Data Processing Agreement

1. The terms used in the GDPR — personal data, processing, controller, processor, sub-processor, data subject, personal data breach — have the meaning the GDPR gives them.
2. You are the controller of the personal data you record in Bravik about your clients, suppliers, staff and other relations. You determine the purposes and means of that processing, you decide which data you enter and how long it is needed, and you are responsible for the legal basis and for informing those data subjects.
3. We are the processor. We process that data solely in order to provide Bravik to you, on your behalf and on your instructions.
4. This division of roles is not a matter of choice; it follows from the facts. You decide who you record as a client and what data goes with them; we have no say in that.
5. For your account, your subscription, your payments to us, your use of the service and our security logs, we are the controller. That processing falls outside this agreement.
6. GDPR means Regulation (EU) 2016/679. In the Netherlands it is supplemented by the Uitvoeringswet AVG.

1. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. That annex satisfies the opening requirements of art. 28(3) GDPR.
2. This agreement applies for as long as the Bravik agreement runs, and thereafter for as long as we still hold personal data on your behalf. The articles on confidentiality, security, deletion and liability remain in force for as long as that data exists.
3. This agreement replaces any earlier arrangements between the parties concerning the processing of personal data.

This article implements art. 28(3)(a) GDPR.

1. We process the personal data solely on your documented instructions, including as regards transfers to a country outside the EEA.
2. Your instructions consist of: this agreement, the Terms and Conditions, the Privacy Policy, and the actions you take in the application. Switching on a feature — receipt scanning, the AI assistant, a bank connection, Peppol, your own SMTP server — is an instruction to carry out the processing that goes with it, with the consequences set out in Annex 3.
3. Any additional or differing instruction must be given in writing. If it requires a change to the service or incurs cost, we will discuss it with you first; we may charge a reasonable fee.
4. We do not process the data for our own purposes, do not disclose it to third parties outside this agreement, do not sell it, and do not use it to train models or for advertising.
5. We may use anonymised and aggregated data to improve the service, provided it cannot be traced back to a data subject and is not shared with third parties in a way that would make that possible.
6. We will inform you if, in our opinion, an instruction infringes the GDPR or other data protection provisions (art. 28(3), final sentence, GDPR). We may suspend the instruction until you confirm or withdraw it.
7. If we are required by law to process beyond your instructions, we will inform you before processing, unless that law prohibits such notification on important grounds of public interest.
8. If we receive an order from an authority to disclose your data, we will assess whether the order is valid, disclose no more than is strictly required, and inform you as soon as we are legally permitted to do so.

This article implements art. 28(3)(b) GDPR.

1. We grant access to your personal data only to persons who need it for their task, and no further than that task requires.
2. Every person we grant access to is bound by confidentiality, either under an employment or service contract, or under a separate undertaking, or under a statutory duty of confidentiality.
3. We make sure those persons are aware of their obligations under this agreement and of the requirements of the GDPR.
4. The duty of confidentiality survives the end of this agreement and the end of the employment or engagement.
5. We only access your environment for maintenance, security, fault correction or a support request you have raised yourself. We record when that happens.

This article implements art. 28(3)(c) and art. 32 GDPR.

1. We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures currently in place are set out in Annex 2.
2. In determining those measures we take account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to data subjects.
3. We may adjust the measures where technology or the risk picture gives cause to, provided the level of protection does not fall.
4. You assess for yourself whether the measures in Annex 2 are appropriate for the data you record in Bravik. If you consider them insufficient for your situation, tell us before you enter that data.
5. You are responsible for security on your side: your passwords, your devices, who you give access to your organisation, and withdrawing that access in good time.

This article implements art. 28(2) and (4) GDPR.

1. You hereby give us general written authorisation to engage sub-processors. The sub-processors we currently engage are listed in Annex 3; by accepting this agreement you consent to that list.
2. We impose on each sub-processor, by contract, the same obligations as are set out in this agreement, in particular as regards security, confidentiality and transfers.
3. We remain fully liable to you for the performance of our sub-processors' obligations.
4. Changes. If we intend to add or replace a sub-processor, we will give at least thirty (30) days' notice. Subscribe to those notices at info@studioprimary.com and you will receive them by email. The current list is always on this page.
5. Objection. If within those thirty days you raise a reasoned objection on data protection grounds, we will discuss it with you and look for a reasonable solution. If we cannot reach one, you may terminate the Bravik agreement effective on the date the change takes effect, with a pro-rata refund of amounts paid in advance. That is your sole remedy on this point.
6. Where a replacement is urgent for reasons of security, continuity or a legal obligation, we may switch sooner; we will notify you as soon as possible and the right of objection in paragraph 5 continues to apply.
7. Some sub-processors are only engaged when you use a particular feature. Annex 3 states this per row. If you do not use that feature, no data goes to them.

