Data processing agreement

Parties

The customer of Nobil who processes personal data of their own customers, visitors or contacts with Nobil ("the Controller"), and Damiën Sluijter, trading as Versa Web Solutions, Sint-Luciestraat 5, 3631 Uikhoven (Maasmechelen), Belgium, company and VAT number BE 1027.741.625, operator of Nobil ("the Processor").

Article 1 · Subject and duration

The Processor processes personal data on behalf of the Controller to provide the services of Nobil, as described in Annex 1. This agreement applies as long as the Controller uses Nobil, and after that until all data has been deleted or returned.

Article 2 · Instructions

The Processor processes the personal data only on the documented instructions of the Controller. Using Nobil as the Controller sets it up counts as an instruction. The Processor does not use the data for its own purposes. If the Processor believes an instruction breaches the GDPR, it says so straight away.

Article 3 · Confidentiality

Only those who need the data for the service (maintenance, support, security) get access, and they are bound to confidentiality. Viewing an account for support is logged.

Article 4 · Security

The Processor takes appropriate technical and organisational measures, described in Annex 2, and keeps them up to date with the state of the art.

Article 5 · Sub-processors

The Controller gives general authorisation to engage the sub-processors in Annex 3. The Processor announces a new or changed sub-processor at least 30 days in advance by email; within that period the Controller can object with reasons and, if no solution is found, end the service. The Processor imposes the same obligations as in this agreement on every sub-processor.

Article 6 · Transfers outside the EEA

Data is processed outside the European Economic Area only on a valid basis, such as the EU–US Data Privacy Framework or the standard contractual clauses of the European Commission (see Annex 3).

Article 7 · Rights of data subjects

The Processor helps the Controller answer requests from data subjects (access, rectification, erasure, portability, objection), among other things with the features in Nobil to view, change, export and delete data. A request that reaches the Processor directly is passed on to the Controller.

Article 8 · Data breaches

The Processor reports a personal data breach without undue delay and at the latest within 48 hours of discovering it, with the information needed to assess it and, where necessary, report it to the supervisory authority and the data subjects. The Processor immediately takes measures to limit the consequences.

Article 9 · Assistance

The Processor helps the Controller, as far as reasonable, with a data protection impact assessment and a prior consultation of the supervisory authority.

Article 10 · End

At the end of the service the Controller can export their data. After that the Processor deletes it within 30 days, except what the law requires it to keep. Copies in backups disappear according to the periods in Annex 2.

Article 11 · Audit

On request, the Processor gives the Controller the information needed to show it complies with this agreement. An on-site audit is possible after reasonable notice, at most once a year, at the Controller's expense, unless a supervisory authority requires it.

Article 12 · Liability and law

Liability follows the section on liability in the Terms of service of Nobil, except where the GDPR does not allow that. This agreement is governed by Belgian law.

Annex 1 · Processing

Annex 2 · Security measures

• Encrypted connections (TLS) for all traffic.
• Servers in the EU (Hetzner, Germany), with security updates.
• Hashed passwords; two-step login available; limits on login attempts.
• Keys of connected services (SumUp, Sendcloud) stored encrypted.
• Access to customer accounts for support only for administrators, and logged.
• Daily backups to separate storage in another data centre in the EU, with snapshots that cannot be deleted from the server. Kept: daily for 7 days, snapshots for 14 days, monthly copies for 12 months.
• Errors and outages are monitored.

Annex 3 · Sub-processors

Stripe, SumUp and Sendcloud work with the shop's own account: the shop makes its own agreement with them.