Data-processing agreement

Parties

Processor: Altitudes Group B.V., Chamber of Commerce/KvK 93488432, trading as Klusinbox, established in Nijmegen, hereinafter "Klusinbox".

Controller: the business that holds a supplier account on klusinbox.nl and has accepted this agreement by electronic means, hereinafter "the supplier".

1. Why this agreement exists, and when it takes effect

When simply buying a request, the supplier is an independent controller for the contact details received. Klusinbox is the controller for its own request flow. In that situation there is no processor relationship and this agreement is not needed.

That changes as soon as Klusinbox starts doing something on the supplier's behalf. From that moment Klusinbox processes personal data under the supplier's responsibility, and article 28 GDPR requires an agreement to underpin it — before the processing starts.

This agreement therefore takes effect only when the supplier accepts it, and solely for the features listed in article 2. Acceptance is a separate, recorded act; it is not hidden inside registration.

2. Subject matter, nature and purpose of the processing

Klusinbox processes personal data on the supplier's behalf solely for the features the supplier switches on:

• A. Calendar connection — Klusinbox reads availability from the supplier's calendar to propose appointment slots, and places the appointment in a calendar created by Klusinbox. Data: busy/free blocks (start and end time), the names of the calendars the supplier subscribes to, and the appointments created by Klusinbox.
• B. Sending on the supplier's behalf — Klusinbox sends messages to the consumer in the supplier's name and house style. Data: name, email address, telephone number and request details of the consumer.
• C. Customer management — Klusinbox maintains a customer file and job history for the supplier. Data: name, address and contact details of their customers, plus notes and job details the supplier adds.

2a. What the calendar connection expressly does not do

Klusinbox does not read the content of existing appointments. Not the subject, not the attendees, not the location, not the description. The connection requests only those Google permissions that reveal availability and that write into a separate calendar created by the app. This is not a promise about intentions but a property of the access rights requested.

Categories of data subjects: consumers who submitted a request through Klusinbox, customers the supplier adds themselves, and the supplier and their staff insofar as their calendar data is processed.

Special categories of personal data (article 9 GDPR) are not processed and must not be entered by the supplier either.

Duration: this agreement applies for as long as the supplier uses at least one of the features in article 2, and ends as described in article 10.

3. Instructions

Klusinbox processes the personal data solely on the supplier's written instructions. Switching on a feature from article 2 and using the associated screens constitute such an instruction; this agreement and the product documentation record those instructions.

Klusinbox does not process the data for its own purposes. Data that Klusinbox processes as an independent controller — the request flow, the assessment of requests, invoicing and platform quality measurement — falls outside this agreement and is governed by the Klusinbox privacy statement. Both kinds of data are stored separately at the technical level.

If Klusinbox considers an instruction to infringe the GDPR or other legislation, it will notify the supplier without delay and may suspend that instruction.

4. Transfers outside the EEA

No personal data is transferred outside the European Economic Area. All processing and storage takes place within the EEA.

Should a transfer outside the EEA become unavoidable in future, Klusinbox will inform the supplier in advance and put a valid transfer mechanism in place (article 46 GDPR).

5. Confidentiality

Klusinbox binds everyone with access to the personal data to confidentiality, whether through an employment contract or through a processing or non-disclosure agreement. Access is granted only insofar as needed to perform this agreement.

6. Security

Klusinbox implements appropriate technical and organisational measures within the meaning of article 32 GDPR. These include at least:

• encryption in transit (TLS) and of stored calendar credentials;
• role-based access restriction, with individual accounts;
• logging of operations on personal data, without logging the data itself;
• separate storage of data for which Klusinbox is processor and data for which it is itself controller;
• backups with the same level of protection as the production environment;
• periodic review of the measures.

7. Sub-processors

The supplier grants Klusinbox general authorisation to engage sub-processors. Klusinbox imposes the same obligations on them as set out in this agreement and remains liable to the supplier for their acts.

The current sub-processors are:

• Amazon Web Services EMEA SARL — hosting and storage — EEA.
• Amazon Web Services EMEA SARL (SES) — sending of email — EEA.
• The scheduling software behind feature A runs on Klusinbox's own infrastructure and is therefore not a sub-processor.

7a. Changes to the sub-processor list

Klusinbox announces any change to this list at least 30 days in advance. The supplier may object on reasonable grounds; if the parties cannot agree, the supplier may terminate the feature or the account free of charge.

8. Data subject rights and assistance

Requests from data subjects that reach Klusinbox and concern data for which the supplier is controller are not handled by Klusinbox: they are forwarded without delay to the supplier, who decides. Klusinbox provides the technical cooperation required.

Klusinbox further provides the supplier with reasonable assistance in:

• responding to requests under articles 15 to 22 GDPR;
• complying with articles 32 to 36 GDPR, including a data protection impact assessment.

9. Personal data breaches

Klusinbox notifies the supplier without undue delay, and in any event within 48 hours of discovery, of a personal data breach affecting their data. The notification states at least the nature of the breach, the categories and numbers concerned, the likely consequences and the measures taken or proposed.

Notification to the Dutch Data Protection Authority and, where required, to the data subjects is the supplier's responsibility. Klusinbox does not notify on their behalf unless agreed otherwise in writing.

10. Termination, return and erasure

This agreement ends when the supplier withdraws acceptance, switches off all features from article 2, or terminates their account. On termination:

• the supplier can export their data in a common format;
• Klusinbox erases or returns the data for which it is processor, at the supplier's choice, within 30 days of their instruction;
• if the supplier gives no instruction within that period, Klusinbox erases the data;
• data Klusinbox must retain by law is kept until the end of that period and not used for anything else.

10a. Important for the supplier

The retention periods Klusinbox applies to its own request flow do not touch the supplier's customer records. Those records are theirs and do not disappear because Klusinbox cleans up its own data.

11. Audit

On request, Klusinbox makes available the information needed to demonstrate compliance with this agreement. The supplier may have an audit carried out at most once a year by an independent expert bound by confidentiality, at their own expense and with at least 30 days' notice. Where a shortcoming is demonstrated, the costs are borne by Klusinbox.

12. Amendment and version control

This agreement carries a version marker. A change is a new version and is announced at least 30 days in advance, in line with the Platform-to-Business Regulation (EU 2019/1150). Until that period expires, the previously accepted version continues to apply.

Acceptance and withdrawal are recorded by electronic means, stating the version, the time and a truncated IP address. That record is immutable: nothing is overwritten, every act is a new line. The supplier can view their own record in their account.

13. Liability and governing law

The liability provision and the choice of law in the Klusinbox terms and conditions apply to this agreement. One regime therefore governs the whole relationship: Dutch law, with disputes submitted to the competent court in the Netherlands.