and operate the Platform and perform our agreement with you.
2. 3.2Processing may include: creating, processing, managing and storing work orders; managing tasks, appointments and planning; time tracking; recording materials and services; processing and storing photos, documents, attachments and notes; processing audio and speech for transcription or AI features; recognising, structuring and processing information using AI; generating work orders, reports and other administrative data; providing integrations with accounting software and other third-party services; managing user accounts, roles and access rights; security, backup, recovery and technical support for the Platform; and other processing necessary to deliver the features you use.

4. Categories of personal data

1. 4.1Depending on how you use the Platform, we may process categories of personal data including: names and contact details; addresses; company and customer details; data about employees and other users; data about work orders, work activities and jobs; appointment, planning and task data; time records; data about materials and services; photos, images, documents and other attachments; notes and free-text fields; audio recordings and speech data; transcriptions of spoken or written information; information generated, recognised or structured by AI; invoicing, administrative and accounting data; data imported through accounting integrations or other integrations; user roles and access rights; device, login, IP and security data; and other personal data that you or your users enter or generate through the Platform.

5. Categories of data subjects

1. 5.1The personal data may relate to: your customers and clients; your staff, employees, self-employed contractors and other persons assisting you; customer or supplier contacts; users of the Platform; and other individuals whose personal data you process through the Platform.

6. Your instructions

1. 6.1We process personal data only in accordance with your documented instructions.
2. 6.2Your use of the Platform in accordance with the agreement, the Terms and Conditions and the settings you select within the Platform constitutes documented instructions.
3. 6.3If we consider that an instruction infringes the GDPR or other applicable data protection law, we will inform you without undue delay.

7. Confidentiality

1. 7.1We ensure that persons authorised to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality.
2. 7.2Personal data is made accessible to individuals only to the extent necessary for their work.

8. Security

1. 8.1We implement appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure, unauthorised access or other unlawful processing.
2. 8.2When determining appropriate security measures, we take into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to data subjects.
3. 8.3Where appropriate, security measures may include: access and authorisation management; securing connections and data transfers; appropriate authentication measures; logging and monitoring; backup and recovery arrangements; incident and vulnerability management procedures; and organisational measures to limit unauthorised access.

9. Personal data breaches and security incidents

1. 9.1We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf.
2. 9.2To the extent that the information is available, we will provide details of: the nature of the breach; the categories of data subjects and personal data; the likely consequences of the breach; the measures taken or proposed; and contact details for the incident contact person.
3. 9.3To the extent reasonably possible, we will assist you in complying with any notification obligations towards the Dutch Data Protection Authority and data subjects.
4. 9.4A notification from us does not constitute an admission of liability.

10. Data subjects’ rights

1. 10.1Taking into account the nature of the processing, we will provide reasonable assistance with requests from data subjects to exercise their rights under the GDPR.
2. 10.2If a data subject contacts us directly with a request concerning personal data processed on your behalf, we will normally refer the request to you.
3. 10.3We will not act on such a request independently unless you instruct us to do so or we are required to do so by law.

11. Subprocessors

1. 11.1You give us general authorisation to engage subprocessors to process personal data.
2. 11.2We may engage subprocessors for purposes including: hosting and cloud infrastructure; storage and backup; email and communications services; push notifications; technical monitoring and diagnostics; payment and administrative services; AI, transcription and language processing services; and technical connections and integrations.
3. 11.3We impose written data protection obligations on subprocessors that are at least equivalent to those in this Data Processing Agreement, to the extent that those obligations apply to the relevant processing.
4. 11.4We remain responsible to you for compliance with the data protection obligations imposed on subprocessors, in accordance with the GDPR.
5. 11.5We maintain an up-to-date list of the subprocessors we use in our Privacy Policy: https://www.werkbonnen.ai/en/privacy#subprocessors. A copy of the list at the publication date of this version is included in Annex 2.
6. 11.6If we engage a new subprocessor or replace an existing one and this materially affects the processing of personal data, we will give you reasonable advance notice.

12. AI service providers

1. 12.1We may use external AI, speech recognition, transcription or language processing services for certain features.
2. 12.2Personal data necessary to perform the relevant function may be disclosed to such a subprocessor for that purpose.
3. 12.3We ensure that the use of these service providers complies with the GDPR and this Data Processing Agreement.
4. 12.4To the extent technically and contractually applicable, we will put appropriate arrangements in place concerning these service providers’ use and storage of data.

13. Transfers outside the European Economic Area

1. 13.1As a general rule, we process personal data within the European Economic Area (EEA) or in countries covered by an applicable adequacy decision.
2. 13.2If personal data is transferred to a country outside the EEA that is not covered by an adequacy decision, we ensure that there is a valid transfer mechanism under Chapter V of the GDPR.
3. 13.3Where necessary, this may involve using Standard Contractual Clauses adopted by the European Commission or another legally permitted transfer mechanism.

14. Data protection by design and data protection impact assessments

1. 14.1To the extent applicable to our role, we take into account the principles of data protection by design and by default.
2. 14.2We will provide reasonable assistance if processing requires a data protection impact assessment or prior consultation with a supervisory authority.
3. 14.3If the requested assistance involves work that reasonably falls outside our regular services, we may charge a reasonable fee, provided that we inform you in advance.

