GDPR data processing agreement — draft

1. Parties

1.1 Data controller

Controller: the business customer who commissions Computer Repair Twente to provide services that may involve the processing of personal data.

• company name;
• legal form;
• address;
• postal code and place;
• KVK number;
• VAT number, if applicable;
• contact person;
• e-mail address;
• telephone number.

Hereinafter referred to as: Controller or customer.

1.2 Data processor

Processor: Computer Repair Twente, established at Enschede.

• company name: Computer Repair Twente;
• email: contact@computerrepairtwente.nl;
• phone / WhatsApp: 06-55734000;
• Web site: www.computerrepairtwente.nl.

Hereinafter referred to as: Processor or Computer Repair Twente.

1.3 The parties jointly

The Controller and Processor are jointly referred to as the parties.

2. Purpose of this Agreement

2.1 Agreements about personal data

This data processing agreement sets out the conditions under which Computer Repair Twente processes personal data on behalf of the Controller.

2.2 GDPR

This agreement is intended to meet the GDPR's obligations to the extent that Computer Repair Twente acts as a processor.

2.3 Supplement to other agreements

This data processing agreement applies alongside the quotation, agreement, general terms and conditions, SLA, support arrangements or other written agreements between the parties. In the event of a conflict between this data processing agreement and other arrangements, the provisions of this data processing agreement take precedence insofar as they concern the processing of personal data in the role of processor.

3. Roles of the parties

3.1 Data controller

The customer is the controller when the customer determines:

• which personal data are processed;
• why these personal data are processed;
• how long this data is required;
• who may have access;
• the persons concerned;
• which legal basis applies;
• which instructions Computer Repair Twente should follow.

3.2 Data processor

Computer Repair Twente is Processor when we process personal data solely on behalf of the customer and according to the customer's instructions.

3.3 Not a data processor for our own administration

Computer Repair Twente is not a processor for own customer administration, invoicing, quotes, debtor management, marketing, security of own systems or legal obligations. For these processing operations, Computer Repair Twente is an independent controller. These situations are covered by our privacy statement.

4. Subject matter and duration of processing

4.1 Subject

The processing relates to personal data that Computer Repair Twente can process in business IT services, support, management, maintenance, security, backup, recovery, migration, incident solution or similar work.

4.2 Duration

This agreement applies to the duration of the service in which Computer Repair Twente processes personal data on behalf of the customer.

4.3 End

The processing shall end when:

• the service ends;
• the agreement is terminated;
• the personal data are no longer required;
• the customer requests removal or return in writing;
• a statutory retention obligation or legitimate basis makes longer retention necessary.

5. Nature and purpose of processing

5.1 Nature of processing

Computer Repair Twente may process personal data by for example:

• consult;
• store temporarily;
• copy;
• transfer;
• recover;
• secure;
• back up;
• delete;
• Analyze for error resolution;
• configure in systems;
• to be processed in support communication;
• temporarily become visible during remote support.

5.2 Purposes

The processing takes place only to the extent necessary for the provision of services to the customer.

Purposes may include:

• IT support;
• workplace management;
• system management;
• user management;
• account support;
• e-mail support;
• backup and restore;
• data recovery;
• data migration;
• security support;
• incident resolution;
• maintenance;
• troubleshooting;
• documentation of support activities;
• communication of support notifications;
• implementation of an agreement or SLA.

6. Categories of data subjects

Depending on the assignment, personal data may be processed relating to, among others:

• staff of the customer;
• the customer’s directors or management;
• users of customer systems;
• contact persons of the customer;
• customers of the customer;
• suppliers of the customer;
• visitors or business contacts of the customer;
• other persons whose data are contained in the customer's systems, files or backups.

The exact categories may vary per customer or assignment and may be specified in an annex.

7. Types of personal data

Depending on the assignment, Computer Repair Twente may gain access to or process, among other things:

• name;
• business e-mail address;
• private e-mail address, if any, in systems;
• telephone number;
• username;
• user account;
• function or department;
• access rights;
• system and log data;
• IP addresses;
• device name;
• serial numbers;
• workplace data;
• email settings;
• files and documents;
• back-ups;
• calendar or contact details;
• error messages;
• support history;
• Technical configuration data;
• security notifications;
• data visible during remote support.

7.1 Special categories of personal data

Computer Repair Twente does not intend to process special categories of personal data. However, such data may be visible in the customer’s files, emails, backups or systems. The customer remains responsible for limiting, securing or deleting special categories of personal data when they are not required for the assignment.

7.2 Data relating to criminal convictions and offences

Computer Repair Twente does not process criminal data as the purpose of the service. If such data happens to be visible in customer systems or files, Computer Repair Twente processes these only to the extent necessary within the technical assignment and according to instructions of the customer.

8. Instructions of the Controller

8.1 Only by instruction

Computer Repair Twente processes personal data solely on the basis of written or demonstrable instructions from the Controller, unless a legal obligation otherwise requires.

