Data processing agreement

1Parties and subject matter

1. This data processing agreement is part of every agreement between Netslim (processor) and a business customer (controller), and forms part of the terms and conditions. By taking a service, the customer accepts this agreement. A signed version is not needed, but we can provide one on request.
2. This agreement covers the personal data the customer processes with Netslim services. Examples are the content of websites and databases, mailboxes, files on servers, and the customer data the customer enters in the invoicing tool.
3. Netslim is itself responsible for the data it processes to serve the customer (such as the customer's account and invoices). The privacy statement applies to that data.

2Nature, purpose and types of data

3Processing on instructions

1. Netslim processes the personal data only on behalf of the customer and according to the customer's instructions. Using the service as the customer has set it up counts as an instruction.
2. Netslim does not use the data for its own purposes, does not sell it and does not look at the content, unless this is needed for support the customer asks for, to resolve an outage, or if the law requires it (for example with a notice-and-takedown report or an order from a competent authority).
3. If Netslim believes an instruction conflicts with the GDPR, it will tell the customer straight away.

4Confidentiality

Everyone at Netslim who has access to the personal data is bound to confidentiality. Access is only given to people who need it for their work.

5Security

Netslim takes appropriate technical and organisational measures to secure the data, taking into account the state of the art and the risks. These include at least:

• servers in data centres within the European Union, with physical access security;
• encrypted connections (TLS) for management and for customers' websites;
• regular security updates for operating systems and server software, firewalls and protection against DDoS attacks;
• separation of the environments of different customers;
• regular backups, which are secured just as well as the original data;
• administrator access only with strong authentication and two-step verification, and logging of administrator access;
• encrypted storage of passwords and other secrets.

The customer is responsible for the security of what they manage themselves, such as their website software, plugins, passwords and access for their own staff.

6Subprocessors

1. The customer gives Netslim general permission to engage subprocessors. At the moment, these are:
   • Netslim's data center and server providers within the EU (including Hetzner Online GmbH, Germany, for VPS and dedicated servers);
   • SMTP2GO, for sending email from the invoice tool and other system emails;
   • Google, only for customers who use Google Workspace.
2. Netslim imposes at least the same obligations on subprocessors as set out in this agreement.
3. When Netslim adds or replaces a subprocessor, it informs the customer in advance via the website or the account. The customer can raise a reasoned objection within 14 days. If we cannot resolve it, the customer may cancel the service concerned.

7Transfers outside the EU

Netslim stores data within the European Economic Area. Data is only processed outside the EEA if a service requires it and appropriate safeguards are in place, such as an adequacy decision or the standard contractual clauses of the European Commission.

8Data breaches

1. If Netslim discovers a personal data breach (data breach) affecting the customer's data, it will report this to the customer without undue delay, and in any case within 48 hours of discovery.
2. The report contains, as far as known: what happened, which data and how many data subjects are (likely) affected, the likely consequences and the measures Netslim has taken or proposes.
3. The customer decides whether to report the data breach to the Dutch Data Protection Authority and to the data subjects. Netslim helps with this where reasonable.

9Cooperation and data subject rights

1. The customer can view, edit, export and delete most data themselves through their hosting or account. If that doesn't work, Netslim helps the customer with requests from data subjects.
2. If Netslim receives a request directly from a data subject, it forwards the request to the customer.
3. Netslim also provides reasonable cooperation with a data protection impact assessment (DPIA) or a request from the supervisory authority. If this takes more than reasonable effort, Netslim may charge its normal hourly rate for it.

10Audit

The customer may check whether Netslim complies with this agreement. Netslim provides the necessary information for this. An audit by an independent expert is possible after consultation, at most once a year, with at least 14 days' notice and without disrupting business operations unnecessarily. The customer bears the costs, unless the audit reveals serious shortcomings.

11End and return of data

1. This agreement runs for as long as the customer uses services for which Netslim processes personal data on the customer's behalf.
2. After the agreement ends, the customer can export their data themselves until the end date. After that, Netslim deletes the data, including from backups as soon as they are overwritten in the normal cycle (usually within 30 days), unless the law requires it to be kept.

12Liability and other terms

1. Liability under this agreement is governed by the terms and conditions.
2. In case of conflict, this data processing agreement takes precedence over the terms and conditions, as far as the processing of personal data is concerned.
3. If you have questions about this agreement, contact us via info@netslim.nl.