This article implements art. 28(3)(e) GDPR.

1. Data subjects address their requests to you; you deal with them. We are not a point of contact for your clients and do not assess their requests.
2. If we nevertheless receive a request directly from one of your data subjects, we will not deal with it ourselves. We will forward it to you without delay and refer the data subject to you.
3. We provide you with appropriate assistance in fulfilling your obligation to respond to requests under Chapter III GDPR — access, rectification, erasure, restriction, portability and objection — insofar as you cannot reasonably do so yourself.
4. Bravik is built so that you can do most of it yourself: view, correct, delete and export data to CSV, UBL and XAF. Those features are the first form of assistance.
5. Where assistance beyond that costs us more than incidental effort, we may charge a reasonable fee at our usual rate. We will say so in advance.
6. We respond to a request for assistance within five (5) working days, so that you can meet your one-month deadline under art. 12(3) GDPR.

This article implements art. 28(3)(f) and arts. 33 and 34 GDPR.

1. If we identify a breach affecting your personal data, we will inform you without undue delay and at the latest within 24 hours of becoming aware of it, at the email address we hold for you.
2. We do not notify the supervisory authority and we do not notify your data subjects. Those notifications are yours to make, as controller, within your own 72-hour deadline (art. 33(1) GDPR). We only notify the supervisory authority where the data is data for which we are ourselves the controller.
3. Our notification to you contains, insofar as known at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point at our end. Where information is not yet available, we supply it as soon as possible afterwards.
4. We give you all reasonable cooperation with your notification, with informing data subjects, and with limiting the consequences.
5. We maintain a register of all breaches affecting your data, recording the facts, the effects and the remedial action taken, and make it available to you on request.
6. A notification under this article does not constitute an admission of liability.

This article implements art. 28(3)(f) and arts. 35 and 36 GDPR.

1. If you are required to carry out a data protection impact assessment (DPIA) or to consult the supervisory authority in advance, we provide appropriate assistance, taking into account the nature of the processing and the information available to us.
2. That assistance consists at least of providing the information in Annex 1, Annex 2 and Annex 3, and of answering reasonable follow-up questions.
3. For use that falls within normal bookkeeping and invoicing purposes, a DPIA is generally not required. That assessment is yours to make.
4. Here too we may charge a reasonable fee where the effort exceeds the incidental, after telling you in advance.

This article implements art. 28(3)(g) GDPR. It is the article where the statutory retention duty and the right to erasure meet, so it is set out in full.

1. After the end of the provision of services we act at your choice: return or deletion of all personal data we process on your behalf. That choice is yours, not ours.
2. If you make no choice, the default is that we retain. After termination you keep ninety (90) days of access in order to export. After that we retain the data for the statutory retention period that applies to you — seven years under art. 52(4) AWR and art. 3:15i BW, and ten years for data concerning immovable property and under certain VAT schemes — and delete it afterwards without you having to ask.
3. This default is expressly permitted. Art. 28(3)(g) GDPR carves out the case where Union or Member State law requires storage, and art. 17(3)(b) GDPR disapplies the right to erasure insofar as processing is necessary for compliance with a legal obligation. The retention duty of a person required to keep records is such an obligation.
4. If you do instruct us to delete, we delete. We confirm the instruction, point out your retention duty once, and carry out the deletion within thirty (30) days of your confirmation. From that moment responsibility for complying with your retention duty rests entirely with you.
5. During the retention period we lock the data down: not used for the service, not displayed, not disclosed to third parties, available only to comply with a legal obligation or to establish a legal claim. This is the restriction of art. 18 GDPR.
6. Existing backups are not searched for individual records. They are overwritten in the normal rotation cycle; until then they remain encrypted and inaccessible for ordinary use.
7. On request we confirm the deletion in writing.
8. Return is made in a commonly used, machine-readable format: CSV, UBL and the XAF audit file. See also article 19 of the Terms and Conditions on switching providers.