8.2 Verifiable instructions

Instructions can be given through:

• agreement;
• quotation;
• e-mail;
• WhatsApp;
• ticket;
• order confirmation;
• SLA;
• support request;
• oral instruction, which is later confirmed demonstrably;
• documentation or work appointment.

8.3 Illegal instructions

If Computer Repair Twente believes that an instruction is contrary to GDPR or other legislation, Computer Repair Twente will inform the customer of this, to the extent reasonably possible.

8.4 No independent use

Computer Repair Twente does not use personal data processed on behalf of the customer for its own purposes, unless it is permitted by law or necessary for its own administration, evidence, security or legal obligations.

9. Confidentiality

9.1 Duty of confidentiality

Computer Repair Twente treats the customer's personal data and confidential information confidentially.

9.2 Persons under the responsibility of Processor

Computer Repair Twente ensures that persons processing personal data under its responsibility are bound by confidentiality or an appropriate legal or contractual confidentiality obligation.

9.3 Exceptions

The obligation of confidentiality shall not apply where disclosure is required by law, by a court order or by a competent supervisory authority.

10. Security measures

10.1 Appropriate measures

Computer Repair Twente takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure or unlawful processing.

10.2 Examples of measures

Depending on the service and technical possibilities, measures may include:

• strong passwords;
• MFA where possible;
• restricted access on a need-to-know basis;
• secure devices;
• secure connections where available;
• encrypted transfer where appropriate;
• software updates and patching where possible;
• antivirus or security measures where appropriate;
• logging where appropriate;
• careful storage of customer information;
• limitation of access to support information;
• confidentiality agreements;
• safe deletion of data where possible;
• use of reliable tools and suppliers;
• physical protection of equipment and workplaces.

10.3 No absolute security guarantee

No system is completely risk-free. Computer Repair Twente does not guarantee that any form of unauthorized access, data breach, malware, hack, human error or system failure can be completely prevented.

10.4 Dependence on customer environment

Security also depends on the customer’s environment, existing settings, password policy, access rights management, updates, user behaviour, network security and the customer’s adherence to advice.

11. Subprocessors

11.1 Engaging subprocessors

Computer Repair Twente may engage subprocessors when necessary or desirable to provide the service.

Examples of subprocessors or third-party services may include:

• hosting providers;
• cloud suppliers;
• e-mail providers;
• remote support tools;
• back-up services;
• accounting or administrative software;
• security software;
• ticket or documentation systems;
• suppliers of IT tools;
• specialised IT partners.

11.2 Appropriate agreements

Computer Repair Twente ensures appropriate agreements with subprocessors on personal data protection where necessary.

11.3 Overview on request

Upon request, Computer Repair Twente may provide an overview of relevant subprocessors used for customer service.

11.4 Objection

If the customer objects to a specific subprocessor, the customer reports this in writing and justified. The Parties shall then enter into consultations on a reasonable solution.

12. Transfers outside the European Economic Area

12.1 Processing within the EEA

Computer Repair Twente strives to process personal data as much as possible within the European Economic Area.

12.2 External services

Some external services or suppliers may process personal data outside the European Economic Area.

12.3 Appropriate safeguards

Where personal data are processed outside the European Economic Area, this will only be done if there is an appropriate basis or guarantee, to the extent required by law.

13. Data breaches and security incidents

13.1 Notification to customer

When Computer Repair Twente discovers or reasonably suspects a personal data breach relating to the customer's personal data, Computer Repair Twente reports this to the Controller without undue delay.

13.2 Information to include in a notification

Where available, Computer Repair Twente provides relevant information, such as:

• nature of the incident;
• date or probable date;
• systems concerned;
• type of personal data;
• categories of data subjects;
• probable cause;
• measures taken or proposed;
• possible consequences;
• contact for follow-up questions.

13.3 Duty to notify the supervisory authority

The Controller remains responsible for assessing whether a data breach must be reported to the Dutch Data Protection Authority or the data subjects, unless otherwise agreed in writing.

13.4 Cooperation

Computer Repair Twente provides reasonable cooperation to the customer in the assessment and handling of a data breach, in so far as this falls within the scope of the service provision and reasonable possibilities.

13.5 Costs

If a data breach or incident is caused by circumstances beyond the responsibility of Computer Repair Twente, research, repair, reporting or support costs may be charged.

14. Rights of data subjects

14.1 Support

Computer Repair Twente supports the customer reasonably with requests from data subjects, insofar as this relates to personal data processed by Computer Repair Twente as a processor.

Think of requests about:

• access;
• correction;
• deletion;
• limitation;
• portability;
• objection;
• withdrawal of consent.

14.2 Customer responsibility

The customer remains responsible for assessing and responding to requests from data subjects.

14.3 Forwarding a request

When a data subject contacts Computer Repair Twente directly about data processed on behalf of the customer, Computer Repair Twente will forward the request to the customer unless otherwise required.

