Data Processing Agreement

Version: 1.0; Last updated: June 29, 2026

In the event of any discrepancy between the Dutch and the English version of this document, the Dutch version prevails.

This data processing agreement (designed as a Data Pro Statement) forms part, as an appendix, of the terms and conditions of Bas de Kort (sole proprietorship, CoC 42038027, located at Kerkeakker 3, 6674 EM Herveld), hereinafter "Processor", and applies as soon as Processor, in the performance of an Assignment, processes personal data on behalf of Client (as defined in the terms and conditions), hereinafter "Controller".

Capitalized terms used in this agreement and not defined here have the meaning given to them by the terms and conditions or by the General Data Protection Regulation (GDPR).

1. Allocation of roles

Controller determines the purpose and the means of the processing of personal data and is and remains the controller within the meaning of the GDPR. Processor processes the personal data solely on behalf of Controller and on its instructions, and has no say over the purpose and means.

2. Subject matter, nature and purpose of the processing

Processor processes personal data solely to the extent necessary for the performance of the Assignment: developing, integrating, maintaining and managing software and AI applications, providing technical advice and carrying out code reviews. Processor does not process the personal data for its own purposes.

3. Categories of data subjects and personal data

The nature and scope of the personal data are determined by the systems and data that Controller makes available in the context of the Assignment. Depending on the Assignment, this may concern data of Controller's customers, employees, suppliers or users, such as contact details, account details and data found in databases, log files or test sets.

Controller does not provide special categories of personal data (Article 9 GDPR) or criminal-law data to Processor, unless this has been agreed in writing in advance and is accompanied by suitable additional measures.

4. Instructions

Processor processes the personal data solely on the basis of written instructions from Controller, which includes the Assignment itself, unless a legal provision applicable to Processor requires Processor to process the personal data. In that case, Processor informs Controller before the processing, unless that legislation prohibits this.

Processor informs Controller if, in its opinion, an instruction infringes the GDPR or other applicable data protection legislation.

5. Confidentiality

Processor ensures that the persons who have access to the personal data under its responsibility are bound by a duty of confidentiality. This confidentiality also applies after the Assignment has ended.

6. Security

Processor takes appropriate technical and organizational measures to protect the personal data against loss or unlawful processing, taking into account the state of the art, the costs of implementation and the nature, scope and context of the processing. The level of security is in line with the provisions of the terms and conditions. If Controller requires a specific level of security or a standard, this is agreed in writing in advance.

Controller remains responsible for the security of its own systems, for making backups and for the choice to make data available to Processor.

7. Subprocessors

Controller grants Processor general authorization to engage subprocessors in the performance of the Assignment, including hosting, infrastructure and AI service providers. Processor imposes on each subprocessor at least the same obligations as are set out in this agreement and remains responsible towards Controller for their compliance.

Processor informs Controller, on request, about the subprocessors engaged and about intended changes to them, so that Controller can object to them.

8. Transfers outside the EEA

Processor transfers personal data to a country outside the European Economic Area only if an appropriate safeguard within the meaning of the GDPR applies, such as an adequacy decision or the standard contractual clauses of the European Commission. If the Assignment uses AI services in which a transfer may take place, this is made transparent on request.

9. Rights of data subjects

Processor assists Controller, to the extent reasonably possible, in complying with requests from data subjects to exercise their rights under the GDPR, including access, rectification, erasure and portability. If a data subject contacts Processor directly, Processor forwards the request to Controller and does not handle it itself.

10. Data breaches

Processor informs Controller without undue delay after becoming aware of a personal data breach, and provides the information that Controller reasonably needs to comply with its duty to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects. Assessing whether a notification must be made, and making it, rests with Controller.

11. Audits

On request, Processor makes available to Controller the information necessary to demonstrate compliance with this agreement. An audit by or on behalf of Controller takes place at most once a year, after reasonable written notice, during office hours and without unnecessarily disrupting Processor's business operations. The costs of an audit are borne by Controller, unless the audit reveals a material breach on the part of Processor.

12. Return and deletion

After the Assignment has ended, Processor deletes the personal data, or makes them available to Controller on request, unless a statutory retention obligation prevents this. Processor may retain anonymized or aggregated data that cannot be traced back to a data subject.

13. Liability

The liability provisions of the terms and conditions apply mutatis mutandis to liability in connection with this data processing agreement.

14. Governing law

This data processing agreement is governed by Dutch law. In the event of a conflict between this agreement and the terms and conditions, this agreement prevails insofar as the processing of personal data is concerned.