This article implements art. 28(3)(h) GDPR.

1. We make available to you all information necessary to demonstrate compliance with the obligations laid down in art. 28 GDPR, and allow for audits.
2. In the first instance we do so by means of this agreement and its annexes, the Privacy Policy, and written answers to your questions. If we hold a third-party audit report or certification, we provide it.
3. Where that demonstrably does not suffice, you may have an audit carried out at most once a year, and in addition following a breach affecting your data or where a supervisory authority requires it.
4. You give at least thirty (30) days' written notice of an audit, stating its scope. The audit takes place during office hours, disrupts our operations as little as possible, and does not extend to other customers' data or to our trade secrets.
5. The auditor may not be a competitor of ours and signs a confidentiality undertaking in advance. We may refuse an auditor on reasonable grounds and ask for an alternative.
6. You bear the cost of the audit, including a reasonable fee for our time. If the audit reveals a material failure by us to comply with this agreement, we bear those costs and remedy the failure at our expense.

1. Processing takes place within the EEA in principle.
2. Transfers to a third country take place only for the sub-processors marked as such in Annex 3, and only when you use the corresponding feature. Your use of that feature constitutes your instruction to transfer within the meaning of art. 28(3)(a) GDPR.
3. For those transfers we rely on an adequacy decision (art. 45 GDPR) or, failing that, on the European Commission's standard contractual clauses (art. 46(2)(c) GDPR), supplemented by a transfer impact assessment and additional technical and organisational measures.
4. On request we provide a copy of the safeguards used, redacting commercially confidential parts.
5. If a safeguard lapses — for example because an adequacy decision is invalidated — we suspend the transfer concerned until a valid basis is in place, and inform you.
6. If you want no transfers outside the EEA, switch off receipt scanning and the AI assistant. All other functionality remains fully available.

1. The liability regime in article 21 of the Terms and Conditions applies to this agreement as well, including the limitations set out there. This agreement creates no separate or wider liability.
2. Art. 82 GDPR continues to apply in full as against data subjects: they may address any of us directly. As between us, we are liable insofar as we have not complied with obligations specifically directed to processors or have acted outside or contrary to your lawful instructions (art. 82(2) GDPR).
3. You indemnify us against claims by data subjects, supervisory authorities and other third parties, and against resulting fines, damages and reasonable legal costs, insofar as they arise from: the absence of a legal basis for the data you enter, failure to meet your duty to inform your data subjects, an unlawful instruction from you, or your recording of data that is not needed for the service.
4. We indemnify you against claims arising from our failure to comply with the obligations this agreement specifically imposes on us as processor, within the limits of paragraph 1.
5. If either of us is subject to a claim, we inform each other without delay and give each other reasonable cooperation in the defence. Neither admits liability nor enters into a settlement affecting the other without that party's prior written consent.

1. This agreement enters into force on acceptance of the Terms and Conditions and ends when we no longer process personal data on your behalf.
2. We may amend this agreement where legislation, a court ruling, guidance from a supervisory authority or a change in the service gives cause to. We give at least thirty (30) days' notice of an amendment; the right of objection in article 6(5) applies accordingly.
3. Order of precedence. Insofar as the processing of personal data is concerned, this agreement prevails over the Terms and Conditions and over the Privacy Policy. In all other respects the Terms and Conditions apply.
4. If any provision of this agreement is void or voidable, the remaining provisions continue to apply and it is replaced by a provision that comes as close as possible to its intent.
5. This agreement is governed by Nederlands recht (Dutch law). Disputes are submitted to the Rechtbank Oost-Brabant (District Court of East Brabant), sitting in Eindhoven, without prejudice to mandatory law.
6. This agreement is drawn up in Dutch. In the event of any difference with a translation, the Dutch text prevails.

The measures referred to in art. 32 GDPR and article 5 of this agreement, as they apply on the date stated above.

The sub-processors referred to in article 6. Rows with an italic addition are only engaged when you use the feature concerned.

This list is derived from the software itself. Changes are announced under article 6(4); subscribe to those notices at info@studioprimary.com.