15. Audits and information

1. 15.1We will provide you with the information reasonably necessary to demonstrate our compliance with the obligations under Article 28 of the GDPR.
2. 15.2Where there are reasonable grounds, you may arrange an audit of compliance with this Data Processing Agreement once a year.
3. 15.3An audit must be announced at least thirty (30) days in advance; take place during normal business hours; avoid unnecessary disruption to our business operations, security and confidentiality or those of other customers; and be carried out by an independent expert bound by a duty of confidentiality.
4. 15.4You will normally bear the audit costs, unless the audit reveals a material failure by us to comply with this Data Processing Agreement.

16. Retention, return and deletion

1. 16.1We retain personal data no longer than necessary to perform the agreement, unless a longer retention period is required by law.
2. 16.2After your subscription ends, we retain your workspace for thirty (30) days. During that period, you may export your data, to the extent that this functionality is available. If you do not resume your subscription, your workspace then becomes eligible for removal from active use. If you have never activated a subscription, this period starts when your trial ends. Activating a subscription before cleanup prevents this automatic removal.
3. 16.3After removal from active use, we retain the workspace data for a further thirty (30) days. It then becomes eligible for permanent deletion. Daily cleanup processes a limited number of workspaces at a time. Completion may take longer because of these batch limits, a pending cancellation with Stripe or separate file cleanup. The exceptions for statutory retention and routine backups in Articles 16.4 and 16.5 continue to apply.
4. 16.4Data subject to a statutory retention obligation is retained only for the applicable statutory period and is then deleted or anonymised, unless further retention is lawfully permitted.
5. 16.5Personal data may remain in routine backups for a limited period after deletion, provided that it is not used again for operational purposes and is overwritten or deleted in accordance with the regular backup policy.

17. Confidentiality and ownership of data

1. 17.1All data that you or your users enter through the Platform remains your data.
2. 17.2This Data Processing Agreement does not transfer ownership of, or other rights in, the data to us.
3. 17.3We do not use personal data for purposes other than those necessary to provide the agreed services, unless you have given additional instructions or another valid legal basis exists.

18. Liability

1. 18.1To the extent permitted by law, the liability provisions in the main agreement and the Terms and Conditions apply to both parties’ liability in connection with this Data Processing Agreement.
2. 18.2Nothing in this Data Processing Agreement limits liability where such a limitation is prohibited by applicable law.

19. Term and termination

1. 19.1This Data Processing Agreement takes effect when the main agreement between us is concluded and remains in force for as long as we process personal data on your behalf.
2. 19.2Provisions that by their nature survive termination remain in force, including those concerning confidentiality, deletion, liability and, where relevant, audits.

20. Changes

1. 20.1We may amend this Data Processing Agreement where necessary because of changes in the law, changes to our services, security requirements or the use of subprocessors.
2. 20.2We will give you reasonable advance notice of material changes.

21. Electronic conclusion

1. 21.1This Data Processing Agreement may be entered into electronically as part of the Platform’s registration or ordering process.
2. 21.2By expressly agreeing to this Data Processing Agreement during registration or ordering, you confirm your acceptance of its contents.
3. 21.3No separate physical or electronic signature is required if consent can be sufficiently demonstrated by other means.
4. 21.4We may retain details of the date, time, user and applicable version of this Data Processing Agreement as evidence that it was entered into.

22. Governing law

1. 22.1This Data Processing Agreement is governed by Dutch law.
2. 22.2Disputes will be handled in accordance with the dispute resolution provisions in the main agreement and the Terms and Conditions.

Annex 1 - Processing overview

Subject matter of processing

Processing personal data to provide services through werkbonnen.ai.

Duration

For the term of the main agreement and any applicable deletion and retention periods.

Nature of processing

Collecting, recording, storing, organising, structuring, consulting, altering, transmitting, linking, analysing, transcribing, processing using AI, deleting and other operations necessary to provide the services.

Purposes

Providing werkbonnen.ai and the features you select.

Categories of data subjects

Customers, employees, clients, suppliers, contacts, users and other individuals whose data is processed through the Platform.

Categories of personal data

As described in Article 4 of this Data Processing Agreement.

Retention after termination

Thirty (30) days after your subscription ends, or after your trial ends if you have never activated a subscription, your workspace becomes eligible for removal from active use. Activating a subscription before cleanup prevents this automatic removal. After removal from active use, a further thirty (30) days of retention apply before the workspace becomes eligible for permanent deletion. Daily cleanup in limited batches, pending cancellation with Stripe and separate file cleanup may delay completion. Statutory retention obligations and temporary storage in routine backups remain exceptions.

Annex 2 - Subprocessors

We maintain an up-to-date list of the subprocessors we use. The full list from our Privacy Policy at the publication date of this version is copied below.

• Supabase — Frankfurt, Germany (EU)Database, file storage and sign-in
• Railway — Amsterdam, the Netherlands (EU)Hosting our server (API)
• Vercel — Global network, Vercel Inc. (US)Hosting the website and web app
• OpenRouter — USRouting AI requests, such as speech to text and filling in work orders
• OpenAI — USAI models for speech recognition and text processing
• Resend — Dublin, Ireland (EU)Sending emails, such as login codes and invitations
• PostHog — Frankfurt, Germany (EU)Website analytics with consent, app usage statistics, feature flags and technical logs
• Stripe — Ireland (EU) and USProcessing subscription payments
• Apple — USDistributing the iOS app and push notifications on iPhone
• Google — USDistributing the Android app and push notifications on Android
• PDOK (Kadaster) — the Netherlands (EU)Looking up addresses while you type
• e-Boekhouden, Moneybird, Jortt and Exact Online — the Netherlands (EU)Accounting integrations, only if you turn them on