15. Assistance with GDPR obligations

Computer Repair Twente provides reasonable assistance to the customer with GDPR obligations related to processing by Computer Repair Twente. This may include information about security measures, assistance with data breaches and data subjects’ rights, information for DPIAs, information about subprocessors, and termination or deletion of data.

This support shall apply to the extent that it is reasonable, technically possible and within the agreed service. If work is outside the normal scope, costs may be charged.

16. Audits and inspections

16.1 Reasonable inspection

The Controller may reasonably request information to verify that Computer Repair Twente complies with this processor agreement.

16.2 Audit request

An audit or inspection may take place only after prior written agreement on its purpose, scope, scheduling, confidentiality, security and costs.

16.3 Limitation

Audits must not unreasonably disrupt the business operations, security, privacy of other customers or confidential information of Computer Repair Twente.

16.4 Costs

Costs of audits, extensive information requests or external auditors shall be borne by the customer, unless otherwise agreed in writing.

17. Retention periods

17.1 In accordance with instructions

Computer Repair Twente keeps personal data processed on behalf of the customer no longer than necessary for the customer's assignment or according to instructions.

17.2 Statutory retention obligations

Some data may be stored longer when necessary for legal obligations, administration, evidence, disputes, security or own business.

17.3 Support and log data

Support history, tickets, log data or documentation may be kept as long as required for service, warranty, security, administration or evidence, unless otherwise agreed.

18. End of processing

18.1 Deletion or return

After termination of the service, Computer Repair Twente will delete or return personal data processed on behalf of the customer, depending on the customer's instruction and the technical possibilities.

18.2 Exceptions

Disposal or return may be omitted if:

• statutory retention obligations apply;
• data are required for administration;
• data are required for the purpose of evidence;
• data are included in backups that cannot be immediately selectively removed;
• deletion is technically impossible or disproportionate;
• Longer storage is necessary for security or dispute settlement.

18.3 Back-ups

Backup data may remain present during a normal backup cycle until it is automatically overwritten or deleted.

19. Liability

19.1 General limitation

The liability of Computer Repair Twente is limited as set out in the general terms and conditions, quotation, agreement or specific written arrangements.

19.2 No liability for customer instructions

Computer Repair Twente is not liable for damage resulting from instructions from the customer, incorrect data, missing information, unsafe customer environment, insufficient access management, weak passwords, missing backups or actions of the customer's employees or third parties.

19.3 No consequential damage

Computer Repair Twente is not liable for indirect damage, consequential damage, business interruption, loss of revenue, loss of profit, reputation loss, loss of data or third party claims, to the extent permitted by law.

20. Force majeure

Computer Repair Twente is not liable for deficiencies due to force majeure, including failures in suppliers, cloud failures, internet failures, cyber attacks, power failures, illness, government measures, transport problems or other circumstances beyond the reasonable influence of Computer Repair Twente.

21. Confidentiality after termination

The confidentiality obligations shall continue to apply after termination of the service or this processor's agreement, as long as the information is confidential.

22. Amendments

Amendments to this processor agreement shall only be valid if they have been confirmed in writing by both parties.

Computer Repair Twente may amend this draft on the website when legislation, services, security measures or business operations change. For agreements already signed, the signed version applies unless the parties agree otherwise in writing.

23. Applicable law

Dutch law applies to this processor agreement. Disputes shall be submitted to the competent court in accordance with the main agreements between the parties, unless mandatory law provides otherwise.

24. Signature

This draft agreement shall not become binding until it has been completed and signed or confirmed in writing by both parties.

Annex 1 — Description of processing

This Annex may be completed per customer.

• IT support;
• workplace management;
• system management;
• remote support;
• maintenance;
• backup and restore;
• data recovery;
• data migration;
• security support;
• incident resolution;
• Business IT services.

Categories of data subjects
Employees, users, contacts, customer customers, suppliers and other persons whose data are in customer systems.

Types of personal data
Name, email address, phone number, user accounts, system data, log data, files, backups, technical data, communication data and access rights.

Retention period
According to the customer's instructions, agreement or instruction, unless statutory retention obligations or technical restrictions apply.

Annex 2 — Security measures

Depending on the service and technical possibilities, the following measures may be applied:

• strong passwords;
• MFA where possible;
• restricted access;
• secure connections;
• encrypted transfer where available;
• patching and updates where appropriate;
• antivirus/security tools where appropriate;
• logging where appropriate;
• careful storage of customer information;
• confidentiality;
• security of own devices;
• limitation of access to support information;
• safe disposal where possible.

Annex 3 — Subprocessors

If applicable, an overview of subprocessors or categories of subprocessors may be included here, such as:

• hosting provider;
• e-mail provider;
• cloud supplier;
• remote support software;
• backup service;
• accounting software;
• documentation or ticketing system;
• security software;
• specialized IT partner.

Related Legal and Business Pages

• Privacy notice
• General terms and conditions
• SLA & support agreements
• Service procedure
• Warranty & Service Policy
• Complaints procedure